@sema-agent/core 7.17.7 → 7.18.0

package/wire-changes/core@7.17.7.json

@@ -0,0 +1,49 @@
+{
+  "repo": "core",
+  "version": "7.17.7",
+  "from": "adb5afdddf8b01be7b9b8a8394251eea7fe2ee19",
+  "to": "d45dba221924363df3176b96550267398c24e26b",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — an INTERPRETER whose program is argument text is the argument-as-program family's fourth member (#791; B-120; test [7227]): one table (26 rows: perl / ruby / python / node / php / lua / tclsh / wish / expect / awk family / jq / bc / dc / sqlite3 / psql / osascript / Rscript / julia / ghci / groovy / bun) declares per interpreter how its program arrives — text-valued options (`-e`/`-c`/`--eval`/`-r`/`-p`), bundle letters (`-pe`/`-lne`/`-0777e`), the program OPERAND (awk program, jq filter, the SQL after a database) and the `stdin when unnamed` rule — and the presence of such a program refuses the whole command through the family's existing mint (`unjudgedProgramTextRefusal`). What is judged is PRESENCE, never CONTENT."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — ONE launcher option grammar, read by every reader that has to find the program word (#792; B-120; test [7227]): `LAUNCHER_OPTION_GRAMMAR` (time's `-p`/`-f <fmt>`/`-o <file>`/`-a`/`-v`) was read by the boundary walk and by the single-command boundary face but NOT by the whitelist's head scan, `argvReentryUnjudged`, nor the bounded poll loop's base-move reader; `time -p xargs cat <<< <path>` therefore fell through the argv re-entry member that `xargs cat <<< <path>` had been refused by since 7.17.5."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — an APPLET DISPATCHER is a launcher and the shell re-entry member is spelled by every shell (#791 complement pass, ruled arm 3): `busybox` joins `COMMAND_LAUNCHERS` (already on the rule lane's curated interpreter table, so the pinned subset relation holds) and `SHELL_REENTRY_PROGRAM_RE` gains `ash|mksh|yash|pdksh` (+ `csh|tcsh` from the receipt round)."
+    }
+  ],
+  "closedSetMembers": [],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.ruleOffersAbsence",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G3.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@f985d9cb server@4406f7fd sdk@6910789 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}

package/dist/tools/fs/read-face.d.ts

@@ -1,68 +0,0 @@
-/** The read-face containment state. `"roots"` = the containment judgment runs.
- *  `"open"` = the containment step is skipped (canonicalization, deny set, UNC out-of-set refusal
- *  and the type gates all still run). */
-export type ReadFace = "open" | "roots";
-/** Loud value gate: a `readFace` seat carries exactly "open" | "roots" — anything else (case
- *  variants, truthy garbage) refuses at wiring time, never folds to a default. Exported
- *  module-internally (not on the package surface) so prepare's unconditional config-guard leg can
- *  screen the seats on runs that never mount hands. The resolver itself also runs on every hands-less
- *  leg; this screen still fires first, so a garbage value refuses before any leg-shape branching. */
-export declare function assertReadFaceValue(v: unknown, seat: string): ReadFace | undefined;
-/** Inputs to {@link resolveReadFace} — all structural/declaration facts, never permission modes
- *  (a deliberate axis separation: this shape carries facts, not verdicts). */
-export interface ReadFaceInputs {
-    /** TaskSpec.readFace (raw — validated here). The TASK layer: may only tighten under governance. */
-    specReadFace?: unknown;
-    /** RunnerDeps.readFace / HandsToolkitOptions.readFace (raw) — the DEPLOYMENT's own declaration. */
-    depsReadFace?: unknown;
-    /** The verifier read-only mount (`handsReadOnly` / toolkit `readOnly`): its containment is a
-     *  LOAD-BEARING wall (bash_readonly is genuinely confined by it) — never openable. */
-    readOnlyMount: boolean;
-    /** Org governance declared (`RunnerDeps.permissionRuleStore.partitions.org === true`): default roots; the task layer
-     *  may not open (tighten-only under governance; the deps layer, being the deployment's own
-     *  declaration, still may). */
-    orgGoverned: boolean;
-    /** Is the FULL shell (`core.bash@1`) structurally reachable on this mount? Computed BEFORE
-     *  tool-band assembly from spec-time facts (env kind / handsReadOnly / Bash exclusion — every
-     *  exclusion source is spec-time-frozen, so this is always computable). When false, the roots fence
-     *  is the ONLY read boundary, so no IMPLICIT default may open the face; an EXPLICIT "open" on
-     *  either seat still wins (row 4 of the order is a default, not a clamp). */
-    fullShellReachable: boolean;
-    /** Observation hook for the ONE silent branch of the order: row 1's deployment-seat clamp
-     *  (readOnly mount + deps "open" + NO task seat). Fired exactly when the deps declaration was the
-     *  deciding seat and the mount overrode it — not when a task-level "roots" pinned the same value
-     *  anyway (the mount changed nothing there, and announcing it would claim a false cause), and
-     *  never on the throw rows (those are already loud). The resolver stays the single owner of the
-     *  clamp predicate; stations own delivery/dedup ({@link deploymentReadFaceClampNotice}). */
-    onDeploymentClamp?: () => void;
-}
-/**
- * The ONE resolution order, first hit wins. prepare-task AND createHandsToolkit both call this — a
- * library-direct mount gets identical validation and identical defaults.
- *
- *  1. read-only (verifier) mount → ROOTS; an explicit "open" on the TASK seat is a genuine
- *     per-call CONTRADICTION and refuses loudly (never silently pick a side). An "open" on the
- *     DEPLOYMENT seat alone is a deployment-wide default, not a per-task assertion — it silently
- *     CLAMPS to roots (stricter-wins), the same seat distinction row 2 draws for org governance.
- *  2. org-governed: TaskSpec "open" refuses (task layer only tightens); deps "open" wins;
- *     otherwise ROOTS.
- *  3. explicit seat: spec ?? deps.
- *  4. bash-less mount: ROOTS (the fence is the only read boundary there — "the fence guards
- *     nothing bash reaches anyway" does not hold, so no implicit default may open it).
- *  5. default: ROOTS — the engine never opens implicitly.
- */
-export declare function resolveReadFace(i: ReadFaceInputs): ReadFace;
-/**
- * The ONE text of the deployment-clamp announcement (`config.read_face_deployment_clamped`).
- * Both stations deliver THIS object through their own `deliverEngineNotice` call (prepare-task with
- * the `RunnerDeps.onNotice` seat, once per notice sink — the sink, not the deps object, because the
- * Runner rebuilds its deps; `createHandsToolkit` with its band-local `HandsToolkitOptions.onNotice`
- * seat — toolkit creation is itself the one-per-mount boot moment, and an absent seat prints the
- * same line via `console.warn`). Built here, import-free, so the message can never fork between
- * the stations.
- */
-export declare function deploymentReadFaceClampNotice(): {
-    code: string;
-    message: string;
-    detail: Record<string, unknown>;
-};

package/dist/tools/fs/read-face.js

@@ -1,47 +0,0 @@
-export function assertReadFaceValue(v, seat) {
-    if (v === undefined)
-        return undefined;
-    if (v === "open" || v === "roots")
-        return v;
-    const e = new Error(`${seat}: invalid readFace value ${JSON.stringify(v)} — expected "open" or "roots" (bad values refuse loudly; nothing falls back to a default).`);
-    e.code = "config.read_face_invalid";
-    throw e;
-}
-export function resolveReadFace(i) {
-    const spec = assertReadFaceValue(i.specReadFace, "TaskSpec.readFace");
-    const deps = assertReadFaceValue(i.depsReadFace, "readFace (deployment seat)");
-    if (i.readOnlyMount) {
-        if (spec === "open") {
-            const e = new Error(`readFace: "open" contradicts the read-only (verifier) mount — that mount's containment is load-bearing (its read-only shell face is confined by it) and is never openable. Drop the readFace declaration or the readOnly mount.`);
-            e.code = "config.read_face_readonly_conflict";
-            throw e;
-        }
-        if (deps === "open" && spec === undefined)
-            i.onDeploymentClamp?.();
-        return "roots";
-    }
-    if (i.orgGoverned) {
-        if (spec === "open") {
-            const e = new Error(`TaskSpec.readFace: "open" is refused under organization governance — the task layer may only tighten (set RunnerDeps.readFace: "open" if the DEPLOYMENT declares the open read face).`);
-            e.code = "config.read_face_org_task_escalation";
-            throw e;
-        }
-        if (spec === "roots")
-            return "roots";
-        return deps ?? "roots";
-    }
-    if (spec !== undefined)
-        return spec;
-    if (deps !== undefined)
-        return deps;
-    if (!i.fullShellReachable)
-        return "roots";
-    return "roots";
-}
-export function deploymentReadFaceClampNotice() {
-    return {
-        code: "config.read_face_deployment_clamped",
-        message: `readFace (deployment seat): the deployment-wide "open" declaration is not in force on this read-only (verifier) mount — clamped to "roots" (stricter-wins: the mount's containment is load-bearing and never openable). Other mounts still honor "open".`,
-        detail: { seat: "readFace (deployment seat)", declared: "open", inForce: "roots", cause: "read_only_mount" },
-    };
-}