@sema-agent/core 7.18.0 → 7.20.0

package/dist/core/runner/classifier-ladder.js

@@ -1,20 +1,98 @@
 import { sameRouteIdentity } from "../../brain/route-adjudicator.js";
-import { thinkingOffExpressible } from "../../brain/reasoning.js";
-import { AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "../auto-mode-defaults.js";
-import { autoModeClassifierFallbackOf } from "../auto-mode.js";
+import { thinkingOffSpelled } from "../../brain/reasoning.js";
+import { AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER, AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, AUTO_MODE_CLASSIFIER_MAX_TOKENS, AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS } from "../auto-mode-defaults.js";
+import { autoModeClassifierFallbackOf, parseAutoModeResponse } from "../auto-mode.js";
+import { DEFAULT_TIER_ORDER, expandTiers, resolveTaskModel, roleSpecNamesModel } from "../roles.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../types.js";
 export function classifierLadderRungs(knob, classifier, main) {
     if (autoModeClassifierFallbackOf(knob) === "none")
         return [classifier];
-    let sameRoute;
+    return sameRouteQuietly(classifier, main) ? [classifier] : [classifier, main];
+}
+function sameRouteQuietly(a, b) {
+    try {
+        return sameRouteIdentity(a, b);
+    }
+    catch {
+        return false;
+    }
+}
+export const CLASSIFIER_ROLE_DEFAULT_REASONS = ["tier_below_main", "tier_table", "role_fallback", "main_only", "role_unresolvable"];
+export function classifierSeatModel(args) {
+    const { main } = args;
+    const deps = normalizeSeatDeps(args.deps);
+    if (roleSpecNamesModel(deps.roles?.classifier)) {
+        try {
+            return { model: resolveTaskModel({ modelRole: "classifier" }, deps).model };
+        }
+        catch {
+            return { model: main, defaulted: "role_unresolvable" };
+        }
+    }
+    const below = tierBelowMain(deps, main);
+    if (below !== undefined)
+        return below;
     try {
-        sameRoute = sameRouteIdentity(classifier, main);
+        const model = resolveTaskModel({ modelRole: "classifier" }, deps).model;
+        if (sameRouteQuietly(model, main))
+            return { model, defaulted: "main_only" };
+        return { model, defaulted: deps.tiers !== undefined && Object.keys(deps.tiers).length > 0 ? "tier_table" : "role_fallback" };
     }
     catch {
-        sameRoute = false;
+        return { model: main, defaulted: "main_only" };
     }
-    return sameRoute ? [classifier] : [classifier, main];
+}
+function normalizeSeatDeps(deps) {
+    if (deps.tiers === undefined)
+        return deps;
+    try {
+        return { ...deps, models: expandTiers(deps.models, deps.tiers) };
+    }
+    catch {
+        return deps;
+    }
+}
+function tierBelowMain(deps, main) {
+    if (deps.tiers === undefined || Object.keys(deps.tiers).length === 0 || deps.models === undefined)
+        return undefined;
+    const bound = DEFAULT_TIER_ORDER.map((tier) => deps.models?.[tier]);
+    let mainTier = -1;
+    for (let i = bound.length - 1; i >= 0; i--) {
+        const m = bound[i];
+        if (m !== undefined && sameRouteQuietly(m, main)) {
+            mainTier = i;
+            break;
+        }
+    }
+    if (mainTier < 0)
+        return undefined;
+    for (let i = mainTier + 1; i < bound.length; i++) {
+        const m = bound[i];
+        if (m !== undefined && !sameRouteQuietly(m, main))
+            return { model: m, defaulted: "tier_below_main" };
+    }
+    return { model: main, defaulted: "main_only" };
+}
+export function announceClassifierRoleDefaulted(args) {
+    const { seat } = args;
+    if (seat.defaulted === undefined)
+        return;
+    const spelled = thinkingOffSpelled(seat.model);
+    deliverEngineNotice(args.onNotice, {
+        code: "classifier.role_defaulted",
+        message: `no classifier role names a model — "${seat.model.id}" classifies this run (${seat.defaulted}); ` +
+            (spelled ? "its wire can turn thinking off for the verdict. " : "its wire cannot turn thinking off, so each classification carries a thinking allowance. ") +
+            "Name a `classifier` role, or declare the model's thinking format (`compat.thinkingFormat`) so the seat can spell off.",
+        detail: {
+            model: seat.model.id,
+            reason: seat.defaulted,
+            thinkingOffSpelled: spelled,
+            ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+            ...(args.runId !== undefined ? { runId: args.runId } : {}),
+        },
+        ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+    });
 }
 function classifierFallbackAnnouncer(args) {
     const announced = new Set();
@@ -41,13 +119,94 @@ function classifierFallbackAnnouncer(args) {
         });
     };
 }
+function classifierContractAnnouncer(args) {
+    const streak = new Map();
+    const announced = new Set();
+    const noVerdict = (rung, model) => {
+        const key = `${rung}:${model}`;
+        const n = (streak.get(key) ?? 0) + 1;
+        streak.set(key, n);
+        if (n < AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER || announced.has(key))
+            return;
+        announced.add(key);
+        deliverEngineNotice(args.onNotice, {
+            code: "classifier.contract_broken",
+            message: `the auto-mode classifier model "${model}" has answered ${n} consecutive classifications without a verdict (each asked twice) — ` +
+                "every gated call it judges is denied. Declare the model's thinking format (`compat.thinkingFormat`) so the seat can turn thinking off, " +
+                "or name a `classifier` role whose model follows the <block> contract.",
+            detail: {
+                model,
+                rung,
+                consecutive: n,
+                ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+                ...(args.runId !== undefined ? { runId: args.runId } : {}),
+            },
+            ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+        });
+    };
+    return (info) => {
+        const record = info.classifier;
+        if (record === undefined)
+            return;
+        if (record.fallback?.cause === "parse_error")
+            noVerdict(0, record.fallback.from);
+        const landed = record.fallback !== undefined ? 1 : 0;
+        if (info.verdict === "parse_error")
+            noVerdict(landed, record.modelUsed);
+        else if (info.verdict === "allow" || info.verdict === "block")
+            streak.delete(`${landed}:${record.modelUsed}`);
+    };
+}
 export const CLASSIFIER_OFF_SEAT = { reasoning: "off", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS };
 export const CLASSIFIER_LOW_SEAT = { reasoning: "low", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS + AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS };
+export const CLASSIFIER_THINK_SEAT = { reasoning: "low", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS + AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS };
 export function classifierRungSeat(model) {
-    return thinkingOffExpressible(model) ? CLASSIFIER_OFF_SEAT : CLASSIFIER_LOW_SEAT;
+    return thinkingOffSpelled(model) ? CLASSIFIER_OFF_SEAT : CLASSIFIER_LOW_SEAT;
+}
+export const CLASSIFIER_ATTEMPT_SUFFIX = {
+    first: '\nErr on the side of blocking. Your ENTIRE response MUST begin with <block>. Do NOT output any analysis, reasoning, or commentary before <block>. No "Looking at..." or similar preamble.',
+    reask: "\nReview the classification process and follow it carefully, making sure you deny actions that should be blocked. As a reminder, explicit (not suggestive or implicit) user confirmation is required to override blocks. Use <thinking> before responding with <block>. Think longer on ambiguous or borderline actions; keep reasoning brief for clear-cut ones.",
+};
+export function classifierReplyText(reply) {
+    return reply.content
+        .filter((c) => c.type === "text")
+        .map((c) => c.text)
+        .join("");
+}
+export function classifierReplyEmptyAtCap(reply) {
+    if (classifierReplyText(reply) !== "")
+        return false;
+    return reply.stopReason === "length" || (reply.stopReason === "error" && reply.errorKind === "length_empty");
+}
+export function classifierReplyTagOnly(reply) {
+    return reply.stopReason === "length" || reply.stopReason === "toolUse" || reply.partialFinalized === true || reply.content.some((c) => c.type === "toolCall");
+}
+export function classifierReplyVerdictText(reply) {
+    const text = classifierReplyText(reply);
+    if (!classifierReplyTagOnly(reply))
+        return text;
+    const tagged = parseAutoModeResponse(text, { bareAnswer: false });
+    return tagged.kind === "parse_error" && tagged.form === "missing" ? "" : text;
+}
+export function classifierReplyAsksAgain(reply) {
+    if (classifierReplyEmptyAtCap(reply))
+        return true;
+    const text = classifierReplyVerdictText(reply);
+    if (text === "")
+        return classifierReplyTagOnly(reply) && classifierReplyText(reply) !== "";
+    const verdict = parseAutoModeResponse(text);
+    return verdict.kind === "parse_error" && verdict.form === "missing";
+}
+export function classifierReplyFailure(reply) {
+    if (reply.stopReason === "aborted")
+        return new Error("the auto-mode classifier request was aborted");
+    if (reply.stopReason !== "error" || reply.errorKind === "length_empty")
+        return undefined;
+    return new Error(`the auto-mode classifier request failed: ${reply.errorMessage ?? "the model leg reported an error with no message"}`);
 }
 export function classifierRoundObserver(args) {
-    const announce = classifierFallbackAnnouncer(args);
+    const announceFallback = classifierFallbackAnnouncer(args);
+    const countContract = classifierContractAnnouncer(args);
     return (info) => {
         emitTrace(args.tracer, () => ({
             kind: "auto_mode.classified",
@@ -60,6 +219,7 @@ export function classifierRoundObserver(args) {
             ...(info.cause !== undefined ? { cause: info.cause } : {}),
             ts: Date.now(),
         }));
-        announce(info.classifier);
+        announceFallback(info.classifier);
+        countContract(info);
     };
 }

package/dist/core/runner/contracts.d.ts

@@ -32,6 +32,7 @@ import type { ClearedProjectionLedger, MicroCompactMachine, OccurrenceIndex } fr
 import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, PostToolBatchResult, ToolGateInput } from "../hooks.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { MemoryEngine } from "../memory-engine/engine.js";
+import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import type { HarvestReport, MemorySessionHandle } from "../memory-engine/types.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
 import type { RecoveredOrphan } from "../session-reconcile.js";
@@ -172,6 +173,35 @@ export interface CommittedPause {
     scope: string;
     gatedCallId?: string;
 }
+/**
+ * One engine frame whose commit waits for the receipt of the message carrying it.
+ *
+ * @contract frames.commit_on_receipt — an engine-minted frame that rides a user message (the git-status
+ * frame, an `agent_listing` or `skills_listing` frame) is recorded as announced ONLY when the run loop's
+ * `message_end` walk sees a persisted user entry whose text equals the carrying text it was registered
+ * with; every receipt with that text settles on that one entry. Until then nothing is recorded — a
+ * message that never reaches the transcript (a pre-append failure, a suppressed or undrained steer, a
+ * leg that ends first) leaves the frame unannounced, and the next boundary or leg renders it again.
+ * The error asymmetry is one-directional by design: a lost receipt costs a duplicate frame, never a
+ * fact the model was recorded as told and was not.
+ */
+export interface FrameReceipt {
+    /** The carrying message's exact text (its first text block) — the receipt's match key. */
+    text: string;
+    /** Which frame this receipt settles. A boundary collector must not render a listing whose receipt is
+     *  still pending (the frame is queued, not yet in the transcript). */
+    source: "git_status" | "agent_listing" | "skills_listing";
+    /** Runs inside the `message_end` walk (synchronous, never awaited): advances the run-local record
+     *  and parks any session write for the next serialization point. */
+    commit: (entryId: string) => void;
+}
+/** The leg's frame-receipt ledger — see {@link FrameReceipt}. `listingSnapshotOwed` is the parked
+ *  announced-listing snapshot write (a session append from inside the walk would race the loop's own
+ *  next transcript append); the boundary's end and the prompt's settle flush it. */
+export interface FrameReceiptLedger {
+    pending: FrameReceipt[];
+    listingSnapshotOwed: boolean;
+}
 export interface Prepared {
     harness: AgentHarness;
     /** The CONCRETE built-in session (engine-internal: prepare constructs/acquires `StoredSession` itself,
@@ -1016,6 +1046,7 @@ export interface Prepared {
         toolName: string;
         seedAnnounced: boolean;
         models?: readonly string[];
+        budget: ResolvedSkillListingBudget;
     };
     /** [c209-C] skills_listing counterpart of {@link agentListing} — the normalized skills METADATA
      *  projection (names/descriptions/attachment paths, never bodies; the exact list `createSkillTool`
@@ -1024,6 +1055,7 @@ export interface Prepared {
     skillsListing?: {
         entries: ReadonlyArray<SkillListingEntry>;
         seedAnnounced: boolean;
+        budget: ResolvedSkillListingBudget;
     };
     /** [c209-C] Q5 — the run loop's live mirror of the listing frames' announced NAME-SETS (updated at
      *  every commit point: first-frame delivery, intact boundary survival, resume seed). Read by the
@@ -1036,6 +1068,9 @@ export interface Prepared {
      *  announce-once-ledger.ts): seeded at prepare from the branch's record, advanced by the run loop
      *  on intact delivery of the tools_delta `failedServers` arm / the mcp_dropped_tools frame. */
     announcedListingsRef: AnnouncedListingSnapshotInput;
+    /** The frame-receipt ledger — the ONE commit point of every engine frame that rides a user message
+     *  (the git-status frame, the agent and skills listing frames). Always present; per leg. */
+    frameReceipts: FrameReceiptLedger;
     /** env-tail migration — the git-status frame lane's run-local state: this leg's
      *  resolved frame (probe outcome rendered + hashed at prepare), the announced `(kind, hash)`
      *  mirror the checkpoint serializer reads, the trim-protection slot the request-build context
@@ -1794,7 +1829,11 @@ export interface RunInternals {
    * `forwardSubagentEvents: true` it ALSO forwards the child's content events (`text_delta` / `text_end` /
      * `reasoning_delta` / `tool_start` / `tool_end` — the subagent viewing pane, carrying the same UNTRUSTED-RAW/consumer-must-redact
      * contract as the main stream's tool events). Either way the child stream is NEVER merged into the parent's
-     * MODEL context (this is purely a render channel). Absent unless the deployment opted in.
+     * MODEL context (this is purely a render channel). Absent unless the deployment opted in. CONTAINED at
+     * one door: every engine site feeding this seat goes through `forwardSafely` (`forward-sink.ts`), so a
+     * sink that throws — or, since an `async` function satisfies this `=> void` type, one that returns a
+     * REJECTING promise — drops its frame and nothing else, never awaited
+     * (`@contract runtask.forward_sink_never_faults_the_run`).
      */
     onForwardEvent?: (event: TaskEvent) => void;
     /**
@@ -1813,6 +1852,12 @@ export interface RunInternals {
     /** The run-local per-tool-call detach hub. runtask creates it and exposes
      *  `TaskStream.detach(toolCallId)`; the hands Bash tool threads `signalFor(toolCallId)` into env.exec. */
     detachHub?: import("../tool-detach.js").ToolDetachHub;
+    /** The run's forwarding-failure bookkeeping for {@link onForwardEvent} — ENGINE-owned and opaque,
+     *  minted once per run by `Runner.runTaskStream` and carried by every later COPY of this object (the
+     *  prepare re-spread, a placement-root rebind, a child's snapshot), which is what makes "announced once
+     *  per run" true across the lanes that forward. A caller value is overridden like the refs beside it;
+     *  absent ⇒ the door mints a per-object one, so containment never depends on the threading. */
+    forwardScope?: import("./forward-sink.js").ForwardSinkScope;
     /**
      * The Runner's per-session read-file-state seats (CC parity: readFileState is
      * session-scoped). Always set by the Runner's own prepare call (overriding any caller value, like

package/dist/core/runner/denial-limit-arms.d.ts

@@ -105,9 +105,12 @@ export declare function inheritedAskCarry(judged: Pick<Extract<InheritedClassifi
 }>, "origin" | "fallback" | "ask">, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
 /** What {@link judgeInheritedClassifier} hands back to the arm that called it. */
 export type InheritedClassifierJudgment<A extends InheritedAsk> = 
-/** The frozen classifier allowed — the arm returns its own allow shape (with or without the ask's rewrite). */
+/** The frozen classifier allowed. `result` is the allow the arm RETURNS — minted at the judging station so
+ *  the model attribution rides the same one object the deny arm's does (an arm re-minting its own
+ *  `{action:"allow"}` drops it); it already carries the ask's rewrite when the arm declared one. */
 {
     kind: "allow";
+    result: PermissionResult;
 }
 /** A block below the bound — the exact deny the ancestor's own gate would have produced. */
  | {
@@ -145,6 +148,13 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  * `req` is the request as the classifier must see it (the arm's presented / edited args);
  * `subject` is the noun the deny names ("this call" on the wrapper arms, "the approved edit" on the
  * re-check).
+ *
+ * ONE MINT for the classification's model attribution: every decision this station hands back — the allow it
+ * mints from `allowRewrite` as much as either deny — carries it on the identity-keyed seat beside the one
+ * carrying the FORM, and the arms return the station's object instead of re-minting their own. The
+ * descendant's fold reads both seats at its single attestation read. A decider with no candidate ladder
+ * vouches for no name and the seat stays empty (absence = unknown); a block AT the bound reaches no seat at
+ * all, since it becomes an ask and the disposition then names that resolution.
  */
 export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     autoMode: InheritedAutoMode | undefined;
@@ -152,6 +162,9 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     req: ToolCallRequest;
     signal: AbortSignal;
     subject: "this call" | "the approved edit";
+    /** The rewrite the arm's allow would have carried (the ask's own `updatedInput`, the re-check's edited
+     *  args) — handed IN so the allow is minted here, attested, once; absent ⇒ a bare allow. */
+    allowRewrite?: unknown;
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
 export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;

package/dist/core/runner/denial-limit-arms.js

@@ -1,6 +1,6 @@
-import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
+import { classifierParseFailureDenyMessage, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
-import { attestClassifierDenyCause } from "../tool-policy.js";
+import { attestClassifierDenyCause, attestClassifierRound } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { askOriginOf, classifierMayAnswer, probeMandatedAsk } from "../ask-origin.js";
@@ -82,17 +82,18 @@ export async function judgeInheritedClassifier(opts) {
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
+    const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
     if (verdict.kind === "allow") {
         autoMode.denialTracking?.recordAllow();
-        return { kind: "allow" };
+        return { kind: "allow", result: attributed({ action: "allow", ...(opts.allowRewrite !== undefined ? { updatedInput: opts.allowRewrite } : {}) }) };
     }
     if (verdict.kind === "unavailable") {
         return {
             kind: "deny",
-            result: attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req),
+            result: attributed(attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req)),
         };
     }
-    const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
+    const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
     const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
     const tracked = autoMode.denialTracking?.recordBlock();
     if (tracked?.limitReached !== true) {
@@ -101,7 +102,7 @@ export async function judgeInheritedClassifier(opts) {
             message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
             decisionReason: "classifier",
         };
-        return { kind: "deny", result: verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied };
+        return { kind: "deny", result: attributed(verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied) };
     }
     const fallback = tracked.fallback;
     const minted = { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };

package/dist/core/runner/env-capability-census.d.ts

@@ -0,0 +1,30 @@
+import type { ExecutionEnv } from "../../internal/harness.js";
+import type { EngineNotice } from "../engine-notice.js";
+/** One capability key whose declared value is not a boolean, with the type it actually carries. */
+export interface MalformedCapabilityDeclaration {
+    readonly key: string;
+    readonly valueType: string;
+}
+/**
+ * Every boolean capability this env DECLARES with a value that is not a boolean.
+ *
+ * The probe is the VALUE, not membership, because the value is what the readers get: a `capabilities`
+ * that answers `has` and `get` differently (a Proxy) would otherwise hide from the census exactly the
+ * value a reader goes on to act on. `undefined` is where absence lands — an absent key and an explicit
+ * `undefined` are the same word to every reader, and both are the documented silent reading — so one
+ * test covers both and the census needs no membership rule at all.
+ *
+ * TOTAL by construction: a diagnostic may not be the thing that fails a run. Every read of the adapter
+ * can throw on a getter or a Proxy trap — the structural probe, the block acquisition and each key —
+ * and a read that throws is itself a declaration nobody can use, so all three are reported rather than
+ * raised (`unreadable`, under the key when there is one and under `capabilities` when the block itself
+ * could not be had).
+ *
+ * What a snapshot cannot promise: this is taken once, at admission. An adapter whose capability values
+ * CHANGE afterwards can hand a later reader something this census never saw; the declaration is
+ * documented as a constant property of the adapter, and a mutable one is outside what any one-time
+ * reading covers.
+ */
+export declare function malformedCapabilityDeclarations(env: ExecutionEnv): MalformedCapabilityDeclaration[];
+/** Announce each malformed declaration once, to the operator who wired the adapter. */
+export declare function announceMalformedCapabilities(env: ExecutionEnv, onNotice: ((notice: EngineNotice) => void) | undefined): void;

package/dist/core/runner/env-capability-census.js

@@ -0,0 +1,38 @@
+import { isRemoteExecutionEnv } from "../remote-env.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+const BOOLEAN_CAPABILITY_KEYS = ["isolation", "suspendable", "canonicalPathAuthoritative"];
+export function malformedCapabilityDeclarations(env) {
+    let caps;
+    try {
+        if (!isRemoteExecutionEnv(env))
+            return [];
+        caps = env.capabilities;
+    }
+    catch {
+        return [{ key: "capabilities", valueType: "unreadable" }];
+    }
+    const out = [];
+    for (const key of BOOLEAN_CAPABILITY_KEYS) {
+        let value;
+        try {
+            value = caps[key];
+        }
+        catch {
+            out.push({ key, valueType: "unreadable" });
+            continue;
+        }
+        if (value === undefined || typeof value === "boolean")
+            continue;
+        out.push({ key, valueType: value === null ? "null" : typeof value });
+    }
+    return out;
+}
+export function announceMalformedCapabilities(env, onNotice) {
+    for (const { key, valueType } of malformedCapabilityDeclarations(env)) {
+        deliverEngineNotice(onNotice, {
+            code: "config.execution_env_capability_invalid",
+            message: `The execution environment declares capabilities.${key} as a ${valueType}, not a boolean. What a reader makes of that is the reader's own business and differs between them — the containment readers take only the boolean, so this reads as undeclared, while the suspend reader takes any truthy value, so a non-empty string reads as TRUE. That is why a declaration of the wrong shape cannot pass quietly: the engine may act on something other than what the adapter meant. Fix the adapter — this is a wiring fault, not a supported way to leave the capability unset.`,
+            detail: { key, valueType },
+        });
+    }
+}

package/dist/core/runner/forward-sink.d.ts

@@ -0,0 +1,32 @@
+import type { TaskEvent } from "../task-event.js";
+import type { RunnerDeps } from "../runner-deps.js";
+import { type SafeNotifier } from "../safe-notify.js";
+/** One run's forwarding-failure bookkeeping: opaque to everything but this module. */
+export interface ForwardSinkScope {
+    readonly notifier: SafeNotifier;
+}
+/** The two seats this module reads off a run's trusted internals — spelled structurally so a SNAPSHOT
+ *  of them (the delegation revive lane holds one) is as valid a holder as the live object. */
+export interface ForwardSinkHolder {
+    onForwardEvent?: (event: TaskEvent) => void;
+    forwardScope?: ForwardSinkScope;
+}
+/**
+ * Mint the forwarding scope for ONE run, bound to the deployment's notice seat. Called where the run's
+ * internals object is composed (`Runner.runTaskStream`), so every copy of that object made later — the
+ * prepare re-spread, a placement-root rebind, a child's snapshot — carries the same counters.
+ */
+export declare function createForwardSinkScope(onNotice: RunnerDeps["onNotice"]): ForwardSinkScope;
+/**
+ * Forward ONE event to the deployment's display sink, containing both failure shapes.
+ *
+ * @contract runtask.forward_sink_never_faults_the_run — a `RunInternals.onForwardEvent` that throws,
+ * or that returns a promise which rejects, never reaches the run's control flow: the frame is dropped,
+ * the failure is counted on the run's own `forwardScope`, and the FIRST one is announced once per run
+ * as `config.forward_sink_failed` (later ones are counted only). Delivery is never awaited — describing
+ * a run is not part of it, so a sink that never settles cannot hold a turn open. An absent sink is a
+ * no-op, and a healthy sink sees the same call it always did, with the same receiver.
+ */
+export declare function forwardSafely(holder: ForwardSinkHolder | undefined, event: TaskEvent): void;
+/** Contained forwarding failures on this scope (diagnostics; 0 on the healthy path). */
+export declare function forwardSinkFailures(holder: ForwardSinkHolder | undefined): number;

package/dist/core/runner/forward-sink.js

@@ -0,0 +1,41 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+import { createSafeNotifier, observeThenableRejection, safeErrorMessage } from "../safe-notify.js";
+const FORWARD_SINK_SITE = "runtask.onForwardEvent";
+const ORPHAN_SCOPES = new WeakMap();
+function forwardSinkFailedNotice(message) {
+    return {
+        code: "config.forward_sink_failed",
+        message: `The subagent display sink (RunInternals.onForwardEvent) failed and the frame was dropped: ${message}. ` +
+            `The run is unaffected — forwarding is a render channel — and further failures of this run are counted, not repeated.`,
+        detail: { site: FORWARD_SINK_SITE, cause: message },
+    };
+}
+export function createForwardSinkScope(onNotice) {
+    return {
+        notifier: createSafeNotifier({
+            onError: (f) => deliverEngineNotice(onNotice, forwardSinkFailedNotice(safeErrorMessage(f.error))),
+        }),
+    };
+}
+function scopeOf(holder) {
+    if (holder.forwardScope !== undefined)
+        return holder.forwardScope;
+    const existing = ORPHAN_SCOPES.get(holder);
+    if (existing !== undefined)
+        return existing;
+    const scope = createForwardSinkScope(undefined);
+    ORPHAN_SCOPES.set(holder, scope);
+    return scope;
+}
+export function forwardSafely(holder, event) {
+    if (holder?.onForwardEvent === undefined)
+        return;
+    const { notifier } = scopeOf(holder);
+    notifier.notify(() => observeThenableRejection(holder.onForwardEvent?.(event), notifier, FORWARD_SINK_SITE), FORWARD_SINK_SITE);
+}
+export function forwardSinkFailures(holder) {
+    if (holder === undefined)
+        return 0;
+    const scope = holder.forwardScope ?? ORPHAN_SCOPES.get(holder);
+    return scope?.notifier.failuresAt(FORWARD_SINK_SITE) ?? 0;
+}

package/dist/core/runner/gate-exit.d.ts

@@ -92,6 +92,10 @@ export interface SettlementLedger {
      *  `parse_error` round travelling through an ancestor wrapper into this fold); undefined for a ruling
      *  block, a non-classifier deny, an allow or an ask. */
     causeOf(decision: PermissionResult): ClassifierDenyCause | undefined;
+    /** Read a decision's attested CLASSIFICATION for this call — which model an ancestor's frozen classifier
+     *  asked and which answered, on the allow arm as much as the deny arm. Undefined when no inherited
+     *  classifier judged the call, or when the ancestor's decider could vouch for no name. */
+    classifierRoundOf(decision: PermissionResult): AutoModeClassifierRound | undefined;
     /** A surviving ask supersedes whatever an earlier decision settled. */
     supersede(): void;
 }

package/dist/core/runner/gate-exit.js

@@ -1,5 +1,5 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
-import { askUnresolvableCauseOf, classifierDenyCauseOf, decisionText, engineSettlementOf } from "../tool-policy.js";
+import { askUnresolvableCauseOf, classifierDenyCauseOf, classifierRoundOf, decisionText, engineSettlementOf } from "../tool-policy.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
 export function mintGateOutcome(facts) {
@@ -56,6 +56,9 @@ export function createSettlementLedger(call) {
         causeOf(decision) {
             return decision.action === "deny" ? classifierDenyCauseOf(decision, call) : undefined;
         },
+        classifierRoundOf(decision) {
+            return classifierRoundOf(decision, call);
+        },
         supersede() {
             settled = undefined;
         },

package/dist/core/runner/git-status-frame.d.ts

@@ -126,15 +126,6 @@ export interface GitStatusLaneRef {
         hash: string;
         entryId: string;
     };
-    /** The duplicate-tolerant receipt slot: set when a frame delivery is in flight, settled by the
-     *  run loop's `message_end` walk when the CARRYING message commits (matched on the exact
-     *  engine-held message text). Commit-on-receipt, never commit-before-append — the git lane's
-     *  error asymmetry is the REVERSE of the listing lane's (a false "announced" = stale git facts
-     *  forever; a duplicate frame = a few idempotent kilobytes). */
-    pendingReceipt?: {
-        text: string;
-        commit: (entryId: string) => void;
-    };
 }
 /**
  * prepare-side probe half of the lane (H4, extracted from prepareTask): run the CC-shape snapshot

package/dist/core/runner/listing-fold.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The ONE folding engine every listing frame renders through — the `<skills>` block, the skills drift
+ * frame's add arm, the agent-type roster and its drift frame's add arm. A listing is an intact-class
+ * turn attachment (`turn-attachments.ts` `ATTACHMENT_DELIVERY_CLASS`): the delivery lane never clips
+ * it, so this engine is the frame's whole bound, byte-exact over the caller's `frame` (headers, fences,
+ * markers, joiners included).
+ *
+ * Three honesty tiers over ONE set of items, each chosen with the LATER tiers' fixed overhead already
+ * reserved so the final render never blows the budget it was sized against:
+ *   A. everything fits → every item gets its full line;
+ *   B. reserve the cap marker + EVERY item's name-only line first, then spend the remaining slack on
+ *      full lines in PRIORITY order (`rank` ascending; absent ⇒ index), admitting each full line whose
+ *      incremental cost still fits and skipping (not stopping at) the ones that do not — every item stays
+ *      listed, the low-priority ones lose their detail;
+ *   C. even all-name-only overflows → the longest name-only prefix that fits, closed by the caller's
+ *      overflow count line.
+ * Pure: the same items, spec and frame always render the same bytes.
+ */
+export interface ListingFoldSpec<T> {
+    /** The whole frame's byte budget, honoured as given. */
+    blockMaxBytes: number;
+    /** One item's full line (tier A, and tier B's admitted lines). */
+    full: (item: T) => string;
+    /** One item's name-only line (tier B's degraded form, tier C's listed prefix). */
+    nameOnly: (item: T) => string;
+    /** The raw name reported for an item the budget degraded (host-facing data, not prompt text). */
+    nameOf: (item: T) => string;
+    /** Priority for keeping the full line: ascending, 0 = first. Absent ⇒ the item's index. */
+    rank?: (item: T, index: number) => number;
+    /** The marker line that opens a degraded (tier B/C) body. */
+    capMarker: string;
+    /** Tier C's closing line for `n` items that could not be listed at all. */
+    overflowLine: (n: number) => string;
+    /** Renders body lines into the lane's frame; its fixed cost is priced once by rendering it empty. */
+    frame: (lines: readonly string[]) => string;
+}
+/** What one fold produced: the frame, and which items the budget degraded (display order). */
+export interface ListingFoldRender {
+    text: string;
+    /** Items listed WITHOUT their full line. */
+    nameOnly: readonly string[];
+    /** Items the frame could not list at all (tier C's overflow tail). */
+    dropped: readonly string[];
+}
+export declare function foldListingWithin<T>(items: ReadonlyArray<T>, spec: ListingFoldSpec<T>): ListingFoldRender | undefined;
+/** The removal arm's FLOOR — the departure fact with none of the names; constant-size, which is what
+ *  keeps the fact from being starved by a budget the names cannot fit. */
+export declare function removalArmFloor(header: string, count: number): string;
+/**
+ * A listing frame's REMOVAL arm rendered INSIDE a byte budget: every departed name when they fit,
+ * otherwise the longest prefix that does, closed by an honest count line — tier C over a list whose
+ * lines have one form, so there is no name-only tier between them. Names are neutralized on the way
+ * out: the announced map holds raw names from the commit half. Cost of the bound, stated: a name that
+ * does not fit is never announced (the commit half advances past it), so the model can still hold an
+ * entry that is gone — one failed call, against a frame that would otherwise never fit its budget.
+ */
+export declare function foldRemovalArmWithin(removed: readonly string[], header: string, maxBytes: number): string;