@sema-agent/core 7.17.7 → 7.18.0

package/dist/tools/fs/index.d.ts

@@ -14,7 +14,8 @@ export * from "./read-deny.js";
 import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
 export { BASH_CLASSIFY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
 import { type ReadDenyEntry } from "./read-deny.js";
-export * from "./read-face.js";
+import { type ContainmentFace } from "./containment-face.js";
+export * from "./containment-face.js";
 import { type CwdRef, type ReadImageDownsamplerOption } from "./fs-shared.js";
 /** Options for {@link createHandsToolkit}. */
 export interface HandsToolkitOptions {
@@ -108,6 +109,14 @@ export interface HandsToolkitOptions {
      *  by the Runner for every task and so cannot double as an opt-in signal. Default undefined ⇒ `false`
      *  downstream. */
     autoBackgroundOnTimeout?: boolean;
+    /** The run's tool-progress sink — see createBashTool's taskOpts field of the same name. Runner-wired
+     *  (a late-bound cell behind the closure), absent for a standalone toolkit build ⇒ the shell's execute
+     *  leg opens no streaming callbacks at all and its `env.exec` options are byte-identical to before. */
+    onToolProgress?: (body: import("../../core/runner/contracts.js").ToolProgressBody) => void;
+    /** Is a PERSON's input waiting for this run's next turn boundary — see createBashTool's taskOpts field
+     *  of the same name. Runner-wired (reads the harness's own accepted-but-unserved account); absent ⇒ the
+     *  shell never auto-backgrounds a running command, exactly as before. */
+    queuedHumanInput?: () => boolean;
     /** Read-image downsampler seam ({@link ReadImageDownsamplerOption}). Default undefined = auto-detect
      *  the optional sharp dependency once per process; `false` disables it (deterministic no-sharp behavior). */
     readImageDownsampler?: ReadImageDownsamplerOption;
@@ -164,16 +173,26 @@ export interface HandsToolkitOptions {
      *  time (never silently ignored). Deployment seat ONLY, same clamp argument as the tiers key. */
     readDenyBuiltinExclude?: readonly string[];
     /** The READ-face containment state for the structured read faces
-     *  ({@link import("./read-face.js").ReadFace}; resolved through the SAME
-     *  {@link import("./read-face.js").resolveReadFace} order prepare-task uses). Absent ⇒ the
+     *  ({@link import("./containment-face.js").ContainmentFace}; resolved through the SAME
+     *  {@link import("./containment-face.js").resolveContainmentFace} order prepare-task uses). Absent ⇒ the
      *  resolution order's default = "roots" (the engine never opens implicitly). "open" skips ONLY the
      *  roots containment judgment — the deny set, the UNC out-of-set refusal and the special-file type
      *  gates run in both faces. Beside `readOnly: true` the mount wins: this seat is deps-shaped (a
      *  deployment default, not a per-call assertion), so its "open" CLAMPS to "roots" and the clamp is
      *  ANNOUNCED (`config.read_face_deployment_clamped`, through `onNotice` / `console.warn`) — the loud
      *  refusal belongs to the TASK seat (`TaskSpec.readFace`), the one genuine per-call contradiction.
-     *  Never affects the write faces. */
-    readFace?: "open" | "roots";
+     *  Never affects the write faces — {@link writeFace} is a separate seat with its own default. */
+    readFace?: ContainmentFace;
+    /** The WRITE-face containment state for the structured write faces (Edit / Write / NotebookEdit)
+     *  ({@link import("./containment-face.js").ContainmentFace}; resolved through the SAME
+     *  {@link import("./containment-face.js").resolveContainmentFace} order — one body, one default,
+     *  per seat). Absent ⇒ "roots" (today's behavior, byte-identical). "open" skips ONLY the roots
+     *  containment judgment on the write band — the write-side sensitive-path policy, the blocked-device
+     *  gate, the UNC out-of-set refusal and the read-before-edit requirement all still run, and the full
+     *  `bash` face is unaffected either way (it was never fenced). Beside `readOnly: true` the mount
+     *  wins the same way the read seat's does (that mount carries no write faces at all), announced as
+     *  `config.write_face_deployment_clamped`. Never affects the read faces. */
+    writeFace?: ContainmentFace;
     /** The session's reminder provenance mark: the band's engine-minted
      *  `<system-reminder>` open tags (the Read cyber/dedup/offset/empty reminders and the gh
      *  rate-limit hint) carry it as `mark="…"`, matching the system-prompt declaration the Runner

package/dist/tools/fs/index.js

@@ -14,8 +14,8 @@ export * from "./read-deny.js";
 import { BASH_READONLY_DEFAULT_ALLOW, } from "./bash-readonly-classifier.js";
 export { BASH_CLASSIFY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
 import { compileReadDeny } from "./read-deny.js";
-import { deploymentReadFaceClampNotice, resolveReadFace } from "./read-face.js";
-export * from "./read-face.js";
+import { deploymentFaceClampNotice, resolveContainmentFace } from "./containment-face.js";
+export * from "./containment-face.js";
 import {} from "./fs-shared.js";
 import { createReadFileTool } from "./fs-read.js";
 import { createEditFileTool, createWriteFileTool, createNotebookEditTool } from "./fs-write.js";
@@ -42,18 +42,27 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
         ...(opts.readDenyBuiltinTiers !== undefined ? { tiers: opts.readDenyBuiltinTiers } : {}),
         ...(opts.readDenyBuiltinExclude !== undefined ? { exclude: opts.readDenyBuiltinExclude } : {}),
     });
-    const readFace = resolveReadFace({
-        depsReadFace: opts.readFace,
+    const readFace = resolveContainmentFace({
+        kind: "read",
+        depsFace: opts.readFace,
         readOnlyMount: readOnly,
         orgGoverned: false,
         fullShellReachable: includeShell && !readOnly,
-        onDeploymentClamp: () => deliverEngineNotice(opts.onNotice, deploymentReadFaceClampNotice()),
+        onDeploymentClamp: () => deliverEngineNotice(opts.onNotice, deploymentFaceClampNotice("read")),
+    });
+    const writeFace = resolveContainmentFace({
+        kind: "write",
+        depsFace: opts.writeFace,
+        readOnlyMount: readOnly,
+        orgGoverned: false,
+        fullShellReachable: includeShell && !readOnly,
+        onDeploymentClamp: () => deliverEngineNotice(opts.onNotice, deploymentFaceClampNotice("write")),
     });
     const tools = [
         createReadFileTool(env, readFileState, rootCanonical, readOnly ? undefined : cwdRef, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, opts.readCyberReminder, readDeny, readFace, opts.reminderMark, opts.reminderDisclosureCounts),
     ];
     if (handsWriteHalfMounts({ readOnly })) {
-        tools.push(createEditFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited), createWriteFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited), createNotebookEditTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited));
+        tools.push(createEditFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFace), createWriteFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFace), createNotebookEditTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFace));
     }
     tools.push(createGrepTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef), createGlobTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef), createRepoMapTool(env, rootCanonical, readFaceRoots, readDeny, readFace));
     if (includeShell) {
@@ -63,6 +72,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
                 ...(opts.bashMaxTimeoutMs !== undefined ? { bashMaxTimeoutMs: opts.bashMaxTimeoutMs } : {}),
                 ...(opts.onNotice !== undefined ? { onNotice: opts.onNotice } : {}),
                 ...(readFaceRoots !== undefined ? { additionalRoots: readFaceRoots } : {}),
+                ...(opts.onToolProgress !== undefined ? { onToolProgress: opts.onToolProgress } : {}),
             })
             : createBashTool(env, rootCanonical, commitCoAuthor, cwdRef, {
                 taskRegistry: opts.taskRegistry,
@@ -72,6 +82,8 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
                 onTaskNotification: opts.taskNotification,
                 detachHub: opts.detachHub,
                 ...(opts.autoBackgroundOnTimeout !== undefined ? { autoBackgroundOnTimeout: opts.autoBackgroundOnTimeout } : {}),
+                ...(opts.onToolProgress !== undefined ? { onToolProgress: opts.onToolProgress } : {}),
+                ...(opts.queuedHumanInput !== undefined ? { queuedHumanInput: opts.queuedHumanInput } : {}),
                 ...(opts.oneShot !== undefined ? { oneShot: opts.oneShot } : {}),
                 ...(additionalRoots !== undefined ? { additionalRoots } : {}),
                 ...(opts.shellReadBoundary !== undefined ? { readBoundary: opts.shellReadBoundary } : {}),

package/dist/tools/fs/repo-map.d.ts

@@ -1,7 +1,7 @@
 import type { AgentTool } from "../../internal/harness-types.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ReadDenyMatcher } from "./read-deny.js";
-import type { ReadFace } from "./read-face.js";
+import type { ContainmentFace } from "./containment-face.js";
 /** Extract top-level symbol names (deduped, in first-seen order) from source text. A lightweight
  *  comment/docstring state machine skips column-0 declaration-like lines that are really inside a
  *  `/* … *​/` block comment or a Python `"""`/`'''` docstring — otherwise e.g. a module docstring
@@ -13,4 +13,4 @@ import type { ReadFace } from "./read-face.js";
  *  (src/core/auto-promote.ts) consumes it in ESCALATE-ONLY mode — a clean scan contributes nothing;
  *  it can only ever raise an escalation, never clear one. */
 export declare function extractSymbols(text: string): string[];
-export declare function createRepoMapTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace): AgentTool;
+export declare function createRepoMapTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ContainmentFace): AgentTool;

package/dist/tools/fs/safety.d.ts

@@ -392,7 +392,7 @@ export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, pat
         pattern: string;
         matchedView?: string;
     } | null;
-}, readFace?: "open" | "roots"): Promise<{
+}, containmentFace?: "open" | "roots"): Promise<{
     ok: true;
     key: string;
 } | {
@@ -458,7 +458,7 @@ export declare function withinAnyRoot(rootsCanonical: readonly string[], p: stri
  *
  * The card names the SANCTIONED way out and nothing else: widening the declaration
  * (`additionalDirectories` / read-only `additionalReadDirectories`), or the deployment-level
- * `readFace: "open"` for reads.
+ * `readFace: "open"` (reads) / `writeFace: "open"` (writes).
  *
  * It deliberately does NOT name the shell as unconfined by this fence, even though that is a true
  * statement rather than a recommendation. A live retest settled the question: a refused agent read
@@ -469,7 +469,7 @@ export declare function withinAnyRoot(rootsCanonical: readonly string[], p: stri
  * shell is deliberately unconfined by this fence, and every shell call still passes the deployment's
  * approval policy); it is simply not handed to the model inside a denial.
  */
-export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access; a deployment that wants reads open everywhere can declare readFace: \"open\" instead of listing directories.)";
+export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access; a deployment that wants reads or writes open everywhere can declare readFace / writeFace: \"open\" instead of listing directories.)";
 /** inv 1 (read-before-edit): a file must have been read this task before it can be edited/overwritten.
  *  Message is CC 2.1.198 live-verbatim (all-tools-live-probe 2026-07-08 §2.1/§3.1/§5.1 — one message for
  *  Edit/Write/NotebookEdit: "before writing to it", not the old sema "before editing").

package/dist/tools/fs/safety.js

@@ -443,7 +443,7 @@ function within(rootCanonical, p) {
         return true;
     return pN.identity.startsWith(rootN.identity.endsWith(SEP) ? rootN.identity : rootN.identity + SEP);
 }
-export async function resolveKey(env, rootCanonical, path, signal, baseCwd, additionalRootsCanonical, exactFileReadExemption, readDeny, readFace) {
+export async function resolveKey(env, rootCanonical, path, signal, baseCwd, additionalRootsCanonical, exactFileReadExemption, readDeny, containmentFace) {
     const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootCanonical }), baseCwd);
     if (!canon.ok)
         return { ok: false, violation: { code: "invalid", message: canon.message } };
@@ -471,13 +471,13 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
             };
         }
     }
-    if (readFace === "open") {
+    if (containmentFace === "open") {
         if (isUncPath(key) && isWinFormPath(key) && !within(rootCanonical, key) && !additionalRootsCanonical?.some((r) => within(r, key))) {
             return {
                 ok: false,
                 violation: {
                     code: "invalid",
-                    message: `path "${path}" names a network (UNC) location outside the declared roots; refused even under the open read face — a read against an undeclared share can hang on the SMB mount timeout and offers credentials to the remote host.`,
+                    message: `path "${path}" names a network (UNC) location outside the declared roots; refused even under an open containment face — an access against an undeclared share can hang on the SMB mount timeout and offers credentials to the remote host.`,
                 },
             };
         }
@@ -604,7 +604,7 @@ export function violationDetails(v) {
 export function withinAnyRoot(rootsCanonical, p) {
     return rootsCanonical.some((r) => within(r, p));
 }
-export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access; a deployment that wants reads open everywhere can declare readFace: \"open\" instead of listing directories.)";
+export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access; a deployment that wants reads or writes open everywhere can declare readFace / writeFace: \"open\" instead of listing directories.)";
 export function requireRead(state, key) {
     const entry = state.get(key);
     if (entry === undefined || entry.isPartialView) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.17.7",
+  "version": "7.18.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2335,
+  "count": 2373,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -23,8 +23,12 @@
     "APPROVAL_CARD_REQUIRED_KEYS": "variable",
     "APPROVER_ATTRIBUTION_MAX_CHARS": "variable",
     "ARTIFACT_ACTIONS": "variable",
+    "ARTIFACT_ACTION_CONCURRENCY_SAFE": "variable",
     "ARTIFACT_ACTION_HOST_METHOD": "variable",
     "ARTIFACT_CARD": "variable",
+    "ARTIFACT_COMMIT_CERTAINTIES": "variable",
+    "ARTIFACT_COMMIT_THROW_OUTCOME": "variable",
+    "ARTIFACT_CONFORMANCE_VECTORS": "variable",
     "ARTIFACT_FAILURE_RESULT_CODE": "variable",
     "ARTIFACT_HOST_ERROR_CODE": "variable",
     "ARTIFACT_HOST_FAILURE_CODES": "variable",
@@ -43,11 +47,13 @@
     "AUTO_MODE_ARMING_RECIPE_VERSION": "variable",
     "AUTO_MODE_ARM_REASONS": "variable",
     "AUTO_MODE_BASE_PROMPT": "variable",
+    "AUTO_MODE_CLASSIFIER_FALLBACKS": "variable",
     "AUTO_MODE_CLASSIFIER_MAX_TOKENS": "variable",
     "AUTO_MODE_DEFAULTS_SENTINEL": "variable",
     "AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS": "variable",
     "AUTO_MODE_DENIAL_LIMIT_DEFAULTS": "variable",
     "AUTO_MODE_DENY_SOURCES": "variable",
+    "AUTO_MODE_FALLBACK_CAUSES": "variable",
     "AUTO_MODE_PERMISSIONS_EXTERNAL": "variable",
     "AUTO_MODE_UNAVAILABLE_CAUSES": "variable",
     "AcquiredSession": "interface",
@@ -78,7 +84,14 @@
     "AppendLog": "class",
     "ArtifactAction": "type",
     "ArtifactCallContext": "interface",
+    "ArtifactCommitCertainty": "type",
     "ArtifactConflictSnapshot": "interface",
+    "ArtifactConformanceHooks": "interface",
+    "ArtifactConformanceOptions": "interface",
+    "ArtifactConformanceReport": "interface",
+    "ArtifactConformanceResult": "interface",
+    "ArtifactConformanceStatus": "type",
+    "ArtifactConformanceVector": "interface",
     "ArtifactFileContent": "interface",
     "ArtifactFileOutcome": "type",
     "ArtifactFilesOutcome": "type",
@@ -125,6 +138,8 @@
     "AutoModeArmingRecipe": "interface",
     "AutoModeClassified": "interface",
     "AutoModeClassifierCompletion": "type",
+    "AutoModeClassifierFallback": "type",
+    "AutoModeClassifierRound": "interface",
     "AutoModeClassifyFn": "type",
     "AutoModeClassifyInput": "interface",
     "AutoModeDecider": "interface",
@@ -132,6 +147,8 @@
     "AutoModeDenialLimitOptions": "interface",
     "AutoModeDenialTracker": "interface",
     "AutoModeDenySource": "type",
+    "AutoModeFallbackCause": "type",
+    "AutoModeLadderRung": "interface",
     "AutoModeRebuildOptions": "interface",
     "AutoModeRebuildRefusal": "type",
     "AutoModeRebuildResult": "type",
@@ -305,8 +322,13 @@
     "ConsolidationRunStopReason": "type",
     "ConsolidationStats": "interface",
     "ConstraintChainEntry": "type",
+    "ContainmentFace": "type",
+    "ContainmentFaceInputs": "interface",
+    "ContainmentFaceKind": "type",
+    "ContainmentFaceLayer": "type",
     "Context": "interface",
     "ContextEditOptions": "interface",
+    "ContextUsageSection": "interface",
     "ContractAssertionRunner": "type",
     "ControlPlaneCorruptError": "class",
     "ControlPlaneRebuildReceipt": "interface",
@@ -509,11 +531,14 @@
     "GraderEnv": "interface",
     "HANDS_BAND_TAGS": "variable",
     "HARNESS_SECTION_ANCHOR": "variable",
+    "HOOKS_INVALID_CODE": "variable",
+    "HOOK_FAMILIES": "variable",
     "HandsBandOptions": "interface",
     "HarvestRejection": "interface",
     "HarvestRejectionCode": "type",
     "HarvestReport": "interface",
     "HookEnvCapabilities": "interface",
+    "HookFamily": "type",
     "HookInvocationIdentity": "interface",
     "HookToolContext": "interface",
     "HookToolFailure": "interface",
@@ -568,6 +593,7 @@
     "LOCKED_KEY_REGISTRY": "variable",
     "LOWERING_VERSION": "variable",
     "LSP_FAILURE_BRAND": "variable",
+    "LSP_LANES": "variable",
     "LSP_OPERATIONS": "variable",
     "LayeredRecallOptions": "interface",
     "LayeredRecallResult": "type",
@@ -588,6 +614,7 @@
     "LspDiagnostic": "interface",
     "LspDiagnosticsRegistry": "class",
     "LspFileDiagnostics": "interface",
+    "LspLane": "type",
     "LspLocation": "interface",
     "LspNoneReason": "type",
     "LspOperation": "type",
@@ -1051,8 +1078,6 @@
     "ReadDenyBuiltinTier": "type",
     "ReadDenyEntry": "type",
     "ReadDenyMatcher": "interface",
-    "ReadFace": "type",
-    "ReadFaceInputs": "interface",
     "ReadOnlyCommandRow": "interface",
     "ReadOnlyFlagArity": "type",
     "ReadOnlyShellVerdict": "type",
@@ -1364,6 +1389,9 @@
     "TOOL_PATH_ACCESSES": "variable",
     "TOOL_PATH_BASES": "variable",
     "TOOL_RESULT_REF_CONFLICT_CODE": "variable",
+    "TOOL_SEARCH_DEFAULT_THRESHOLD_PERCENT": "variable",
+    "TOOL_SEARCH_INVALID_CODE": "variable",
+    "TOOL_SEARCH_POLICIES": "variable",
     "TOOL_WIRE_NAME_MAX_CHARS": "variable",
     "TSchema": "interface",
     "TaskAccess": "interface",
@@ -1414,6 +1442,7 @@
     "ToolContentOrigin": "type",
     "ToolContractDescriptor": "interface",
     "ToolDisclosureManifest": "interface",
+    "ToolDisclosureSnapshot": "interface",
     "ToolEffect": "type",
     "ToolExecuteContext": "interface",
     "ToolFaceDeclaration": "interface",
@@ -1449,6 +1478,8 @@
     "ToolRosterPathTarget": "interface",
     "ToolRosterRenderHints": "variable",
     "ToolRuleFace": "interface",
+    "ToolSearchPolicy": "type",
+    "ToolSearchSetting": "type",
     "ToolSpec": "interface",
     "TraceEvent": "type",
     "TracerHook": "type",
@@ -1512,6 +1543,7 @@
     "WiringFacts": "interface",
     "WiringLegKind": "type",
     "WiringManifest": "interface",
+    "WiringManifestHookEntry": "interface",
     "WiringManifestMcpEntry": "interface",
     "WorkerErrorClass": "type",
     "WorkflowAgentBlockedError": "class",
@@ -1591,6 +1623,7 @@
     "applyTombstones": "function",
     "archiveDistillerPlan": "function",
     "artifactAttemptId": "function",
+    "artifactConformanceVectors": "function",
     "artifactDeclarations": "function",
     "askUnresolvableNotice": "function",
     "assembleCodeTools": "function",
@@ -1703,6 +1736,7 @@
     "constitutionBlocks": "function",
     "constraintChainDigest": "function",
     "constraintChainEntryOf": "function",
+    "contextUsageSections": "function",
     "contractGroupingDiff": "function",
     "cosineDistance": "function",
     "countElicitOptIns": "function",
@@ -1787,7 +1821,7 @@
     "delimitUntrusted": "function",
     "denialLimitFallbackMessage": "function",
     "denialLimitSentence": "function",
-    "deploymentReadFaceClampNotice": "function",
+    "deploymentFaceClampNotice": "function",
     "deriveAgentDisplayStatus": "function",
     "deriveAskEffective": "function",
     "deriveControlPlaneDir": "function",
@@ -1841,6 +1875,7 @@
     "err": "function",
     "errorClassOf": "function",
     "eventDefaultOn": "function",
+    "executionEnvironmentBlockFor": "function",
     "executionRecordDisposition": "function",
     "executionVerdict": "function",
     "expandLexicalTerms": "function",
@@ -1905,7 +1940,9 @@
     "isAbsoluteForFamily": "function",
     "isAliasModelId": "function",
     "isAskOrigin": "function",
+    "isAutoModeClassifierFallback": "function",
     "isAutoModeDenySource": "function",
+    "isAutoModeFallbackCause": "function",
     "isAutoModeUnavailableCause": "function",
     "isCanonicalPeerAddress": "function",
     "isClassifierDenyCause": "function",
@@ -2161,6 +2198,7 @@
     "resolveBuiltinWorkflow": "function",
     "resolveCheckpointStore": "function",
     "resolveComplianceDenies": "function",
+    "resolveContainmentFace": "function",
     "resolveCrossSessionDialogExpiry": "function",
     "resolveCrossSessionInboundSetting": "function",
     "resolveDataRoot": "function",
@@ -2180,7 +2218,6 @@
     "resolveProjectId": "function",
     "resolveQuestionSeam": "function",
     "resolveReadDenyBuiltins": "function",
-    "resolveReadFace": "function",
     "resolveReasoning": "function",
     "resolveReasoningProfile": "function",
     "resolveRouteCredential": "function",
@@ -2210,6 +2247,7 @@
     "ruleSourceOf": "function",
     "ruleSyncVector": "function",
     "ruleToolGrammarOf": "function",
+    "runArtifactConformance": "function",
     "runCascade": "function",
     "runDeveloperTask": "function",
     "runExecGate": "function",
@@ -2360,8 +2398,12 @@
     "APPROVAL_CARD_REQUIRED_KEYS": "internal",
     "APPROVER_ATTRIBUTION_MAX_CHARS": "advanced",
     "ARTIFACT_ACTIONS": "advanced",
+    "ARTIFACT_ACTION_CONCURRENCY_SAFE": "advanced",
     "ARTIFACT_ACTION_HOST_METHOD": "advanced",
     "ARTIFACT_CARD": "advanced",
+    "ARTIFACT_COMMIT_CERTAINTIES": "advanced",
+    "ARTIFACT_COMMIT_THROW_OUTCOME": "advanced",
+    "ARTIFACT_CONFORMANCE_VECTORS": "advanced",
     "ARTIFACT_FAILURE_RESULT_CODE": "advanced",
     "ARTIFACT_HOST_ERROR_CODE": "advanced",
     "ARTIFACT_HOST_FAILURE_CODES": "advanced",
@@ -2380,11 +2422,13 @@
     "AUTO_MODE_ARMING_RECIPE_VERSION": "advanced",
     "AUTO_MODE_ARM_REASONS": "advanced",
     "AUTO_MODE_BASE_PROMPT": "advanced",
+    "AUTO_MODE_CLASSIFIER_FALLBACKS": "advanced",
     "AUTO_MODE_CLASSIFIER_MAX_TOKENS": "advanced",
     "AUTO_MODE_DEFAULTS_SENTINEL": "advanced",
     "AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS": "advanced",
     "AUTO_MODE_DENIAL_LIMIT_DEFAULTS": "advanced",
     "AUTO_MODE_DENY_SOURCES": "advanced",
+    "AUTO_MODE_FALLBACK_CAUSES": "advanced",
     "AUTO_MODE_PERMISSIONS_EXTERNAL": "advanced",
     "AUTO_MODE_UNAVAILABLE_CAUSES": "advanced",
     "AcquiredSession": "advanced",
@@ -2415,7 +2459,14 @@
     "AppendLog": "advanced",
     "ArtifactAction": "advanced",
     "ArtifactCallContext": "advanced",
+    "ArtifactCommitCertainty": "advanced",
     "ArtifactConflictSnapshot": "advanced",
+    "ArtifactConformanceHooks": "advanced",
+    "ArtifactConformanceOptions": "advanced",
+    "ArtifactConformanceReport": "advanced",
+    "ArtifactConformanceResult": "advanced",
+    "ArtifactConformanceStatus": "advanced",
+    "ArtifactConformanceVector": "advanced",
     "ArtifactFileContent": "advanced",
     "ArtifactFileOutcome": "advanced",
     "ArtifactFilesOutcome": "advanced",
@@ -2462,6 +2513,8 @@
     "AutoModeArmingRecipe": "advanced",
     "AutoModeClassified": "advanced",
     "AutoModeClassifierCompletion": "advanced",
+    "AutoModeClassifierFallback": "advanced",
+    "AutoModeClassifierRound": "advanced",
     "AutoModeClassifyFn": "advanced",
     "AutoModeClassifyInput": "advanced",
     "AutoModeDecider": "advanced",
@@ -2469,6 +2522,8 @@
     "AutoModeDenialLimitOptions": "advanced",
     "AutoModeDenialTracker": "advanced",
     "AutoModeDenySource": "advanced",
+    "AutoModeFallbackCause": "advanced",
+    "AutoModeLadderRung": "advanced",
     "AutoModeRebuildOptions": "advanced",
     "AutoModeRebuildRefusal": "advanced",
     "AutoModeRebuildResult": "advanced",
@@ -2642,8 +2697,13 @@
     "ConsolidationRunStopReason": "advanced",
     "ConsolidationStats": "internal",
     "ConstraintChainEntry": "advanced",
+    "ContainmentFace": "stable",
+    "ContainmentFaceInputs": "advanced",
+    "ContainmentFaceKind": "advanced",
+    "ContainmentFaceLayer": "advanced",
     "Context": "stable",
     "ContextEditOptions": "advanced",
+    "ContextUsageSection": "advanced",
     "ContractAssertionRunner": "advanced",
     "ControlPlaneCorruptError": "advanced",
     "ControlPlaneRebuildReceipt": "advanced",
@@ -2846,11 +2906,14 @@
     "GraderEnv": "advanced",
     "HANDS_BAND_TAGS": "advanced",
     "HARNESS_SECTION_ANCHOR": "advanced",
+    "HOOKS_INVALID_CODE": "advanced",
+    "HOOK_FAMILIES": "advanced",
     "HandsBandOptions": "stable",
     "HarvestRejection": "advanced",
     "HarvestRejectionCode": "advanced",
     "HarvestReport": "advanced",
     "HookEnvCapabilities": "advanced",
+    "HookFamily": "advanced",
     "HookInvocationIdentity": "advanced",
     "HookToolContext": "advanced",
     "HookToolFailure": "advanced",
@@ -2905,6 +2968,7 @@
     "LOCKED_KEY_REGISTRY": "advanced",
     "LOWERING_VERSION": "advanced",
     "LSP_FAILURE_BRAND": "advanced",
+    "LSP_LANES": "advanced",
     "LSP_OPERATIONS": "advanced",
     "LayeredRecallOptions": "advanced",
     "LayeredRecallResult": "advanced",
@@ -2925,6 +2989,7 @@
     "LspDiagnostic": "advanced",
     "LspDiagnosticsRegistry": "advanced",
     "LspFileDiagnostics": "advanced",
+    "LspLane": "advanced",
     "LspLocation": "advanced",
     "LspNoneReason": "advanced",
     "LspOperation": "advanced",
@@ -3388,8 +3453,6 @@
     "ReadDenyBuiltinTier": "advanced",
     "ReadDenyEntry": "advanced",
     "ReadDenyMatcher": "advanced",
-    "ReadFace": "stable",
-    "ReadFaceInputs": "advanced",
     "ReadOnlyCommandRow": "advanced",
     "ReadOnlyFlagArity": "advanced",
     "ReadOnlyShellVerdict": "advanced",
@@ -3701,6 +3764,9 @@
     "TOOL_PATH_ACCESSES": "advanced",
     "TOOL_PATH_BASES": "advanced",
     "TOOL_RESULT_REF_CONFLICT_CODE": "advanced",
+    "TOOL_SEARCH_DEFAULT_THRESHOLD_PERCENT": "advanced",
+    "TOOL_SEARCH_INVALID_CODE": "advanced",
+    "TOOL_SEARCH_POLICIES": "advanced",
     "TOOL_WIRE_NAME_MAX_CHARS": "advanced",
     "TSchema": "advanced",
     "TaskAccess": "advanced",
@@ -3751,6 +3817,7 @@
     "ToolContentOrigin": "advanced",
     "ToolContractDescriptor": "advanced",
     "ToolDisclosureManifest": "advanced",
+    "ToolDisclosureSnapshot": "internal",
     "ToolEffect": "advanced",
     "ToolExecuteContext": "advanced",
     "ToolFaceDeclaration": "advanced",
@@ -3786,6 +3853,8 @@
     "ToolRosterPathTarget": "advanced",
     "ToolRosterRenderHints": "advanced",
     "ToolRuleFace": "advanced",
+    "ToolSearchPolicy": "advanced",
+    "ToolSearchSetting": "advanced",
     "ToolSpec": "stable",
     "TraceEvent": "advanced",
     "TracerHook": "advanced",
@@ -3849,6 +3918,7 @@
     "WiringFacts": "advanced",
     "WiringLegKind": "advanced",
     "WiringManifest": "stable",
+    "WiringManifestHookEntry": "advanced",
     "WiringManifestMcpEntry": "advanced",
     "WorkerErrorClass": "advanced",
     "WorkflowAgentBlockedError": "advanced",
@@ -3928,6 +3998,7 @@
     "applyTombstones": "advanced",
     "archiveDistillerPlan": "advanced",
     "artifactAttemptId": "advanced",
+    "artifactConformanceVectors": "advanced",
     "artifactDeclarations": "advanced",
     "askUnresolvableNotice": "advanced",
     "assembleCodeTools": "advanced",
@@ -4040,6 +4111,7 @@
     "constitutionBlocks": "advanced",
     "constraintChainDigest": "advanced",
     "constraintChainEntryOf": "advanced",
+    "contextUsageSections": "advanced",
     "contractGroupingDiff": "advanced",
     "cosineDistance": "stable",
     "countElicitOptIns": "advanced",
@@ -4124,7 +4196,7 @@
     "delimitUntrusted": "advanced",
     "denialLimitFallbackMessage": "advanced",
     "denialLimitSentence": "advanced",
-    "deploymentReadFaceClampNotice": "advanced",
+    "deploymentFaceClampNotice": "advanced",
     "deriveAgentDisplayStatus": "advanced",
     "deriveAskEffective": "advanced",
     "deriveControlPlaneDir": "advanced",
@@ -4178,6 +4250,7 @@
     "err": "stable",
     "errorClassOf": "advanced",
     "eventDefaultOn": "advanced",
+    "executionEnvironmentBlockFor": "advanced",
     "executionRecordDisposition": "stable",
     "executionVerdict": "advanced",
     "expandLexicalTerms": "advanced",
@@ -4242,7 +4315,9 @@
     "isAbsoluteForFamily": "advanced",
     "isAliasModelId": "advanced",
     "isAskOrigin": "advanced",
+    "isAutoModeClassifierFallback": "advanced",
     "isAutoModeDenySource": "advanced",
+    "isAutoModeFallbackCause": "advanced",
     "isAutoModeUnavailableCause": "advanced",
     "isCanonicalPeerAddress": "advanced",
     "isClassifierDenyCause": "advanced",
@@ -4498,6 +4573,7 @@
     "resolveBuiltinWorkflow": "advanced",
     "resolveCheckpointStore": "advanced",
     "resolveComplianceDenies": "advanced",
+    "resolveContainmentFace": "advanced",
     "resolveCrossSessionDialogExpiry": "advanced",
     "resolveCrossSessionInboundSetting": "advanced",
     "resolveDataRoot": "advanced",
@@ -4517,7 +4593,6 @@
     "resolveProjectId": "advanced",
     "resolveQuestionSeam": "advanced",
     "resolveReadDenyBuiltins": "advanced",
-    "resolveReadFace": "advanced",
     "resolveReasoning": "advanced",
     "resolveReasoningProfile": "advanced",
     "resolveRouteCredential": "advanced",
@@ -4547,6 +4622,7 @@
     "ruleSourceOf": "advanced",
     "ruleSyncVector": "advanced",
     "ruleToolGrammarOf": "advanced",
+    "runArtifactConformance": "advanced",
     "runCascade": "advanced",
     "runDeveloperTask": "advanced",
     "runExecGate": "advanced",