@sema-agent/core 7.16.0 → 7.17.1

package/dist/core/tool-catalog-entries.js

@@ -7,6 +7,7 @@ export const TASK_UPDATE_TOOL_NAME = "TaskUpdate";
 export const TASK_LIST_TOOL_NAME = "TaskList";
 export const TODO_WRITE_TOOL_NAME = "TodoWrite";
 export const REFRESH_MCP_TOOLS_TOOL_NAME = "RefreshMcpTools";
+export const ARTIFACT_TOOL_NAME = "Artifact";
 const SHELL_RULE_FACE = { primaryParams: ["command"], params: ["command", "timeout", "description", "run_in_background"] };
 const c = (contractId, implementationRevision = "1") => ({ contractId, implementationRevision });
 export const TOOL_CATALOG_ENTRIES = [
@@ -97,6 +98,10 @@ export const TOOL_CATALOG_ENTRIES = [
     },
     { id: "repo-map", name: "RepoMap", source: "builtin", definedIn: "src/tools/fs/repo-map.ts", mountedBy: ["hands"], cards: ["repo-map"], face: { family: "search", effect: "read", contract: c("core.repo_map@1") } },
     { id: "lsp", name: "LSP", source: "builtin", definedIn: "src/core/lsp.ts", mountedBy: ["optional"], cards: [], face: { family: "search", effect: "read", contract: c("core.lsp@1") } },
+    {
+        id: "artifact", name: ARTIFACT_TOOL_NAME, source: "builtin", definedIn: "src/tools/artifact/artifact-tool.ts", mountedBy: ["optional"], cards: ["artifact"],
+        face: { family: "other", effect: "write", contract: c("core.artifact@1"), ruleFace: { primaryParams: ["action"] }, renderHints: { summaryParams: ["action", "file_path", "url"] } },
+    },
     { id: "enter-worktree", name: "EnterWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", effect: "write", contract: c("core.enter_worktree@1") } },
     { id: "exit-worktree", name: "ExitWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", effect: "write", contract: c("core.exit_worktree@1") } },
     { id: "task-output-hands", name: "TaskOutput", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", effect: "read", contract: TASK_OUTPUT_CONTRACT } },
@@ -160,7 +165,7 @@ export function toolFace(id) {
     const e = byId.get(id);
     if (e === undefined)
         throw new Error(`tool catalog: no definition ${JSON.stringify(id)}`);
-    return structuredClone(e.face);
+    return { contentOrigin: "local", ...structuredClone(e.face) };
 }
 function deepFreeze(value) {
     if (value !== null && typeof value === "object" && !Object.isFrozen(value)) {

package/dist/core/tool-conformance.d.ts

@@ -18,5 +18,3 @@ export interface ToolConformanceVector {
 }
 /** The matrix. Vector ids are stable (a host's own conformance test keys on them). */
 export declare const TOOL_CONFORMANCE_VECTORS: readonly ToolConformanceVector[];
-/** The matrix as a host reads it (a frozen copy). */
-export declare function describeToolConformanceVectors(): readonly ToolConformanceVector[];

package/dist/core/tool-conformance.js

@@ -25,6 +25,7 @@ export const TOOL_CONFORMANCE_VECTORS = [
     ], [OFFLOAD_READER]),
     vector("plan-mode", ["always", "optional"], [
         { name: "LSP", why: "needs a wired LSP manager" },
+        { name: "Artifact", why: "needs a wired artifact host" },
         { name: "Skill", why: "needs a skills listing" },
         { name: "StructuredOutput", why: "needs an output schema" },
         { name: "ToolSearch", why: "needs a deferred tool" },
@@ -32,6 +33,3 @@ export const TOOL_CONFORMANCE_VECTORS = [
         { name: "EnterPlanMode", why: "needs a checkpoint store beside plan mode" },
     ]),
 ];
-export function describeToolConformanceVectors() {
-    return TOOL_CONFORMANCE_VECTORS;
-}

package/dist/core/tool-errors.d.ts

@@ -27,6 +27,11 @@ export declare function truncateError(s: string): string;
  * a file, legacy head+tail middle-omission (there is no path to point at, and the head often carries
  * status a bare tail-keep would drop).
  */
+/** The smallest output budget the clip primitives are given: below it a clip cannot carry its own
+ *  truncation banner plus any content, so the operator knobs that feed {@link clipWithFilePointer}
+ *  (`BASH_MAX_OUTPUT_LENGTH`, `TASK_MAX_OUTPUT_LENGTH`) are raised to it, loudly, never honored as a
+ *  budget of one character. */
+export declare const OUTPUT_BUDGET_MIN_CHARS = 512;
 export declare function clipWithFilePointer(s: string, limit: number, fullOutputPath?: string): string;
 /**
  * Format a thrown tool error into model-facing text (design/64 §11.1/§11.2): a shell/exec error becomes

package/dist/core/tool-errors.js

@@ -10,6 +10,7 @@ export function truncateError(s) {
     const removed = s.length - head.length - tail.length;
     return `${head}\n\n... [${removed} characters truncated] ...\n\n${tail}`;
 }
+export const OUTPUT_BUDGET_MIN_CHARS = 512;
 export function clipWithFilePointer(s, limit, fullOutputPath) {
     if (s.length <= limit)
         return s;

package/dist/core/tool-policy.d.ts

@@ -27,7 +27,7 @@ export interface ToolCallRequest {
      */
     face?: ToolCallFace;
     /**
-     * RB-108 — the LIVE working directory this call's RELATIVE path arguments will actually resolve
+     * The LIVE working directory this call's RELATIVE path arguments will actually resolve
      * against, read at adjudication time from the same tracked `cwdRef` the fs hand tools resolve with
      * (design/64 §16.3: a resident shell's `cd` persists and moves the fs tools' relative base with it).
      *
@@ -127,6 +127,17 @@ export declare function classifierDenyCauseOf(d: unknown, call: {
     toolCallId: string;
     toolName: string;
 }): import("./gate-outcome.js").ClassifierDenyCause | undefined;
+/** Attest that `d` is an in-fold deny of an ask nobody could resolve, for `call`, for the named cause. */
+export declare function attestAskUnresolvableCause<T extends object>(d: T, cause: import("./ask-unresolvable-notice.js").AskUnresolvableCause, call: {
+    toolCallId: string;
+    toolName: string;
+}): T;
+/** Read the attested unresolvable cause off a deny FOR the named call (the gate's exit is the consumer); a
+ *  binding to a different call is a replayed object and answers absence. Internal seam — not re-exported. */
+export declare function askUnresolvableCauseOf(d: unknown, call: {
+    toolCallId: string;
+    toolName: string;
+}): import("./ask-unresolvable-notice.js").AskUnresolvableCause | undefined;
 /** Read the engine-attested settlement off a funneled decision FOR the named call (the gate's exit is the
  *  one consumer): an attestation bound to a different call is a replayed object and answers absence.
  *  Exported for the gate module only — deliberately NOT re-exported from `src/index.ts` (an internal seam
@@ -215,7 +226,7 @@ export type PermissionResult = {
     message?: string;
     decisionReason?: DecisionReason;
     requiresRealApproval?: boolean;
-    /** #548 (additive): this ask is the classifier DENIAL-LIMIT fallback — the block that reached a
+    /** This ask is the classifier DENIAL-LIMIT fallback — the block that reached a
      *  bound (CC 2.1.250 `FO`, count-then-judge) handed to a person instead of being denied.
      *  ENGINE-STAMPED beside `requiresRealApproval: true` and `decisionReason: "classifier"` at the
      *  classifier block sites (the gate's own and the inherited-lane arms); carries the COUNTS ONLY —
@@ -249,7 +260,7 @@ export type PermissionResult = {
      *  understands (see {@link import("./checkpoint-store.js").ProbeCause}). Engine-stamped and
      *  validated at the irreversibility tighten; same display-only posture as the prose sibling. */
     probeCause?: import("./checkpoint-store.js").ProbeCause;
-    /** #502 (additive): the reversibility probe declared this demotion STRUCTURAL — see
+    /** The reversibility probe declared this demotion STRUCTURAL — see
      *  {@link import("./types.js").ReversibilityVerdict.mandated}. Unlike its two `probe*` neighbours
      *  this is NOT display metadata: it joins the #144 mandate family, so the persisted-rule lane
      *  discloses a matching allow rule as shadowed instead of clearing the ask, and the card's
@@ -474,7 +485,7 @@ export interface ToolPolicyProjection {
  * `session-rule-policy.ts`. Not part of the public API (`src/index.ts` re-exports by name and does not
  * list these two): every publisher of {@link ToolPolicyNameSets} must resolve a covering entry the same
  * way, because the prepare-time audit's exemption for these spellings speaks for ALL published name sets
- * at once — the four in-engine lanes do so by sharing this module's matcher. #450: that premise is NOT
+ * at once — the four in-engine lanes do so by sharing this module's matcher. That premise is NOT
  * structural for an OUT-OF-ENGINE publisher (a host compiling its own settings into an exact-match ask
  * closure is fail-open on these spellings while the audit stays silent) — which is why the underlying
  * judgment predicates (`isNamespacedCoveringRuleName` / `namespacedRuleNameCovers`) ARE exported from
@@ -517,7 +528,7 @@ export type ConstraintChainEntryMeta = {
     /** True iff the layer carried a frozen auto-mode classifier (`autoMode`). */
     autoModeArmed?: true;
     /**
-     * #503 — the layer's serializable auto-mode ARMING RECIPE: the criteria half of the frozen classifier
+     * The layer's serializable auto-mode ARMING RECIPE: the criteria half of the frozen classifier
      * (assembly inputs + knobs + the deployment's settings epoch), recorded so a CROSS-PROCESS redemption
      * can rebuild an equivalent decider over its own fresh model leg
      * ({@link import("./auto-mode-arming.js").rebuildAutoModeDecider}) instead of answering `unavailable`
@@ -753,7 +764,7 @@ export declare function combinePolicies(...policies: ToolPolicy[]): ToolPolicy;
 /**
  * The shell tools whose `{ command }` arg a coarse command-name policy parses. Other tools are out of scope.
  *
- * RB-130 (2026-07-25, defect probe): `Monitor` belongs here. It takes a `command` and runs it through the
+ * `Monitor` belongs here. It takes a `command` and runs it through the
  * SAME `env.spawnBackground` seam as Bash, and prepare-task's own note says so in as many words — "Monitor
  * runs an arbitrary shell `command` through the SAME env seam — it must sit behind the SAME shellGate
  * tighten (else it becomes a policy side-door around a gated Bash)". The shellGate half was implemented;
@@ -763,7 +774,7 @@ export declare function combinePolicies(...policies: ToolPolicy[]): ToolPolicy;
  * gate at all; the same substitution makes `rm -rf ~/.ai-agent/sessions` a way to erase the audit trail.
  */
 /**
- * RB-153: EXPORTED. A downstream governance layer keeps its own copy of this list so its
+ * EXPORTED. A downstream governance layer keeps its own copy of this list so its
  * per-command ask-list gates the same tools core does, and it had no way to read the real one — its guard
  * had to probe a hand-written candidate list of names, which stays green for any name nobody thought to
  * put in it. The list itself is the fact; publishing it removes the guess.
@@ -805,13 +816,11 @@ export declare const COARSE_SHELL_TOOLS: string[];
  * you MUST compose explicitly: `combinePolicies(deploymentBaseline, createCoarseCommandNamePolicy(…))`
  * (deny-wins — both policies' denies still fire). {@link tightenTaskSpec} does this for you.
  *
- * 🪤 **TRAP #2 — under `TaskSpec.shellGate: "classify"`, a plain `ask` from this policy is promoted to a
- * NON-budgetable `irreversible_ask`.** `shellGate:"classify"` statically marks `bash` `irreversibility:"maybe"`;
- * the safety gate keys the checkpoint axis on that STATIC tool mark (not on `decisionReason`), so a `bash`
- * command that doesn't prove reversible suspends as `irreversible_ask` — which a budget-aware escalation
- * resolver will NEVER auto-approve. Net: combining this policy's `ask` with `shellGate:"classify"` does NOT
- * give you a budgetable normal-ask on `bash`; it gives a hard human-approval suspend. Choose `shellGate` and a
- * `defaultAction:"ask"` deliberately.
+ * Under `TaskSpec.shellGate: "classify"` a plain `ask` from this policy stays a plain ask: the shell seat's
+ * `"maybe"` tier is the doctrine's probe instrument, not a risk label, so the park is the budgetable kind
+ * (`human` under `durableApproval`) unless the probe mandated the call (an out-of-root read) or could not
+ * answer. A command the doctrine's OWN tighten refuses (`rm -rf …` with no policy asking first) still parks
+ * non-budgetable — the safety axis is judged per call by `safetyAxisOf`.
  */
 export declare function createCoarseCommandNamePolicy(opts: {
     /** Command names (argv[0]) explicitly allowed. If provided, a name NOT listed falls to `defaultAction`. */
@@ -832,7 +841,7 @@ export declare function findUnverifiableRecursiveDelete(command: string, safeVar
  * message carries the CC-sanctioned remediation (re-run with the resolved LITERAL path written into the
  * command, or assign the variable in the same command) — it doubles as the `askMessage` a classifier sees.
  *
- * RB-203 (2026-07-26): this used to be an unconditional `deny`, on the theory that the CC rule text forbids
+ * This used to be an unconditional `deny`, on the theory that the CC rule text forbids
  * auto-allow («must be explicitly approved … cannot be auto-allowed by a permission rule»).
  *
  * RB-341 (2026-07-29) re-checked that citation against the 220 corpus and corrected it in BOTH directions.
@@ -883,7 +892,7 @@ export declare function findUnverifiableRecursiveDelete(command: string, safeVar
  * (already denied). Core wires this policy ALWAYS-ON in the runner's gate composition (prepare-task); it is
  * exported so deployments can also compose/test it directly.
  *
- * RB-341: `requiresRealApproval` also turns out to be the correct sema analog of the one thing
+ * `requiresRealApproval` also turns out to be the correct sema analog of the one thing
  * `classifierApprovable: false` still buys in 220 that a `circuitBreaker` does NOT take back — 220's
  * bypassPermissions arm refuses to auto-allow an ask carrying `circuitBreaker === "dangerousRemoval"`
  * (603856-603869), i.e. a blanket MODE setting cannot clear it, only judgment can. That is exactly the
@@ -942,21 +951,21 @@ export interface AskDelegationProvenance {
  *  (see {@link OnAsk} for the full detached-settlement contract). */
 export interface AskRequest {
     toolName: string;
-    /** #144: a persisted allow rule MATCHED this call but could not clear the ask (mandated — see
+    /** A persisted allow rule MATCHED this call but could not clear the ask (mandated — see
      *  {@link PermissionResult}'s ask arm). The matched rule text — or, when a covering SET admitted the
      *  command segment-wise (the conjunction arm), a comma-joined display list of up to five sanitized
      *  rule texts with an "and N more" tail — so the approval card renders "your rule is alive, just
      *  outranked" instead of leaving the person to regex the message prose. A DISPLAY value, not an
      *  identity channel: per-rule identity travels on {@link AskRuleEvidence.personalRuleDots}. */
     persistedRuleShadowed?: string;
-    /** backlog #239: WHY the reversibility probe did not clear this call — the account of the tighten the
+    /** WHY the reversibility probe did not clear this call — the account of the tighten the
      *  card was showing WITHOUT until now (the gate knew the cause and dropped it at this seam, leaving the
      *  approver the action but not the reason it is being asked about). Present only for a `"maybe"`-tier
      *  tighten whose probe supplied a cause; the durable park route carries the same string as
      *  `RiskDescriptor.probeReason`. Neutralized + length-capped by the gate. UNTRUSTED-for-display,
      *  never adjudication input. */
     readonly probeReason?: string;
-    /** backlog #239: the STRUCTURED cause behind the tighten — a machine-readable code plus the operand
+    /** The STRUCTURED cause behind the tighten — a machine-readable code plus the operand
      *  families as arrays with honest totals, so this surface renders its OWN sentence rather than one the
      *  engine had to write before the check's edge cases were known. See
      *  {@link import("./checkpoint-store.js").ProbeCause}, whose contract is that the ARRAY is the
@@ -1149,12 +1158,12 @@ export interface AskRequest {
      *  - `isDelegatedChild` — REFUSAL POSTURE: "no user turn ever lands in this run's transcript";
      *    drives which deny text the model is told (stop-and-wait vs adapt-or-report), forks included. */
     readonly isDelegatedChild?: true;
-    /** RB-203 (confirmed P1) — carried from the originating {@link PermissionResult}'s ask
+    /** Carried from the originating {@link PermissionResult}'s ask
      *  variant of the same name: `true` ⇒ {@link resolveAsk} must not let a blanket `onAsk: "allow"`
      *  clear this ask (see that field's doc). `readonly`, filled by the gate from the decision, never a
      *  caller/worker-settable field. */
     readonly requiresRealApproval?: boolean;
-    /** #548 (additive) — present ⇔ this ask is the classifier DENIAL-LIMIT fallback (see the
+    /** Present ⇔ this ask is the classifier DENIAL-LIMIT fallback (see the
      *  {@link PermissionResult} ask-arm member of the same name): the counts that tripped the bound and
      *  this ask's own auto-deny window. Two readers: a card renders it as a countdown; {@link resolveAsk}
      *  arms its deadline from `autoDenyAfterMs` (> 0 ⇒ an unanswered function approver auto-denies at
@@ -1304,7 +1313,7 @@ export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal)
  * (abort, throw, unavailable, out-of-contract value), each already stamped at its own arm, and a
  * self-reported one would let a host relabel its refusal as an engine failure.
  *
- * #548 — the ONE ask on this leg the engine DOES time: a classifier denial-limit fallback (the ask
+ * The ONE ask on this leg the engine DOES time: a classifier denial-limit fallback (the ask
  * carrying `denialLimitFallback` with a non-zero `autoDenyAfterMs`). Its window is core's, because
  * the fallback exists to bound a classifier that would otherwise deny without end. When it elapses
  * the approver's promise is DETACHED (design/384: the wait is released, not cancelled — an approver
@@ -1390,6 +1399,41 @@ export declare function askApproverIdentity(onAsk: unknown): unknown;
  * fold and the wiring station) plus the orchestrator, and each reaches DOWN for the one definition.
  */
 export declare function isLiveApproverSeat(onAsk: OnAsk | undefined): boolean;
+/** Where a durable-approval MANDATE on a leg comes from — the closed set of its two sources. */
+export declare const DURABLE_MANDATE_SOURCES: readonly ["force_durable_gate", "durable_approval"];
+export type DurableMandateSource = (typeof DURABLE_MANDATE_SOURCES)[number];
+/**
+ * Is every interactive permission ask of this leg MANDATED to gate durably — and by which source?
+ * `force_durable_gate`: the per-principal control-plane entitlement, in force regardless of any seat.
+ * `durable_approval`: the task's own opt-in with NO live approver seat (a blanket string or nobody at all
+ * cannot answer an ask, so the park is the only honest resolution). A live seat beside the opt-in is not a
+ * mandate: the leg's asks — and its children's, at the same frozen seat — resolve there.
+ *
+ * ONE definition on purpose, like {@link isLiveApproverSeat} beside it: the chain a parent freezes for its
+ * children and the loud "mandated but no store" disclosure at the wiring station used to derive the same
+ * fact with two hand-written conditions, and the second one read only the entitlement — a task that opted
+ * in and had no store degraded to the live chain in silence.
+ */
+export declare function durableMandateSourceOf(args: {
+    forceDurableGate: boolean;
+    durableApprovalDeclared: boolean;
+    onAsk: OnAsk | undefined;
+}): DurableMandateSource | undefined;
+/**
+ * Has this leg DECLARED a durable park opt-in, from EITHER source (the per-principal
+ * entitlement or the task's own `durableApproval`) — with NO live-seat narrowing. Deliberately
+ * NOT {@link durableMandateSourceOf}: that one asks "is every ask MANDATED to gate durably" (a
+ * live approver seat beside a mere `durableApproval` opt-in defeats the mandate), while this one
+ * asks "does this leg have a durable park FACILITY at all" — the question-face mount decision and
+ * the inherited-mandate float both need the bare declaration, seat or no seat, and had each spelled
+ * `forceDurableGate === true || durableApprovalDeclared` by hand (two call sites, `prepare-
+ * question-face.ts` and `prepare-policy-chain.ts`, one drifting from the other silently if either
+ * grows a third source or a typo'd operator).
+ */
+export declare function durableParkOptInDeclared(args: {
+    forceDurableGate: boolean;
+    durableApprovalDeclared: boolean;
+}): boolean;
 /** EXACT structural clone for the approval boundary (alias isolation) — fail-closed, never lossy,
  *  never identity: a JSON round-trip would silently DROP unclonable members (presented ≠ executing =
  *  consent misrepresentation) and an identity fallback would hand the approver the live executing

package/dist/core/tool-policy.js

@@ -2,14 +2,14 @@ import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { sanitizeAutoModeArmingRecipe } from "./auto-mode-arming.js";
-import { join, normalize as normalizePath, posix as posixPath, sep, win32 as winPath } from "node:path";
+import { join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
 import { protocolOf } from "./protocol-table.js";
-import { isAbsolutePathForm, isWinFormPath, writeTargetPath } from "../tools/fs/safety.js";
+import { isAbsoluteForFamily, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 const DECISION_REASONS = ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only"];
 const DECISION_REASON_SET = new Set(DECISION_REASONS);
 function settledByNobody(kind) {
@@ -32,6 +32,9 @@ function transferEngineSettlement(from, to) {
     const c = CLASSIFIER_DENY_CAUSES_SEAT.get(from);
     if (c !== undefined)
         CLASSIFIER_DENY_CAUSES_SEAT.set(to, c);
+    const u = ASK_UNRESOLVABLE_CAUSES_SEAT.get(from);
+    if (u !== undefined)
+        ASK_UNRESOLVABLE_CAUSES_SEAT.set(to, u);
 }
 export function carryEngineAttestations(from, to) {
     transferEngineSettlement(from, to);
@@ -56,6 +59,19 @@ export function classifierDenyCauseOf(d, call) {
         return undefined;
     return v.cause;
 }
+const ASK_UNRESOLVABLE_CAUSES_SEAT = new WeakMap();
+export function attestAskUnresolvableCause(d, cause, call) {
+    ASK_UNRESOLVABLE_CAUSES_SEAT.set(d, { cause, toolCallId: call.toolCallId, toolName: call.toolName });
+    return d;
+}
+export function askUnresolvableCauseOf(d, call) {
+    if (typeof d !== "object" || d === null)
+        return undefined;
+    const v = ASK_UNRESOLVABLE_CAUSES_SEAT.get(d);
+    if (v === undefined || v.toolCallId !== call.toolCallId || v.toolName !== call.toolName)
+        return undefined;
+    return v.cause;
+}
 export function engineSettlementOf(d, call) {
     if (typeof d !== "object" || d === null)
         return undefined;
@@ -807,9 +823,8 @@ export function createTranscriptIntegrityPolicy(opts) {
     const shellTools = canonicalToolNameSet(opts?.tools);
     const dirSegs = dirs.map((d) => pathSegments(d).map(foldPathCase));
     const inProtectedDir = (p, liveCwd) => {
-        const rawRelative = !isAbsolutePathForm(p);
-        const joinInFamily = (base, rel) => isWinFormPath(base) ? winPath.join(base, rel) : posixPath.join(base, rel);
-        const abs = liveCwd !== undefined && rawRelative ? lexicalPath(joinInFamily(liveCwd, p), home) : lexicalPath(p, home);
+        const rawRelative = liveCwd === undefined ? !isAbsolutePathForm(p) : !isAbsoluteForFamily(pathFamilyOf({ root: liveCwd }), p);
+        const abs = liveCwd !== undefined && rawRelative ? lexicalPath(normalizeAbsPathLexically(joinForFamily(pathFamilyOf({ root: liveCwd }), liveCwd, p)), home) : lexicalPath(p, home);
         const segs = pathSegments(abs).map(foldPathCase);
         if (isAbsolutePathForm(abs) && dirSegs.some((d) => d.length <= segs.length && d.every((s, i) => s === segs[i])))
             return true;
@@ -891,6 +906,17 @@ export function askApproverIdentity(onAsk) {
 export function isLiveApproverSeat(onAsk) {
     return typeof onAsk === "function";
 }
+export const DURABLE_MANDATE_SOURCES = ["force_durable_gate", "durable_approval"];
+export function durableMandateSourceOf(args) {
+    if (args.forceDurableGate)
+        return "force_durable_gate";
+    if (args.durableApprovalDeclared && !isLiveApproverSeat(args.onAsk))
+        return "durable_approval";
+    return undefined;
+}
+export function durableParkOptInDeclared(args) {
+    return args.forceDurableGate || args.durableApprovalDeclared;
+}
 export function tryCloneArgs(v) {
     try {
         const value = structuredClone(v);

package/dist/core/tool-result-budget.d.ts

@@ -35,7 +35,7 @@ export interface AggregateBudgetOptions {
         sizeChars: number;
         storeFallback: boolean;
     }) => void;
-    /** RB-142: fired once per batch that is STILL over budget after both passes — i.e. the cap did what it
+    /** Fired once per batch that is STILL over budget after both passes — i.e. the cap did what it
      *  could and the request is going out oversized anyway. Reachable when a batch holds more results than
      *  the budget can hold even at the minimum preview size (a compact preview has a floor, and N of them
      *  cannot be smaller than N × that floor). Before this existed the shortfall was entirely silent, so a

package/dist/core/tool-result-store.d.ts

@@ -25,7 +25,7 @@ export interface ToolResultStore {
      * deterministic ref, so `put` for an already-stored ref MUST be a no-op — re-writing would risk a
      * non-identical preview and break the prompt cache). A durable backend treats `ref` as the primary key
      * and should validate/sanitize it (it is composed from sessionId+toolCallId, not raw model input, but a
-     * durable store still owns key hygiene for its storage layer). RB-266: the floor of that hygiene is
+     * durable store still owns key hygiene for its storage layer). The floor of that hygiene is
      * NOT per-backend — every implementation rejects the unsafe ref set via {@link assertSafeToolResultRef}
      * (a volatile backend silently accepting what a durable one rejects is the drift this closes).
      *
@@ -139,7 +139,7 @@ export interface ToolResultDeletionReport {
  * the read face authorizes by COMPARING fields it already knows; `taskId` is present when the write site
  * has one (it is a narrowing of the session, never a substitute for it).
  *
- * #167 (namespace rule): a stamped `taskId` must name a coordinate the read face's CALLER presents —
+ * A stamped `taskId` must name a coordinate the read face's CALLER presents —
  * the host's own task/run id — never an engine-internal registry handle id. A handle id lives in a
  * namespace only the engine's in-memory registry can resolve, so an owner stamped with one compares
  * unequal to every caller coordinate forever: the entry becomes readable by NOBODY across the wire
@@ -181,7 +181,7 @@ export declare function assertToolResultProvenanceMatch(ref: string, stored: Too
  *  round-tripping through a durable backend (NULL column, missing JSON key) compares equal. */
 export declare function normalizeToolResultProvenance(p: ToolResultProvenance): ToolResultProvenance;
 /**
- * RB-266 — the ref-safety half of the {@link ToolResultStore} contract, shared by every backend.
+ * The ref-safety half of the {@link ToolResultStore} contract, shared by every backend.
  *
  * Why it is central and not per-backend: the file backend has always rejected these refs (its path
  * component guard, `stores/file/fs-atomic.ts:48`), while the in-memory backend accepted them
@@ -207,7 +207,7 @@ export declare function normalizeToolResultProvenance(p: ToolResultProvenance):
  */
 export declare function assertSafeToolResultRef(ref: string): void;
 /**
- * RB-273 — the SINGLE mint point for a tool-result `ref`. Three call sites compose the same
+ * The SINGLE mint point for a tool-result `ref`. Three call sites compose the same
  * `tr_<sessionId>~<toolCallId>` string (`withToolResultOffload` here, the aggregate budget's preview
  * pass, and the runner's clear-with-offload persist); this is that string's one definition.
  *
@@ -320,7 +320,7 @@ export declare class InMemoryToolResultStore implements ToolResultStore {
     private readonly opts?;
     /** put/get only — no scheduled deletion contract: honestly `"none"` (retention.ts). */
     readonly retention: "none";
-    /** #119: the entry is content AND owner as ONE value — the write-once election that decides the
+    /** The entry is content AND owner as ONE value — the write-once election that decides the
      *  content decides the owner in the same step (no window where an entry exists ownerless). */
     private readonly map;
     private totalChars;
@@ -328,7 +328,7 @@ export declare class InMemoryToolResultStore implements ToolResultStore {
         maxTotalChars?: number;
     } | undefined);
     put(ref: string, content: string, provenance?: ToolResultProvenance): void;
-    /** #119 — the owner recorded at the winning write; `undefined` for unknown AND for unowned entries,
+    /** The owner recorded at the winning write; `undefined` for unknown AND for unowned entries,
      *  which a read face treats identically (fail-closed). */
     ownerOf(ref: string): ToolResultProvenance | undefined;
     /** Erase this session's entries, selected on the owner recorded at the winning write (the interface
@@ -370,7 +370,7 @@ export declare class ScopedToolResultStore implements ToolResultStore {
     readonly volatileBacking: boolean;
     constructor(inner: ToolResultStore, scope: string);
     /** Length-prefixed namespace — unambiguous for any scope string (no delimiter-injection ambiguity).
-     *  RB-266: the scope segment is ENCODED (injective, and its output charset carries no path separator
+     *  The scope segment is ENCODED (injective, and its output charset carries no path separator
      *  or control character), so a deployment whose trust scope contains one cannot compose a key the
      *  inner store must reject — the ref-safety rule then applies to the caller's ref alone. */
     private key;
@@ -379,7 +379,7 @@ export declare class ScopedToolResultStore implements ToolResultStore {
         offset?: number;
         limit?: number;
     }): Promise<ToolResultSlice | undefined> | ToolResultSlice | undefined;
-    /** #119 — same namespacing as {@link get}. `undefined` when the inner store predates the operation
+    /** Same namespacing as {@link get}. `undefined` when the inner store predates the operation
      *  (an unowned answer, which the read face reads fail-closed — never a fabricated owner). */
     ownerOf(ref: string): Promise<ToolResultProvenance | undefined> | ToolResultProvenance | undefined;
     /** THIS task's offload count only — the D-2 gate's per-task semantics (see class doc). */
@@ -390,10 +390,10 @@ export declare function isVolatileOffloadStore(store: ToolResultStore): boolean;
 /** Reserved name of the injected large-result reader (design/108 PascalCase: `read_tool_result`→`ReadToolResult`). */
 export declare const OFFLOAD_TOOL_NAME = "ReadToolResult";
 /**
- * RB-469-d — the runner's clear-with-offload persist, as ONE construction point (the closure used to
+ * The runner's clear-with-offload persist, as ONE construction point (the closure used to
  * live inline in prepare-task). Fire-and-forget by design (the caller returns the ref synchronously).
  *
- * #167 (A-025.17) — a failed put REPORTS the loss, it never writes under the ref. The previous arm
+ * A failed put REPORTS the loss, it never writes under the ref. The previous arm
  * wrote a lost-marker row under the SAME ref "so the page-back face reports the true cause", and that
  * one write carried two defects:
  *   - **revival**: the put and a session purge can race. When the put loses, the marker write lands
@@ -450,7 +450,7 @@ export declare const DEFAULT_TOOL_RESULT_THRESHOLD_CHARS = 20000;
  *  the per-message aggregate budget (design/64 §17.2) produces the SAME preview format (deterministic →
  *  byte-identical across queries → prompt-cache safe).
  *
- *  #115 (2026-08-09) — the truncation line states WHERE the rest is, not what anyone can do with it.
+ *  The truncation line states WHERE the rest is, not what anyone can do with it.
  *  "read more" alone reads as a promise that the full output is retrievable, and the model relays that
  *  promise to the person it is talking to; what is actually guaranteed is narrower and exactly two
  *  things: the text is retained in this run's tool-result store, and THIS chain can page it back. A

package/dist/core/tool-spec.d.ts

@@ -48,7 +48,7 @@ export interface ReversibilityVerdict {
      *  a malformed value costs the DISCLOSURE only, never the ask. */
     cause?: import("./checkpoint-store.js").ProbeCause;
     /**
-     * #502 (additive) — this demotion is STRUCTURAL, not the probe hesitating: the call crosses a
+     * This demotion is STRUCTURAL, not the probe hesitating: the call crosses a
      * boundary the deployment declared, so a persisted allow rule must not retire the resulting ask.
      * The gate folds it into the #144 mandate family ("allow rules silence the CLASSIFIER's questions,
      * never a MANDATED one") beside an operator `shellGate:"always"` and the tool's own
@@ -385,7 +385,7 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      */
     defer?: boolean;
     /**
-     * RB-400-a — inline-keep override, judged FIRST in the deferral chain (CC 220 counterpart:
+     * Inline-keep override, judged FIRST in the deferral chain (CC 220 counterpart:
      * `alwaysLoad`, declared per MCP tool via `_meta["anthropic/alwaysLoad"]`, whose `isDeferredTool`
      * checks it before every deferral arm): `true` pins this tool's full schema inline in every
      * request — it is never deferred, regardless of its own {@link defer}, {@link TaskSpec.deferTools},
@@ -493,7 +493,7 @@ export type ToolReturn = string | {
     /** Hint the agent to stop after this tool batch. */
     terminate?: boolean;
     /**
-     * RB-211 (root-cause widening): a `ToolSpec.execute` can RETURN a failure
+     * A `ToolSpec.execute` can RETURN a failure
      * receipt instead of throwing (teaching errors that carry structured `details`, e.g. an
      * unrecoverable-but-informative rejection). Before this field existed, `ToolReturn` had NO
      * isError channel at all — `defineTool`'s wrapper builds a fresh `{content,details,terminate}`
@@ -872,21 +872,15 @@ export interface ToolExecuteContext {
      */
     interactiveTools?: false;
     /**
-     * RB-220 — read-only mirror of {@link "./types.js".TaskSpec.oneShot} (same trust tier/seat as
+     * Read-only mirror of {@link "./types.js".TaskSpec.oneShot} (same trust tier/seat as
      * `principal`): this RUN has no later turn for an async background notification to land in (a
      * headless `-p` process exits once the turn ends). A delegation tool (`createSubagentTool`) reads
      * it to branch its background-launch RECEIPT toward an active block-wait instruction instead of
-     * "end your turn and wait" — mirrors {@link import("../orchestration/run-workflow-tool.js").RunWorkflowToolDeps.oneShot}'s
-     * guidance-text branch for `run_workflow`. Undefined when the tool runs outside a Runner task.
+     * "end your turn and wait" — the Workflow tool branches its launch receipt the same way off the seat it is
+     * mounted with (`RunWorkflowToolDeps.parentSpecSeat.oneShot`). The CHILDREN's copy rides {@link parentSpecSeat}
+     * (only `true` travels there). Undefined when the tool runs outside a Runner task.
      */
     oneShot?: boolean;
-    /**
-     * design/112 C1/C5 — read-only SNAPSHOT of the parent task's client-supplied USER facts (timeZone/userEmail),
-     * inherited verbatim down the delegation tree like `principal`, so a subagent/fork child's
-     * `# Environment` block localizes "today" to the SAME user zone (not the container's UTC) and names the same
-     * user. Runner-filled (NOT a tool argument). Undefined when the task carries no clientContext.
-     */
-    clientContext?: TaskSpec["clientContext"];
     /**  — the parent's tool-face controls ({@link TaskSpec.excludeTools} /
      *  {@link TaskSpec.deferTools}), inherited down the delegation tree like `principal` (Runner-filled,
      *  read-only): a scenario-wide roster must not be escapable by delegating to a child that remounts
@@ -911,30 +905,32 @@ export interface ToolExecuteContext {
      *  tool-face controls (Runner-filled): a classic-profile parent's children speak classic too
      *  unless the child spec says otherwise (child spec wins — profile is presentation, not policy). */
     promptProfile?: "simple" | "classic";
-    /** the parent's declared extra file-tool roots ({@link TaskSpec.additionalDirectories}),
-     *  inherited down the delegation tree (Runner-filled, copy-at-spawn): a deployment that widened the
-     *  fs fence (e.g. the scratchpad host lane) widened it for the TASK, and a delegated child doing the
-     *  same work hit `path_not_in_root` on the very directory the parent could write. Same trust tier as
-     *  the spec field (deployment declaration, never a model argument). */
-    additionalDirectories?: readonly string[];
-    /** The read-only half of the same seat ({@link TaskSpec.additionalReadDirectories}), inherited by
-     *  the same rule (Runner-filled, copy-at-spawn): a child doing the parent's work needs the same
-     *  read whitelist, and MUST NOT have it silently widened into a write grant in transit. */
-    additionalReadDirectories?: readonly string[];
-    /** the parent's environment facts ({@link TaskSpec.envFacts}), inherited down the
-     *  delegation tree (Runner-filled, copy-at-spawn): the sandbox binding (profile/egress/scratchpad)
-     *  is a DEPLOYMENT property, not a per-task one — a child in the same sandbox needs the same facts
-     *  (its env block renders the scratchpad section; its root fence admits the scratchpad dir). */
-    envFacts?: TaskSpec["envFacts"];
-    /**
-     * The parent task's DECLARED {@link TaskSpec.memoryPersistenceCapable} — present ONLY when the spec
-     * set it (an inferred run's ctx gains no key), Runner-filled on the same trusted seat as
-     * {@link principal}: never a model/tool argument. A delegation tool (`createSubagentTool`) forwards
-     * it into every child spec it builds so the deployment's persistence statement survives delegation:
-     * `false` is a floor a chosen agent definition cannot loosen (the read-only-memory disclosure must
-     * hold tree-wide when the deployment says nothing durable is reachable), `true` is a default a
-     * definition may narrow back to `false`. Absent ⇒ nothing is forwarded and each child's own roster
-     * inference decides, exactly as before the seat existed.
+    /**
+     * The parent SPEC seat this run hands its children ({@link import("./parent-spec-seat.js").ParentSpecSeat}):
+     * `principal`, `oneShot` (only `true`), `clientContext` (the user's TZ/email facts), `onQuestion` (the FROZEN
+     * question face — `AskUserQuestion` mounts on it), `additionalDirectories` / `additionalReadDirectories` (the
+     * fs-fence widening; the read-only half stays read-only in transit), `envFacts` (the sandbox facts), and the
+     * DECLARED `memoryPersistenceCapable`. Runner-filled, read-only, NEVER a model/tool argument; minted ONCE per
+     * prepare from the run's rebound spec + frozen question face (arrays and the facts object frozen copies). ABSENT
+     * when the tool runs outside a Runner task.
+     *
+     * A delegation tool applies it onto every child spec it builds with `applyParentSpecSeat` — the ONE law both
+     * delegation lanes (Task and Workflow) share: a value the child spec already carries WINS (an agent definition's
+     * own declaration, a deployment baseline, a trusted script), the seat FILLS an unset one, and the two REMOVAL
+     * values (`oneShot: true`, `memoryPersistenceCapable: false`) land unconditionally. A deployment that widened the
+     * fs fence widened it for the TASK, a per-request question face is the child's face too, a one-shot process is
+     * one-shot for the whole tree — none of that stops at one level.
+     */
+    parentSpecSeat?: import("./parent-spec-seat.js").ParentSpecSeat;
+    /** This run's per-request question face was STRIPPED by the engine (`RunInternals.questionFaceStripped` — the leg outlives
+     *  the request that spawned it), Runner-filled read-only. A delegation tool forwards it onto every descendant's internals:
+     *  the descendants are faceless by the same engine act, so the posture door's exemption travels with them. */
+    questionFaceStripped?: true;
+    /**
+     * The parent task's DECLARED {@link TaskSpec.memoryPersistenceCapable} as THIS run's own fact — present ONLY when
+     * the spec set it (an inferred run's ctx gains no key), Runner-filled on the same trusted seat as {@link principal}:
+     * never a model/tool argument. Read by the revival spawner as the waking run's own clamp (a declared `false` forces
+     * the read-only-memory disclosure onto the cycle it wakes). The CHILDREN's copy rides {@link parentSpecSeat}.
      */
     memoryPersistenceCapable?: boolean;
     /**
@@ -954,7 +950,7 @@ export interface ToolExecuteContext {
      */
     memoryCaptureOptedOut?: boolean | Promise<boolean>;
     /**
-     * design/383 §2.5 (rescan post-6.0.0-RC) — the floor seat's THIRD state: TRUE ⇔ the spawning
+     * design/383 §2.5 — the floor seat's THIRD state: TRUE ⇔ the spawning
      * session's capture opt-out state is INDETERMINATE at the moment a delegation tool reads this
      * seat (its capture record store is faulting, and no genuine record is known in-process). The
      * delegation lanes forward it into the child's trusted internals as the floor's indeterminate

package/dist/core/tools.d.ts

@@ -44,7 +44,7 @@ export declare function stampDefineToolBrand<T extends object>(tool: T, rebind:
  */
 export declare function rebindDefineToolCtx(product: AgentTool, enrich: ToolCtxEnricher): AgentTool;
 /**
- * RB-409 — a per-call ctx builder a MOUNT hands to {@link defineTool}.
+ * A per-call ctx builder a MOUNT hands to {@link defineTool}.
  *
  * Why the seat exists: the adapter below feeds the inner `ToolSpec.execute` a `{toolCallId, signal}`
  * ctx, because `AgentTool.execute(toolCallId, rawParams, signal, onUpdate)` — the contract every
@@ -72,7 +72,7 @@ export type ToolCtxEnricher = (base: ToolExecuteContext) => ToolExecuteContext;
  * typing accepts without needing the name.
  */
 export interface DefineToolOptions {
-    /** RB-409 — see {@link ToolCtxEnricher}. Absent ⇒ the inner spec sees exactly the pre-RB-409
+    /** See {@link ToolCtxEnricher}. Absent ⇒ the inner spec sees exactly the pre-RB-409
      *  `{toolCallId, signal}` ctx, so every mount that does not opt in stays byte-identical. */
     enrichCtx?: ToolCtxEnricher;
 }