@sema-agent/core 7.17.7 → 7.18.0

package/dist/index.js

@@ -4,14 +4,16 @@ export { terminalProjection } from "./core/runner/terminal-projection.js";
 export { SESSION_LOG_DIGEST_SCHEME, sessionEntryDigest, sessionLogDigest, sessionLogDigestsComparable, } from "./engine/session/log-digest.js";
 export { defineTool } from "./core/tools.js";
 export { SKILL_TOOL_NAME } from "./core/runner/synthetic-tools.js";
+export { TOOL_SEARCH_POLICIES, TOOL_SEARCH_DEFAULT_THRESHOLD_PERCENT, TOOL_SEARCH_INVALID_CODE, } from "./core/tool-search-setting.js";
 export { createSkillsFromDirectory, } from "./core/skills-directory.js";
 export { REPORT_FINDINGS_TOOL_NAME } from "./core/runner/synthetic-tools.js";
 export { formatToolError, formatZodValidationError, formatValidationPath, truncateError, errorClassOf } from "./core/tool-errors.js";
 export { createWebFetchTool, webFetchToolSpec, htmlToText, createWebSearchTool, createSearxngSearchBackend, probeSearchBackend, createWebFetchSummarizer, WEBFETCH_SUMMARY_MAX_CONTENT, WEBFETCH_SUMMARY_GUIDELINES, } from "./tools/web.js";
 export { createTodoWriteTool } from "./tools/todo.js";
-export { ARTIFACT_ACTIONS, ARTIFACT_PLANES, ARTIFACT_PUBLISH_CONTEXTS, ARTIFACT_LIST_SCOPES, ARTIFACT_PLANE_CONTENT_ORIGIN, ARTIFACT_ACTION_HOST_METHOD, ARTIFACT_HOST_FAILURE_CODES, ARTIFACT_FAILURE_RESULT_CODE, ARTIFACT_HOST_ERROR_CODE, ARTIFACT_CARD, readArtifactHostCapabilities, } from "./core/artifact-host.js";
+export { ARTIFACT_ACTIONS, ARTIFACT_PLANES, ARTIFACT_COMMIT_CERTAINTIES, ARTIFACT_COMMIT_THROW_OUTCOME, ARTIFACT_PUBLISH_CONTEXTS, ARTIFACT_LIST_SCOPES, ARTIFACT_PLANE_CONTENT_ORIGIN, ARTIFACT_ACTION_HOST_METHOD, ARTIFACT_ACTION_CONCURRENCY_SAFE, ARTIFACT_HOST_FAILURE_CODES, ARTIFACT_FAILURE_RESULT_CODE, ARTIFACT_HOST_ERROR_CODE, ARTIFACT_CARD, readArtifactHostCapabilities, } from "./core/artifact-host.js";
 export { createArtifactTool, artifactAttemptId, normalizePublishedPath, mediaTypeOf } from "./tools/artifact/artifact-tool.js";
 export { localArtifactStub, LocalArtifactStub, EVAL_STUB_URL_PREFIX, LOCAL_STUB_MAX_FILE_BYTES, LOCAL_STUB_MAX_TOTAL_BYTES } from "./tools/artifact/local-stub.js";
+export { ARTIFACT_CONFORMANCE_VECTORS, artifactConformanceVectors, runArtifactConformance, } from "./tools/artifact/conformance.js";
 export { createTaskListTools, createMemoryTaskListStore, assertJsonMetadata } from "./tools/task-list.js";
 export { assembleCodeTools, CODE_ROLE } from "./scenarios/full-body.js";
 export { TOOL_MODEL_GATE_CLASSES, isModelGatedForClass } from "./core/tool-model-gate.js";
@@ -80,7 +82,7 @@ export { bashReversibilityProbe, bashReadBoundaryProbe, BASH_READONLY_DEFAULT_AL
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, } from "./tools/fs/index.js";
-export { deploymentReadFaceClampNotice, resolveReadFace } from "./tools/fs/index.js";
+export { deploymentFaceClampNotice, resolveContainmentFace, } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreExecutionUndeclared, } from "./core/checkpoint-store.js";
@@ -119,7 +121,7 @@ export { parkedToolIdentity } from "./core/tool-roster.js";
 export {} from "./core/fs-write-gate-policy.js";
 export { catalogRuleFaceView } from "./core/permission-rules.js";
 export { DURABLE_HISTORY_NAMES } from "./engine/compaction/utils.js";
-export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, } from "./core/wiring-manifest.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, LSP_LANES, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, } from "./core/park-selfcheck.js";
 export {} from "./core/checkpoint-store.js";
 export {} from "./core/checkpoint-store.js";
@@ -148,7 +150,7 @@ export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./core/runtime-cap
 export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";
 export {} from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
-export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
+export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -171,6 +173,7 @@ export { adoptFilePermissionRuleStore } from "./stores/file/permission-rule-adop
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, } from "./stores/file/adoption/marker.js";
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
+export { HOOK_FAMILIES, HOOKS_INVALID_CODE } from "./core/hook-seats.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
@@ -181,7 +184,7 @@ export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDAT
 export { consolidateScope, advanceCursorAfterInline, } from "./core/consolidate-scope.js";
 export { resolveMemoryConsolidationDriver, } from "./core/runner/memory-consolidation-driver.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { compose, validatePack } from "./prompt-assembly/composer.js";
 export { SEMA_DEFAULT_PACK } from "./prompt-assembly/packs/sema-default.js";
@@ -192,6 +195,7 @@ export { buildTurnPromptSnapshot, loweringRecordFor, LOWERING_VERSION, PREFIX_IN
 export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "./prompt-assembly/artifact-store.js";
 export { stripEngineMetadata } from "./internal/llm.js";
 export { EVENT_PROMPT_REGISTRY, eventDefaultOn } from "./prompt-assembly/event-registry.js";
+export { contextUsageSections } from "./prompt-assembly/section-usage.js";
 export { DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, reasoningEffortLevelsOf, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffExpressible, declaredOffSpelling, resolveReasoningProfile, } from "./brain/reasoning.js";
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, } from "./scenarios/teacher-quickstart.js";

package/dist/internal/harness.d.ts

@@ -11,7 +11,7 @@
  */
 export * from "./harness-types.js";
 export { AgentHarness } from "../engine/harness/agent-harness.js";
-export type { HaltConsumption, SeatCutSource, StopRequestSource } from "../engine/harness/agent-harness.js";
+export type { HaltConsumption, PromptDeliveredCallback, SeatCutSource, StopRequestSource, TrailingToolBatchOptions } from "../engine/harness/agent-harness.js";
 export { CompactionError, ExecutionError, FileError, ok, err } from "../engine/harness/types.js";
 export { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, prepareCompaction, shouldCompact, summaryOutputBudgetTokens, } from "../engine/compaction/compaction.js";
 export { SKILL_RETENTION_PER_SKILL_MAX_CHARS, SKILL_RETENTION_TOTAL_MAX_CHARS, SKILL_RETENTION_TRUNCATION_MARKER, formatFileOperations, formatPersistedOutputRefs, readCompactionActiveTools, readRetainedInvokedSkills, renderInvokedSkillsRetention, } from "../engine/compaction/utils.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -276,6 +276,9 @@ export interface RunWorkflowToolDeps {
      *  read-face containment; folds stricter-wins into every spawned workflow child (see
      *  `buildWorkflowPrimitives`'s injection block for the full rationale). */
     parentReadFace?: () => import("../core/types.js").TaskSpec["readFace"];
+    /** The WRITE seat's twin of the above: the HOST task's RESOLVED write-face containment, folded
+     *  stricter-wins into every spawned workflow child on its own seat. */
+    parentWriteFace?: () => import("../core/types.js").TaskSpec["writeFace"];
     /** Twin of the above for the deny-set additions (union, not replace). */
     parentReadDenyPatterns?: () => import("../core/types.js").TaskSpec["readDenyPatterns"];
     /** #345 ③ — the HOST task's write-hands clamp, the read-face clamp's sibling on this lane (the

package/dist/orchestration/run-workflow-tool.js

@@ -21,6 +21,11 @@ import { builtinWorkflowListings, canonicalWorkflowName, resolveBuiltinWorkflow,
 import { workflowSizeGuidelineSection } from "./workflow-size-guideline.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
 export const RUN_WORKFLOW_TOOL_NAME = "Workflow";
+function parentFaceSeat(ctxSeat, dep) {
+    if (ctxSeat !== "roots")
+        return dep;
+    return () => "roots";
+}
 function stripCodeFences(s) {
     const t = s.trim();
     const m = /^```[A-Za-z]*\r?\n([\s\S]*?)\r?\n?```$/.exec(t);
@@ -503,7 +508,7 @@ export async function createRunWorkflowTool(d) {
             const childParkSeat = ctx.checkpointStoreForChildren ?? d.parentCheckpointStore;
             const parkStore = checkpointStoreOfSeat(childParkSeat);
             const scriptFn = (wfCtx) => {
-                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, childParkSeat, d.parentReadFace, d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false);
+                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, childParkSeat, parentFaceSeat(ctx.readFace, d.parentReadFace), parentFaceSeat(ctx.writeFace, d.parentWriteFace), d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false);
                 return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
             };
             if (ctx.signal?.aborted) {

package/dist/orchestration/workflow-governance.d.ts

@@ -65,6 +65,12 @@ export interface WorkflowAgentSpec {
      * {@link pickWhitelist} enforces it on the untrusted value.
      */
     readFace?: "roots";
+    /**
+     * TIGHTEN-ONLY, the write seat's twin of {@link readFace}: `"roots"` — the write-face containment
+     * judgment — is the ONLY value a script may set. `"open"` is the WIDENING direction, so it is
+     * stripped and announced rather than applied.
+     */
+    writeFace?: "roots";
     /**
      * design/199 件B, TIGHTEN-ONLY: additional read-deny entries. Add-only at every layer a governed
      * SCRIPT can reach: the baseline's entries and the deployment-ACTIVE built-in set are always in
@@ -91,7 +97,7 @@ export interface WorkflowAgentSpec {
  * NON-GOAL of this window: it would break every existing script carrying a harmless extra field, and is held
  * for a BREAKING window.
  */
-export declare const WHITELIST_KEYS: readonly ["objective", "modelName", "thinking", "systemPrompt", "images", "limits", "readFace", "readDenyPatterns"];
+export declare const WHITELIST_KEYS: readonly ["objective", "modelName", "thinking", "systemPrompt", "images", "limits", "readFace", "writeFace", "readDenyPatterns"];
 /**
  * #505 ② — ACCEPTED ALIAS SPELLINGS on the spec: `alias → the {@link WHITELIST_KEYS} member it means`.
  *

package/dist/orchestration/workflow-governance.js

@@ -22,6 +22,7 @@ export const WHITELIST_KEYS = [
     "images",
     "limits",
     "readFace",
+    "writeFace",
     "readDenyPatterns",
 ];
 const WHITELIST_KEY_SET = new Set(WHITELIST_KEYS);
@@ -46,7 +47,7 @@ function emitStrippedKeysNotice(survey, onNotice) {
     const omitted = survey.total - shown.length;
     const list = shown.map((s) => JSON.stringify(s.key)).join(", ") + (omitted > 0 ? `, +${omitted} more` : "");
     const message = `workflow governance: ${survey.total} field(s) of an agent spec were NOT applied to the child (${list}). ` +
-        `A governed workflow script may set only: ${WHITELIST_KEYS.join(", ")} — and \`readFace\` only as "roots" ` +
+        `A governed workflow script may set only: ${WHITELIST_KEYS.join(", ")} — and \`readFace\`/\`writeFace\` only as "roots" ` +
         `(the containment-tightening direction; "open" widens and is never taken from a script). Every other field ` +
         `of the child comes from the deployment baseline.`;
     try {
@@ -277,13 +278,16 @@ function pickWhitelist(scriptSpec) {
         readAxis("maxCostUsd", "spend ceiling");
         safe.limits = limits;
     }
-    if (s.readFace !== undefined) {
-        if (s.readFace === "roots") {
-            safe.readFace = "roots";
+    for (const faceKey of ["readFace", "writeFace"]) {
+        const declared = s[faceKey];
+        if (declared === undefined)
+            continue;
+        if (declared === "roots") {
+            safe[faceKey] = "roots";
         }
         else {
             stripped.total++;
-            stripped.sample.unshift({ key: "readFace", reason: "not_a_tightening_value" });
+            stripped.sample.unshift({ key: faceKey, reason: "not_a_tightening_value" });
             if (stripped.sample.length > MAX_STRIPPED_KEYS_ANNOUNCED)
                 stripped.sample.pop();
         }

package/dist/orchestration/workflow-primitives.d.ts

@@ -48,6 +48,9 @@ parentCheckpointStore?: CheckpointStore | "disabled",
  *  a workflow child is that subtree; the Task/SendMessage delegation lane already carries this,
  *  the workflow lane was the one gap. Lazy (read at spawn time, after prepare has resolved it). */
 parentReadFace?: () => TaskSpec["readFace"], 
+/** The WRITE seat's twin of the above — the host run's RESOLVED write-face containment, folded
+ *  stricter-wins into every spawned child on its own seat (the two seats never read each other). */
+parentWriteFace?: () => TaskSpec["writeFace"], 
 /** Twin of the above for the deny-set additions (built-ins always apply; these are the extra
  *  entries the host's own deployment/task layers stacked on). */
 parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"], 

package/dist/orchestration/workflow-primitives.js

@@ -65,7 +65,7 @@ function formatResourceClampNote(notes) {
     const parts = notes.map((n) => `${n.field}: requested ${n.requested === undefined ? "unset" : n.requested} → applied ${n.applied}`);
     return `workflow governance tightened this agent's resource limits (${parts.join("; ")})`;
 }
-export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentCheckpointStore, parentReadFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
+export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentCheckpointStore, parentReadFace, parentWriteFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
     const agent = (spec, opts) => {
         if (typeof spec === "string")
             spec = { objective: spec };
@@ -82,6 +82,11 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentChe
             if (pf === "roots" && childSpec.readFace !== "roots")
                 childSpec.readFace = "roots";
         }
+        if (parentWriteFace) {
+            const pw = parentWriteFace();
+            if (pw === "roots" && childSpec.writeFace !== "roots")
+                childSpec.writeFace = "roots";
+        }
         if (parentReadDenyPatterns) {
             const pd = parentReadDenyPatterns();
             if (pd !== undefined && pd.length > 0) {

package/dist/orchestration/workflow-types.d.ts

@@ -5,11 +5,14 @@ export type WorkflowRunStatus = "running" | "completed" | "failed";
  *  {@link WorkflowAgentRun.parkedCheckpointToken}); a phase or group never parks (a parked agent ends the run). */
 export type WorkflowItemStatus = "running" | "completed" | "failed" | "parked";
 /** The arm a `workflow.park_truth_unreadable` resume refusal fired on (`detail.reason`): the prior run's record could not
- *  be read (`store_threw`), is absent under this scope (`record_missing`), is not terminal (`record_not_terminal`) or
- *  carries no `parks` array (`parks_unreadable`); a candidate's checkpoint could not be read (`checkpoint_store_threw`);
- *  or the record/journal name parks while this workflow holds no checkpoint seat to prove them (`capability_not_armed`).
+ *  be read (`store_threw`), is absent under this scope (`record_missing`), is not terminal (`record_not_terminal`),
+ *  carries no `parks` array and nothing to derive one from — an empty journal, or an empty derived union
+ *  (`parks_unreadable`) — or says its OWN resume admission never completed
+ *  ({@link WorkflowRun.resumeAdmissionIncomplete} — nothing on it describes a settled park set, so it is not a
+ *  resume base: `admission_incomplete`); a candidate's checkpoint could not be read (`checkpoint_store_threw`); or
+ *  the record/journal name parks while this workflow holds no checkpoint seat to prove them (`capability_not_armed`).
  *  Registered in docs/CLOSED-SETS.md with a mint obligation: every throw site spells its word. */
-export declare const PARK_TRUTH_UNREADABLE_REASONS: readonly ["store_threw", "record_missing", "record_not_terminal", "parks_unreadable", "checkpoint_store_threw", "capability_not_armed"];
+export declare const PARK_TRUTH_UNREADABLE_REASONS: readonly ["store_threw", "record_missing", "record_not_terminal", "parks_unreadable", "admission_incomplete", "checkpoint_store_threw", "capability_not_armed"];
 export type ParkTruthUnreadableReason = (typeof PARK_TRUTH_UNREADABLE_REASONS)[number];
 /** What the checkpoint store said about a parked ordinal's token when a resume carried no acknowledgement for it
  *  (`workflow.park_not_pending`, `detail.status`): the row's own word, or `absent` when the store holds no row. */
@@ -141,6 +144,13 @@ export interface WorkflowAgentRun {
      * truth read binds on the same two facts — `WorkflowRun.parks`); the checkpoint row itself carries no
      * workflow key. It is the resume CAPABILITY (never log it or put it in a URL); a durable row is its home
      * exactly as on the background lane. Absent on every other status.
+     *
+     * CONTRACT (a resume's second key cache). This token lands in the SAME store write as the run record's
+     * {@link WorkflowRun.parks} entry for the same call, so a record carrying one carries both — and one written before
+     * `parks` existed carries only this. A resume of a record WITHOUT that list reads a `parked` row as a park CANDIDATE
+     * of equal standing with the journal's entry, proven the only way any cache is: one `checkpointStore.get(token)`,
+     * whose word is the truth. Deriving adds NO trust; the row is POSITIVE evidence only (an empty `agents` array never
+     * reads as "no park"), and one carrying neither this token nor its {@link sessionId} claims its ordinal with NO key.
      */
     parkedCheckpointToken?: string;
     /**
@@ -388,22 +398,47 @@ export interface WorkflowRun {
     };
     /**
      * Every park this run is RESPONSIBLE for: its own (written at the park) and the ones it inherited from the run
-     * it resumed and did not settle (written at resume admission). KEYS ONLY — the truth of a park is the checkpoint
-     * store (`get(token).status`), never this list: a listed token may be resolved, expired or reaped, and the next
-     * resume reads the store for every entry. Present on every record this engine writes (`[]` when there is none)
-     * EXCEPT a record whose resume admission refused before its inherited set was established (deliberately absent:
-     * not a resume base). It is an ADMISSION INPUT of the next resume, so a store must project it verbatim and keep
-     * it through any size degrade; a reader treats absence as a state (an older engine's record, a stripped
-     * projection), never as `[]`. `token` is the same capability as {@link WorkflowAgentRun.parkedCheckpointToken}
-     * (never log it, never put it in a URL); `originRunId` is the run whose journal holds the `parked` entry for
-     * `callKey` (the re-park material).
+     * it resumed and did not settle (written when resume admission COMPLETES). KEYS ONLY — the truth of a park is the
+     * checkpoint store (`get(token).status`), never this list: a listed token may be resolved, expired or reaped, and
+     * the next resume reads the store for every entry. Present on every record this engine writes (`[]` when there is
+     * none) EXCEPT a record whose resume admission never completed — that record carries
+     * {@link resumeAdmissionIncomplete} instead, which is what says "not a resume base". Absence ALONE is the older
+     * engine's record or a stripped projection, and the next resume derives its candidates from the other two key
+     * caches ({@link WorkflowAgentRun.parkedCheckpointToken} on this record's `parked` agent rows, and the journal's
+     * `parked` entries) — and that union must come back NON-EMPTY: a record with no list beside an empty journal, or
+     * beside an empty union, is refused (`parks_unreadable`), zero positive evidence not being evidence of zero (both
+     * derived caches only ever hold a park the run MADE, so one it inherited and never reached lives in the list alone).
+     * When the list IS present it is the record's word ALONE (the agent rows are not a second opinion, so a size degrade
+     * emptying `agents` costs nothing), and it is an ADMISSION INPUT of the next resume: a store must project it
+     * verbatim and keep it through any size degrade. `token` is the same capability as
+     * {@link WorkflowAgentRun.parkedCheckpointToken} (never log it, never put it in a URL); `originRunId` is the run
+     * whose journal holds the `parked` entry for `callKey` (the re-park material).
+     *
+     * `originUnconfirmed: true` says the entry IS on the record but no journal has confirmed whose it is: the key
+     * must be durable before the append is awaited, so it lands first and the confirmation follows. `originRunId`
+     * then names the run the park was made in — where the material BELONGS, not where it has been seen — and A
+     * CONSUMER MUST NOT READ IT AS CONFIRMED. The member is REMOVED (never written `false`) the moment a journal is
+     * read or written carrying this token's `parked` entry, so
+     * absence is the confirmed state and an entry written before this member reads as confirmed, exactly as it did; the
+     * engine's own material read identity-checks what it finds, so an unconfirmed origin degrades rather than mis-binds.
      */
     parks?: Array<{
         callKey: string;
         sessionId: string;
         token: string;
         originRunId: string;
+        originUnconfirmed?: true;
     }>;
+    /**
+     * Set (`true`) on a resume run's record from its creation and REMOVED the moment its admission completes — so a record
+     * still carrying it is one whose admission never finished (it refused, or the process died inside it). Nothing on such
+     * a record describes a settled park set: `parks` is absent, its own journal holds no prefix, and the run it resumed is
+     * still the valid base. PRESENCE MEANS NOT A RESUME BASE — the engine refuses (`workflow.park_truth_unreadable` /
+     * `admission_incomplete`) and derives no candidate from it — while absence is the ordinary state of every non-resume
+     * run and of every completed admission, so a reader treats presence as the signal. Same projection obligation as
+     * {@link parks}: dropping it turns a refused record back into an admissible one.
+     */
+    resumeAdmissionIncomplete?: true;
     /** RB-243: how many agent results were NOT journaled because they exceeded the per-entry size
      *  cap ({@link MAX_JOURNAL_RESULT_BYTES}) — each skip also logs and journals a tombstone. Additive
      *  observation; absent when 0. */

package/dist/orchestration/workflow-types.js

@@ -1,4 +1,4 @@
-export const PARK_TRUTH_UNREADABLE_REASONS = ["store_threw", "record_missing", "record_not_terminal", "parks_unreadable", "checkpoint_store_threw", "capability_not_armed"];
+export const PARK_TRUTH_UNREADABLE_REASONS = ["store_threw", "record_missing", "record_not_terminal", "parks_unreadable", "admission_incomplete", "checkpoint_store_threw", "capability_not_armed"];
 export const PARK_NOT_PENDING_STATUSES = ["resolved", "expired", "absent"];
 export class WorkflowBudgetExceededError extends Error {
     spent;

package/dist/orchestration/workflow.js

@@ -564,7 +564,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             startedAt: 0,
         })),
         agents: [],
-        ...(opts.resumeFromRunId === undefined ? { parks: [] } : {}),
+        ...(opts.resumeFromRunId === undefined ? { parks: [] } : { resumeAdmissionIncomplete: true }),
         groups: [],
         stats: { tokens: 0, turns: 0, costMicroUsd: 0, nested: { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0 } },
         startedAt: t0,
@@ -999,10 +999,11 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
     };
     const journalAppendParked = async (callKey, paused) => {
         if (!journalStore)
-            return;
+            return false;
         const p = journalStore.append(runId, scope, { callKey, parked: paused });
         journalTail = journalTail.then(() => p).catch(() => undefined);
         await p;
+        return true;
     };
     const parkAgentLeg = async (rec, paused, activityTail, chargeLive) => {
         const s = paused.stats;
@@ -1027,15 +1028,20 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         const ordinal = callKeyOrdinal(rec.callKey);
         const parks = run.parks ?? (run.parks = []);
         const at = parks.findIndex((e) => e.callKey === rec.callKey);
-        const key = { callKey: rec.callKey, sessionId: paused.sessionId, token: paused.terminal.token, originRunId: at === -1 ? runId : parks[at].originRunId };
+        const held = at === -1 ? undefined : parks[at];
+        const key = held !== undefined && held.token === paused.terminal.token && held.originUnconfirmed !== true
+            ? { callKey: rec.callKey, sessionId: paused.sessionId, token: paused.terminal.token, originRunId: held.originRunId }
+            : { callKey: rec.callKey, sessionId: paused.sessionId, token: paused.terminal.token, originRunId: runId, originUnconfirmed: true };
         if (at === -1)
             parks.push(key);
         else
             parks[at] = key;
         void persist("update");
         try {
-            await journalAppendParked(rec.callKey, paused);
-            key.originRunId = runId;
+            if (await journalAppendParked(rec.callKey, paused)) {
+                key.originRunId = runId;
+                delete key.originUnconfirmed;
+            }
         }
         catch (err) {
             emitRunLog(`resume-journal: the PARKED leg at ordinal ${ordinal} ("${rec.label.slice(0, 80)}") could not be recorded in this run's journal (${withoutToken(errText(err), key.token)}) — ` +
@@ -2214,34 +2220,52 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                         throw new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — the prior run's record is not in the run store under this scope, so its parks cannot be proven.`, { reason: "record_missing" });
                     if (parkSeat !== undefined && prior !== null && prior.status === "running")
                         throw new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — the prior run is still recorded as running; a run that could park must have finished before it is resumed (a crashed park-capable run is decided through the deployment's approval channel, not resumed).`, { reason: "record_not_terminal" });
-                    if (prior !== null && !Array.isArray(prior.parks))
-                        throw new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — the prior run's record carries no parks list (written by an older engine, or stripped by the store's projection), so its parks cannot be proven.`, { reason: "parks_unreadable" });
+                    if (prior?.resumeAdmissionIncomplete === true)
+                        throw new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — that record's own resume admission never completed, so it settled no park set and its journal holds no replayable prefix; the run IT resumed is still the base. Resume that one instead.`, { reason: "admission_incomplete" });
+                    const recordParks = Array.isArray(prior?.parks) ? prior.parks : undefined;
+                    const noParksList = prior !== null && recordParks === undefined;
+                    const parksUnreadable = (why) => new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — the prior run's record carries no parks list (written by an older engine, or stripped by the store's projection) and ${why}, so its parks cannot be proven.`, { reason: "parks_unreadable" });
+                    if (noParksList && entries.length === 0)
+                        throw parksUnreadable("its journal yielded no entry to derive one from");
                     const candidates = new Map();
-                    const recordParks = prior !== null && Array.isArray(prior.parks) ? prior.parks : [];
-                    for (const raw of recordParks) {
+                    const keyed = (k) => k.token !== "" && k.sessionId !== "";
+                    const offerCandidate = (ord, key) => {
+                        const recorded = candidates.get(ord);
+                        if (recorded !== undefined && (recorded.callKey !== key.callKey || (keyed(recorded) && keyed(key) && (recorded.token !== key.token || recorded.sessionId !== key.sessionId))))
+                            throw parkBindingBroken(ord, "the prior run's key caches name different tokens, sessions or calls for it");
+                        if (recorded === undefined || (!keyed(recorded) && keyed(key)))
+                            candidates.set(ord, key);
+                    };
+                    for (const raw of recordParks ?? []) {
                         const e = raw;
                         if (e === null || typeof e !== "object" || typeof e.callKey !== "string" || typeof e.sessionId !== "string" || typeof e.token !== "string" || typeof e.originRunId !== "string" || !/^\d+:/.test(e.callKey)) {
                             throw parkBindingBroken(-1, "a recorded park entry is malformed or its call key has no ordinal");
                         }
-                        candidates.set(callKeyOrdinal(e.callKey), { callKey: e.callKey, sessionId: e.sessionId, token: e.token, originRunId: e.originRunId });
+                        offerCandidate(callKeyOrdinal(e.callKey), { callKey: e.callKey, sessionId: e.sessionId, token: e.token, originRunId: e.originRunId, ...(e.originUnconfirmed === true ? { originUnconfirmed: true } : {}) });
                     }
                     for (const [ord, e] of replayByOrdinal.entries()) {
                         if (e?.parked === undefined)
                             continue;
-                        const fromJournal = { callKey: e.callKey, sessionId: e.parked.sessionId, token: e.parked.terminal.token, originRunId: opts.resumeFromRunId };
-                        const recorded = candidates.get(ord);
-                        if (recorded === undefined)
-                            candidates.set(ord, fromJournal);
-                        else if (recorded.token !== fromJournal.token || recorded.sessionId !== fromJournal.sessionId || recorded.callKey !== fromJournal.callKey)
-                            throw parkBindingBroken(ord, "the run record and the journal name different tokens, sessions or calls for it");
+                        offerCandidate(ord, { callKey: e.callKey, sessionId: e.parked.sessionId, token: e.parked.terminal.token, originRunId: opts.resumeFromRunId });
+                        const settled = candidates.get(ord);
+                        settled.originRunId = opts.resumeFromRunId;
+                        delete settled.originUnconfirmed;
                     }
+                    for (const rec of recordParks === undefined && Array.isArray(prior?.agents) ? prior.agents : []) {
+                        if (rec === null || typeof rec !== "object" || rec.status !== "parked")
+                            continue;
+                        if (typeof rec.callKey !== "string" || !/^\d+:/.test(rec.callKey))
+                            throw parkBindingBroken(-1, "a parked agent row is malformed or its call key has no ordinal");
+                        offerCandidate(callKeyOrdinal(rec.callKey), { callKey: rec.callKey, sessionId: rec.sessionId ?? "", token: rec.parkedCheckpointToken ?? "", originRunId: opts.resumeFromRunId, originUnconfirmed: true });
+                    }
+                    if (noParksList && candidates.size === 0)
+                        throw parksUnreadable("neither its journal nor its own parked agent rows names a park to derive (a park it inherited and never reached is recorded in that list alone)");
                     const inherited = [];
                     for (const [ord, key] of [...candidates.entries()].sort((a, b) => a[0] - b[0])) {
                         if (replayByOrdinal[ord]?.result !== undefined)
                             continue;
                         inherited.push(key);
                     }
-                    run.parks = inherited;
                     if (parkSeat === undefined) {
                         if (inherited.length > 0) {
                             throw new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — it is responsible for ${inherited.length} recorded park(s) and this workflow holds no checkpoint store to prove them against (RunWorkflowOptions.checkpointStore); without the seat a parked call would run live beside its pinned child.`, { reason: "capability_not_armed" });
@@ -2261,6 +2285,10 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                             parkedByOrdinal[ord] = truth;
                         }
                     }
+                    if (!finalized) {
+                        run.parks = inherited;
+                        delete run.resumeAdmissionIncomplete;
+                    }
                     run.resume = {
                         fromRunId: clampRunIdText(opts.resumeFromRunId),
                         journalEntries: entries.length,

package/dist/prompt-assembly/epoch.js

@@ -23,6 +23,7 @@ const PROBE_FACTS_OFF = {
     promptProfile: "simple",
     fableMitigations: false,
     readFaceOpen: false,
+    writeFaceOpen: false,
     reminderMark: undefined,
 };
 const PROBE_FACTS_ON = {
@@ -41,6 +42,7 @@ const PROBE_FACTS_ON = {
     promptProfile: "classic",
     fableMitigations: true,
     readFaceOpen: true,
+    writeFaceOpen: true,
     reminderMark: "PROBE-FIXED-MARK-AXIS0",
 };
 const PROBE_VECTORS = [

package/dist/prompt-assembly/packs/sema-default.js

@@ -1,4 +1,4 @@
-import { CYBER_RISK, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, WORKTREE_NOTICE, SUBAGENT_CONSENT_NOTICE, SUBAGENT_DELIVERY_NOTES, harnessHeadLines, } from "../../prompts/default.js";
+import { CYBER_RISK, executionEnvironmentBlockFor, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, WORKTREE_NOTICE, SUBAGENT_CONSENT_NOTICE, SUBAGENT_DELIVERY_NOTES, harnessHeadLines, } from "../../prompts/default.js";
 import { GOAL_COMPLETION_GUIDANCE, ORCHESTRATION_AWARENESS, ORCHESTRATION_GUIDANCE, ORCHESTRATION_GUIDANCE_DEFERRED, SUPERVISOR_PROMPT, } from "../../prompts/supervisor.js";
 import { TEAMMATE_COMMUNICATION_ADDENDUM } from "../../prompts/coordinator.js";
 import { SIMPLE_ACTION_CAUTION, SIMPLE_ACT_DONT_REDERIVE, SIMPLE_AUTONOMY_FABLE, SIMPLE_COMMUNICATING_FABLE, SIMPLE_CORRECTIONS_FABLE, SIMPLE_DELIVERING_WORK_FABLE, SIMPLE_COMMUNICATING_LEAN, SIMPLE_CONTEXT_MANAGEMENT, SIMPLE_PRONOUNS, SIMPLE_TOOL_PARAM_JSON, SEMA_VERIFY_FRESH, SEMA_EVIDENCE_AUDIT, } from "../../prompts/simple-sections.js";
@@ -41,7 +41,7 @@ export const SEMA_DEFAULT_PACK = {
             rank: 240,
             ...CORE,
             admit: (i) => i.facts.policyEnabled || i.facts.isolationEnabled,
-            content: (i) => (i.facts.readFaceOpen === true ? EXECUTION_ENVIRONMENT_OPEN_READS : EXECUTION_ENVIRONMENT),
+            content: (i) => executionEnvironmentBlockFor({ readOpen: i.facts.readFaceOpen === true, writeOpen: i.facts.writeFaceOpen === true }),
             blockId: "harness.context",
         },
         { id: "core/simple.communicating", slot: "harness", rank: 250, ...CORE, admit: (i) => i.facts.promptProfile !== "classic", content: (i) => (i.facts.fableMitigations === true ? SIMPLE_COMMUNICATING_FABLE : SIMPLE_COMMUNICATING_LEAN), blockId: "harness.context" },

package/dist/prompt-assembly/section-usage.d.ts

@@ -0,0 +1,26 @@
+/** One section's share of the leg's system prompt, as the `context_usage` frame reports it. */
+export interface ContextUsageSection {
+    /** The pack section id — the same wordlist `prompt.assembled`'s `sections[].id` uses. */
+    id: string;
+    /** The section's ESTIMATED token weight (see {@link contextUsageSections} for what that promises). */
+    tokens: number;
+    /** The section's semantic slot (`identity`, `security`, …), so a view can group without knowing every
+     *  id. Absent only if the manifest entry carried no slot. */
+    kind?: string;
+}
+/**
+ * Project the manifest's compiled sections onto the frame's occupancy view.
+ * @contract context_usage.sections — `sections[]` is the leg's PREPARE-TIME system-prompt composition,
+ * one entry per rendered pack section, `tokens` ESTIMATED from rendered characters at the engine's
+ * chars→tokens coefficient. A different measurement from `usedTokens`, the engine's trigger input over the
+ * whole conversation. The two coordinates MUST NOT be mixed: do not subtract `Σ sections[].tokens` from
+ * `usedTokens`, do not compare a section to `compactAtTokens`, and do not read a change across frames as
+ * growth — the value is frozen at prepare and re-reported verbatim at every boundary of the leg. It
+ * answers "what is my system prompt made of, and which part is big". Absent when the leg assembled no
+ * section IR (a provider that replaced the prompt wholesale ships one opaque block).
+ */
+export declare function contextUsageSections(sections: ReadonlyArray<{
+    id: string;
+    slot?: string;
+    chars: number;
+}> | undefined): ContextUsageSection[] | undefined;

package/dist/prompt-assembly/section-usage.js

@@ -0,0 +1,10 @@
+import { DEFAULT_CHARS_PER_TOKEN } from "../internal/harness.js";
+export function contextUsageSections(sections) {
+    if (sections === undefined || sections.length === 0)
+        return undefined;
+    return sections.map((s) => ({
+        id: s.id,
+        tokens: Math.ceil(s.chars / DEFAULT_CHARS_PER_TOKEN),
+        ...(s.slot !== undefined ? { kind: s.slot } : {}),
+    }));
+}

package/dist/prompt-assembly/types.d.ts

@@ -45,6 +45,10 @@ export interface PromptRuntimeFacts {
      *  open-reads first bullet). OPTIONAL: absence reads as false (roots wording, byte-identical),
      *  so existing fact constructors keep compiling. */
     readFaceOpen?: boolean;
+    /** The resolved WRITE face is OPEN (renders the execution-environment block's open-writes first
+     *  bullet column). OPTIONAL on the same law as {@link readFaceOpen}: absence reads as false (roots
+     *  wording, byte-identical), so existing fact constructors keep compiling. */
+    writeFaceOpen?: boolean;
     /** design/319 (A ticket) — the session's reminder provenance mark: threads into the
      *  `core/harness.head` section (single-sourced from `harnessHeadLines`), which extends the
      *  reminder sentence into the strict mark declaration when present. OPTIONAL (public export —
@@ -190,12 +194,10 @@ export interface ComposedPrompt {
  * routes sections into groups WITHOUT reordering them (emission stays rank order — slot never
  * drives physical order).
  *
- * Accuracy note (hardening 2026-07-31): the layout is a LOWERING argument, not a pack field —
- * `PromptPack` declares none, and every production `layoutSystemBlocks` call site passes no second
- * argument, i.e. always `SINGLE_BLOCK_LAYOUT` (one group, one cache_control breakpoint at the end).
- * Multi-block layouts (CC209's billing/persona/body) are therefore a lowering CAPABILITY exercised
- * only by fixtures today; no bundled pack can select one. The earlier wording ("the pack's layout")
- * described an association that does not exist in the type system.
+ * The layout is a LOWERING argument, not a pack field — `PromptPack` declares none, and every production
+ * `layoutSystemBlocks` call site passes no second argument, i.e. always `SINGLE_BLOCK_LAYOUT` (one group,
+ * one cache_control breakpoint at the end). Multi-block layouts are a lowering CAPABILITY exercised only
+ * by fixtures today; no bundled pack can select one.
  */
 export interface CompiledSystemBlock {
     groupId: string;

package/dist/prompts/default.d.ts

@@ -167,6 +167,10 @@ export declare const URL_SAFETY = "IMPORTANT: You must NEVER generate or guess U
  * per-message aggregate tool-result budget, which sheds the largest results at any size.
  */
 export declare const SUMMARIZE_TOOL_RESULTS = "When working with tool results, write down any important information you might need later in your own response, as the original tool result may be cleared or summarized from the context later.";
+export declare function executionEnvironmentBlockFor(faces?: {
+    readOpen?: boolean;
+    writeOpen?: boolean;
+}): string;
 export declare const EXECUTION_ENVIRONMENT: string;
 /** design/199 F8① — the open-read-face variant (first bullet tells the truth about reads). */
 export declare const EXECUTION_ENVIRONMENT_OPEN_READS: string;
@@ -319,6 +323,9 @@ export interface EnvironmentFacts {
      *  structured key). Rendered only when "open" (the roots posture is the historical default and
      *  renders nothing new — byte-compat). */
     readFace?: "open" | "roots";
+    /** The RESOLVED write-face containment state ("open" | "roots"; additive structured key). Rendered
+     *  only when "open" (the roots posture is the historical default and renders nothing new). */
+    writeFace?: "open" | "roots";
     /** OS name (uname -s) — remote = the container's, not the host's. */
     platform?: string;
     /** OS version (uname -r). */
@@ -496,6 +503,12 @@ export interface StablePromptContext {
      * byte-identical.
      */
     readFaceOpen?: boolean;
+    /**
+     * The resolved WRITE face is OPEN: the `# Execution environment` block's first bullet renders its
+     * open-writes column so the prompt never claims a write fence that is not there. Absent/false ⇒
+     * the historical (roots) wording, byte-identical.
+     */
+    writeFaceOpen?: boolean;
     /**
      * design/319 (A ticket) — the session's reminder provenance mark
      * ({@link import("../core/reminder-mint.js").mintReminderMark}): when present, the `# Harness`