@sema-agent/core 7.18.0 → 7.20.0

package/dist/core/auto-mode-defaults.d.ts

@@ -1,5 +1,19 @@
-/** Hard cap on one classification round-trip when `AutoModeDeciderOptions.timeoutMs` is omitted. */
-export declare const AUTO_MODE_DEFAULT_TIMEOUT_MS = 15000;
+/**
+ * Hard cap on one classification RUNG (both attempts) when `AutoModeDeciderOptions.timeoutMs` is omitted — CC
+ * 2.1.259's per-attempt classifier base (`j7e = 60000`; 2.1.250 `oue`, the same number), which upstream
+ * stretches to 120 s with prompt size and sema leaves to the deployment knob. The 15 s that stood here was
+ * never upstream's: live 2026-09-15 a thinking-by-default gateway answers in 5–165 s (Qwen 3.8 p50 11–24 s,
+ * kimi and GLM p50 ~10 s), so 15 s turned most classifications into `unavailable (timed out)`. Worst-case
+ * walk = this × rungs (2) = 120 s.
+ */
+export declare const AUTO_MODE_DEFAULT_TIMEOUT_MS = 60000;
+/**
+ * What an arming RECORDING that carries no `timeoutMs` meant when it was written: the default of its day. Every
+ * recipe minted since the deadline moved to 60 s MATERIALISES its bound, so an absent recorded knob dates the
+ * recording — the fold reads it as the 15 s it ran under, never as the current default
+ * (`auto_mode.arming.absent_timeout_reads_recorded_default`, on the fold).
+ */
+export declare const AUTO_MODE_RECORDED_ABSENT_TIMEOUT_MS = 15000;
 /** Newest transcript entries in the classify window when `AutoModeWindowOptions.maxEntries` is omitted. */
 export declare const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
 /** Per-entry excerpt cap when `AutoModeWindowOptions.maxCharsPerEntry` is omitted. */
@@ -17,25 +31,39 @@ export declare const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2000;
  * parses as a block (the parser tolerates a missing tail), a truncated allow does not exist (it is
  * seven tokens), and the cap's job is to make a model that ignores the "no preamble" instruction —
  * or that reasons in-text — cost a bounded, quickly-detected contract failure instead of a slow one.
- * Paired with `reasoning:"off"` at the call: the cap hosts the ANSWER, so it applies only where the
- * wire can say off (`thinkingOffExpressible`); a model that thinks regardless keeps its own budget.
+ * Paired with `reasoning:"off"` at the call: the cap hosts the ANSWER, so it stands alone only where the
+ * wire SPELLS off (`thinkingOffSpelled`); every other seat adds a thinking allowance to it.
  */
 export declare const AUTO_MODE_CLASSIFIER_MAX_TOKENS = 256;
 /**
- * The output-budget ALLOWANCE for a classifier request that must think: added to the verdict cap when the
- * seat asks for `reasoning:"low"` instead of `"off"` — a model whose wire cannot say off (`reasoning:true`
- * with no off spelling on an effort-only wire, or the anthropic adaptive family), or an unknown model whose
- * capped off-request came back EMPTY at the cap (it reasoned anyway). The seat then pays for the lowest
- * reasoning tier plus the verdict, never for an open-ended budget.
+ * The output-budget ALLOWANCE for a classifier request whose thinking the wire could not turn OFF: added to
+ * the verdict cap when the seat asks for `reasoning:"low"` instead of `"off"` — a model whose wire has no off
+ * spelling (`reasoning:true` on an effort-only wire with no declared off, the anthropic adaptive family) and a
+ * model that declares NO reasoning (the wire then carries nothing and the request is the gateway's default,
+ * which on a default-on gateway is a think). The seat pays for the least the wire can grade plus the verdict,
+ * never for an open-ended budget.
  *
- * 2048 is anchored twice: CC 2.1.250 `E4` adds exactly this many tokens to the verdict cap for a model in
- * its `rejects_disabled_thinking` family (`BHe`); and it is 2 × `MIN_THINKING_TOKENS` (1024), so on the
- * anthropic BUDGET path a HARD cap of 256 + 2048 clears the cap-wins skip (`budgetCapSkipsThinking`) and
- * hosts a legal `low` budget (`1024 ≤ budget_tokens < max_tokens`) without the brain having to raise a cap
- * it refuses to raise. A model that spends more than this on thinking still answers nothing — that reply
- * is the contract failure it always was.
+ * 2048 is anchored twice: CC 2.1.259 `MU` adds exactly this many tokens to the verdict cap for a model in
+ * its `rejects_disabled_thinking` family (2.1.250 `E4`/`BHe`); and it is 2 × `MIN_THINKING_TOKENS` (1024), so
+ * on the anthropic BUDGET path a HARD cap of 256 + 2048 clears the cap-wins skip (`budgetCapSkipsThinking`)
+ * and hosts a legal `low` budget (`1024 ≤ budget_tokens < max_tokens`) without the brain having to raise a
+ * cap it refuses to raise. Live 2026-09-15: deepseek's default think fits it ~90–100% of the time; the tail
+ * is the re-ask seat's ({@link AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS}). What a cap can and cannot promise is
+ * the seat's contract (`classifier.budget_is_room`, on `classifierRungSeat`).
  */
 export declare const AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS = 2048;
+/**
+ * The RE-ASK seat's allowance — the room a rung gets ONCE after its first attempt produced no verdict: CC
+ * 2.1.259's stage-2 classifier cap (`max_tokens: 8192 + bn`). Live 2026-09-15 the thinking tail that overruns
+ * 2048 (deepseek 1–2 of 20, some past 4096; Qwen up to 6k) sits under it. One re-ask, never a loop.
+ */
+export declare const AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS = 8192;
+/**
+ * How many CONSECUTIVE no-verdict classifications on ONE model mint `classifier.contract_broken` (once per run
+ * per model): one is a fluke, two is a pattern, and at three the denial limit already hands the user a card —
+ * the operator line lands before that one.
+ */
+export declare const AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER = 2;
 /** The sentinel a deployment puts INSIDE a paired rule list to splice the CC default rules back in at
  *  that position (CC `XYt = "$defaults"`). It lives here, beside the other defaults, because the #503
  *  recipe canonicalizer needs its VALUE and must not load the assembly face (and its SHA-locked assets)

package/dist/core/auto-mode-defaults.js

@@ -1,8 +1,11 @@
-export const AUTO_MODE_DEFAULT_TIMEOUT_MS = 15_000;
+export const AUTO_MODE_DEFAULT_TIMEOUT_MS = 60_000;
+export const AUTO_MODE_RECORDED_ABSENT_TIMEOUT_MS = 15_000;
 export const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
 export const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2_000;
 export const AUTO_MODE_CLASSIFIER_MAX_TOKENS = 256;
 export const AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS = 2048;
+export const AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS = 8192;
+export const AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER = 2;
 export const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
 export const AUTO_MODE_DENIAL_LIMIT_DEFAULTS = Object.freeze({ maxConsecutive: 3, maxTotal: 20 });
 export const AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS = 120_000;

package/dist/core/auto-mode.d.ts

@@ -10,12 +10,27 @@ export declare const AUTO_MODE_UNAVAILABLE_CAUSES: readonly ["error", "timeout"]
 export type AutoModeUnavailableCause = (typeof AUTO_MODE_UNAVAILABLE_CAUSES)[number];
 /** Whether a value is a member of the unavailable-cause set — the screen a row reader applies to a stored word. */
 export declare function isAutoModeUnavailableCause(v: unknown): v is AutoModeUnavailableCause;
+/**
+ * HOW a reply failed to carry a verdict — the closed set behind `parse_error.form`. `missing` = the reader found
+ * NO answer (empty text, prose, an answer only inside a thinking block); `conflict` = it found TWO distinct
+ * `<block>` answers (raw or thinking-stripped). The split decides who gets a SECOND ATTEMPT at the same
+ * question, on both seats that offer one: a missing answer is asked for again (CC 2.1.259 `Vrr` re-asks an
+ * unparseable reply) and handed on to the next candidate ({@link rungDidNotRule}); a conflict gets neither —
+ * it carries a `yes`, and any second attempt that answered `no` would erase it. One rule, two seats: whatever
+ * a re-ask may not overwrite, a later rung may not overwrite either. Not on any wire face; the trace frame and
+ * the gate record keep the one word `parse_error`.
+ */
+export declare const AUTO_MODE_PARSE_FAILURES: readonly ["missing", "conflict"];
+export type AutoModeParseFailure = (typeof AUTO_MODE_PARSE_FAILURES)[number];
+/** Whether a value is a member of the parse-failure set. */
+export declare function isAutoModeParseFailure(v: unknown): v is AutoModeParseFailure;
 /**
  * WHY a classification moved DOWN the candidate ladder — the closed set behind
  * {@link AutoModeClassifierRound}'s `fallback.cause`, i.e. the ways a candidate produces NO RULING
  * ({@link rungDidNotRule}). Two words are the unavailable causes verbatim (the leg threw / rejected; the
- * round-trip cap elapsed); `parse_error` is the candidate that ANSWERED without a verdict. A ruling is not a
- * member: the ladder stops at a verdict either way.
+ * round-trip cap elapsed); `parse_error` is the candidate that ANSWERED with no answer in it at all (the
+ * `missing` form). A ruling is not a member, and neither is a CONTRADICTORY reply (`conflict`): the ladder
+ * stops at a rung that settled the classification, whichever way it settled it.
  */
 export declare const AUTO_MODE_FALLBACK_CAUSES: readonly ["error", "timeout", "parse_error"];
 export type AutoModeFallbackCause = (typeof AUTO_MODE_FALLBACK_CAUSES)[number];
@@ -52,10 +67,14 @@ export type AutoModeVerdict = ({
     cause: AutoModeUnavailableCause;
 } & AutoModeRoundAttributed)
 /** The model responded but not in the `<block>…` contract shape. Handled as a BLOCK with the CC
- *  parse-failure sentence ({@link CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE}), counted by the denial limit. */
+ *  parse-failure sentence ({@link classifierParseFailureDenyMessage}), counted by the denial limit. `form`
+ *  says WHICH way the reply failed ({@link AutoModeParseFailure}) and decides who may try the question a
+ *  second time: the classify leg re-asks a `missing` reply once and the ladder hands it to the next rung;
+ *  a `conflict` gets neither ({@link rungDidNotRule}). */
  | ({
     kind: "parse_error";
     raw: string;
+    form: AutoModeParseFailure;
 } & AutoModeRoundAttributed);
 /** The member every verdict arm shares: WHICH MODEL this classification asked and which one answered. */
 export interface AutoModeRoundAttributed {
@@ -85,20 +104,18 @@ export interface AutoModeClassifierRound {
  * the QUESTION (the transcript window every rung shares), not in a rung's answer.
  *
  * WHY IT EXISTS. The ladder advances on "the rung produced no ruling", and a hook that rejects looks exactly
- * like that. But a classification whose prompt could not be built fails IDENTICALLY on every rung (the build is one
- * shared promise, by contract — "the same prompt, re-asked" is literal), so the walk recorded a fallback
- * `{from: seat, to: main, cause: "error"}` and a deny sentence naming two models, for a classification in which NO
- * MODEL WAS EVER DISPATCHED: a transcript-store outage read, on every face a person can see, as a broken
- * classifier seat. The verdict is unchanged (fail-closed `unavailable`); what changes is that the record
- * stops attributing it to models that were never asked.
+ * like that. But a classification whose prompt could not be built fails IDENTICALLY on every rung (the build is
+ * one shared promise, by contract — "the same prompt, re-asked" is literal), so without this word the walk
+ * records a fallback and a deny sentence naming two models for a classification in which NO MODEL WAS EVER
+ * DISPATCHED. The verdict is unchanged (fail-closed `unavailable`); what this changes is that the record stops
+ * attributing it to models that were never asked.
  *
  * Carried as a `code` on the thrown error rather than a class so any classify hook — including one this
  * package never constructed — can raise it without importing a constructor.
  *
  * WHAT IT DOES NOT COVER, stated: a build that OUTRUNS a rung's cap is still recorded as that rung's
  * `timeout`. The cap bounds the whole classify call, assembly included, so at that point nothing distinguishes
- * a slow transcript store from a slow model. Moving the per-classification build outside the rung cap is a
- * seam change, filed for a later version.
+ * a slow transcript store from a slow model.
  */
 export declare const AUTO_MODE_ROUND_NOT_ASKED_CODE = "auto_mode.round_not_asked";
 /** Mint the marker above around whatever failed, keeping the original as `cause` for the host's own logs.
@@ -109,8 +126,25 @@ export declare const AUTO_MODE_ROUND_NOT_ASKED_CODE = "auto_mode.round_not_asked
 export declare function autoModeRoundNotAsked(reason: unknown): Error & {
     code: string;
 };
-/** Why a rung did not settle the classification, or `undefined` when it RULED and the ladder stops — the ONE
- *  predicate behind the advance (there is no `if (fallback)` arm anywhere). */
+/**
+ * Why a rung did not settle the classification, or `undefined` when it SETTLED it and the ladder stops — the
+ * ONE predicate behind the advance (there is no `if (fallback)` arm anywhere).
+ *
+ * A rung settles the classification two ways: it RULES (`allow` / `block`), or it answers with a
+ * CONTRADICTION (`parse_error` of form `conflict` — two distinct `<block>` answers in one reply). The second
+ * is not a ruling and stays the fail-closed deny it is; what it is NOT is an unanswered question. It holds a
+ * `yes`, so asking the SAME question again — of the same model as a re-ask, or of the next rung as a fallback
+ * — can only overwrite that `yes` with a `no` and allow a call the classifier already objected to. One rule
+ * for both second attempts: {@link AUTO_MODE_PARSE_FAILURES} names the form, the leg reads it for the re-ask
+ * and this predicate reads it for the walk. Only a reply with NO answer in it (`missing`) moves the ladder.
+ *
+ * @contract auto_mode.ladder.advances_on_no_evidence — the candidate ladder advances on exactly one
+ * condition, and it is the ABSENCE of evidence: the rung's leg threw or rejected, its round-trip cap elapsed,
+ * or its reply carried no answer at all. A rung that RULED and a rung whose reply CONTRADICTED itself both
+ * settle the classification where they stand — the contradiction as the fail-closed `parse_error` deny it
+ * already is, attributed to that rung and disclosing no fallback — so no later candidate is ever asked a
+ * question an earlier one has already answered `yes` to.
+ */
 export declare function rungDidNotRule(v: AutoModeVerdict): AutoModeFallbackCause | undefined;
 /**
  * The model-facing deny text for an `unavailable` verdict — CC 2.1.250 `x1t`, with the parenthetical `EIt`
@@ -121,23 +155,35 @@ export declare function rungDidNotRule(v: AutoModeVerdict): AutoModeFallbackCaus
  * NOT move keeps the CC text byte for byte.
  */
 export declare function classifierUnavailableDenyMessage(toolName: string, cause: AutoModeUnavailableCause, attribution?: AutoModeClassifierRound): string;
-/** The model-facing deny text for a `parse_error` verdict — CC 2.1.250 `Ure` over the R3t stem: the classifier
- *  answered, but not with a verdict, and auto mode blocks what it could not evaluate. */
-export declare const CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE = "Auto mode could not evaluate this action and is blocking it for safety \u2014 the classifier's reply carried no verdict.";
 /**
- * Parse the classifier's output contract — the CC 2.1.250 verdict reader (`wCe`, its thinking strip
- * `xCe`, its reason reader `yCe`) ported as is:
+ * The model-facing deny text for a `parse_error` verdict — CC 2.1.259 `i7t` stem ("Auto mode could not evaluate
+ * this action and is blocking it for safety"; 2.1.250 `Ure`): the classifier answered, but not with a verdict,
+ * and auto mode blocks what it could not evaluate. With a candidate ladder wired the tail NAMES the model whose
+ * reply carried no verdict (`attribution.modelUsed`) — a declared departure from upstream, whose card names no
+ * model: the person reading this card is the one who can change the catalog, and on a single-model deployment
+ * the name is the whole diagnosis. Without attribution the sentence is unchanged. The stem is a stable prefix
+ * either way; one writer for both deny sites.
+ */
+export declare function classifierParseFailureDenyMessage(attribution?: AutoModeClassifierRound): string;
+/**
+ * Parse the classifier's output contract — the CC 2.1.259 verdict reader (`MTt`, its thinking strip `QTt`, its
+ * reason reader `TTt`; unchanged from 2.1.250 `wCe`/`xCe`/`yCe`), plus ONE arm of sema's own:
  *   blocked: `<block>yes</block><category>Rule Name</category><reason>[Rule Name] …</reason>`
  *   allowed: `<block>no</block>`
  *
  * The verdict is the set of `<block>yes|no` hits, NOT a prefix match:
  *   1. CONFLICT, read on the RAW text (thinking included): `<block>(yes|no)\b` collected over the whole
- *      response — more than one distinct answer ⇒ no verdict (`parse_error`). A scratch-space "yes"
- *      contradicting a final "no" is a contradiction, not an allow.
- *   2. HITS, read on the text with `<thinking>` blocks removed (closed ones anywhere, then an unclosed
- *      trailing one — a reasoning model's scratch space is not part of the verdict): `<block>(yes|no)\b`
- *      with the closing tag OPTIONAL, at ANY position. Zero hits ⇒ `parse_error` (a reply that only
- *      answered inside its thinking has no verdict); the one distinct answer ⇒ `no` = allow, `yes` = block.
+ *      response — more than one distinct answer ⇒ no verdict (`parse_error`, form `conflict`). A scratch-space
+ *      "yes" contradicting a final "no" is a contradiction, not an allow.
+ *   2. HITS, read on the text with thinking blocks removed ({@link stripThinking}): `<block>(yes|no)\b` with
+ *      the closing tag OPTIONAL, at ANY position. Two distinct answers ⇒ `conflict`; the one distinct answer ⇒
+ *      `no` = allow, `yes` = block.
+ *   3. BARE ANSWER (sema, ruled 2026-09-15 — small open models drop the tag; recorded as a divergence; a caller
+ *      that knows the reply is not a complete answer passes `bareAnswer: false` and this arm is closed): zero
+ *      hits AND the whole thinking-stripped text is an answer by {@link bareAnswerOf} ⇒ that word is the
+ *      verdict (a bare `yes` blocks with empty category/reason) — unless a `<block>` answer inside the
+ *      thinking disagrees with it (`conflict`). Zero hits and anything else — prose, a question with its
+ *      answer, a reply that only answered inside its thinking — ⇒ `parse_error`, form `missing`.
  * So a preamble before the tag, prose after `<block>no`, a missing `</block>` and a reply that repeats
  * its answer all read as the answer they carry; the tag must be spelled `<block>yes` / `<block>no` with
  * no whitespace inside (the word-boundary form — `<block>yesterday` is not a hit) and case does not matter.
@@ -149,11 +195,13 @@ export declare const CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE = "Auto mode could no
  * line from the tool name in that case. Downgrading a stated block to `parse_error` would lose the
  * classifier's explicit verdict on the exact calls it flagged.
  *
- * `parse_error` is fail-closed: the gate handles it as a BLOCK (CC 2.1.250's own outcome for a reply with no
+ * `parse_error` is fail-closed: the gate handles it as a BLOCK (CC 2.1.259's own outcome for a reply with no
  * verdict) that the denial limit counts like any other — never a silent allow, and never a question handed
  * to a person on the classifier's behalf.
  */
-export declare function parseAutoModeResponse(text: string): AutoModeVerdict;
+export declare function parseAutoModeResponse(text: string, options?: {
+    bareAnswer?: boolean;
+}): AutoModeVerdict;
 /** What the decider hands the deployment's `classify` hook (the assembled prompt is the hook's job
  *  when it owns assembly; when using {@link buildAutoModePrompt} the decider passes its output). */
 export interface AutoModeClassifyInput {

package/dist/core/auto-mode.js

@@ -5,6 +5,11 @@ const AUTO_MODE_UNAVAILABLE_CAUSE_SET = new Set(AUTO_MODE_UNAVAILABLE_CAUSES);
 export function isAutoModeUnavailableCause(v) {
     return AUTO_MODE_UNAVAILABLE_CAUSE_SET.has(v);
 }
+export const AUTO_MODE_PARSE_FAILURES = ["missing", "conflict"];
+const AUTO_MODE_PARSE_FAILURE_SET = new Set(AUTO_MODE_PARSE_FAILURES);
+export function isAutoModeParseFailure(v) {
+    return AUTO_MODE_PARSE_FAILURE_SET.has(v);
+}
 export const AUTO_MODE_FALLBACK_CAUSES = ["error", "timeout", "parse_error"];
 const AUTO_MODE_FALLBACK_CAUSE_SET = new Set(AUTO_MODE_FALLBACK_CAUSES);
 export function isAutoModeFallbackCause(v) {
@@ -51,7 +56,7 @@ export function rungDidNotRule(v) {
     if (v.kind === "unavailable")
         return v.cause;
     if (v.kind === "parse_error")
-        return "parse_error";
+        return v.form === "conflict" ? undefined : "parse_error";
     return undefined;
 }
 export function classifierUnavailableDenyMessage(toolName, cause, attribution) {
@@ -64,19 +69,83 @@ export function classifierUnavailableDenyMessage(toolName, cause, attribution) {
         "If it keeps failing, continue with other tasks that don't require this action and come back to it later. " +
         "Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.");
 }
-export const CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE = "Auto mode could not evaluate this action and is blocking it for safety — the classifier's reply carried no verdict.";
-export function parseAutoModeResponse(text) {
+export function classifierParseFailureDenyMessage(attribution) {
+    const stem = "Auto mode could not evaluate this action and is blocking it for safety";
+    return attribution === undefined ? `${stem} — the classifier's reply carried no verdict.` : `${stem} — the classifier model "${attribution.modelUsed}" replied without a verdict.`;
+}
+function stripThinking(text) {
+    return text.replace(/<(thinking|think)>[\s\S]*?<\/\1>/gi, "").replace(/<(thinking|think)>[\s\S]*$/i, "");
+}
+const BARE_ANSWER_WRAPPERS = [
+    ["**", "**"],
+    ["__", "__"],
+    ["*", "*"],
+    ["_", "_"],
+    ["`", "`"],
+    ['"', '"'],
+    ["'", "'"],
+    ["«", "»"],
+];
+function unwrapBareAnswer(text) {
+    let s = text;
+    for (;;) {
+        const before = s;
+        s = s.trim().replace(/[.!]+$/, "").trim();
+        for (const [open, close] of BARE_ANSWER_WRAPPERS) {
+            if (s.length > open.length + close.length && s.startsWith(open) && s.endsWith(close)) {
+                s = s.slice(open.length, s.length - close.length);
+                break;
+            }
+        }
+        if (s === before)
+            return s;
+    }
+}
+function bareAnswerOf(text) {
+    const visible = text.replace(/[\u200b-\u200d\ufeff]/g, "").trim();
+    if (visible.includes("```") || visible.includes("\n"))
+        return undefined;
+    let s = unwrapBareAnswer(visible);
+    const labelled = labelledAnswer(s);
+    if (labelled !== undefined)
+        s = unwrapBareAnswer(labelled);
+    const word = /^(yes|no)$/i.exec(s)?.[1]?.toLowerCase();
+    return word === "yes" || word === "no" ? word : undefined;
+}
+function labelledAnswer(s) {
+    const label = "(?:final[ \\t]+)?(?:block|answer|verdict|decision)";
+    for (const [open, close] of [["", ""], ...BARE_ANSWER_WRAPPERS]) {
+        const re = new RegExp(`^${escapeRe(open)}${label}${escapeRe(close)}[ \\t]*[:=][ \\t]*(.*)$`, "i");
+        const m = re.exec(s);
+        if (m !== null)
+            return m[1];
+    }
+    return undefined;
+}
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+export function parseAutoModeResponse(text, options) {
     const rawAnswers = new Set([...text.matchAll(/<block>(yes|no)\b/gi)].map((m) => m[1].toLowerCase()));
     if (rawAnswers.size > 1)
-        return { kind: "parse_error", raw: text };
-    const stripped = text.replace(/<thinking>[\s\S]*?<\/thinking>/g, "").replace(/<thinking>[\s\S]*$/, "");
+        return { kind: "parse_error", raw: text, form: "conflict" };
+    const stripped = stripThinking(text);
     const hits = [...stripped.matchAll(/<block>(yes|no)\b(<\/block>)?/gi)];
-    if (hits.length === 0)
-        return { kind: "parse_error", raw: text };
-    const answers = new Set(hits.map((m) => m[1].toLowerCase()));
-    if (answers.size !== 1)
-        return { kind: "parse_error", raw: text };
-    if (!answers.has("yes"))
+    let answer;
+    if (hits.length > 0) {
+        const answers = new Set(hits.map((m) => m[1].toLowerCase()));
+        if (answers.size !== 1)
+            return { kind: "parse_error", raw: text, form: "conflict" };
+        answer = answers.has("yes") ? "yes" : "no";
+    }
+    else {
+        answer = options?.bareAnswer === false ? undefined : bareAnswerOf(stripped);
+        if (answer === undefined)
+            return { kind: "parse_error", raw: text, form: "missing" };
+        if (rawAnswers.size > 0 && !rawAnswers.has(answer))
+            return { kind: "parse_error", raw: text, form: "conflict" };
+    }
+    if (answer === "no")
         return { kind: "allow" };
     const category = /<category>([\s\S]*?)<\/category>/i.exec(stripped)?.[1]?.trim() ?? "";
     const reason = /<reason>([\s\S]*?)<\/reason>/.exec(stripped)?.[1]?.trim() ?? "";

package/dist/core/checkpoint-store.d.ts

@@ -369,6 +369,13 @@ export interface PendingSteerInput {
     inputId?: string;
     priority?: SystemInjectionPriority;
 }
+/** True ONLY for a PLAIN data record (not null / array / class-instance / proxy-with-odd-prototype) — the only
+ *  shape we safely digest. Adversarial args (a proxy, a getter that throws) must never crash the mint, so this +
+ *  {@link safeDataValue}/{@link safeKeys} make {@link buildRiskDescriptor} fully TOTAL. */
+export declare function isPlainRecord(x: unknown): x is Record<string, unknown>;
+/** Read `obj[key]` as a DATA property only — NEVER invokes a getter/accessor (so a throwing getter can't escape
+ *  AND a non-deterministic getter can't vary the digest); a trapped descriptor read ⇒ undefined. */
+export declare function safeDataValue(obj: Record<string, unknown>, key: string): unknown;
 /**
  * design/80 §D-E: build the DETERMINISTIC, REDACTED {@link RiskDescriptor} for an escalation checkpoint at
  * MINT. Pure — a function ONLY of (`toolName`, `args`, the D-2 `safety` axis, the `shellGated` flag); it reads

package/dist/core/checkpoint-store.js

@@ -73,7 +73,7 @@ export const MAX_PENDING_STEER_CHARS = 16_000;
 export const PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES = 48_000;
 export const MAX_PENDING_STEER_ENTRIES = Math.floor(PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES / MAX_PENDING_STEER_CHARS);
 export const PENDING_STEER_FROZEN_FIELDS = ["text", "trusted", "actor", "seq", "inputId", "priority"];
-function isPlainRecord(x) {
+export function isPlainRecord(x) {
     try {
         if (x === null || typeof x !== "object" || Array.isArray(x))
             return false;
@@ -84,7 +84,7 @@ function isPlainRecord(x) {
         return false;
     }
 }
-function safeDataValue(obj, key) {
+export function safeDataValue(obj, key) {
     try {
         const d = Object.getOwnPropertyDescriptor(obj, key);
         return d && "value" in d ? d.value : undefined;

package/dist/core/child-clamp-seats.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The TIGHTEN-ONLY CLAMP SEATS an engine-built child spec carries from the run that builds it — and the
+ * ONE carrier every such constructor passes them through.
+ *
+ * Why a carrier and not a convention. The engine builds child specs in several places (the delegation
+ * lane, the observer sidecar, the wake/revival fold, the teacher's internal legs, the verify gate's two
+ * legs, the workflow lane), and each re-deriving per seat WHICH value is the tightening one lands a new
+ * seat one constructor at a time — the ones it does not reach staying invisible, since a `grep readFace`
+ * census cannot see a station that carries the face through a persisted seed or a synthesized fold.
+ *
+ * Two mechanical halves replace the census:
+ *  · the COMPILER — {@link ChildClampSource} requires every seat as a PRESENT key (an `undefined` value
+ *    is fine; a missing key is not), so adding a member to {@link CHILD_CLAMP_SEATS} reds `tsc` at every
+ *    construction site until each one says what it carries there;
+ *  · the SCAN — `scripts/verify-child-clamp-seats.mjs` reads {@link ENGINE_CHILD_SPEC_CONSTRUCTORS} and
+ *    requires each registered constructor to go through this carrier, requires the carrier's own source
+ *    to cover every seat, and requires every tighten-only seat `tightenTaskSpec` governs to be either
+ *    carried here or listed in {@link CHILD_CLAMP_SEATS_NOT_CARRIED} with a reason.
+ *
+ * What "tighten-only" means for this seat list: the value that travels is the RESTRICTING one and only
+ * that one, so a parent that clamped nothing changes nothing about its children, and nothing a child can
+ * author lifts a clamp its parent ran under. That is why the carrier omits a key rather than writing a
+ * loosening value — a constructor may state its own stricter default and spread this after it.
+ */
+import type { ReadDenyEntry } from "../tools/fs/read-deny.js";
+import type { TaskSpec } from "./types.js";
+/**
+ * The clamp seats, as string literals (the closed set the scan and the wire-manifest reader both parse —
+ * a spread or an identifier here reads as an empty set).
+ */
+export declare const CHILD_CLAMP_SEATS: readonly ["handsReadOnly", "interactiveTools", "readFace", "writeFace", "readDenyPatterns"];
+/** One clamp seat's name. */
+export type ChildClampSeat = (typeof CHILD_CLAMP_SEATS)[number];
+/**
+ * The seats `tightenTaskSpec` governs that this carrier deliberately does NOT carry, each with the reason
+ * — the "forgot" / "decided" distinction, kept where a new reader will trip over it. The scan requires
+ * every seat named in `tightenTaskSpec` to be in this table or in {@link CHILD_CLAMP_SEATS}.
+ */
+export declare const CHILD_CLAMP_SEATS_NOT_CARRIED: Readonly<Record<string, string>>;
+/**
+ * The engine-built child-spec constructors, as `<repo-relative file>#<name>` — the closed registry the
+ * scan enumerates. A constructor that builds a spec for a child RUN belongs here; the scan requires each
+ * row to resolve to exactly one declaration IN ITS OWN FILE that calls {@link childClampSeats}.
+ *
+ * Why the file is half the key, and why a shape the scan cannot read is a RED rather than an absence: a
+ * registry keyed on a bare NAME asks a syntactic scan to enumerate every shape that binds a callable, and
+ * that list has no end — every shape it misses leaves the real constructor invisible while a namesake
+ * answers for it.
+ */
+export declare const ENGINE_CHILD_SPEC_CONSTRUCTORS: readonly ["src/agents/subagent.ts#buildChildSpec", "src/agents/subagent.ts#observerSpec", "src/agents/subagent.ts#resumeSpec", "src/agents/teacher.ts#inheritedDeploymentConfig", "src/agents/verify.ts#verifierSpec", "src/agents/verify.ts#fixLegSpec", "src/orchestration/workflow-primitives.ts#workflowChildClamps"];
+/**
+ * The clamp source a construction site hands the carrier: EVERY seat as a present key. A site whose lane
+ * has no value for a seat writes `undefined` explicitly — which is the point, since that is a sentence
+ * a reader (and a diff) can see, unlike an absent key.
+ */
+export interface ChildClampSource {
+    /** The write-hands clamp: only `true` travels. */
+    handsReadOnly: boolean | undefined;
+    /** The hard-headless clamp: only `false` travels. */
+    interactiveTools: boolean | undefined;
+    /** The read containment face: only `"roots"` travels. */
+    readFace: TaskSpec["readFace"] | undefined;
+    /** The write containment face: only `"roots"` travels. */
+    writeFace: TaskSpec["writeFace"] | undefined;
+    /** The deny-set additions: an add-only axis, so a non-empty list travels as a spawn-time copy. */
+    readDenyPatterns: readonly ReadDenyEntry[] | undefined;
+}
+/**
+ * Project a parent's clamps onto a child spec — the ONE place that decides, per seat, which value is the
+ * tightening one and how it is copied. Spread the result onto the child spec; a seat with nothing to
+ * clamp contributes NO KEY, so a constructor may state its own stricter value above the spread and keep
+ * it (a `false` from the parent can never lift it).
+ *
+ * @contract child_spec.clamps_travel_whole — every child spec the ENGINE builds carries the whole of its
+ * parent's tighten-only clamp seats (`CHILD_CLAMP_SEATS`) through this one carrier: only the restricting
+ * value of each seat travels, arrays are copied at spawn, and a seat the parent did not clamp adds no key
+ * — so a clamp can never end one level deep, and a new seat cannot reach some constructors and not others.
+ */
+export declare function childClampSeats(source: ChildClampSource): Partial<TaskSpec>;

package/dist/core/child-clamp-seats.js

@@ -0,0 +1,29 @@
+export const CHILD_CLAMP_SEATS = ["handsReadOnly", "interactiveTools", "readFace", "writeFace", "readDenyPatterns"];
+export const CHILD_CLAMP_SEATS_NOT_CARRIED = Object.freeze({
+    toolPolicy: "not a clamp a child spec copies: a parent's denies reach its children through the ancestor-constraint chain the child's own prepare folds, not by putting the parent's policy object on the child seat",
+    shellGate: "travels on the inherited-gate lane (`InheritedGate.shellGate`, a trusted internals seat), not on the child spec — a spec-level copy would be a second source for the same clamp",
+    onAsk: "per-lane by construction: the delegation lane wraps the parent's approver with spawn provenance before it becomes the child's seat, and a lane with no approver must hand down none",
+    hooks: "a deployment seat, not an inherited clamp — `tightenTaskSpec` refuses to merge two hook sets rather than composing them, so there is no tightening value to carry",
+    excludeTools: "roster control rather than containment: the lanes that copy a parent's roster do so beside these seats, and the workflow lane authors its child roster from the governance baseline instead of the host's",
+    deferTools: "roster control, same reading as `excludeTools` above",
+});
+export const ENGINE_CHILD_SPEC_CONSTRUCTORS = [
+    "src/agents/subagent.ts#buildChildSpec",
+    "src/agents/subagent.ts#observerSpec",
+    "src/agents/subagent.ts#resumeSpec",
+    "src/agents/teacher.ts#inheritedDeploymentConfig",
+    "src/agents/verify.ts#verifierSpec",
+    "src/agents/verify.ts#fixLegSpec",
+    "src/orchestration/workflow-primitives.ts#workflowChildClamps",
+];
+export function childClampSeats(source) {
+    return {
+        ...(source.handsReadOnly === true ? { handsReadOnly: true } : {}),
+        ...(source.interactiveTools === false ? { interactiveTools: false } : {}),
+        ...(source.readFace === "roots" ? { readFace: "roots" } : {}),
+        ...(source.writeFace === "roots" ? { writeFace: "roots" } : {}),
+        ...(source.readDenyPatterns !== undefined && source.readDenyPatterns.length > 0
+            ? { readDenyPatterns: [...source.readDenyPatterns] }
+            : {}),
+    };
+}