@sema-agent/core 7.17.7 → 7.19.0

package/dist/core/auto-mode-defaults.d.ts

@@ -1,5 +1,19 @@
-/** Hard cap on one classification round-trip when `AutoModeDeciderOptions.timeoutMs` is omitted. */
-export declare const AUTO_MODE_DEFAULT_TIMEOUT_MS = 15000;
+/**
+ * Hard cap on one classification RUNG (both attempts) when `AutoModeDeciderOptions.timeoutMs` is omitted — CC
+ * 2.1.259's per-attempt classifier base (`j7e = 60000`; 2.1.250 `oue`, the same number), which upstream
+ * stretches to 120 s with prompt size and sema leaves to the deployment knob. The 15 s that stood here was
+ * never upstream's: live 2026-09-15 a thinking-by-default gateway answers in 5–165 s (Qwen 3.8 p50 11–24 s,
+ * kimi and GLM p50 ~10 s), so 15 s turned most classifications into `unavailable (timed out)`. Worst-case
+ * walk = this × rungs (2) = 120 s.
+ */
+export declare const AUTO_MODE_DEFAULT_TIMEOUT_MS = 60000;
+/**
+ * What an arming RECORDING that carries no `timeoutMs` meant when it was written: the default of its day. Every
+ * recipe minted since the deadline moved to 60 s MATERIALISES its bound, so an absent recorded knob dates the
+ * recording — the fold reads it as the 15 s it ran under, never as the current default
+ * (`auto_mode.arming.absent_timeout_reads_recorded_default`, on the fold).
+ */
+export declare const AUTO_MODE_RECORDED_ABSENT_TIMEOUT_MS = 15000;
 /** Newest transcript entries in the classify window when `AutoModeWindowOptions.maxEntries` is omitted. */
 export declare const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
 /** Per-entry excerpt cap when `AutoModeWindowOptions.maxCharsPerEntry` is omitted. */
@@ -17,25 +31,39 @@ export declare const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2000;
  * parses as a block (the parser tolerates a missing tail), a truncated allow does not exist (it is
  * seven tokens), and the cap's job is to make a model that ignores the "no preamble" instruction —
  * or that reasons in-text — cost a bounded, quickly-detected contract failure instead of a slow one.
- * Paired with `reasoning:"off"` at the call: the cap hosts the ANSWER, so it applies only where the
- * wire can say off (`thinkingOffExpressible`); a model that thinks regardless keeps its own budget.
+ * Paired with `reasoning:"off"` at the call: the cap hosts the ANSWER, so it stands alone only where the
+ * wire SPELLS off (`thinkingOffSpelled`); every other seat adds a thinking allowance to it.
  */
 export declare const AUTO_MODE_CLASSIFIER_MAX_TOKENS = 256;
 /**
- * The output-budget ALLOWANCE for a classifier request that must think: added to the verdict cap when the
- * seat asks for `reasoning:"low"` instead of `"off"` — a model whose wire cannot say off (`reasoning:true`
- * with no off spelling on an effort-only wire, or the anthropic adaptive family), or an unknown model whose
- * capped off-request came back EMPTY at the cap (it reasoned anyway). The seat then pays for the lowest
- * reasoning tier plus the verdict, never for an open-ended budget.
+ * The output-budget ALLOWANCE for a classifier request whose thinking the wire could not turn OFF: added to
+ * the verdict cap when the seat asks for `reasoning:"low"` instead of `"off"` — a model whose wire has no off
+ * spelling (`reasoning:true` on an effort-only wire with no declared off, the anthropic adaptive family) and a
+ * model that declares NO reasoning (the wire then carries nothing and the request is the gateway's default,
+ * which on a default-on gateway is a think). The seat pays for the least the wire can grade plus the verdict,
+ * never for an open-ended budget.
  *
- * 2048 is anchored twice: CC 2.1.250 `E4` adds exactly this many tokens to the verdict cap for a model in
- * its `rejects_disabled_thinking` family (`BHe`); and it is 2 × `MIN_THINKING_TOKENS` (1024), so on the
- * anthropic BUDGET path a HARD cap of 256 + 2048 clears the cap-wins skip (`budgetCapSkipsThinking`) and
- * hosts a legal `low` budget (`1024 ≤ budget_tokens < max_tokens`) without the brain having to raise a cap
- * it refuses to raise. A model that spends more than this on thinking still answers nothing — that reply
- * is the contract failure it always was.
+ * 2048 is anchored twice: CC 2.1.259 `MU` adds exactly this many tokens to the verdict cap for a model in
+ * its `rejects_disabled_thinking` family (2.1.250 `E4`/`BHe`); and it is 2 × `MIN_THINKING_TOKENS` (1024), so
+ * on the anthropic BUDGET path a HARD cap of 256 + 2048 clears the cap-wins skip (`budgetCapSkipsThinking`)
+ * and hosts a legal `low` budget (`1024 ≤ budget_tokens < max_tokens`) without the brain having to raise a
+ * cap it refuses to raise. Live 2026-09-15: deepseek's default think fits it ~90–100% of the time; the tail
+ * is the re-ask seat's ({@link AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS}). What a cap can and cannot promise is
+ * the seat's contract (`classifier.budget_is_room`, on `classifierRungSeat`).
  */
 export declare const AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS = 2048;
+/**
+ * The RE-ASK seat's allowance — the room a rung gets ONCE after its first attempt produced no verdict: CC
+ * 2.1.259's stage-2 classifier cap (`max_tokens: 8192 + bn`). Live 2026-09-15 the thinking tail that overruns
+ * 2048 (deepseek 1–2 of 20, some past 4096; Qwen up to 6k) sits under it. One re-ask, never a loop.
+ */
+export declare const AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS = 8192;
+/**
+ * How many CONSECUTIVE no-verdict classifications on ONE model mint `classifier.contract_broken` (once per run
+ * per model): one is a fluke, two is a pattern, and at three the denial limit already hands the user a card —
+ * the operator line lands before that one.
+ */
+export declare const AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER = 2;
 /** The sentinel a deployment puts INSIDE a paired rule list to splice the CC default rules back in at
  *  that position (CC `XYt = "$defaults"`). It lives here, beside the other defaults, because the #503
  *  recipe canonicalizer needs its VALUE and must not load the assembly face (and its SHA-locked assets)

package/dist/core/auto-mode-defaults.js

@@ -1,8 +1,11 @@
-export const AUTO_MODE_DEFAULT_TIMEOUT_MS = 15_000;
+export const AUTO_MODE_DEFAULT_TIMEOUT_MS = 60_000;
+export const AUTO_MODE_RECORDED_ABSENT_TIMEOUT_MS = 15_000;
 export const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
 export const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2_000;
 export const AUTO_MODE_CLASSIFIER_MAX_TOKENS = 256;
 export const AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS = 2048;
+export const AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS = 8192;
+export const AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER = 2;
 export const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
 export const AUTO_MODE_DENIAL_LIMIT_DEFAULTS = Object.freeze({ maxConsecutive: 3, maxTotal: 20 });
 export const AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS = 120_000;

package/dist/core/auto-mode.d.ts

@@ -10,72 +10,179 @@ export declare const AUTO_MODE_UNAVAILABLE_CAUSES: readonly ["error", "timeout"]
 export type AutoModeUnavailableCause = (typeof AUTO_MODE_UNAVAILABLE_CAUSES)[number];
 /** Whether a value is a member of the unavailable-cause set — the screen a row reader applies to a stored word. */
 export declare function isAutoModeUnavailableCause(v: unknown): v is AutoModeUnavailableCause;
-/** The classifier's verdict over one pending `ask`. */
-export type AutoModeVerdict = {
+/**
+ * HOW a reply failed to carry a verdict — the closed set behind `parse_error.form`. `missing` = the reader found
+ * NO answer (empty text, prose, an answer only inside a thinking block); `conflict` = it found TWO distinct
+ * `<block>` answers (raw or thinking-stripped). The split exists for the classify leg's re-ask: a missing
+ * answer is asked for again (CC 2.1.259 `Vrr` re-asks an unparseable reply), a conflict is not — it carries a
+ * `yes`, and a second attempt that answered `no` would erase it. Not on any wire face; the trace frame and the
+ * gate record keep the one word `parse_error`.
+ */
+export declare const AUTO_MODE_PARSE_FAILURES: readonly ["missing", "conflict"];
+export type AutoModeParseFailure = (typeof AUTO_MODE_PARSE_FAILURES)[number];
+/** Whether a value is a member of the parse-failure set. */
+export declare function isAutoModeParseFailure(v: unknown): v is AutoModeParseFailure;
+/**
+ * WHY a classification moved DOWN the candidate ladder — the closed set behind
+ * {@link AutoModeClassifierRound}'s `fallback.cause`, i.e. the ways a candidate produces NO RULING
+ * ({@link rungDidNotRule}). Two words are the unavailable causes verbatim (the leg threw / rejected; the
+ * round-trip cap elapsed); `parse_error` is the candidate that ANSWERED without a verdict. A ruling is not a
+ * member: the ladder stops at a verdict either way.
+ */
+export declare const AUTO_MODE_FALLBACK_CAUSES: readonly ["error", "timeout", "parse_error"];
+export type AutoModeFallbackCause = (typeof AUTO_MODE_FALLBACK_CAUSES)[number];
+/** Whether a value is a member of the fallback-cause set — the screen a row reader applies to a stored word. */
+export declare function isAutoModeFallbackCause(v: unknown): v is AutoModeFallbackCause;
+/**
+ * The deployment's answer to "what happens when the classifier seat does not rule?"
+ * (`RunnerDeps.autoMode.classifierFallback`) — the closed set behind the candidate ladder's LENGTH:
+ * `main` = [classifier seat, the run's main model]; `none` = [classifier seat].
+ */
+export declare const AUTO_MODE_CLASSIFIER_FALLBACKS: readonly ["main", "none"];
+export type AutoModeClassifierFallback = (typeof AUTO_MODE_CLASSIFIER_FALLBACKS)[number];
+/** Whether a value is a member of the classifier-fallback set. */
+export declare function isAutoModeClassifierFallback(v: unknown): v is AutoModeClassifierFallback;
+/** Read the knob: absent ⇒ the default `main`; a member ⇒ itself; ANYTHING ELSE ⇒ a loud refusal carrying
+ *  `config.auto_mode_classifier_fallback_invalid`. A typo'd knob must not read as the default: `"non"` would
+ *  keep paying for the rung it meant to turn off. */
+export declare function autoModeClassifierFallbackOf(v: unknown): AutoModeClassifierFallback;
+/** The classifier's verdict over one pending `ask`. Every arm may carry the classification's model
+ *  attribution ({@link AutoModeClassifierRound}), present iff the decider was wired with a candidate ladder. */
+export type AutoModeVerdict = ({
     kind: "allow";
-}
+} & AutoModeRoundAttributed)
 /** `category` is the matched BLOCK rule name (207 output contract); `reason` starts with `[Rule Name]`. */
- | {
+ | ({
     kind: "block";
     category: string;
     reason: string;
-}
+} & AutoModeRoundAttributed)
 /** The classifier could not run: the model leg threw / rejected, or ran past the cap. NOT a decision — the
  *  gate denies and says so ({@link classifierUnavailableDenyMessage}). */
- | {
+ | ({
     kind: "unavailable";
     cause: AutoModeUnavailableCause;
-}
+} & AutoModeRoundAttributed)
 /** The model responded but not in the `<block>…` contract shape. Handled as a BLOCK with the CC
- *  parse-failure sentence ({@link CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE}), counted by the denial limit. */
- | {
+ *  parse-failure sentence ({@link classifierParseFailureDenyMessage}), counted by the denial limit. `form`
+ *  says WHICH way the reply failed ({@link AutoModeParseFailure}): the classify leg re-asks a `missing`
+ *  reply once and never a `conflict`. */
+ | ({
     kind: "parse_error";
     raw: string;
+    form: AutoModeParseFailure;
+} & AutoModeRoundAttributed);
+/** The member every verdict arm shares: WHICH MODEL this classification asked and which one answered. */
+export interface AutoModeRoundAttributed {
+    /** Absent when the decider was given no candidate ladder (a hand-built decider, the cross-process rebuild's
+     *  single fresh leg): it ran on whatever model the leg is bound to and can vouch for no name. Never faked. */
+    readonly classifier?: AutoModeClassifierRound;
+}
+/**
+ * WHICH MODEL answered one classification — the record a walk of the CANDIDATE LADDER
+ * ({@link AutoModeDeciderOptions.candidates}) hands its consumers: `modelRequested` = the ladder's FIRST rung
+ * (the seat the classification was for); `modelUsed` = the rung whose answer the gate acted on, and where NO
+ * candidate ruled, the last rung ATTEMPTED (stated, not implied by absence); `fallback` = present exactly
+ * when the ladder MOVED to reach `modelUsed` — which rung it left, which it arrived at, and why
+ * ({@link AutoModeFallbackCause}); absent = the first rung answered.
+ */
+export interface AutoModeClassifierRound {
+    readonly modelRequested: string;
+    readonly modelUsed: string;
+    readonly fallback?: {
+        readonly from: string;
+        readonly to: string;
+        readonly cause: AutoModeFallbackCause;
+    };
+}
+/**
+ * The classify hook's word for "this classification was NEVER PUT TO A MODEL" — the failure is in assembling
+ * the QUESTION (the transcript window every rung shares), not in a rung's answer.
+ *
+ * WHY IT EXISTS. The ladder advances on "the rung produced no ruling", and a hook that rejects looks exactly
+ * like that. But a classification whose prompt could not be built fails IDENTICALLY on every rung (the build is one
+ * shared promise, by contract — "the same prompt, re-asked" is literal), so the walk recorded a fallback
+ * `{from: seat, to: main, cause: "error"}` and a deny sentence naming two models, for a classification in which NO
+ * MODEL WAS EVER DISPATCHED: a transcript-store outage read, on every face a person can see, as a broken
+ * classifier seat. The verdict is unchanged (fail-closed `unavailable`); what changes is that the record
+ * stops attributing it to models that were never asked.
+ *
+ * Carried as a `code` on the thrown error rather than a class so any classify hook — including one this
+ * package never constructed — can raise it without importing a constructor.
+ *
+ * WHAT IT DOES NOT COVER, stated: a build that OUTRUNS a rung's cap is still recorded as that rung's
+ * `timeout`. The cap bounds the whole classify call, assembly included, so at that point nothing distinguishes
+ * a slow transcript store from a slow model. Moving the per-classification build outside the rung cap is a
+ * seam change, filed for a later version.
+ */
+export declare const AUTO_MODE_ROUND_NOT_ASKED_CODE = "auto_mode.round_not_asked";
+/** Mint the marker above around whatever failed, keeping the original as `cause` for the host's own logs.
+ *  TOTAL by construction: the failure it wraps is an arbitrary value, and an `instanceof` or a `.message` read
+ *  on a revoked proxy (or a throwing getter) THROWS — which would replace the marker with an ordinary error and
+ *  hand the walk back the attribution this whole seat exists to remove. So the detail is a guarded read that
+ *  must already be a string, and the total describer otherwise. */
+export declare function autoModeRoundNotAsked(reason: unknown): Error & {
+    code: string;
 };
+/** Why a rung did not settle the classification, or `undefined` when it RULED and the ladder stops — the ONE
+ *  predicate behind the advance (there is no `if (fallback)` arm anywhere). */
+export declare function rungDidNotRule(v: AutoModeVerdict): AutoModeFallbackCause | undefined;
 /**
  * The model-facing deny text for an `unavailable` verdict — CC 2.1.250 `x1t`, with the parenthetical `EIt`
  * spells for the causes this engine distinguishes (a wall-clock / connection timeout reads " (timed out)";
- * an error of unknown kind reads nothing — CC spells HTTP statuses it has, and this decider does not). The
- * subject is the classifier itself rather than a model id: the decider does not know which model answered,
- * and the sentence must not name one it cannot vouch for. One writer for every deny site (the gate's own
- * station and the inherited-lane arms).
+ * an unknown kind reads nothing). The subject is the classifier itself rather than a model id: without a
+ * candidate ladder the decider cannot vouch for a name. One writer for every deny site. ROOT CAUSE, when
+ * `attribution.fallback` is present: the sentence names BOTH rungs that failed to answer; a ladder that did
+ * NOT move keeps the CC text byte for byte.
  */
-export declare function classifierUnavailableDenyMessage(toolName: string, cause: AutoModeUnavailableCause): string;
-/** The model-facing deny text for a `parse_error` verdict — CC 2.1.250 `Ure` over the R3t stem: the classifier
- *  answered, but not with a verdict, and auto mode blocks what it could not evaluate. */
-export declare const CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE = "Auto mode could not evaluate this action and is blocking it for safety \u2014 the classifier's reply carried no verdict.";
+export declare function classifierUnavailableDenyMessage(toolName: string, cause: AutoModeUnavailableCause, attribution?: AutoModeClassifierRound): string;
 /**
- * Parse the classifier's output contract — the CC 2.1.250 verdict reader (`wCe`, its thinking strip
- * `xCe`, its reason reader `yCe`) ported as is:
+ * The model-facing deny text for a `parse_error` verdict — CC 2.1.259 `i7t` stem ("Auto mode could not evaluate
+ * this action and is blocking it for safety"; 2.1.250 `Ure`): the classifier answered, but not with a verdict,
+ * and auto mode blocks what it could not evaluate. With a candidate ladder wired the tail NAMES the model whose
+ * reply carried no verdict (`attribution.modelUsed`) — a declared departure from upstream, whose card names no
+ * model: the person reading this card is the one who can change the catalog, and on a single-model deployment
+ * the name is the whole diagnosis. Without attribution the sentence is unchanged. The stem is a stable prefix
+ * either way; one writer for both deny sites.
+ */
+export declare function classifierParseFailureDenyMessage(attribution?: AutoModeClassifierRound): string;
+/**
+ * Parse the classifier's output contract — the CC 2.1.259 verdict reader (`MTt`, its thinking strip `QTt`, its
+ * reason reader `TTt`; unchanged from 2.1.250 `wCe`/`xCe`/`yCe`), plus ONE arm of sema's own:
  *   blocked: `<block>yes</block><category>Rule Name</category><reason>[Rule Name] …</reason>`
  *   allowed: `<block>no</block>`
  *
  * The verdict is the set of `<block>yes|no` hits, NOT a prefix match:
  *   1. CONFLICT, read on the RAW text (thinking included): `<block>(yes|no)\b` collected over the whole
- *      response — more than one distinct answer ⇒ no verdict (`parse_error`). A scratch-space "yes"
- *      contradicting a final "no" is a contradiction, not an allow.
- *   2. HITS, read on the text with `<thinking>` blocks removed (closed ones anywhere, then an unclosed
- *      trailing one — a reasoning model's scratch space is not part of the verdict): `<block>(yes|no)\b`
- *      with the closing tag OPTIONAL, at ANY position. Zero hits ⇒ `parse_error` (a reply that only
- *      answered inside its thinking has no verdict); the one distinct answer ⇒ `no` = allow, `yes` = block.
+ *      response — more than one distinct answer ⇒ no verdict (`parse_error`, form `conflict`). A scratch-space
+ *      "yes" contradicting a final "no" is a contradiction, not an allow.
+ *   2. HITS, read on the text with thinking blocks removed ({@link stripThinking}): `<block>(yes|no)\b` with
+ *      the closing tag OPTIONAL, at ANY position. Two distinct answers ⇒ `conflict`; the one distinct answer ⇒
+ *      `no` = allow, `yes` = block.
+ *   3. BARE ANSWER (sema, ruled 2026-09-15 — small open models drop the tag; recorded as a divergence; a caller
+ *      that knows the reply is not a complete answer passes `bareAnswer: false` and this arm is closed): zero
+ *      hits AND the whole thinking-stripped text is an answer by {@link bareAnswerOf} ⇒ that word is the
+ *      verdict (a bare `yes` blocks with empty category/reason) — unless a `<block>` answer inside the
+ *      thinking disagrees with it (`conflict`). Zero hits and anything else — prose, a question with its
+ *      answer, a reply that only answered inside its thinking — ⇒ `parse_error`, form `missing`.
  * So a preamble before the tag, prose after `<block>no`, a missing `</block>` and a reply that repeats
  * its answer all read as the answer they carry; the tag must be spelled `<block>yes` / `<block>no` with
  * no whitespace inside (the word-boundary form — `<block>yesterday` is not a hit) and case does not matter.
  *
  * A stated BLOCK stands with or without its tail: `<category>` (the BLOCK rule NAME the prompt asked
- * for, read case-insensitively as free text — the deployment authors those names, so there is no
- * fixed vocabulary to screen them against) and `<reason>` (first `<reason>…</reason>` pair on the
- * stripped text, the tag spelled as the prompt spells it, trimmed) are carried when present and `""`
- * when absent; the consumers render their
- * own fallback line from the tool name in that case. The block intent is unambiguous either way, and
- * downgrading a stated block to `parse_error` (a block with the generic parse-failure sentence instead
- * of the classifier's own reason) would lose the classifier's explicit verdict on the exact calls it flagged.
+ * for, read case-insensitively as free text — the deployment authors those names, so there is no fixed
+ * vocabulary to screen them against) and `<reason>` (first `<reason>…</reason>` pair on the stripped
+ * text, trimmed) are carried when present and `""` when absent; the consumers render their own fallback
+ * line from the tool name in that case. Downgrading a stated block to `parse_error` would lose the
+ * classifier's explicit verdict on the exact calls it flagged.
  *
- * `parse_error` is fail-closed: the gate handles it as a BLOCK (CC 2.1.250's own outcome for a reply with no
+ * `parse_error` is fail-closed: the gate handles it as a BLOCK (CC 2.1.259's own outcome for a reply with no
  * verdict) that the denial limit counts like any other — never a silent allow, and never a question handed
  * to a person on the classifier's behalf.
  */
-export declare function parseAutoModeResponse(text: string): AutoModeVerdict;
+export declare function parseAutoModeResponse(text: string, options?: {
+    bareAnswer?: boolean;
+}): AutoModeVerdict;
 /** What the decider hands the deployment's `classify` hook (the assembled prompt is the hook's job
  *  when it owns assembly; when using {@link buildAutoModePrompt} the decider passes its output). */
 export interface AutoModeClassifyInput {
@@ -84,19 +191,42 @@ export interface AutoModeClassifyInput {
     /** The human-readable text of the ask being decided (policy/safety message), when present. */
     askMessage?: string;
 }
-/** The pluggable model leg: given the classify input, return the model's raw text response.
- *  Deployment-injected (roster cheap tier per); MAY throw / reject — the decider fail-closes. */
-export type AutoModeClassifyFn = (input: AutoModeClassifyInput, signal?: AbortSignal) => Promise<string>;
+/** One rung of the ladder, as the leg is told about it. `index` is the ADDRESS (a ladder may carry two rungs
+ *  whose model id is the same string), while `model` is the NAME the record will carry. */
+export interface AutoModeLadderRung {
+    readonly index: number;
+    readonly model: string;
+}
+/** The pluggable model leg: given the classify input and the RUNG the ladder is on, return that model's raw
+ *  text response. Deployment-injected; MAY throw / reject — the decider fail-closes. A rejection carrying
+ *  {@link AUTO_MODE_ROUND_NOT_ASKED_CODE} says the failure was in assembling the QUESTION rather than in this
+ *  rung's answer, and stops the walk instead of blaming the next rung. `rung` is `undefined`
+ *  for a decider wired with no ladder. Both trailing parameters are OPTIONAL, not `| undefined`: a caller
+ *  INVOKING it with one or two arguments must keep compiling. */
+export type AutoModeClassifyFn = (input: AutoModeClassifyInput, signal?: AbortSignal, rung?: AutoModeLadderRung) => Promise<string>;
 export interface AutoModeDeciderOptions {
     classify: AutoModeClassifyFn;
-    /** Hard cap on one classification round-trip. Default 15_000 ms (sema 裁量 — CC's constant is not
-     *  established; a permission gate must not stall the whole run on a slow classifier). */
+    /**
+     * The CANDIDATE LADDER this decider walks, in order — the models a classification may be asked on, NOT a
+     * second way to say what `classify` says (that hook is the DISPATCH; this is the sequence it dispatches
+     * to). Rung 0 is the seat the classification is for; every later rung is consulted only when the one
+     * before it produced NO RULING ({@link rungDidNotRule}). The FIRST ruling ends the walk and is the
+     * verdict; when no rung rules, the LAST rung's own non-ruling verdict stands.
+     *
+     * Omitted = a one-rung anonymous ladder: the leg as wired, no attribution on the verdict. An EMPTY array,
+     * or a rung that is not a non-empty string, is REFUSED loudly at construction (a deployment that computed
+     * its ladder and got nothing has a bug, not a default). COST: {@link timeoutMs} bounds ONE rung, so the
+     * worst case is the cap times the rungs actually walked.
+     */
+    candidates?: readonly string[];
+    /** Hard cap on one classification round-trip — one LADDER RUNG, not the whole classification (see
+     *  {@link candidates}). Default 15_000 ms: a permission gate must not stall the whole run on a slow classifier. */
     timeoutMs?: number;
     /**
-     * Fired once per `decide` call with the verdict the gate is about to act on and the wall time it
-     * waited (`ms`, integer ≥ 0; a timed-out round reads the deadline). `cause` is present iff the verdict
-     * is `unavailable`. The engine's own wiring turns this into the `auto_mode.classified` trace frame; a
-     * hand-built decider need not implement it. A throwing hook never breaks the gate.
+     * Fired once per `decide` call with the verdict the gate is about to act on and the wall time it waited
+     * (`ms`, integer ≥ 0; a timed-out classification reads the deadline, one that walked two rungs the whole
+     * walk). `cause` is present iff the verdict is `unavailable`; `classifier` iff a ladder was wired. A
+     * throwing hook never breaks the gate.
      */
     onClassified?: (info: AutoModeClassified) => void;
 }
@@ -110,16 +240,17 @@ export interface AutoModeClassified {
     cause?: Extract<AutoModeVerdict, {
         kind: "unavailable";
     }>["cause"];
+    /** The classification's model attribution, present exactly when the decider was wired with a candidate ladder
+     *  ({@link AutoModeClassifierRound}) — the same object the verdict carries. */
+    classifier?: AutoModeClassifierRound;
 }
 export interface AutoModeDecider {
     /** Never rejects. Any internal failure surfaces as `unavailable`/`parse_error` (fail-closed). */
     decide(input: AutoModeClassifyInput, signal?: AbortSignal): Promise<AutoModeVerdict>;
 }
-/**
- * The per-run decider: timeout + fail-closed error mapping, and nothing carried between rounds. One instance
- * per run (it binds the run's model leg and assembled prompt); a round that failed says nothing about the
- * next one, which asks the model again.
- */
+/** The per-run decider: timeout + fail-closed error mapping, nothing carried between rounds. One instance per
+ *  run (it binds the run's model leg and assembled prompt); a round that failed says nothing about the next,
+ *  which asks the model again. */
 export declare function createAutoModeDecider(opts: AutoModeDeciderOptions): AutoModeDecider;
 /** The deployment's bounds for the denial limit (`RunnerDeps.autoMode.denialLimit`). Every member
  *  optional; an omitted member takes its CC default. A present member with a bad value is REFUSED
@@ -152,24 +283,18 @@ export interface DenialLimitCounts {
  * The DECISION-layer member of a denial-limit fallback ask (`PermissionResult` ask arm): the counts
  * that tripped the bound, and NOTHING about a window. A window is a fact of the ask's ROUTE — a live
  * function approver can count down, a durable park row and a headless deny cannot — and the route is
- * chosen downstream of the count, so the decision that carries these counts is by construction not in
- * a position to state one. The type says so: there is no window member to write here, and the only
+ * chosen downstream of the count. The type says so: there is no window member to write here, and the only
  * ways to reach a {@link DenialLimitFallback} (the member an {@link
  * import("./tool-policy.js").AskRequest} carries) are the two route stations,
- * {@link AutoModeDenialTracker.armTimedWindow} and {@link unarmedWindow}. A host that builds its own
- * gate adapter therefore cannot forward a decision's member straight into an approval request: the
- * compiler stops it and names the station it skipped.
+ * {@link AutoModeDenialTracker.armTimedWindow} and {@link unarmedWindow}.
  */
 export interface UnarmedDenialLimitFallback extends DenialLimitCounts {
     /** FORBIDDEN on a decision, and stated rather than merely omitted. Leaving the member out would only
      *  stop a FRESH object literal (TypeScript's excess-property check); a policy that writes its window
      *  through a `const`, an `as const`, or an annotated return type would still compile — and would then
-     *  have its number silently replaced at whichever route station the ask reached, turning a bounded
-     *  wait into an unbounded one with no diagnostic. `never` makes the old shape a compile error at the
-     *  policy boundary instead, so the retirement of the self-declared window is a migration a host is
-     *  TOLD about rather than one it discovers when nobody is auto-denied. (A host that casts past the
-     *  type still meets the route stations' runtime belt: they write the route's number, never the
-     *  decision's.) */
+     *  have its number silently replaced at whichever route station the ask reached. `never` makes the old
+     *  shape a compile error at the policy boundary instead. (A host that casts past the type still meets
+     *  the route stations' runtime belt: they write the route's number, never the decision's.) */
     readonly autoDenyAfterMs?: never;
 }
 /** The REQUEST-layer member (`AskRequest`, a durable park row, a checkpoint summary's echo): the same