@sema-agent/core 7.16.0 → 7.17.1

package/dist/core/runner/contracts.d.ts

@@ -28,7 +28,7 @@ import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
 import type { ActorAssertion, Checkpoint, CheckpointState, CheckpointStore, CheckpointToken, PendingSteerEntry, PlatformLimitReason, ReopenReason, ResourceLedger, ResourceLimitReason, ResumeOutcome, SerializedCheckpointState } from "../checkpoint-store.js";
 import type { ExecutionOutcomeRecordWord } from "../checkpoint-execution-record.js";
-import type { ClearedProjectionLedger, ContextEditMachine, OccurrenceIndex } from "../context-edit.js";
+import type { ClearedProjectionLedger, MicroCompactMachine, OccurrenceIndex } from "../context-edit.js";
 import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, PostToolBatchResult, ToolGateInput } from "../hooks.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { MemoryEngine } from "../memory-engine/engine.js";
@@ -1051,16 +1051,14 @@ export interface Prepared {
      *  `context-edit.ts`'s ledger note; per-run in-memory, so durable resume / `resumeAt` rebuilds
      *  start EMPTY by construction), the last request's projection seat (what the provider actually
      *  saw — the MC-R rejection arm computes its candidates and savings on THIS view, never on the
-     *  raw session rebuild), the MC-R knob, and the slice-3 arm-B seat. The explicit opt-out
-     *  (`machine: "legacy"` + MC-R off) ⇒ the ledger never gains an entry and every replay is a
-     *  same-reference no-op (opt-out bytes unchanged). */
+     *  raw session rebuild), the MC-R knob, and the slice-3 arm-B seat. */
     microCompact: PreparedMicroCompact;
 }
 /** See {@link Prepared.microCompact}. */
 export interface PreparedMicroCompact {
-    /** The frontier-machine selection — `"off"` = no proactive frontier clearing (the unified
-     *  machine instead gets its one blocking-point shot, slice-3 arm A). */
-    machine: "off" | ContextEditMachine;
+    /** The frontier-machine selection — `"off"` = no proactive frontier clearing (the machine
+     *  instead gets its one blocking-point shot, slice-3 arm A). */
+    machine: MicroCompactMachine;
     /** MC-R: one-shot clear-and-retry on a provider input-too-long rejection.
      *  Default true since the slice-3 flip. */
     clearOnRejection: boolean;
@@ -1105,7 +1103,7 @@ export interface PrepareResume {
      *  crash-interrupted; closing them with `[INTERRUPTED]` would DESTROY the suspended batch, §15.2 #7). */
     suspendedBatch: ReadonlySet<string>;
     /** The §4.bis correctness-state snapshot to re-seed (activeTools / outputRef / nestedStats /
-     *  consolidationNotes / readFileState). */
+     *  readFileState). */
     seed: CheckpointState;
     /** How many times this task already suspended (the resumed checkpoint's
      *  `suspendCount`). The next suspend mints `priorSuspendCount + 1`; past `maxSuspends` it fails
@@ -1393,7 +1391,10 @@ export interface RunInternals {
      * `"interactive"` tree's engine-stripped legs are exempt). TRUST POSTURE (ruled 2026-08-05):
      * RunInternals is a public trusted-caller parameter, so this flag is an honesty channel, not a
      * security gate — a caller forging it is a deployment lying to itself; resource-face safety
-     * stays with its own fail-closed mechanisms.
+     * stays with its own fail-closed mechanisms. INHERITS DOWN THE TREE: a stripped leg's descendants are faceless by
+     * the same engine act (the trusted ctx carries it as `ToolExecuteContext.questionFaceStripped`, the Workflow mount as
+     * `parentQuestionFaceStripped`), so the posture-door exemption travels with the facelessness it explains; a leg
+     * that strips on its own mints the same flag.
      */
     questionFaceStripped?: true;
     /**
@@ -1516,7 +1517,7 @@ export interface RunInternals {
     workflowParkedResume?: ReadonlyArray<{
         runId: string;
         token: CheckpointToken;
-        outcome: ResumeOutcome;
+        outcome?: ResumeOutcome;
         inheritedGate?: InheritedGate;
     }>;
     /**

package/dist/core/runner/gate-exit.js

@@ -1,5 +1,5 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
-import { classifierDenyCauseOf, decisionText, engineSettlementOf } from "../tool-policy.js";
+import { askUnresolvableCauseOf, classifierDenyCauseOf, decisionText, engineSettlementOf } from "../tool-policy.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
 export function mintGateOutcome(facts) {
@@ -96,6 +96,15 @@ export function hookDenyExit(pass, r) {
         preToolContext: pass.preToolContext,
     };
 }
+function unresolvableCauseOfSettlement(gate) {
+    if (gate.disposition.kind !== "denied" || gate.disposition.deniedBy !== "ask_resolution" || gate.settlement === undefined)
+        return undefined;
+    if (gate.settlement.kind === "approver_unavailable")
+        return "approver_unavailable";
+    if (gate.settlement.kind === "no_approver")
+        return "no_approver_wired";
+    return undefined;
+}
 export async function exitGate(pass) {
     const { input, event, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
     if (pass.decision.action === "deny") {
@@ -106,6 +115,11 @@ export async function exitGate(pass) {
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
         const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
+        const unresolvable = askUnresolvableCauseOf(pass.decision, { toolCallId, toolName }) ?? unresolvableCauseOfSettlement(gate);
+        if (unresolvable !== undefined) {
+            const cause = unresolvable;
+            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined }), "toolGate.onAskUnresolvable");
+        }
         await notifyPermissionDenied({
             toolName,
             input: cloneObserverInput(pass.currentInput),

package/dist/core/runner/halt-attribution.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Halt attribution, the consumer half: the ONE predicate that turns the harness's
+ * consumption statement ({@link HaltConsumption}) into the result's `haltedByUser` seat, and the disclosure
+ * for the halt that was accepted but never consumed. Both readers of the statement live here so the law
+ * has one spelling: signed ⇔ consumed; unconsumed ⇔ absent + `task.halt_unconsumed`.
+ */
+import type { HaltConsumption } from "../../internal/harness.js";
+import { type RunnerDeps } from "../types.js";
+/**
+ * The attribution law: `haltedByUser` ⇔ the halt was CONSUMED by the machinery — its cut settled a turn (the
+ * loop's report, stamped `"halt"` at the seat's abort) OR its stop request was among the sources a boundary
+ * consult stopped the loop for. A halt merely ACCEPTED (latched, receipt answered) while the run ended for its
+ * own reason is not consumed and never signs (fail-closed: rather absent than guessed).
+ */
+export declare function haltConsumed(c: HaltConsumption | undefined): boolean;
+export interface UnconsumedHaltDisclosureInput {
+    /** The verb's acceptance fact (`loopLatch.userHalted`): a halt was latched on this run. */
+    accepted: boolean;
+    /** The harness's statement, read after the prompt settled. */
+    consumption: HaltConsumption | undefined;
+    onNotice: RunnerDeps["onNotice"];
+    sessionId: string;
+    runId: string;
+    taskId: string | undefined;
+}
+/**
+ * The ACCEPTED-but-UNCONSUMED halt: the verb latched the stop (and may have cut a seat), but the run ended for
+ * its own reason before the machinery consumed it — no settlement took the halt's cut as its cause and no
+ * boundary consult stopped the loop for it (a brain minting its own `aborted` final, a natural completion past
+ * the final commit point, an approval park whose commit won the race). The result reads the run's own terminal
+ * without `haltedByUser`; this notice is the halt's trace — the same code the verb mints on its own arm (a halt
+ * refused by an already-owned ending), one fact with one spelling, the two mint points disjoint: the verb arm mints
+ * only while NO halt has been accepted on the run; once one was, this arm alone speaks. One per such run. Returns whether it was minted.
+ */
+export declare function discloseUnconsumedHalt(input: UnconsumedHaltDisclosureInput): boolean;

package/dist/core/runner/halt-attribution.js

@@ -0,0 +1,16 @@
+import { deliverEngineNotice } from "../types.js";
+export function haltConsumed(c) {
+    return c?.turnCut === "halt" || c?.boundaryStop?.sources.includes("halt") === true;
+}
+export function discloseUnconsumedHalt(input) {
+    if (!input.accepted || haltConsumed(input.consumption))
+        return false;
+    deliverEngineNotice(input.onNotice, {
+        code: "task.halt_unconsumed",
+        message: "a user halt was accepted, but the run ended for its own reason before the halt stopped or cut anything: " +
+            "no turn was settled as its cut and no boundary stopped for it — the run's own ending stands, and the result " +
+            "will not carry haltedByUser for this halt.",
+        detail: { sessionId: input.sessionId, runId: input.runId, ...(input.taskId !== undefined ? { taskId: input.taskId } : {}) },
+    });
+    return true;
+}

package/dist/core/runner/memory-consolidation.d.ts

@@ -23,8 +23,6 @@ export declare const DEFAULT_CONSOLIDATION_BAND: {
 export declare const DEFAULT_CONSOLIDATION_SEARCH_LIMIT = 20;
 /** Default cap on this-task notes consolidated in one batch (F6 token bound). */
 export declare const DEFAULT_CONSOLIDATION_MAX_NOTES = 50;
-/** Default independent timeout for the whole consolidation pass (seconds). */
-export declare const DEFAULT_CONSOLIDATION_TIMEOUT_SEC = 30;
 /** Normalize a note body for the EXACT-restatement check in the `<lo` near-dup cheap path. Case- + whitespace-
  *  insensitive ONLY (lower-case, collapse whitespace runs, trim); it PRESERVES every symbol/punctuation so it can
  *  NOT false-equate semantically-distinct facts. (The earlier `[^\p{L}\p{N}]`-stripping

package/dist/core/runner/memory-consolidation.js

@@ -4,7 +4,6 @@ import { cacheFamilyOf, usageCostMicroUsd } from "./usage-accounting.js";
 export const DEFAULT_CONSOLIDATION_BAND = { lo: 0.05, hi: 0.3 };
 export const DEFAULT_CONSOLIDATION_SEARCH_LIMIT = 20;
 export const DEFAULT_CONSOLIDATION_MAX_NOTES = 50;
-export const DEFAULT_CONSOLIDATION_TIMEOUT_SEC = 30;
 export function normalizeForExactMatch(s) {
     return s.toLowerCase().replace(/\s+/g, " ").trim();
 }

package/dist/core/runner/prepare-artifact.d.ts

@@ -0,0 +1,52 @@
+/**
+ * PrepareTask's Artifact phase: the `RunnerDeps.artifactHost` seat is read once; an absent seat mounts
+ * nothing and announces nothing; a seat whose declaration fails an invariant mounts nothing and announces
+ * `config.artifact_host_invalid` (operator audience) so a bad wiring can never read as "no hosting"; a
+ * valid seat mounts ONE `Artifact` tool assembled from the declaration, on the same optional band the LSP
+ * seat uses. The tool's local-file read goes through the run's fs fence (root containment, read-deny, read
+ * face) exactly as `Read` does, then reads the bytes once from the execution env. A local stub's store
+ * (`capabilities.storageDir`) must lie OUTSIDE every root the run may write or read — a ledger the model can
+ * edit through the fs tools is not a trust boundary — and a store inside one refuses the mount, naming both.
+ * Synchronous: the stretch has no await (the file read is a closure the tool calls later).
+ */
+import type { ExecutionEnv } from "../../internal/harness.js";
+import { type ArtifactPlane } from "../artifact-host.js";
+import { RosterBuilder } from "../tool-roster.js";
+import type { AgentTool, RunnerDeps } from "../types.js";
+import type { ReadDenyMatcher, ReadFace } from "../../tools/fs/index.js";
+import type { Prepared } from "./contracts.js";
+export interface PrepareArtifactInput {
+    /** borrowed-readonly — the deployment's hosting seat and the notice sink the refusal arm announces on. */
+    deps: Pick<RunnerDeps, "artifactHost" | "onNotice">;
+    /** borrowed-readonly — the engine-minted run id: the host's `onMount` key and every call context's `runId`. */
+    runId: string;
+    /** borrowed-readonly — the host task id, the call context's audit attribution. */
+    taskId: string;
+    /** borrowed-readonly — the acquired session id (notice attribution and the call context's `sessionId`). */
+    sessionId: string;
+    /** borrowed-readonly — the spawned name this run carries, when any (call-context attribution only). */
+    agentName: string | undefined;
+    /** borrowed-readonly — the run's resolved env: the byte source of a published local file. */
+    executionEnv: ExecutionEnv;
+    /** borrowed-readonly — the canonical task root the fs fence contains reads to; undefined ⇒ no local-file publish. */
+    rootCanonical: string | undefined;
+    /** borrowed-readonly — the extra containment roots (write and read-only) the fence admits. */
+    additionalRootsCanonical: readonly string[];
+    /** borrowed-readonly — the read-deny matcher in force for the run, when any. */
+    readDenyMatcher: ReadDenyMatcher | undefined;
+    /** borrowed-readonly — the resolved read face (`"open"` lifts root containment for reads). */
+    resolvedReadFace: ReadFace | undefined;
+    /** borrowed-readonly — the tracked-cwd cell; `current` is read per call as the relative-path base. */
+    handsCwdRef: Prepared["cwdRef"];
+    /** borrowed-mutable — the run's roster builder; writer here: ONE mount when the seat is valid. */
+    roster: RosterBuilder;
+    /** borrowed-readonly — the first-party result-offload wrapper every core mount passes through (a large read or a conflict snapshot is offloaded, not inlined). */
+    firstPartyOffload: (tool: AgentTool) => AgentTool;
+    /** borrowed-mutable — the env-hand membership set the memory content-origin face reads (a tool that reads the execution env's files is a hand); writer here: `add("Artifact")` on the mount. */
+    envHandToolNames: Set<string>;
+}
+export interface PrepareArtifactResult {
+    /** owned — the mounted face's plane, or undefined when nothing mounted (absent seat, or an invalid one). */
+    artifactPlane: ArtifactPlane | undefined;
+}
+export declare function prepareArtifact(input: PrepareArtifactInput): PrepareArtifactResult;

package/dist/core/runner/prepare-artifact.js

@@ -0,0 +1,63 @@
+import { readArtifactHostCapabilities } from "../artifact-host.js";
+import { ARTIFACT_TOOL_NAME } from "../tool-catalog-entries.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { RosterBuilder } from "../tool-roster.js";
+import { defineTool } from "../tools.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { physicalPathOfExisting } from "../physical-path.js";
+import { resolveKey, violationDetails, violationText, withinAnyRoot } from "../../tools/fs/safety.js";
+import { createArtifactTool } from "../../tools/artifact/artifact-tool.js";
+export function prepareArtifact(input) {
+    const { deps, runId, taskId, sessionId, agentName, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames } = input;
+    const host = deps.artifactHost;
+    if (host === undefined)
+        return { artifactPlane: undefined };
+    const refuse = (problem) => {
+        deliverEngineNotice(deps.onNotice, {
+            code: "config.artifact_host_invalid",
+            message: `RunnerDeps.artifactHost is wired but unusable, so no Artifact tool is mounted for this task: ${problem}`,
+            detail: { problem, sessionId, runId },
+        });
+        return { artifactPlane: undefined };
+    };
+    const verdict = readArtifactHostCapabilities(host);
+    if (!verdict.ok)
+        return refuse(verdict.problem);
+    const storageDir = verdict.capabilities.storageDir;
+    if (storageDir !== undefined && rootCanonical !== undefined) {
+        const real = physicalPathOfExisting(storageDir);
+        const inside = [rootCanonical, ...additionalRootsCanonical].find((root) => withinAnyRoot([root], real));
+        if (inside !== undefined)
+            return refuse(`the local artifact store ${storageDir} lies inside a root this run may reach through its file tools (${inside}); put the store outside every task root and additional directory`);
+    }
+    try {
+        host.onMount?.(runId);
+    }
+    catch (err) {
+        return refuse(`artifactHost.onMount threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const readLocalFile = async (path, maxBytes, signal) => {
+        if (rootCanonical === undefined)
+            return { ok: false, reason: "refused", text: "Error (Artifact): this task has no filesystem root, so a local file cannot be published." };
+        const rk = await resolveKey(executionEnv, rootCanonical, path, signal, handsCwdRef?.current, additionalRootsCanonical, undefined, readDenyMatcher, resolvedReadFace);
+        if (!rk.ok)
+            return { ok: false, reason: "refused", text: violationText("Artifact", rk.violation), details: violationDetails(rk.violation) };
+        const meta = await executionEnv.fileInfo(rk.key, signal);
+        if (!meta.ok)
+            return { ok: false, reason: "refused", text: `Error (Artifact): cannot stat ${inlineUntrusted(path, 200)} (${inlineUntrusted(meta.error.code, 40)}).` };
+        if (meta.value.kind !== "file")
+            return { ok: false, reason: "not_a_file", kind: meta.value.kind };
+        if (meta.value.size > maxBytes)
+            return { ok: false, reason: "too_large", size: meta.value.size, limit: maxBytes, judgedOn: "metadata" };
+        const r = await executionEnv.readBinaryFile(rk.key, signal);
+        if (!r.ok)
+            return { ok: false, reason: "refused", text: `Error (Artifact): cannot read ${inlineUntrusted(path, 200)} (${inlineUntrusted(r.error.code, 40)}).` };
+        if (r.value.byteLength > maxBytes)
+            return { ok: false, reason: "too_large", size: r.value.byteLength, limit: maxBytes, judgedOn: "bytes" };
+        return { ok: true, key: rk.key, bytes: r.value };
+    };
+    const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile });
+    roster.mount(firstPartyOffload(defineTool(artifactSpec)), { source: "builtin", mountedBy: "optional" });
+    envHandToolNames.add(ARTIFACT_TOOL_NAME);
+    return { artifactPlane: verdict.capabilities.plane };
+}

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -37,10 +37,11 @@ import type { ReadFace } from "../../tools/fs/index.js";
 import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
 import { RosterBuilder } from "../tool-roster.js";
+import type { ParentSpecSeat } from "../parent-spec-seat.js";
 export interface PrepareCapsAndWorkflowInput {
     /** borrowed-readonly — the REBOUND spec, whole: the roster map reads `tools`; the mounts read `enableBlockedReport`,
      *  `enablePlanMode`, `interactiveTools`; the caps/compliance stations read `principal`, `selfOrchestration`,
-     *  `enableFork`, `getApiKeyAndHeaders`; the Workflow mount forwards `oneShot`, `handsReadOnly`, `interactiveTools`. The
+     *  `enableFork`, `getApiKeyAndHeaders`; the Workflow mount forwards `handsReadOnly`, `interactiveTools`. The
      *  self-orchestration predicate takes the whole spec. Never mutated. */
     spec: TaskSpec;
     /** borrowed-readonly — the deployment seats, whole: `runtimeCapsResolver`, `compliancePostureResolver`, `onError`, `onNotice`,
@@ -54,7 +55,7 @@ export interface PrepareCapsAndWorkflowInput {
     checkpointSeat: CheckpointSeat | undefined;
     /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
      *  `onTaskNotification`, `workflowDepth`, and the capture-floor getter reads `memoryCaptureAncestors`. */
-    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume"> | undefined;
+    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "questionFaceStripped"> | undefined;
     /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
     session: Pick<StoredSession, "buildContext">;
     /** borrowed-readonly — the acquired session id (operator-line context, the refusal codes' phase record). */
@@ -88,6 +89,7 @@ export interface PrepareCapsAndWorkflowInput {
     };
     /** borrowed-readonly — the FROZEN approver seat (the Workflow mount's parentOnAsk). */
     frozenOnAsk: OnAsk | undefined;
+    /** borrowed-readonly — the parent SPEC seat the children inherit (minted once by the inherited-gate phase; the Workflow mount's dep, the same value the delegation ctx carries). */ parentSpecSeat: ParentSpecSeat;
     /** borrowed-readonly — the ONE read-face carrier expression (the Workflow mount's parentReadFace getter calls it). */
     carrierReadFace: () => ReadFace | undefined;
     /** borrowed-readonly — the filtered display-forwarding wrapper (the Workflow mount's forwardEvent; absent ⇒ no key). */

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -112,7 +112,7 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
@@ -312,8 +312,7 @@ export async function prepareCapsAndWorkflow(input) {
                         return mine.length > 0 ? mine : undefined;
                     } }
                 : {}),
-            principal: spec.principal,
-            oneShot: spec.oneShot,
+            parentSpecSeat, ...(internals?.questionFaceStripped === true ? { parentQuestionFaceStripped: true } : {}),
             ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
             parentMemoryCaptureState: () => {
                 const memoryEngineSession = input.memoryEngineSession();

package/dist/core/runner/prepare-config-doors.d.ts

@@ -22,7 +22,7 @@
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
 import type { Model } from "../../internal/llm.js";
 import type { ThinkingLevel } from "../../internal/harness.js";
-import type { ContextEditMachine } from "../context-edit.js";
+import { type MicroCompactMachine } from "../context-edit.js";
 import { type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
 import type { SessionStore } from "../session.js";
@@ -150,7 +150,7 @@ export interface PrepareConfigDoorsResult {
      *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
      *  the deps bag is never re-read after this door. */
     microCompactKnob: {
-        machine: "off" | ContextEditMachine;
+        machine: MicroCompactMachine;
         clearOnRejection: boolean;
     };
     /** owned — the resolved role; its `systemPrompt` seat is still read at prompt-input time. */
@@ -213,7 +213,7 @@ export interface PrepareConfigDoorsResult {
  *  it must refuse exactly like a malformed field, never fold to the defaults. The RESOLVED values
  *  returned here are immutable and are the state builder's ONLY source — nothing re-reads the bag. */
 export declare function resolveMicroCompactKnob(bag: RunnerDeps["microCompact"]): {
-    machine: "off" | ContextEditMachine;
+    machine: MicroCompactMachine;
     clearOnRejection: boolean;
 };
 export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;

package/dist/core/runner/prepare-config-doors.js

@@ -1,5 +1,7 @@
 import { resolveBrainCallGuardrailMs } from "../../brain/timeout.js";
 import { assertReadFaceValue } from "../../tools/fs/index.js";
+import { MICRO_COMPACT_MACHINES } from "../context-edit.js";
+import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { isModelPriced, malformedPricingField, modelCostToPricing } from "../pricing.js";
 import { preflightLockedConfig } from "../locked-config.js";
@@ -133,8 +135,8 @@ export function resolveMicroCompactKnob(bag) {
         throw microCompactConfigError(undefined, bag, "an object carrying optional machine/clearOnRejection keys");
     }
     const declaredMachine = bag?.machine;
-    if (declaredMachine !== undefined && declaredMachine !== "off" && declaredMachine !== "legacy" && declaredMachine !== "cc") {
-        throw microCompactConfigError("machine", declaredMachine, `"off" | "legacy" | "cc"`);
+    if (declaredMachine !== undefined && !MICRO_COMPACT_MACHINES.includes(declaredMachine)) {
+        throw microCompactConfigError("machine", declaredMachine, MICRO_COMPACT_MACHINES.map((m) => `"${m}"`).join(" | "));
     }
     return { machine: declaredMachine ?? "cc", clearOnRejection: resolveClearOnRejection(bag) };
 }
@@ -148,6 +150,7 @@ function resolveClearOnRejection(bag) {
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;
     let spec = input.spec;
+    assertNoRetiredRunnerDeps(deps);
     assertRestoreGatedToolsValue(spec.restoreGatedTools);
     const microCompactKnob = resolveMicroCompactKnob(deps.microCompact);
     const assertToolNameListValue = (value, seat) => {

package/dist/core/runner/prepare-context-lane.d.ts

@@ -17,7 +17,7 @@
  */
 import { type AgentHarness, type AgentMessage } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
-import { type ContextEditMachine, type OccurrenceIndex } from "../context-edit.js";
+import { type MicroCompactMachine, type OccurrenceIndex } from "../context-edit.js";
 import { type ToolResultStore } from "../tool-result-store.js";
 import { type RunnerDeps } from "../types.js";
 import type { Prepared, PreparedMicroCompact } from "./contracts.js";
@@ -39,7 +39,7 @@ export interface PrepareContextLaneInput {
     offloadStore: ToolResultStore | undefined;
     /** borrowed-readonly — the doors' RESOLVED microCompact knob (immutable values, never the deps bag). */
     microCompactKnob: {
-        machine: "off" | ContextEditMachine;
+        machine: MicroCompactMachine;
         clearOnRejection: boolean;
     };
     /** borrowed-mutable — the built harness. Writer here: `on("context", …)` — the ONE registration of the request-build

package/dist/core/runner/prepare-context-lane.js

@@ -44,14 +44,8 @@ export function prepareContextLane(input) {
             let ccPass;
             const edited = microCompact.machine === "off" ? mediaCapped : clearStaleToolResults(mediaCapped, {
                 budgetTokens: editAt,
-                machine: microCompact.machine,
-                ...(microCompact.machine === "cc" || microCompact.clearOnRejection ? { recognizeCcMarkers: true } : {}),
-                ...(microCompact.machine === "cc"
-                    ? {
-                        clearSource: replayed,
-                        onCleared: (pass) => { ccPass = pass; },
-                    }
-                    : {}),
+                clearSource: replayed,
+                onCleared: (pass) => { ccPass = pass; },
                 anchoredTotalTokens: estimateContextTokens(mediaCapped, charsPerToken).tokens,
                 charsPerToken,
                 ...(offloadStore
@@ -193,15 +187,10 @@ export async function runGuardChain(args) {
     };
     let working = edited;
     let anchoredWorking = estimateContextTokens(working, charsPerToken).tokens;
-    if (microCompact.machine === "legacy") {
-        const t = applyGuardTrim(working, anchoredWorking);
-        return { working, trimmed: t.trimmed, trimDroppedMessages: t.dropped };
-    }
     if (microCompact.machine === "off" && anchoredWorking > guardAt) {
         let blockingPass;
         const blockingEdited = clearStaleToolResults(working, {
             budgetTokens: guardAt,
-            machine: "cc",
             clearSource: args.replayed,
             onCleared: (pass) => { blockingPass = pass; },
             anchoredTotalTokens: anchoredWorking,

package/dist/core/runner/prepare-file-history.d.ts

@@ -25,7 +25,7 @@ import type { FileHistoryBoundarySeat, RunInternals } from "./contracts.js";
 export interface PrepareFileHistoryInput {
     /** borrowed-readonly — the deployment seats this phase reads: the first-touch failure policy and the
      *  history store (both validated HERE, once), the incident sink, and the retired-epoch diagnostic probe. */
-    deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "onError" | "legacyRewindBoundaryProbe">;
+    deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "onError">;
     /** borrowed-readonly — the REBOUND spec's rewind request fields (the retired `rewindFiles` spelling is
      *  read off the same object as an unknown key) and the caller's cancel signal for the restore. */
     spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "acceptPartialRestore" | "signal">;

package/dist/core/runner/prepare-file-history.js

@@ -63,7 +63,6 @@ export async function prepareFileHistory(input) {
             });
         }
     }
-    const legacyEpochTail = (entryId, form = "at-or-above") => legacyRewindEpochTail(deps, sessionId, entryId, form);
     let restoredFilePaths = [];
     if (rewindTarget !== undefined && fileHistoryStore !== undefined && handsEnabled) {
         const historyStore = fileHistoryStore;
@@ -85,7 +84,7 @@ export async function prepareFileHistory(input) {
                 }
             }
             if (anchor === undefined) {
-                const e = new Error(`rewind-files: no file-history boundary exists at or above the "before" branch point on session "${sessionId}" — cannot restore files consistent with the rewound context. ${await legacyEpochTail(rewindTarget)}`);
+                const e = new Error(`rewind-files: no file-history boundary exists at or above the "before" branch point on session "${sessionId}" — cannot restore files consistent with the rewound context. ${rewindRefusalTail("at-or-above")}`);
                 e.code = "rewind_snapshot.unresolvable";
                 throw e;
             }
@@ -99,7 +98,7 @@ export async function prepareFileHistory(input) {
             if (restored.error?.code === "not_found") {
                 const e = new Error(rewindBefore
                     ? `rewind-files: the resolved "before" history anchor "${rewindTarget}" disappeared before restore — files were NOT rewound`
-                    : `rewind-files: no file-history boundary exists for entry "${rewindTarget}" on session "${sessionId}" — the working tree was NOT rewound. ${await legacyEpochTail(rewindTarget, "keyed")}`);
+                    : `rewind-files: no file-history boundary exists for entry "${rewindTarget}" on session "${sessionId}" — the working tree was NOT rewound. ${rewindRefusalTail("keyed")}`);
                 e.code = "rewind_snapshot.unresolvable";
                 throw e;
             }
@@ -192,55 +191,7 @@ function resolveWiredFileHistoryStore(candidate) {
     }
     return candidate;
 }
-const LEGACY_PROBE_TIMEOUT_MS = 2_000;
-const LEGACY_PROBE_TIMED_OUT = Symbol("legacy-rewind-probe-timeout");
-async function legacyRewindEpochTail(deps, sessionId, entryId, form) {
-    const probe = deps.legacyRewindBoundaryProbe;
-    let verdict;
-    if (probe !== undefined) {
-        try {
-            let timer;
-            const timeout = new Promise((resolve) => {
-                timer = setTimeout(() => resolve(LEGACY_PROBE_TIMED_OUT), LEGACY_PROBE_TIMEOUT_MS);
-            });
-            try {
-                verdict = await Promise.race([Promise.resolve(probe({ sessionId, entryId })), timeout]);
-            }
-            finally {
-                clearTimeout(timer);
-            }
-            if (verdict === LEGACY_PROBE_TIMED_OUT) {
-                verdict = undefined;
-                try {
-                    deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe did not answer within ${LEGACY_PROBE_TIMEOUT_MS}ms while explaining a rewind refusal — the refusal stands and names both possibilities`), { phase: "rewind", sessionId });
-                }
-                catch {
-                }
-            }
-        }
-        catch (err) {
-            verdict = undefined;
-            try {
-                deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe threw while explaining a rewind refusal (${err.message}) — the refusal stands and names both possibilities`), { phase: "rewind", sessionId });
-            }
-            catch {
-            }
-        }
-        if (verdict !== undefined && typeof verdict !== "boolean") {
-            try {
-                deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe answered ${JSON.stringify(String(verdict))} for entry "${entryId}" — only true/false/undefined are meaningful, so the refusal names both possibilities instead of trusting it`), { phase: "rewind", sessionId });
-            }
-            catch {
-            }
-            verdict = undefined;
-        }
-    }
-    if (verdict === true) {
-        return `This deployment's legacy-epoch probe reports that entry "${entryId}" DOES carry a boundary from the retired whole-tree snapshot era, which this engine's per-edited-file seat does not restore — the two epochs are not interchangeable (a whole-tree manifest carries no tracked-set provenance, so replaying it here would converge files this session never edited). Restore it with the whole-tree-era tooling this deployment kept, or re-run the turns under the current engine.`;
-    }
-    if (verdict === false) {
-        return `This deployment's legacy-epoch probe reports no whole-tree-era boundary for entry "${entryId}" either, so the boundary simply does not exist: its turns ran without a RunnerDeps.fileHistoryStore wired, or it was reaped.`;
-    }
+function rewindRefusalTail(form) {
     return form === "keyed"
         ? `Boundaries are keyed by a turn's INITIAL entry and exist only for turns that ran with a RunnerDeps.fileHistoryStore wired; a boundary from the retired whole-tree snapshot era is not restorable by this seat, and reaped boundaries have none.`
         : `Either the boundary does not exist (its turns ran without a RunnerDeps.fileHistoryStore, or it was reaped), or it was produced in the retired whole-tree snapshot era, which this engine's per-edited-file seat does not restore.`;

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -162,13 +162,10 @@ export interface PrepareHandsReadFaceInput {
      *  when no file restore ran. Fail-closed by construction — dropping a read record only ever
      *  produces refusals. */
     restoredFilePaths?: readonly string[];
-    /** borrowed-readonly — (ref cell; the REF itself is never replaced) memory write gate:
-     *  the band's beforeWrite closure reads `.current` call-time; prepareMemory (driver, BEFORE this phase
-     *  since the memory root must be known before the toolkit compiles) installs the gate — the one
-     *  writer; this phase only reads. Declared in the driver because the SAME ref feeds prepareMemory. */
-    memoryWriteGateRef: {
-        current?: BeforeWriteHook;
-    };
+    /** borrowed-readonly — the memory write gate the memory phase minted (it runs BEFORE this phase: the memory root
+     *  must be known before the toolkit compiles), composed into the band's beforeWrite below; undefined for a
+     *  memory-less run (every write passes the engine half). */
+    memoryWriteGate: BeforeWriteHook | undefined;
     /** borrowed-mutable — the advertised-writable-directory seat (see its module header for the one
      *  rule). Present on the hands leg only (a fence exists). The memory phase, which runs BEFORE this one,
      *  has already admitted its write root through it; this phase admits the deployment's scratchpad and

package/dist/core/runner/prepare-hands-readface.js

@@ -123,7 +123,7 @@ export function resolveHandsLessReadFace(input) {
 }
 export async function prepareHandsMount(input) {
     const envHandToolNames = new Set();
-    const { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
+    const { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
     assertStringArraySeat(spec.additionalDirectories, "TaskSpec.additionalDirectories", "strings");
     assertStringArraySeat(spec.additionalReadDirectories, "TaskSpec.additionalReadDirectories", "strings");
     assertStringArraySeat(deps.readDenyPatterns, "RunnerDeps.readDenyPatterns", "compiler-owned");
@@ -328,7 +328,7 @@ export async function prepareHandsMount(input) {
                     if (verdict !== undefined && verdict.ok === false)
                         return verdict;
                 }
-                return memoryWriteGateRef.current?.(w);
+                return memoryWriteGate?.(w);
             },
             mountBackgroundTaskTools: false,
             monitorToolActive: backgroundTaskToolsActive && !(toolFaceSnapshot.exclude?.includes("Monitor") ?? false),
@@ -354,6 +354,7 @@ export async function prepareHandsMount(input) {
             const shellReadBoundary = () => ({
                 roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical],
                 ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}),
+                ...(executionEnv.homeDir !== undefined ? { homeDir: executionEnv.homeDir } : {}),
                 denyMatch: (p) => readDenyMatcher?.matchPath(p)?.pattern ?? null,
                 ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}),
             });

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -5,7 +5,7 @@
  * freeze with its tighten-only intersection and the monotonic governed bit), the effective shellGate against the
  * spec, the three cells later phases fill for the children's chain (own session rules, own admitted org scopes,
  * own org verdict), the checkpoint-section closures the suspend serializer reads (face / org / F-012 stamps), the
- * FROZEN ask and question seats (spec over deps), the two delegation refs the memory phase binds late, the ONE
+ * FROZEN ask and question seats (spec over deps), the parent SPEC seat the children inherit, the two delegation refs the memory phase binds late, the ONE
  * child-chain assembly `inheritedGateForChildren`, the caller-tool ctx enrichment `enrichSpecToolCtx` shared by
  * the roster wrap and the revival spawner, the denial-limit stop seat, and the full-shell reachability predicate.
  * The interface is the dependency list the segment had implicitly.
@@ -36,6 +36,7 @@ import type { ReadFace } from "../../tools/fs/index.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type OnQuestion } from "../ask-question.js";
+import { type ParentSpecSeat } from "../parent-spec-seat.js";
 import { type HookEnvCapabilities, type Hooks } from "../hooks.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
@@ -65,7 +66,7 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — the trusted spawn-side channel: `inheritedGate` (the LIVE half of the chain fold), `ownOrgAdmissionRef`
      *  (the same-session continuation's freeze), `delegationProvenance` (the F-012 stamp), and the identity / peer / notification
      *  seats the ctx enrichment forwards. Never mutated. */
-    internals: Pick<RunInternals, "inheritedGate" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork"> | undefined;
+    internals: Pick<RunInternals, "inheritedGate" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork" | "questionFaceStripped"> | undefined;
     /** borrowed-readonly — the resume leg, or undefined on a fresh one: `seed.inheritedGate` is the CHECKPOINT half of the chain
      *  fold (the trust floor the live half may only tighten), `seed.readFace` the hands-less re-park's carried section. */
     resume: Pick<PrepareResume, "seed"> | undefined;
@@ -240,6 +241,8 @@ export interface PrepareInheritedGateResult {
     notifyOwnHookCrash: (err: unknown) => void;
     /** owned — the FROZEN question seat (spec over deps), the content-ask twin of `frozenOnAsk`. */
     frozenOnQuestion: OnQuestion | undefined;
+    /** owned — the parent SPEC seat this run hands its children (`parentSpecSeatOf(spec, frozenOnQuestion)`): the ctx seat and the Workflow mount dep are this one value; both lanes apply it with `applyParentSpecSeat` (one law). */
+    parentSpecSeat: ParentSpecSeat;
     /** borrowed-mutable — the delegation runtime-provenance arming face. Writer: the memory-engine-session phase
      *  (prepareMemoryEngineSession), once per leg when it arms. Read lazily by delegation tools through the ctx. */
     provenanceForChildrenRef: {