@sema-agent/core 7.20.1 → 7.21.1

package/dist/tools/fs/safety.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { sliceHeadSafe } from "../../core/surrogate-safe-slice.js";
 import { pathTargetValue, protectivePathTargetOf } from "../../core/tool-registry.js";
+import { withGateTimeout, DEFAULT_GATE_AWAIT_TIMEOUT_MS } from "../../core/gate-bounded-await.js";
 export function fileArgPath(args) {
     const a = args;
     const fp = a?.file_path;
@@ -291,29 +292,6 @@ function stripWin32ExtendedPrefix(p) {
     }
     return unc ? "\\\\" + rest.slice(unc[0].length) : rest;
 }
-function foldUncLexically(p) {
-    const body = p.slice(2);
-    const segs = body.split(/[\\/]+/).filter((s) => s !== "");
-    const host = segs.shift() ?? "";
-    const share = segs.shift();
-    const out = [];
-    let climbed = false;
-    for (const seg of segs) {
-        if (seg === ".")
-            continue;
-        if (seg === "..") {
-            if (out.length === 0)
-                climbed = true;
-            else
-                out.pop();
-            continue;
-        }
-        const stripped = seg.replace(/[. ]+$/, "");
-        out.push(stripped.length > 0 ? stripped : seg);
-    }
-    const anchor = `\\\\${host}${share !== undefined ? `\\${share}` : ""}`;
-    return { key: out.length > 0 ? `${anchor}\\${out.join("\\")}` : anchor, climbedAboveShare: climbed };
-}
 export function hasWin32AliasedComponent(p) {
     if (!isWinFormPath(p))
         return false;
@@ -325,7 +303,7 @@ export function pathFamilyOf(bases) {
     const tree = bases.root ?? bases.cwd;
     return tree === undefined ? undefined : isWinFormPath(tree) ? "win" : "posix";
 }
-function isUncSpelling(p) {
+export function isUncSpelling(p) {
     return /^[\\/]{2}[^\\/]+[\\/]+[^\\/]/.test(p);
 }
 export function isAbsoluteForFamily(family, p) {
@@ -511,16 +489,26 @@ export async function canonicalizeTarget(env, path, signal, family, baseCwd) {
     if (!screened.ok) {
         return { ok: false, message: `path "${clipSpelling(path)}" ${WIN32_NAMESPACE_REFUSAL_TEXT[screened.refuse]}; refused (${screened.refuse}).`, refused: screened.refuse };
     }
-    const unprefixed = screened.spelled;
-    if (family === "win" && isUncSpelling(unprefixed)) {
-        const folded = foldUncLexically(unprefixed);
-        if (folded.climbedAboveShare) {
-            return { ok: false, message: `path "${path}" climbs above its UNC share root via ".." (\\\\host\\share is the root of a network path); refused.` };
-        }
-        return { ok: true, key: folded.key };
-    }
+    const unprefixed = nativeUncSpellingOf(family, screened.spelled);
     const spelled = family === "posix" && unprefixed.startsWith("//") ? unprefixed.replace(/^\/+/, "/") : unprefixed;
     const target = baseCwd && !isAbsoluteForFamily(family, spelled) ? joinForFamily(family, baseCwd, spelled) : spelled;
+    let thrownByProbe;
+    let seenThrow = false;
+    const probe = probeRealTarget(env, path, target, family, signal).catch((e) => {
+        thrownByProbe = e;
+        seenThrow = true;
+        throw e;
+    });
+    try {
+        return await withGateTimeout(probe, DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "pathCanonicalization");
+    }
+    catch (err) {
+        if (seenThrow && err === thrownByProbe)
+            throw err;
+        return { ok: false, message: `cannot resolve path "${path}": ${err instanceof Error ? err.message : String(err)}` };
+    }
+}
+async function probeRealTarget(env, path, target, family, signal) {
     const absR = await env.absolutePath(target, signal);
     if (!absR.ok)
         return { ok: false, message: `cannot resolve path "${path}": ${absR.error.message}` };
@@ -531,7 +519,7 @@ export async function canonicalizeTarget(env, path, signal, family, baseCwd) {
             return { ok: false, message: `cannot determine whether "${path}" exists: ${exists.error.message}`, unresolvedSymlink: true };
         }
         if (!exists.value) {
-            const newPath = await canonicalizeNewPath(env, abs, signal);
+            const newPath = await canonicalizeNewPath(env, abs, family, signal);
             if (!newPath.ok) {
                 return { ok: false, message: newPath.message, unresolvedSymlink: true };
             }
@@ -545,7 +533,7 @@ export async function canonicalizeTarget(env, path, signal, family, baseCwd) {
             return { ok: false, message: `cannot determine whether "${path}" is a symlink: ${info.error.message}`, unresolvedSymlink: true };
         }
         if (info.value.kind !== "symlink") {
-            const viaAncestors = await canonicalizeNewPath(env, abs, signal, { skipLeaf: true });
+            const viaAncestors = await canonicalizeNewPath(env, abs, family, signal, { skipLeaf: true });
             if (!viaAncestors.ok) {
                 return { ok: false, message: viaAncestors.message, unresolvedSymlink: true };
             }
@@ -574,13 +562,26 @@ function parentDir(abs) {
     const head = abs.slice(0, i);
     return /^[A-Za-z]:$/.test(head) ? head + abs[i] : head;
 }
-async function canonicalizeNewPath(env, abs, signal, opts) {
+function uncAnchorIndex(parts) {
+    let seen = 0;
+    for (let i = 0; i < parts.length; i++) {
+        if (parts[i] === "")
+            continue;
+        seen++;
+        if (seen === 2)
+            return i;
+    }
+    return parts.length;
+}
+async function canonicalizeNewPath(env, abs, family, signal, opts) {
     const sep = nativeSepOf(abs);
-    const parts = isWinFormPath(abs) ? abs.split(/[\\/]/) : abs.split("/");
+    const winForm = family === "win" || isWinFormPath(abs);
+    const parts = winForm ? abs.split(/[\\/]/) : abs.split("/");
     const tail = [];
+    const floor = family === "win" && isUncSpelling(abs) ? uncAnchorIndex(parts) : 1;
     if (opts?.skipLeaf === true && parts.length > 1)
         tail.push(parts.pop());
-    while (parts.length > 1) {
+    while (parts.length > floor) {
         const candidate = parts.join(sep) || sep;
         const ex = await env.exists(candidate, signal);
         if (!ex.ok) {
@@ -591,7 +592,11 @@ async function canonicalizeNewPath(env, abs, signal, opts) {
             if (!canon.ok) {
                 return { ok: false, message: `cannot canonicalize existing ancestor "${candidate}": ${canon.error.message}` };
             }
-            return { ok: true, key: [canon.value, ...tail.reverse()].join(nativeSepOf(canon.value)) };
+            const tailSegments = tail.reverse();
+            const canonSep = nativeSepOf(canon.value);
+            if (tailSegments.length === 0)
+                return { ok: true, key: canon.value };
+            return { ok: true, key: [canon.value.replace(family === "win" ? /[\\/]+$/ : /\/+$/, ""), ...tailSegments].join(canonSep) };
         }
         tail.push(parts.pop());
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.20.1",
+  "version": "7.21.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -88,6 +88,7 @@
     "gate:docs-tool-names": "node scripts/verify-docs-tool-names.mjs",
     "gate:comment-ratio": "vitest run test/comment-ratio-ratchet.test.ts",
     "gate:negative-controls": "vitest run test/gate-negative-controls.test.ts",
+    "gate:memory-ga": "node scripts/gate-memory-distillation-ga.mjs",
     "gate:all": "node scripts/gate-all.mjs",
     "car:gate": "node scripts/car-gate.mjs"
   },

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2389,
+  "count": 2390,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -1369,6 +1369,7 @@
     "SummarizableFinding": "interface",
     "SwappableDepSeat": "type",
     "SwappableDeps": "type",
+    "SymlinkChain": "interface",
     "SyncMemoryScopeOptions": "interface",
     "SyntheticContinuationReason": "type",
     "SystemInjection": "interface",
@@ -3760,6 +3761,7 @@
     "SummarizableFinding": "advanced",
     "SwappableDepSeat": "advanced",
     "SwappableDeps": "advanced",
+    "SymlinkChain": "internal",
     "SyncMemoryScopeOptions": "advanced",
     "SyntheticContinuationReason": "advanced",
     "SystemInjection": "advanced",

package/wire-changes/core@7.21.0.json

@@ -0,0 +1,452 @@
+{
+  "repo": "core",
+  "version": "7.21.0",
+  "from": "6f1349738f7d9d23f81326f1fadcd09fbdca3283",
+  "to": "v7.21.0",
+  "added": [
+    {
+      "name": "SymlinkChain",
+      "kind": "interface",
+      "tier": "internal",
+      "at": [
+        "src/engine/harness/types.ts:400",
+        "src/index.ts:511",
+        "src/internal/harness-types.ts:33"
+      ],
+      "criteriaCovered": true,
+      "breaking": false
+    }
+  ],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (allow -> ask), roots face, unlisted programs (#860; main session): a `NAME=value` word offers its VALUE as a path candidate BESIDE the whole word, judged where the value points. ONE arm read by both boundary faces (`collectSegmentBoundaryFindings`, `src/tools/fs/bash-readonly-classifier.ts:3219-3223`) and by the refused-whole word scan (`unlistedSegmentJudgedInside`, `:1099-1112` and `:1140`), including the LEADING environment words bash strips before choosing the program (`:1164`, `:1178`, `:1183`; launcher scan re-headed from the FIRST token at `:4417`). Who needs it: every roots-face deployment — `dd if=/etc/passwd` read outside the roots at ZERO asks under the default doctrine, because the whole word `if=/etc/passwd` contains a separator and resolved to `./if=/etc/passwd`, inside. Who is hurt: roots-face runs of `make PREFIX=/usr/local`, `docker run -e HOME=/root ...` and every other `NAME=<outside path>` spelling now pay one mandated ask (headless: refused). Compensation: path-less and in-roots values stay at zero asks on both faces, and the open face vouches for a plain value (only the deny half speaks there)."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (allow -> ask), BOTH faces, the two spellings the folded text cannot settle (#860, second half): a value carrying a tilde (`assignmentWordPayload`, `src/tools/fs/bash-readonly-classifier.ts:2971-2978`; `value.includes(\"~\")` at `:2976`) and the APPEND form `NAME+=value` (`:2975`, regex `ASSIGNMENT_OR_APPEND_WORD` at `:2969`) are reported UNRESOLVED and ask on both faces, never guessed — bash expands a tilde in such a word only where it is unquoted, and the folded word no longer says which. STATED OVER-FIRE, measured on the merge tree: a LISTED reader handed `NAME=<outside path>` as a POSITIONAL operand (`cat a=/etc/passwd`) now asks on the roots face too (the card carries a `readRootCandidate` way out); the open face vouches for it. Who is hurt: those two spellings on an unlisted program, plus that one listed-reader shape. Compensation: the fail-closed direction, and the program-position reader is deliberately NOT widened to `+=` (a quoted `'A+=x'` is a command NAME to bash and reading it as an assignment would skip the real program — pinned as a negative control)."
+    },
+    {
+      "id": "F4",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (a stored yes no longer answers it) (#850 / C-R52 / DV-817-1; car-850): the write-protection demotion becomes a member of the MANDATE family — `PERSISTED_RULE_MANDATES` (`src/core/ask-origin.ts:298`, now a registered closed set in `docs/CLOSED-SETS.md` with two total tables behind `AssertAllKeysHandled` fences at `:325` and `:358`), with the two new words `write_protection` and `write_protection_unresolved` placed on the ladder at `persistedRuleMandateOf` (`:398-403`). A matching persisted allow rule is DISCLOSED as shadowed (`persistedRuleShadowed` plus the word's own sentence from `MANDATE_DISCLOSURE`, `:345-357`) instead of clearing the ask. Who needs it: upstream parity — the reference CLI runs the write-protection judge BEFORE the general allow rules, so one stored 'allow this from now on' covering the path silently retired every later write onto the protected table. Who is hurt: a deployment whose store answers `allow` for a write tool (core's own DSL mints no such rule — `parseRuleText` refuses an allow on a path tool; an imported foreign settings store can hold one); those writes ask again, once per write. Compensation: an armed classifier and a person still clear it, and the durable park stays budgetable (`safetyAxisOf` is unchanged — this is not an irreversibility mandate)."
+    },
+    {
+      "id": "F5",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (the same escape through a different door) (#850): the judge now ALSO runs over an ask another layer already raised (`src/core/gate-fold.ts:360-361`, `writeProtectionStandingAsk`) and merges the mandate ALONE — `decision !== undefined && !writeProtectionStandingAsk` at `:381` is what keeps the standing ask's action, message, provenance and disclosures BYTE-IDENTICAL. Who needs it: a deployment whose write face asks FIRST (`FsWriteGatePolicyOptions.defaultWrite: \"ask\"`, or any policy that asks) never reached the judge at all, so the standing rule cleared that question with the table never consulted. Who is hurt: those deployments' protected writes now ask again per write. Compensation: the pin is byte-equality against the same run with no judge mounted (G2.d), so nothing but the mandate word is merged."
+    },
+    {
+      "id": "F6",
+      "source": "behaviorFlips.summary",
+      "text": "ADDITIVE word + NARROWING on the automatic lanes, and one LOUD failure (#850): the judge's OTHER non-clear verdict carries `write_protection_unresolved` (`src/core/ask-origin.ts:398-401`; the pass cells `GatePass.writeProtected` / `GatePass.writeProtectionUnresolved` at `src/core/runner/gate-exit.ts:355-361`, written at `gate-fold.ts:378-379` through the two verdict predicates `writeProtectionMandated` / `writeProtectionUnresolved`, `src/core/write-protect.ts:730/:736`, contract sentence `write_protection.verdict_is_the_mandate`). The ACTION stays the owning arm's (a surviving allow is still denied; an ask another layer raised is untouched). TWO COLUMNS, not one word: `MANDATE_LANE_ANSWERS` (`ask-origin.ts:316-323`) gives this word `classifier: false` (the table's answer for this call is UNKNOWN) and `sandboxAdmission: true` (containment holds the effect whether or not the target is on the table). A judge that TIMES OUT or THROWS produces the same verdict AND reaches `RunnerDeps.onError(phase:\"hook\")` naming the judge, the tool and the callId (`gate-fold.ts:366-375` -> `traceHookCrash`, `gate-exit.ts:197` -> `notifyHookError`, `prepare-ask-lane.ts:342-344`). Who needs it: the cost of F4 is paid in AUTONOMY, so a broken judge must not silently stop every covered write from being handled automatically. Who is hurt: a deployment whose judge is SLOW keeps its writes behind a person or an approver seat on the ask-first path too."
+    },
+    {
+      "id": "F7",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (allow -> ask), one alias shape, every deployment whose environment declares the new seat (#851 / C-R53 / DV-817-3; car-851): the write-protection judge judges every hop of the target's LEAF symlink chain (`src/core/write-protect.ts:673-680`), consulted LAST and ONLY for a terminal that names no row and is not inside the data root; a hop is judged as a SPELLING (`judgeSpelled` at `:614` — the data-root passthrough and the three readings apply) and a hit reports `via: \"chain\"` (`:679`) with its own ask sentence (`writeProtectionTightenDecision`, `:705-707`). Who needs it: `plainname -> <home>/.ssh/newfile` where `<home>/.ssh` is itself a symlink to an unguarded directory was cleared by both judges (measured on 7.20.0 by the black-box acceptance: zero asks, `disposition.kind: \"allowed\"`), while the reference CLI (2.1.259) judges every variant a path has and asks there. Who is hurt: such writes ask once where they execute (headless: refused). Compensation: the exemption by IDENTITY outranks a hop and ends the judgment; a 7.20.0 spelling or target hit keeps its own word and its byte-identical sentence; an environment that declares no chain is byte-identical."
+    },
+    {
+      "id": "F8",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (allow -> deny), the same shape on the sensitive-path deny set (#851): `createSensitivePathPolicy().check` judges each hop as a WRITTEN spelling (both readings, no data-root passthrough — that exemption compares canonical keys and ends the judgment by identity) and refuses naming the pattern (`src/core/sensitive-path-policy.ts:470-484`; reached only when `relative === null`, i.e. the terminal is not inside the data root). Who needs it: deployments that mount the recommended deny set (the server does). Who is hurt: an aliased write whose chain crosses a guarded row is refused rather than executed, on every lane including headless. Compensation: pinned as CURRENT reach and not as a promise — the deny set still does not judge the SPELLING itself, so the direct `~/.ssh/x` under a symlinked `~/.ssh` stays allowed by this set (the table asks) while `plainname -> ~/.ssh/x` is refused; a follow-up ticket carries the spelling arm."
+    },
+    {
+      "id": "F14",
+      "source": "behaviorFlips.summary",
+      "text": "SECURITY / NARROWING (allow -> refuse), win-family trees only (#840 / C-R54; car-840): the UNC lexical arm of `canonicalizeTarget` is deleted (`foldUncLexically` with it), so a win-form `\\\\host\\share\\...` spelling takes the ordinary resolution path — resolve, follow the symlink chain, canonicalize the deepest existing ancestor (`src/tools/fs/safety.ts:1132` onwards; the probing half `probeRealTarget` at `:1240`). Who needs it: on a UNC-rooted workspace a link INSIDE the share was never followed, so a target spelled in-root whose real destination is another share (or a guarded directory) was admitted by root containment, the sensitive-path deny set, the fs write gate, the session `allowDirs` and a skill manifest's `allowPaths` alike — measured on the previous tree, all four fences. Who is hurt: such a spelling is now refused by whichever fence is wired (headless: the write/read is refused rather than executed); a UNC-rooted workspace whose files are ordinary files is unchanged. Compensation: non-win trees are byte-identical spelling for spelling, and the negative-control matrix was re-run against the previous tree."
+    }
+  ],
+  "closedSetMembers": [
+    {
+      "set": "GateWaitFailure",
+      "at": [
+        "src/core/gate-bounded-await.ts:24"
+      ],
+      "newSet": true,
+      "added": [
+        "aborted",
+        "timeout"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "set": "PERSISTED_RULE_MANDATES",
+      "at": [
+        "src/core/ask-origin.ts:298"
+      ],
+      "newSet": true,
+      "added": [
+        "operator_always",
+        "probe_mandate",
+        "probe_unanswered",
+        "tool_marks",
+        "write_protection",
+        "write_protection_unresolved"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "ExecutionEnv",
+      "at": [
+        "src/engine/harness/types.ts:599"
+      ],
+      "added": [
+        "canonicalChain"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    },
+    {
+      "type": "RemoteExecutionEnv",
+      "at": [
+        "src/core/remote-env.ts:313"
+      ],
+      "added": [
+        "canonicalChain"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "RunMemoryConsolidationOptions",
+      "at": [
+        "src/core/memory-engine/consolidation-driver.ts:234"
+      ],
+      "added": [
+        "onNotice"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "RunnerDeps",
+      "at": [
+        "src/core/runner-deps.ts:104"
+      ],
+      "added": [
+        "autoRunOnRecommendation"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    },
+    {
+      "type": "WiringFacts",
+      "at": [
+        "src/core/wiring-manifest.ts:378"
+      ],
+      "added": [
+        "autoConsolidationOnRecommendation"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "WiringManifest",
+      "at": [
+        "src/core/wiring-manifest.ts:164"
+      ],
+      "added": [
+        "autoConsolidation"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "engineNoticeCode",
+      "name": "config.execution_env_capability_invalid",
+      "assertions": [
+        "G4.a"
+      ]
+    },
+    {
+      "kind": "engineNoticeCode",
+      "name": "memory.consolidation_recommended",
+      "assertions": [
+        "G5.c"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.errorCode",
+      "assertions": [
+        "G7.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.isError",
+      "assertions": [
+        "G7.a"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.structured",
+      "assertions": [
+        "G7.e"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.toolName",
+      "assertions": [
+        "G2.d"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "BashReadonlyRootBoundary.denyMatch",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "BashReadonlyRootBoundary.face",
+      "assertions": [
+        "G1.a",
+        "G1.c",
+        "G1.e"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "CompoundReadonlyVerdict.outOfRootPaths",
+      "assertions": [
+        "G1.d"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ExecutionEnv.canonicalChain",
+      "assertions": [
+        "G3.b",
+        "G3.f"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ExecutionEnv.canonicalPath",
+      "assertions": [
+        "G7.d"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "FsWriteGatePolicyOptions.defaultWrite",
+      "assertions": [
+        "G2.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "FsWriteGatePolicyOptions.exemptDirs",
+      "assertions": [
+        "G7.f"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "GateDisposition.classifier",
+      "assertions": [
+        "G8.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "GateDisposition.deniedBy",
+      "assertions": [
+        "G2.e",
+        "G3.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "GateDisposition.kind",
+      "assertions": [
+        "G8.d"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "GateOutcome.settlement",
+      "assertions": [
+        "G8.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "LlmConsolidationPlan.minting",
+      "assertions": [
+        "G6.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "LlmConsolidationPlan.minting.writingChannel",
+      "assertions": [
+        "G6.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "PermissionResult.persistedRuleShadowed",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ReadDenyMatcher.matchTarget",
+      "assertions": [
+        "G3.e"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RemoteExecutionEnv.capabilities",
+      "assertions": [
+        "G4.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ReversibilityVerdict.mandated",
+      "assertions": [
+        "G1.f"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ReversibilityVerdict.readRootCandidate",
+      "assertions": [
+        "G7.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunnerDeps.autoRunOnRecommendation",
+      "assertions": [
+        "G5.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunnerDeps.memoryConsolidation",
+      "assertions": [
+        "G5.d"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunnerDeps.memoryConsolidationDriver",
+      "assertions": [
+        "G5.e"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunnerDeps.onError",
+      "assertions": [
+        "G2.f"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunnerDeps.writeProtectedPaths",
+      "assertions": [
+        "G2.g"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "Settlement.kind",
+      "assertions": [
+        "G2.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "Settlement.who.approver",
+      "assertions": [
+        "G8.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SymlinkChain.hops",
+      "assertions": [
+        "G3.d"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskResult.stats.humanReview",
+      "assertions": [
+        "G8.e"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "WiringManifest.autoConsolidation",
+      "assertions": [
+        "G5.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "WriteProtectionVerdict.via",
+      "assertions": [
+        "G3.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "ExecutionEnv",
+      "RemoteExecutionEnv",
+      "RunnerDeps",
+      "WiringFacts",
+      "WiringManifest"
+    ],
+    "server": [
+      "ExecutionEnv",
+      "RemoteExecutionEnv",
+      "RunMemoryConsolidationOptions",
+      "RunnerDeps",
+      "WiringFacts",
+      "WiringManifest"
+    ],
+    "sdk": [
+      "ExecutionEnv",
+      "RunnerDeps",
+      "WiringManifest"
+    ],
+    "note": "scanned cli@0f132216 server@6e121caf sdk@6209e5e — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "abb48087842215283113c231f31d255691a3b8dc"
+}

package/wire-changes/core@7.21.1.json

@@ -0,0 +1,41 @@
+{
+  "repo": "core",
+  "version": "7.21.1",
+  "from": "d1999920883607f4063bb8e311f0cc98633218c4",
+  "to": "v7.21.1",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "RunnerDeps.autoRunOnRecommendation",
+      "assertions": [
+        "G1.b",
+        "G1.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "WiringManifest.autoConsolidation",
+      "assertions": [
+        "G1.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@0f132216 server@6e121caf sdk@6209e5e — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "33bdf10459de6fbf3a9ede670468f73f95203628"
+}