@sema-agent/core 7.17.7 → 7.19.0

package/dist/orchestration/workflow-types.d.ts

@@ -5,11 +5,14 @@ export type WorkflowRunStatus = "running" | "completed" | "failed";
  *  {@link WorkflowAgentRun.parkedCheckpointToken}); a phase or group never parks (a parked agent ends the run). */
 export type WorkflowItemStatus = "running" | "completed" | "failed" | "parked";
 /** The arm a `workflow.park_truth_unreadable` resume refusal fired on (`detail.reason`): the prior run's record could not
- *  be read (`store_threw`), is absent under this scope (`record_missing`), is not terminal (`record_not_terminal`) or
- *  carries no `parks` array (`parks_unreadable`); a candidate's checkpoint could not be read (`checkpoint_store_threw`);
- *  or the record/journal name parks while this workflow holds no checkpoint seat to prove them (`capability_not_armed`).
+ *  be read (`store_threw`), is absent under this scope (`record_missing`), is not terminal (`record_not_terminal`),
+ *  carries no `parks` array and nothing to derive one from — an empty journal, or an empty derived union
+ *  (`parks_unreadable`) — or says its OWN resume admission never completed
+ *  ({@link WorkflowRun.resumeAdmissionIncomplete} — nothing on it describes a settled park set, so it is not a
+ *  resume base: `admission_incomplete`); a candidate's checkpoint could not be read (`checkpoint_store_threw`); or
+ *  the record/journal name parks while this workflow holds no checkpoint seat to prove them (`capability_not_armed`).
  *  Registered in docs/CLOSED-SETS.md with a mint obligation: every throw site spells its word. */
-export declare const PARK_TRUTH_UNREADABLE_REASONS: readonly ["store_threw", "record_missing", "record_not_terminal", "parks_unreadable", "checkpoint_store_threw", "capability_not_armed"];
+export declare const PARK_TRUTH_UNREADABLE_REASONS: readonly ["store_threw", "record_missing", "record_not_terminal", "parks_unreadable", "admission_incomplete", "checkpoint_store_threw", "capability_not_armed"];
 export type ParkTruthUnreadableReason = (typeof PARK_TRUTH_UNREADABLE_REASONS)[number];
 /** What the checkpoint store said about a parked ordinal's token when a resume carried no acknowledgement for it
  *  (`workflow.park_not_pending`, `detail.status`): the row's own word, or `absent` when the store holds no row. */
@@ -141,6 +144,13 @@ export interface WorkflowAgentRun {
      * truth read binds on the same two facts — `WorkflowRun.parks`); the checkpoint row itself carries no
      * workflow key. It is the resume CAPABILITY (never log it or put it in a URL); a durable row is its home
      * exactly as on the background lane. Absent on every other status.
+     *
+     * CONTRACT (a resume's second key cache). This token lands in the SAME store write as the run record's
+     * {@link WorkflowRun.parks} entry for the same call, so a record carrying one carries both — and one written before
+     * `parks` existed carries only this. A resume of a record WITHOUT that list reads a `parked` row as a park CANDIDATE
+     * of equal standing with the journal's entry, proven the only way any cache is: one `checkpointStore.get(token)`,
+     * whose word is the truth. Deriving adds NO trust; the row is POSITIVE evidence only (an empty `agents` array never
+     * reads as "no park"), and one carrying neither this token nor its {@link sessionId} claims its ordinal with NO key.
      */
     parkedCheckpointToken?: string;
     /**
@@ -388,22 +398,47 @@ export interface WorkflowRun {
     };
     /**
      * Every park this run is RESPONSIBLE for: its own (written at the park) and the ones it inherited from the run
-     * it resumed and did not settle (written at resume admission). KEYS ONLY — the truth of a park is the checkpoint
-     * store (`get(token).status`), never this list: a listed token may be resolved, expired or reaped, and the next
-     * resume reads the store for every entry. Present on every record this engine writes (`[]` when there is none)
-     * EXCEPT a record whose resume admission refused before its inherited set was established (deliberately absent:
-     * not a resume base). It is an ADMISSION INPUT of the next resume, so a store must project it verbatim and keep
-     * it through any size degrade; a reader treats absence as a state (an older engine's record, a stripped
-     * projection), never as `[]`. `token` is the same capability as {@link WorkflowAgentRun.parkedCheckpointToken}
-     * (never log it, never put it in a URL); `originRunId` is the run whose journal holds the `parked` entry for
-     * `callKey` (the re-park material).
+     * it resumed and did not settle (written when resume admission COMPLETES). KEYS ONLY — the truth of a park is the
+     * checkpoint store (`get(token).status`), never this list: a listed token may be resolved, expired or reaped, and
+     * the next resume reads the store for every entry. Present on every record this engine writes (`[]` when there is
+     * none) EXCEPT a record whose resume admission never completed — that record carries
+     * {@link resumeAdmissionIncomplete} instead, which is what says "not a resume base". Absence ALONE is the older
+     * engine's record or a stripped projection, and the next resume derives its candidates from the other two key
+     * caches ({@link WorkflowAgentRun.parkedCheckpointToken} on this record's `parked` agent rows, and the journal's
+     * `parked` entries) — and that union must come back NON-EMPTY: a record with no list beside an empty journal, or
+     * beside an empty union, is refused (`parks_unreadable`), zero positive evidence not being evidence of zero (both
+     * derived caches only ever hold a park the run MADE, so one it inherited and never reached lives in the list alone).
+     * When the list IS present it is the record's word ALONE (the agent rows are not a second opinion, so a size degrade
+     * emptying `agents` costs nothing), and it is an ADMISSION INPUT of the next resume: a store must project it
+     * verbatim and keep it through any size degrade. `token` is the same capability as
+     * {@link WorkflowAgentRun.parkedCheckpointToken} (never log it, never put it in a URL); `originRunId` is the run
+     * whose journal holds the `parked` entry for `callKey` (the re-park material).
+     *
+     * `originUnconfirmed: true` says the entry IS on the record but no journal has confirmed whose it is: the key
+     * must be durable before the append is awaited, so it lands first and the confirmation follows. `originRunId`
+     * then names the run the park was made in — where the material BELONGS, not where it has been seen — and A
+     * CONSUMER MUST NOT READ IT AS CONFIRMED. The member is REMOVED (never written `false`) the moment a journal is
+     * read or written carrying this token's `parked` entry, so
+     * absence is the confirmed state and an entry written before this member reads as confirmed, exactly as it did; the
+     * engine's own material read identity-checks what it finds, so an unconfirmed origin degrades rather than mis-binds.
      */
     parks?: Array<{
         callKey: string;
         sessionId: string;
         token: string;
         originRunId: string;
+        originUnconfirmed?: true;
     }>;
+    /**
+     * Set (`true`) on a resume run's record from its creation and REMOVED the moment its admission completes — so a record
+     * still carrying it is one whose admission never finished (it refused, or the process died inside it). Nothing on such
+     * a record describes a settled park set: `parks` is absent, its own journal holds no prefix, and the run it resumed is
+     * still the valid base. PRESENCE MEANS NOT A RESUME BASE — the engine refuses (`workflow.park_truth_unreadable` /
+     * `admission_incomplete`) and derives no candidate from it — while absence is the ordinary state of every non-resume
+     * run and of every completed admission, so a reader treats presence as the signal. Same projection obligation as
+     * {@link parks}: dropping it turns a refused record back into an admissible one.
+     */
+    resumeAdmissionIncomplete?: true;
     /** RB-243: how many agent results were NOT journaled because they exceeded the per-entry size
      *  cap ({@link MAX_JOURNAL_RESULT_BYTES}) — each skip also logs and journals a tombstone. Additive
      *  observation; absent when 0. */

package/dist/orchestration/workflow-types.js

@@ -1,4 +1,4 @@
-export const PARK_TRUTH_UNREADABLE_REASONS = ["store_threw", "record_missing", "record_not_terminal", "parks_unreadable", "checkpoint_store_threw", "capability_not_armed"];
+export const PARK_TRUTH_UNREADABLE_REASONS = ["store_threw", "record_missing", "record_not_terminal", "parks_unreadable", "admission_incomplete", "checkpoint_store_threw", "capability_not_armed"];
 export const PARK_NOT_PENDING_STATUSES = ["resolved", "expired", "absent"];
 export class WorkflowBudgetExceededError extends Error {
     spent;

package/dist/orchestration/workflow.js

@@ -564,7 +564,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             startedAt: 0,
         })),
         agents: [],
-        ...(opts.resumeFromRunId === undefined ? { parks: [] } : {}),
+        ...(opts.resumeFromRunId === undefined ? { parks: [] } : { resumeAdmissionIncomplete: true }),
         groups: [],
         stats: { tokens: 0, turns: 0, costMicroUsd: 0, nested: { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0 } },
         startedAt: t0,
@@ -999,10 +999,11 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
     };
     const journalAppendParked = async (callKey, paused) => {
         if (!journalStore)
-            return;
+            return false;
         const p = journalStore.append(runId, scope, { callKey, parked: paused });
         journalTail = journalTail.then(() => p).catch(() => undefined);
         await p;
+        return true;
     };
     const parkAgentLeg = async (rec, paused, activityTail, chargeLive) => {
         const s = paused.stats;
@@ -1027,15 +1028,20 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         const ordinal = callKeyOrdinal(rec.callKey);
         const parks = run.parks ?? (run.parks = []);
         const at = parks.findIndex((e) => e.callKey === rec.callKey);
-        const key = { callKey: rec.callKey, sessionId: paused.sessionId, token: paused.terminal.token, originRunId: at === -1 ? runId : parks[at].originRunId };
+        const held = at === -1 ? undefined : parks[at];
+        const key = held !== undefined && held.token === paused.terminal.token && held.originUnconfirmed !== true
+            ? { callKey: rec.callKey, sessionId: paused.sessionId, token: paused.terminal.token, originRunId: held.originRunId }
+            : { callKey: rec.callKey, sessionId: paused.sessionId, token: paused.terminal.token, originRunId: runId, originUnconfirmed: true };
         if (at === -1)
             parks.push(key);
         else
             parks[at] = key;
         void persist("update");
         try {
-            await journalAppendParked(rec.callKey, paused);
-            key.originRunId = runId;
+            if (await journalAppendParked(rec.callKey, paused)) {
+                key.originRunId = runId;
+                delete key.originUnconfirmed;
+            }
         }
         catch (err) {
             emitRunLog(`resume-journal: the PARKED leg at ordinal ${ordinal} ("${rec.label.slice(0, 80)}") could not be recorded in this run's journal (${withoutToken(errText(err), key.token)}) — ` +
@@ -2214,34 +2220,52 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                         throw new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — the prior run's record is not in the run store under this scope, so its parks cannot be proven.`, { reason: "record_missing" });
                     if (parkSeat !== undefined && prior !== null && prior.status === "running")
                         throw new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — the prior run is still recorded as running; a run that could park must have finished before it is resumed (a crashed park-capable run is decided through the deployment's approval channel, not resumed).`, { reason: "record_not_terminal" });
-                    if (prior !== null && !Array.isArray(prior.parks))
-                        throw new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — the prior run's record carries no parks list (written by an older engine, or stripped by the store's projection), so its parks cannot be proven.`, { reason: "parks_unreadable" });
+                    if (prior?.resumeAdmissionIncomplete === true)
+                        throw new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — that record's own resume admission never completed, so it settled no park set and its journal holds no replayable prefix; the run IT resumed is still the base. Resume that one instead.`, { reason: "admission_incomplete" });
+                    const recordParks = Array.isArray(prior?.parks) ? prior.parks : undefined;
+                    const noParksList = prior !== null && recordParks === undefined;
+                    const parksUnreadable = (why) => new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — the prior run's record carries no parks list (written by an older engine, or stripped by the store's projection) and ${why}, so its parks cannot be proven.`, { reason: "parks_unreadable" });
+                    if (noParksList && entries.length === 0)
+                        throw parksUnreadable("its journal yielded no entry to derive one from");
                     const candidates = new Map();
-                    const recordParks = prior !== null && Array.isArray(prior.parks) ? prior.parks : [];
-                    for (const raw of recordParks) {
+                    const keyed = (k) => k.token !== "" && k.sessionId !== "";
+                    const offerCandidate = (ord, key) => {
+                        const recorded = candidates.get(ord);
+                        if (recorded !== undefined && (recorded.callKey !== key.callKey || (keyed(recorded) && keyed(key) && (recorded.token !== key.token || recorded.sessionId !== key.sessionId))))
+                            throw parkBindingBroken(ord, "the prior run's key caches name different tokens, sessions or calls for it");
+                        if (recorded === undefined || (!keyed(recorded) && keyed(key)))
+                            candidates.set(ord, key);
+                    };
+                    for (const raw of recordParks ?? []) {
                         const e = raw;
                         if (e === null || typeof e !== "object" || typeof e.callKey !== "string" || typeof e.sessionId !== "string" || typeof e.token !== "string" || typeof e.originRunId !== "string" || !/^\d+:/.test(e.callKey)) {
                             throw parkBindingBroken(-1, "a recorded park entry is malformed or its call key has no ordinal");
                         }
-                        candidates.set(callKeyOrdinal(e.callKey), { callKey: e.callKey, sessionId: e.sessionId, token: e.token, originRunId: e.originRunId });
+                        offerCandidate(callKeyOrdinal(e.callKey), { callKey: e.callKey, sessionId: e.sessionId, token: e.token, originRunId: e.originRunId, ...(e.originUnconfirmed === true ? { originUnconfirmed: true } : {}) });
                     }
                     for (const [ord, e] of replayByOrdinal.entries()) {
                         if (e?.parked === undefined)
                             continue;
-                        const fromJournal = { callKey: e.callKey, sessionId: e.parked.sessionId, token: e.parked.terminal.token, originRunId: opts.resumeFromRunId };
-                        const recorded = candidates.get(ord);
-                        if (recorded === undefined)
-                            candidates.set(ord, fromJournal);
-                        else if (recorded.token !== fromJournal.token || recorded.sessionId !== fromJournal.sessionId || recorded.callKey !== fromJournal.callKey)
-                            throw parkBindingBroken(ord, "the run record and the journal name different tokens, sessions or calls for it");
+                        offerCandidate(ord, { callKey: e.callKey, sessionId: e.parked.sessionId, token: e.parked.terminal.token, originRunId: opts.resumeFromRunId });
+                        const settled = candidates.get(ord);
+                        settled.originRunId = opts.resumeFromRunId;
+                        delete settled.originUnconfirmed;
                     }
+                    for (const rec of recordParks === undefined && Array.isArray(prior?.agents) ? prior.agents : []) {
+                        if (rec === null || typeof rec !== "object" || rec.status !== "parked")
+                            continue;
+                        if (typeof rec.callKey !== "string" || !/^\d+:/.test(rec.callKey))
+                            throw parkBindingBroken(-1, "a parked agent row is malformed or its call key has no ordinal");
+                        offerCandidate(callKeyOrdinal(rec.callKey), { callKey: rec.callKey, sessionId: rec.sessionId ?? "", token: rec.parkedCheckpointToken ?? "", originRunId: opts.resumeFromRunId, originUnconfirmed: true });
+                    }
+                    if (noParksList && candidates.size === 0)
+                        throw parksUnreadable("neither its journal nor its own parked agent rows names a park to derive (a park it inherited and never reached is recorded in that list alone)");
                     const inherited = [];
                     for (const [ord, key] of [...candidates.entries()].sort((a, b) => a[0] - b[0])) {
                         if (replayByOrdinal[ord]?.result !== undefined)
                             continue;
                         inherited.push(key);
                     }
-                    run.parks = inherited;
                     if (parkSeat === undefined) {
                         if (inherited.length > 0) {
                             throw new WorkflowParkRefusal("workflow.park_truth_unreadable", `startWorkflow: resume from "${fromRunId}" was REFUSED — it is responsible for ${inherited.length} recorded park(s) and this workflow holds no checkpoint store to prove them against (RunWorkflowOptions.checkpointStore); without the seat a parked call would run live beside its pinned child.`, { reason: "capability_not_armed" });
@@ -2261,6 +2285,10 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                             parkedByOrdinal[ord] = truth;
                         }
                     }
+                    if (!finalized) {
+                        run.parks = inherited;
+                        delete run.resumeAdmissionIncomplete;
+                    }
                     run.resume = {
                         fromRunId: clampRunIdText(opts.resumeFromRunId),
                         journalEntries: entries.length,

package/dist/prompt-assembly/epoch.js

@@ -23,6 +23,7 @@ const PROBE_FACTS_OFF = {
     promptProfile: "simple",
     fableMitigations: false,
     readFaceOpen: false,
+    writeFaceOpen: false,
     reminderMark: undefined,
 };
 const PROBE_FACTS_ON = {
@@ -41,6 +42,7 @@ const PROBE_FACTS_ON = {
     promptProfile: "classic",
     fableMitigations: true,
     readFaceOpen: true,
+    writeFaceOpen: true,
     reminderMark: "PROBE-FIXED-MARK-AXIS0",
 };
 const PROBE_VECTORS = [

package/dist/prompt-assembly/packs/sema-default.js

@@ -1,4 +1,4 @@
-import { CYBER_RISK, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, WORKTREE_NOTICE, SUBAGENT_CONSENT_NOTICE, SUBAGENT_DELIVERY_NOTES, harnessHeadLines, } from "../../prompts/default.js";
+import { CYBER_RISK, executionEnvironmentBlockFor, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, WORKTREE_NOTICE, SUBAGENT_CONSENT_NOTICE, SUBAGENT_DELIVERY_NOTES, harnessHeadLines, } from "../../prompts/default.js";
 import { GOAL_COMPLETION_GUIDANCE, ORCHESTRATION_AWARENESS, ORCHESTRATION_GUIDANCE, ORCHESTRATION_GUIDANCE_DEFERRED, SUPERVISOR_PROMPT, } from "../../prompts/supervisor.js";
 import { TEAMMATE_COMMUNICATION_ADDENDUM } from "../../prompts/coordinator.js";
 import { SIMPLE_ACTION_CAUTION, SIMPLE_ACT_DONT_REDERIVE, SIMPLE_AUTONOMY_FABLE, SIMPLE_COMMUNICATING_FABLE, SIMPLE_CORRECTIONS_FABLE, SIMPLE_DELIVERING_WORK_FABLE, SIMPLE_COMMUNICATING_LEAN, SIMPLE_CONTEXT_MANAGEMENT, SIMPLE_PRONOUNS, SIMPLE_TOOL_PARAM_JSON, SEMA_VERIFY_FRESH, SEMA_EVIDENCE_AUDIT, } from "../../prompts/simple-sections.js";
@@ -41,7 +41,7 @@ export const SEMA_DEFAULT_PACK = {
             rank: 240,
             ...CORE,
             admit: (i) => i.facts.policyEnabled || i.facts.isolationEnabled,
-            content: (i) => (i.facts.readFaceOpen === true ? EXECUTION_ENVIRONMENT_OPEN_READS : EXECUTION_ENVIRONMENT),
+            content: (i) => executionEnvironmentBlockFor({ readOpen: i.facts.readFaceOpen === true, writeOpen: i.facts.writeFaceOpen === true }),
             blockId: "harness.context",
         },
         { id: "core/simple.communicating", slot: "harness", rank: 250, ...CORE, admit: (i) => i.facts.promptProfile !== "classic", content: (i) => (i.facts.fableMitigations === true ? SIMPLE_COMMUNICATING_FABLE : SIMPLE_COMMUNICATING_LEAN), blockId: "harness.context" },

package/dist/prompt-assembly/section-usage.d.ts

@@ -0,0 +1,26 @@
+/** One section's share of the leg's system prompt, as the `context_usage` frame reports it. */
+export interface ContextUsageSection {
+    /** The pack section id — the same wordlist `prompt.assembled`'s `sections[].id` uses. */
+    id: string;
+    /** The section's ESTIMATED token weight (see {@link contextUsageSections} for what that promises). */
+    tokens: number;
+    /** The section's semantic slot (`identity`, `security`, …), so a view can group without knowing every
+     *  id. Absent only if the manifest entry carried no slot. */
+    kind?: string;
+}
+/**
+ * Project the manifest's compiled sections onto the frame's occupancy view.
+ * @contract context_usage.sections — `sections[]` is the leg's PREPARE-TIME system-prompt composition,
+ * one entry per rendered pack section, `tokens` ESTIMATED from rendered characters at the engine's
+ * chars→tokens coefficient. A different measurement from `usedTokens`, the engine's trigger input over the
+ * whole conversation. The two coordinates MUST NOT be mixed: do not subtract `Σ sections[].tokens` from
+ * `usedTokens`, do not compare a section to `compactAtTokens`, and do not read a change across frames as
+ * growth — the value is frozen at prepare and re-reported verbatim at every boundary of the leg. It
+ * answers "what is my system prompt made of, and which part is big". Absent when the leg assembled no
+ * section IR (a provider that replaced the prompt wholesale ships one opaque block).
+ */
+export declare function contextUsageSections(sections: ReadonlyArray<{
+    id: string;
+    slot?: string;
+    chars: number;
+}> | undefined): ContextUsageSection[] | undefined;

package/dist/prompt-assembly/section-usage.js

@@ -0,0 +1,10 @@
+import { DEFAULT_CHARS_PER_TOKEN } from "../internal/harness.js";
+export function contextUsageSections(sections) {
+    if (sections === undefined || sections.length === 0)
+        return undefined;
+    return sections.map((s) => ({
+        id: s.id,
+        tokens: Math.ceil(s.chars / DEFAULT_CHARS_PER_TOKEN),
+        ...(s.slot !== undefined ? { kind: s.slot } : {}),
+    }));
+}

package/dist/prompt-assembly/types.d.ts

@@ -45,6 +45,10 @@ export interface PromptRuntimeFacts {
      *  open-reads first bullet). OPTIONAL: absence reads as false (roots wording, byte-identical),
      *  so existing fact constructors keep compiling. */
     readFaceOpen?: boolean;
+    /** The resolved WRITE face is OPEN (renders the execution-environment block's open-writes first
+     *  bullet column). OPTIONAL on the same law as {@link readFaceOpen}: absence reads as false (roots
+     *  wording, byte-identical), so existing fact constructors keep compiling. */
+    writeFaceOpen?: boolean;
     /** design/319 (A ticket) — the session's reminder provenance mark: threads into the
      *  `core/harness.head` section (single-sourced from `harnessHeadLines`), which extends the
      *  reminder sentence into the strict mark declaration when present. OPTIONAL (public export —
@@ -190,12 +194,10 @@ export interface ComposedPrompt {
  * routes sections into groups WITHOUT reordering them (emission stays rank order — slot never
  * drives physical order).
  *
- * Accuracy note (hardening 2026-07-31): the layout is a LOWERING argument, not a pack field —
- * `PromptPack` declares none, and every production `layoutSystemBlocks` call site passes no second
- * argument, i.e. always `SINGLE_BLOCK_LAYOUT` (one group, one cache_control breakpoint at the end).
- * Multi-block layouts (CC209's billing/persona/body) are therefore a lowering CAPABILITY exercised
- * only by fixtures today; no bundled pack can select one. The earlier wording ("the pack's layout")
- * described an association that does not exist in the type system.
+ * The layout is a LOWERING argument, not a pack field — `PromptPack` declares none, and every production
+ * `layoutSystemBlocks` call site passes no second argument, i.e. always `SINGLE_BLOCK_LAYOUT` (one group,
+ * one cache_control breakpoint at the end). Multi-block layouts are a lowering CAPABILITY exercised only
+ * by fixtures today; no bundled pack can select one.
  */
 export interface CompiledSystemBlock {
     groupId: string;

package/dist/prompts/default.d.ts

@@ -167,6 +167,10 @@ export declare const URL_SAFETY = "IMPORTANT: You must NEVER generate or guess U
  * per-message aggregate tool-result budget, which sheds the largest results at any size.
  */
 export declare const SUMMARIZE_TOOL_RESULTS = "When working with tool results, write down any important information you might need later in your own response, as the original tool result may be cleared or summarized from the context later.";
+export declare function executionEnvironmentBlockFor(faces?: {
+    readOpen?: boolean;
+    writeOpen?: boolean;
+}): string;
 export declare const EXECUTION_ENVIRONMENT: string;
 /** design/199 F8① — the open-read-face variant (first bullet tells the truth about reads). */
 export declare const EXECUTION_ENVIRONMENT_OPEN_READS: string;
@@ -319,6 +323,9 @@ export interface EnvironmentFacts {
      *  structured key). Rendered only when "open" (the roots posture is the historical default and
      *  renders nothing new — byte-compat). */
     readFace?: "open" | "roots";
+    /** The RESOLVED write-face containment state ("open" | "roots"; additive structured key). Rendered
+     *  only when "open" (the roots posture is the historical default and renders nothing new). */
+    writeFace?: "open" | "roots";
     /** OS name (uname -s) — remote = the container's, not the host's. */
     platform?: string;
     /** OS version (uname -r). */
@@ -496,6 +503,12 @@ export interface StablePromptContext {
      * byte-identical.
      */
     readFaceOpen?: boolean;
+    /**
+     * The resolved WRITE face is OPEN: the `# Execution environment` block's first bullet renders its
+     * open-writes column so the prompt never claims a write fence that is not there. Absent/false ⇒
+     * the historical (roots) wording, byte-identical.
+     */
+    writeFaceOpen?: boolean;
     /**
      * design/319 (A ticket) — the session's reminder provenance mark
      * ({@link import("../core/reminder-mint.js").mintReminderMark}): when present, the `# Harness`

package/dist/prompts/default.js

@@ -109,10 +109,14 @@ You have no persistent memory store: what is said in this conversation is not au
 export const CYBER_RISK = `IMPORTANT: Assist with authorized security testing, defensive security, CTF challenges, and educational contexts. Refuse requests for destructive techniques, DoS attacks, mass targeting, supply chain compromise, or detection evasion for malicious purposes. Dual-use security tools (C2 frameworks, credential testing, exploit development) require clear authorization context: pentesting engagements, CTF competitions, security research, or defensive use cases.`;
 export const URL_SAFETY = `IMPORTANT: You must NEVER generate or guess URLs for the user unless you are confident that the URLs are for helping the user with programming. You may use URLs provided by the user in their messages or local files.`;
 export const SUMMARIZE_TOOL_RESULTS = `When working with tool results, write down any important information you might need later in your own response, as the original tool result may be cleared or summarized from the context later.`;
-function executionEnvironmentBlock(openReads) {
-    const readWriteLine = openReads
-        ? "- You can read files anywhere this environment exposes (a small sensitive-path deny list applies), and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy."
-        : "- You can read and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy.";
+const READ_WRITE_BULLET = {
+    "roots/roots": "- You can read and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy.",
+    "open/roots": "- You can read files anywhere this environment exposes (a small sensitive-path deny list applies), and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy.",
+    "roots/open": "- You can read within the project working directory, and write files anywhere this environment exposes (a small protected-path list still applies). Writes to system paths may still be denied by the environment or the permission policy.",
+    "open/open": "- You can read and write files anywhere this environment exposes (small sensitive-path and protected-path lists still apply). Writes to system paths may still be denied by the environment or the permission policy.",
+};
+export function executionEnvironmentBlockFor(faces = {}) {
+    const readWriteLine = READ_WRITE_BULLET[`${faces.readOpen === true ? "open" : "roots"}/${faces.writeOpen === true ? "open" : "roots"}`];
     return `# Execution environment
 Commands run inside an isolated execution environment (a managed container or remote host), not on the operator's machine. Within it:
 ${readWriteLine}
@@ -125,8 +129,8 @@ When a command fails, identify the cause before retrying:
 
 If a restriction genuinely blocks a necessary action, do NOT attempt to circumvent it (no privilege escalation, no disabling of guards, no destructive workarounds). Adjust your approach, or surface the limitation to the user with the specific evidence you saw.`;
 }
-export const EXECUTION_ENVIRONMENT = executionEnvironmentBlock(false);
-export const EXECUTION_ENVIRONMENT_OPEN_READS = executionEnvironmentBlock(true);
+export const EXECUTION_ENVIRONMENT = executionEnvironmentBlockFor();
+export const EXECUTION_ENVIRONMENT_OPEN_READS = executionEnvironmentBlockFor({ readOpen: true });
 export const WORKTREE_NOTICE = `# Isolated worktree
 This task runs in its own isolated git worktree — a separate working copy whose root is the working directory shown in # Environment, NOT the repository's main checkout. Any absolute path you were given that points at the main checkout (or another worktree) refers to a DIFFERENT copy; translate it to the same relative path under this worktree's root before reading or writing, and operate only within this worktree. A file's content here may differ from the main checkout, so re-read a file in this worktree before editing it rather than assuming an earlier or external view is current.`;
 export const WORKTREE_STASH_WARNING = "The git stash stack is shared with the main checkout and all other worktrees, and other agent sessions may push or pop it concurrently. " +
@@ -162,8 +166,9 @@ export function harnessHeadLines(ctx) {
 }
 export function harnessContext(ctx) {
     const blocks = [harnessHeadLines(ctx), CYBER_RISK, URL_SAFETY, SUMMARIZE_TOOL_RESULTS];
-    if (ctx.policyEnabled || ctx.isolationEnabled)
-        blocks.push(ctx.readFaceOpen === true ? EXECUTION_ENVIRONMENT_OPEN_READS : EXECUTION_ENVIRONMENT);
+    if (ctx.policyEnabled || ctx.isolationEnabled) {
+        blocks.push(executionEnvironmentBlockFor({ readOpen: ctx.readFaceOpen === true, writeOpen: ctx.writeFaceOpen === true }));
+    }
     if (ctx.promptProfile !== "classic") {
         blocks.push(ctx.fableMitigations === true ? SIMPLE_COMMUNICATING_FABLE : SIMPLE_COMMUNICATING_LEAN);
         blocks.push(SIMPLE_PRONOUNS);
@@ -259,6 +264,9 @@ export function buildEnvironmentContext(facts) {
     if (facts.readFace === "open") {
         lines.push("File reads are not confined to the workspace root. A small sensitive-path deny list applies (see refusals for the exact pattern).");
     }
+    if (facts.writeFace === "open") {
+        lines.push("File writes are not confined to the workspace root. A small protected-path list still applies, and every write still passes the deployment's approval policy (see refusals for the exact reason).");
+    }
     if (facts.isGitRepo !== undefined)
         lines.push(`Is a git repository: ${facts.isGitRepo ? "yes" : "no"}`);
     if (facts.gitWorktreeRoot)

package/dist/tools/artifact/artifact-text.d.ts

@@ -6,6 +6,7 @@
  * neutral phrase. The replacement list is registered in the divergence register beside this package.
  */
 import type { ArtifactAction, ArtifactPlane } from "../../core/artifact-host.js";
+import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 /** Opening sentence of the hosted face (`U$t`, line 51145; "hosted on claude.ai" replaced). */
 export declare const HOSTED_OPENING = "Render an HTML file to an Artifact \u2014 a default-private web page hosted by this deployment's artifact host. Use this when communicating visually would be clearer than terminal text. Publishing proactively is fine for your own work-product \u2014 artifacts start private. The exception is content that could mislead or cause harm if shared onward: anything imitating a real organization, person, or record, or content the user framed as sensitive. Build those as files, and let the user decide whether they get a URL.";
 /** The title rule (`G$t`, line 51145). */
@@ -54,7 +55,15 @@ export declare const PARAM_TEXT: {
     readonly scope: "list only: 'mine' (default) lists artifacts the user owns — the only ones the update flow can target; 'shared' lists artifacts other people shared with the user (read-only); 'all' lists both. Rows are labeled (mine)/(shared) whenever scope is not 'mine'.";
     readonly path: "read_file only: the published path of the file to return (as listed by 'list_files').";
 };
-/** The tool description for a face: the plane picks the opening, the declared actions pick the paragraphs. */
+/** The opening paragraphs of each declared plane: the hosted opening with its title rule, or the two stub sentences
+ *  (the stub names no gallery, so no title rule). Every paragraph after the opening is keyed on a declared action. */
+export declare const ARTIFACT_PLANE_OPENING: {
+    readonly hosted: readonly ["Render an HTML file to an Artifact — a default-private web page hosted by this deployment's artifact host. Use this when communicating visually would be clearer than terminal text. Publishing proactively is fine for your own work-product — artifacts start private. The exception is content that could mislead or cause harm if shared onward: anything imitating a real organization, person, or record, or content the user framed as sensitive. Build those as files, and let the user decide whether they get a URL.", "**Title**: Set a `<title>` at the top of the HTML — only the first 8KB of the file is scanned for it. It names the artifact in the browser tab and gallery, so make it a name, not a summary: a short noun phrase, typically two to four words, distinctive to this page's subject so the reader can pick it out of a gallery of many — the way an app or a document gets named, never a generic category label, and never a name plus an appended explainer after a dash or colon. When a natural title pairs the name with a generic word, the name is the half that survives the trim — keeping the generic half and dropping the identity makes the title worse, not shorter. And trim only actual explainers: a multi-word title that already reads as one specific name is finished as it is. The explanation belongs in the `description` parameter instead: pass a one-sentence `description` — it becomes the gallery card's subtitle. For HTML publishes, a `title` parameter fills in when the file has no tag (Markdown pages always keep their filename identity). Keep the title stable across redeploys."];
+    readonly "local-stub": readonly ["This eval run stubs artifact publishing locally and has no artifact control plane: only publishing (the default action) is available here — list, delete, comments, replies, watches, database writes, asset uploads, and live docs are not.", "This eval run stubs artifact publishing locally: `url` may only name an artifact this run published (an eval-stub:// link), never an artifact hosted anywhere else. Omit `url` to publish fresh."];
+};
+export type OpeningTableCoversEveryPlane = AssertAllKeysHandled<Exclude<ArtifactPlane, keyof typeof ARTIFACT_PLANE_OPENING>>;
+/** The tool description for a face: the plane's opening, the update rule, one paragraph per declared action, and the
+ *  comments disclosure — no host declares a comments action in this version, so its absence is a fact of every face. */
 export declare function artifactDescription(plane: ArtifactPlane, actions: ReadonlyArray<ArtifactAction>): string;
 /** The `url` parameter's description for a face: the list hint and the read clause ride only with their actions. */
 export declare function urlDescription(actions: ReadonlyArray<ArtifactAction>): string;

package/dist/tools/artifact/artifact-text.js

@@ -33,11 +33,13 @@ export const PARAM_TEXT = {
     scope: "list only: 'mine' (default) lists artifacts the user owns — the only ones the update flow can target; 'shared' lists artifacts other people shared with the user (read-only); 'all' lists both. Rows are labeled (mine)/(shared) whenever scope is not 'mine'.",
     path: "read_file only: the published path of the file to return (as listed by 'list_files').",
 };
+export const ARTIFACT_PLANE_OPENING = {
+    hosted: [HOSTED_OPENING, TITLE_RULE],
+    "local-stub": [STUB_PUBLISH_ONLY, STUB_OWN_MINT_ONLY],
+};
 export function artifactDescription(plane, actions) {
-    if (plane === "local-stub")
-        return [STUB_PUBLISH_ONLY, STUB_OWN_MINT_ONLY, UPDATE_RULE, COMMENTS_NOT_ENABLED].join("\n\n");
     const has = (a) => actions.includes(a);
-    const parts = [HOSTED_OPENING, TITLE_RULE, UPDATE_RULE];
+    const parts = [...ARTIFACT_PLANE_OPENING[plane], UPDATE_RULE];
     if (has("list") && has("read"))
         parts.push(UPDATE_FROM_EARLIER_RULE);
     if (has("read"))
@@ -48,6 +50,7 @@ export function artifactDescription(plane, actions) {
         parts.push(LIST_FILES_RULE);
     if (has("read_file"))
         parts.push(READ_FILE_RULE);
+    parts.push(COMMENTS_NOT_ENABLED);
     return parts.join("\n\n");
 }
 export function urlDescription(actions) {

package/dist/tools/artifact/artifact-tool.d.ts

@@ -1,4 +1,5 @@
 import { type ArtifactHost, type ArtifactHostCapabilities } from "../../core/artifact-host.js";
+import { type OnAsk } from "../../core/tool-policy.js";
 import type { ToolSpec } from "../../core/types.js";
 /** What the engine's local-file reader hands back: the canonical key (the path-binding key) and the bytes, or one of
  *  three refusals — the fence's own (`refused`, with its text and card), a file over the byte budget the caller
@@ -35,11 +36,20 @@ export interface ArtifactToolOptions {
     /** The engine's fs-gated single read of a model-named local file (one read per call; the bytes read are the bytes
      *  published); `maxBytes` is the budget left for this file, judged on metadata before the read. */
     readLocalFile: (path: string, maxBytes: number, signal?: AbortSignal) => Promise<ArtifactLocalRead>;
+    /** The run's effective approver — the same frozen seat the tool gate resolves asks at (`frozenOnAsk` =
+     *  `spec.onAsk ?? deps.onAsk`), riding the MOUNT dep under the same rule as the workflow mount's `parentOnAsk`: a core
+     *  mount's execute ctx is minimal, so the seat never rides `ctx`. The shared-read consent gate resolves at it. Absent
+     *  = the run has no ask face, and a shared read is then REFUSED fail-closed (`artifact.refused`, content withheld) —
+     *  never silently delivered. */
+    onAsk?: OnAsk;
 }
+/** Supporting files per publish (upstream cap); enforced in the schema AND in the body, for callers that bypass the schema. */
+export declare const MAX_FILES_PER_PUBLISH = 255;
 export declare function mediaTypeOf(path: string): string;
 export declare function isTextMedia(mediaType: string | undefined): boolean;
-/** One opaque key per tool-call OCCURRENCE (a gateway may reuse a call id across turns; `occurrence` counts prior
- *  executions of that id in the run), stable for any host retry inside that execution: the host's idempotency key. */
+/** One opaque key per HOST CALL (`occurrence` counts prior host calls made under that tool-call id in this run — so a
+ *  gateway that reuses a call id across turns never replays, and neither do two host calls of ONE execution), stable
+ *  for any retry the host itself makes of that call: the host's idempotency key. */
 export declare function artifactAttemptId(runId: string, toolCallId: string, occurrence?: number): string;
 /** A published path: relative, forward-slash, no dot segments, no NUL, no backslash; returns the NFC form or the refusal. */
 export declare function normalizePublishedPath(raw: string): {