@sema-agent/core 7.26.3 → 7.28.0

package/dist/agents/verify.d.ts

@@ -7,22 +7,21 @@ import type { ModelRef, TaskResult, TaskSpec, TaskStatus, ToolSpec } from "../co
  * an implementation task and tries to BREAK it — read-only, evidence-required, returning a structured
  * verdict — then the gate loops fix→re-verify until PASS or a round cap.
  *
- * PROVENANCE (2026-07-14; RB-306 ④ — re-verified and CORRECTED against CC 2.1.220): distilled and
- * de-branded from the MIT-era upstream source's dedicated `verification` agent — which was an
- * Anthropic-internal A/B experiment (third-party default OFF) and has since been RETIRED upstream:
- * 2.1.207 through 2.1.220 ship NO verification agent. The current upstream completion-gate shape is
- * (a) the Stop hook (`decision:"block"` + reason fed back — sema's Stop hook is at full parity) and
- * (b) — corrected — NOT a bundled skill. There is no built-in `verify` skill in the 220 corpus. What
- * 220 ships is an INSTRUCTION TO CREATE ONE PER PROJECT: its memory prompt (@190146 (cli250.js:38927)) forbids creating
- * project skills ("never create one — a new project skill silently shadows a same-named built-in
- * skill") and makes exactly one exception — "The single exception is verify, because how a project
- * verifies changes is project-specific: put a verify correction in the `.claude/skills/verify/
- * SKILL.md` closest to the code it covers … and if that file does not exist, create it." So upstream's
- * position is "verification is project-specific; teach the user's repo to describe its own", not "here
- * is a verifier". This primitive is therefore a SUPERSET of what upstream ships in a different
- * direction than the old note implied: a spawned falsification-style verifier with a fix loop, bundled. It is
- * orthogonal to and composable with the Stop hook (wire the verdict into a stop() hook to make it a
- * hard completion gate).
+ * PROVENANCE (2026-07-14; re-verified and CORRECTED against CC 2.1.220): distilled and de-branded from the
+ * MIT-era upstream source's dedicated `verification` agent — which was an Anthropic-internal A/B experiment
+ * (third-party default OFF) and has since been RETIRED upstream: 2.1.207 through 2.1.220 ship NO verification
+ * agent. The current upstream completion-gate shape is (a) the Stop hook (`decision:"block"` + reason fed
+ * back — sema's Stop hook is at full parity) and (b) — corrected — NOT a bundled skill. There is no built-in
+ * `verify` skill in the 220 corpus. What 220 ships is an INSTRUCTION TO CREATE ONE PER PROJECT: its memory
+ * prompt (@190146 (cli250.js:38927)) forbids creating project skills ("never create one — a new project skill
+ * silently shadows a same-named built-in skill") and makes exactly one exception — "The single exception is
+ * verify, because how a project verifies changes is project-specific: put a verify correction in the
+ * `.claude/skills/verify/ SKILL.md` closest to the code it covers … and if that file does not exist, create
+ * it." So upstream's position is "verification is project-specific; teach the user's repo to describe its
+ * own", not "here is a verifier". This primitive is therefore a SUPERSET of what upstream ships in a
+ * different direction than the old note implied: a spawned falsification-style verifier with a fix loop,
+ * bundled. It is orthogonal to and composable with the Stop hook (wire the verdict into a stop() hook to make
+ * it a hard completion gate).
  *
  * DEPLOYMENT POSTURE (ruled 2026-07-14): opt-in library primitive ONLY — never a scenario default,
  * never deployed implicitly. It is a **thin composition** over existing core seams — a verifier subtask
@@ -244,11 +243,11 @@ export interface VerificationResult extends TaskResult {
 export declare function verifyCompleted(runner: RunnerSelfSeat, result: TaskResult, specBase: ResumeTaskConfig, objective: string, config: VerifyConfig, 
 /**
  * The TRUSTED, run-scoped internals channel — the same object `Runner.runTask` takes as its second
- * argument — forwarded to EVERY leg this gate drives under the composition forward contract (identity,
- * with the one placement-axis exception stated where the shape is named in `src/index.ts`): the verifier run of each round and
- * each fix continuation (and, from {@link runWithVerification} / {@link resumeWithVerification} /
- * {@link runDeveloperTask}, the implementation leg as well). This doc is the contract for the whole
- * family; the sibling entries carry the same parameter and point here.
+ * argument — forwarded to EVERY leg this gate drives under the composition forward contract
+ * (identity, with the one placement-axis exception stated where the shape is named in
+ * `src/index.ts`): each round's verifier run and each fix continuation, plus (from
+ * {@link runWithVerification} / {@link resumeWithVerification} / {@link runDeveloperTask}) the
+ * implementation leg. This doc is the contract for the family; the siblings point here.
  *
  * WHY THE SEAT EXISTS: these entries return a `TaskResult` and DRAIN each leg's event stream
  * internally, so the host never holds a `TaskStream` for any of them. Without this parameter a
@@ -257,34 +256,31 @@ export declare function verifyCompleted(runner: RunnerSelfSeat, result: TaskResu
  * (`onActivity`, `onForwardEvent`, `onWorkspaceResolved`, `onWiringManifest`) is the only way in.
  *
  * ATTRIBUTION — WEAK, and deliberately stated as such: the legs run SEQUENTIALLY (impl → verifier →
- * fix → verifier → …) and each is dispatched with the SAME object, so a leg's own tool beats are all
- * delivered before the next leg is dispatched. That ORDERING is the whole of it. `ToolActivity`
- * carries no leg identity, so generic activity CANNOT be attributed to a leg from the frame alone:
- * two adjacent legs calling the same tool are indistinguishable, and the structured-output tool is
- * no verifier marker either (an impl spec carrying its own `outputSchema` mounts it too).
- * {@link VerifyConfig.onRound} bounds a ROUND, not a leg — the segment before it holds the impl (or
- * fix) leg's beats AND that round's verifier beats together. A host that needs true per-leg
- * attribution for THOSE frames must drive the legs itself (one `runner.runTask` per leg) rather than
- * read it out of this stream. Two further honesty notes: SUBAGENT events forwarded through
+ * fix → verifier → …) with the SAME object, so a leg's beats are all delivered before the next leg
+ * is dispatched, and that ORDERING is the whole of it. `ToolActivity` carries no leg identity, so
+ * generic activity CANNOT be attributed to a leg from the frame alone: two adjacent legs calling
+ * the same tool are indistinguishable, and the structured-output tool is no verifier marker either
+ * (an impl spec carrying its own `outputSchema` mounts it too). {@link VerifyConfig.onRound} bounds
+ * a ROUND, not a leg — the segment before it holds the impl (or fix) leg's beats AND that round's
+ * verifier beats. A host needing true per-leg attribution for THOSE frames must drive the legs
+ * itself (one `runner.runTask` per leg). Two honesty notes: SUBAGENT events forwarded through
  * `onForwardEvent` do carry their own `sourceTaskId`, and a BACKGROUND child outlives the leg that
- * spawned it — its frames can arrive after that leg returned, i.e. interleaved into a later leg's
- * segment.
+ * spawned it — its frames can arrive interleaved into a later leg's segment.
  *
- * ONE SEAT IS EXEMPT, because its frame is per-leg by construction: `onWiringManifest` fires exactly
- * once per leg, at that leg's start, and this gate hands it the leg's own IDENTITY beside the
- * manifest (the axis, and the two readings a consumer cannot infer, are documented at the seat).
- * That identity is minted HERE, in the dispatch that knows it — the engine stamps none and infers
- * none — so a consumer of this seat reads per-leg attribution instead of reconstructing it from
- * arrival order. This is also the one place the forwarding below is not by identity: a caller that
- * wired that sink gets a fresh per-dispatch copy carrying the bound sink (see `withLegIdentity`),
- * every other field still by its own reference.
+ * ONE SEAT IS EXEMPT, because its frame is per-leg by construction: `onWiringManifest` fires once
+ * per leg, at that leg's start, and this gate hands it the leg's own IDENTITY beside the manifest
+ * (the axis, and the two readings a consumer cannot infer, are documented at the seat). That
+ * identity is minted HERE, in the dispatch that knows it — the engine stamps none — so this seat's
+ * consumer reads per-leg attribution instead of reconstructing it from arrival order. It is also
+ * the one place the forwarding below is not by identity: a caller that wired that sink gets a fresh
+ * per-dispatch copy carrying the bound sink (see `withLegIdentity`), other fields by reference.
  *
- * FAILURE-ISOLATED since #248, by the same primitive as {@link VerifyConfig.onRound} /
+ * FAILURE-ISOLATED, by the same primitive as {@link VerifyConfig.onRound} /
  * {@link VerifyConfig.onVerifierPause}: the fields on this object are invoked by the ENGINE on the
  * run's own path, through a run-scoped safe notifier — a throwing `onActivity` is contained (first
  * failure per site disclosed via `console.warn`, later ones counted) and never faults the leg it
- * fires on. Before #248 a throw here failed the leg (misclassified `provider.error`) and an impl
- * leg was reported incomplete — the MEASURED HAZARD pins that recorded that now pin containment.
+ * fires on. Uncontained, such a throw fails the leg (misclassified `provider.error`) and reports an
+ * impl leg incomplete — the MEASURED HAZARD pins hold containment.
  *
  * FORWARDED WHOLE, NOT FILTERED, with ONE refusal: every field rides every leg, including the
  * ref-valued ones (`peerSelfRef`, `ownOrgAdmissionRef`) whose own contract is one ref per RUN —
@@ -296,12 +292,11 @@ export declare function verifyCompleted(runner: RunnerSelfSeat, result: TaskResu
  * (`refuseUnhonorableInternals`) carries the reasoning, the re-check rule, and what a mid-gate
  * refusal does and does not undo.
  *
- * Absent ⇒ every leg is dispatched exactly as before (each call site passes `undefined`, which is
- * what an omitted optional argument already was) — with ONE design/380 O1② placement delta either
- * way: when neither `placementRoot` nor `rootSessionId` is present, the verifier and fix legs are
- * dispatched with a fresh shallow copy carrying `placementRoot` = the entry implementation leg's
- * sessionId (the gate's placement fixed point); every other field still rides by the same
- * reference, and an internals object that already carries a fixed point is forwarded verbatim.
+ * Absent ⇒ every leg is dispatched with `undefined`, with ONE design/380 O1② placement delta either
+ * way: when neither `placementRoot` nor `rootSessionId` is present, the verifier and fix legs get a
+ * fresh shallow copy carrying `placementRoot` = the entry implementation leg's sessionId (the
+ * gate's placement fixed point); every other field still rides by the same reference, and an
+ * internals object that already carries a fixed point is forwarded verbatim.
  */
 internals?: RunInternals): Promise<VerificationResult>;
 /**

package/dist/brain/input-too-long.d.ts

@@ -1,12 +1,12 @@
 /**
  * design/374 slice 2 — TYPED input-too-long classification for provider refusals.
  *
- * "The request INPUT alone exceeds the model's context limit" used to be recognized only by the
- * loop's prose regex over the human-facing `errorMessage` — a classifier that (a) cannot tell a
- * provider's own diagnostic from caller text a gateway reflected, and (b) breaks the moment a
- * provider rewords. This module classifies at the BRAIN boundary, where provenance is decidable,
- * and the verdict rides `BrainError.inputTooLong` → `AssistantMessage.errorKind: "input_too_long"`
- * (the same typed lane `degenerate`/`length_empty` already use).
+ * "The request INPUT alone exceeds the model's context limit" is recognizable from prose over the
+ * human-facing `errorMessage`, but such a classifier cannot tell a provider's own diagnostic from
+ * caller text a gateway reflected, and breaks the moment a provider rewords. This module classifies
+ * at the BRAIN boundary, where provenance is decidable, and the verdict rides
+ * `BrainError.inputTooLong` → `AssistantMessage.errorKind: "input_too_long"` (the same typed lane
+ * `degenerate`/`length_empty` already use).
  *
  * PROVENANCE DISCIPLINE (mirrors `context-overflow.ts`, the sibling classifier for the
  * input+max_tokens overflow — a DIFFERENT error: there the input fits and lowering the output cap
@@ -24,12 +24,10 @@
  *   - Structural signals need no prose at all: OpenAI-family `error.code ===
  *     "context_length_exceeded"`, and HTTP 413 (the transport's own "request entity too large").
  *
- * Misclassification cost note (updated with the r1 three-state verdict — the original "a miss
- * keeps exactly the pre-374 behavior" claim died with the binary form): inside a PARSED provider
- * envelope a miss is an AUTHORITATIVE negative that SUPPRESSES the loop's prose fallback — which
- * is why the family must carry every observed genuine opening (the r2/r3/r4 additions below);
- * prose-only bodies keep the pre-374 fallback reach via "unknown". A FALSE HIT costs one bounded
- * recovery attempt — but only on a 400/413/422 the request already failed on.
+ * Misclassification cost: inside a PARSED provider envelope a miss is an AUTHORITATIVE negative
+ * that SUPPRESSES the loop's prose fallback — which is why the family must carry every observed
+ * genuine opening; prose-only bodies keep the fallback reach via the "unknown" arm. A FALSE HIT
+ * costs one bounded recovery attempt, and only on a 400/413/422 the request already failed on.
  */
 /** True when the (provider-authored) diagnostic OPENS with the context-limit refusal family. */
 export declare function startsWithInputTooLongAnchor(diagnostic: string): boolean;

package/dist/brain/media-degrade.d.ts

@@ -1,11 +1,10 @@
 /**
  * Media degradation shared by the two message assemblers (anthropic.ts / openai.ts).
  *
- * Both lanes have to answer the same two questions on every request — "may this model see images?"
- * and "what do I say when a media block cannot ride along?" — and both used to answer them with
- * their own copy of the predicate and their own copy of the sentence. One construction point:
- * a capability rule that drifts between lanes is a silent per-provider behavior difference, and a
- * placeholder sentence that drifts is a string consumers grep for.
+ * Both lanes answer the same two questions on every request — "may this model see images?" and
+ * "what do I say when a media block cannot ride along?" — from ONE construction point: a capability
+ * rule that drifts between lanes is a silent per-provider behavior difference, and a placeholder
+ * sentence that drifts is a string consumers grep for.
  */
 import type { Model } from "../internal/llm.js";
 /**

package/dist/brain/reasoning.d.ts

@@ -30,11 +30,10 @@ export declare function isThinkingLevel(v: unknown): v is ThinkingLevel;
  * where it lives); this predicate only closes the gate the three appliers used to re-spell.
  *
  * Single-sourced here because every wire applier (openai.ts `applyThinking`, anthropic.ts's thinking
- * + effort arms, open-responses.ts `resolveWireEffort`) used to re-spell the same three conjuncts —
- * and the REPORTING resolver ({@link resolveReasoning}) mirrored only ONE of them (`!model.reasoning`),
- * so a garbage tier put ZERO parameters on the wire while the resolution claimed a clamped-to-minimal
- * gradient (or echoed the garbage string as `effective` on binary formats). A predicate the appliers
- * and the reporter both call cannot drift.
+ * + effort arms, open-responses.ts `resolveWireEffort`) would otherwise re-spell the same three
+ * conjuncts while the REPORTING resolver ({@link resolveReasoning}) mirrored one of them, so a
+ * garbage tier puts ZERO parameters on the wire while the resolution claims a clamped-to-minimal
+ * gradient. A predicate the appliers and the reporter both call cannot drift.
  */
 export declare function reasoningRequestCarried(model: {
     reasoning?: boolean;
@@ -237,17 +236,16 @@ export interface ResolvedReasoning extends ReasoningResolution {
  * - A CLAMPED tier that `model.thinkingLevelMap` maps to `null` (declared unsupported on this model) →
  *   `graded:false`: both effort-wire appliers key the map by the post-clamp tier and then carry NO effort
  *   value (thinking still enables via the format's own enable key where one exists), so the tier is not
- *   honored. Previously this resolver never read the map and reported such a request as exactly honored
- *   (`graded:true`, `clamped:false`) while the wire dropped the value — trace/result-face drift.
+ *   honored. A resolver blind to the map reports such a request as exactly honored while the wire
+ *   drops the value — trace/result-face drift.
  *
  * - A request that never CARRIES ({@link reasoningRequestCarried} false on a non-"off" value: the model's
  *   `reasoning` capability flag is FALSY, or the requested value is not a valid tier — no brain emits any
  *   thinking parameter for either, whatever the format) → `effective:"off"`, `graded:false`, `clamped:true`,
- *   `dropped:true` — the loud-drop arm. Previously this resolver described the capability dispatch for such
- *   a model (a resolution the request never carried), and the runner's trace guard skipped the frame — the
- *   one arm where the request evaporates was the one arm with no disclosure; and an out-of-contract tier
- *   was worse still — reported as a clamped-to-minimal gradient (or echoed verbatim as `effective` on the
- *   binary formats) while the wire carried nothing.
+ *   `dropped:true` — the loud-drop arm. Describing the capability dispatch instead would report a
+ *   resolution the request never carried, leaving the one arm where the request evaporates as the one
+ *   arm with no disclosure (and an out-of-contract tier reported as a clamped gradient, or echoed as
+ *   `effective` on the binary formats, while the wire carried nothing).
  *
  * `off`/falsy never enables thinking, so it resolves trivially (no clamp, graded:true) — the caller decides
  * whether to emit at all.

package/dist/brain/repetition.d.ts

@@ -72,17 +72,15 @@ export declare function looksDegenerate(text: string): boolean;
  * bounded degenerate-recovery continue would otherwise re-feed the model as context — the very text
  * it must not repeat).
  *
- * Always-on by design (no opt-out flag). The honest argument (fable review tightened the original
- * "zero information loss" claim):
+ * Always-on by design (no opt-out flag). The honest bound — not "zero information loss":
  *  - everything removed is a byte-identical duplicate of the unit that is KEPT, so no UNIQUE text is
  *    ever swallowed (a non-repeating tail never matches and is returned unchanged). What CAN be lost
- *    is a repetition COUNT: if the legitimate text immediately before the loop happened to end with
- *    the same unit repeated (e.g. an intentional "very very" directly abutting a "very"-loop), those
- *    legitimate repeats fold into the loop and collapse to the single kept instance. This only ever
- *    happens on a stream the detector ALREADY cut as degenerate, and the alternative is worse (the
- *    full loop tail re-fed to the model);
- *  - most legitimate verbatim repetition (code lines, dividers) never gets here at all — the 2e1c161
- *    allowances spare it upstream, and a spared stream is never cut;
+ *    is a repetition COUNT: legitimate text ending with the same unit repeated (an intentional
+ *    "very very" abutting a "very"-loop) folds into the loop and collapses to the single kept
+ *    instance. That only happens on a stream the detector ALREADY cut as degenerate, and the
+ *    alternative is worse (the full loop tail re-fed to the model);
+ *  - most legitimate verbatim repetition (code lines, dividers) never gets here — the allowances
+ *    spare it upstream, and a spared stream is never cut;
  *  - the loop may have grown far past the 400-char inspection window before the poll fired; the
  *    scan below strips ALL trailing repeats (and one trailing PARTIAL unit from post-cut buffered
  *    deltas), not just the reps the window measured.

package/dist/brain/request-params.d.ts

@@ -35,25 +35,21 @@ export declare const AUTH_CARRIER_NAMES: ReadonlySet<string>;
 /**
  * #343 — the shared USER-HEADER merge layer (`model.headers` → construction `config.headers` →
  * per-call `options.headers`, later bag wins), CASE-FOLD deduplicated: HTTP header field names are
- * case-insensitive (RFC 9110), but the plain-object spread the three brains used
- * (`{...model.headers, ...config.headers, ...options.headers}`) keyed by exact spelling — a
- * `X-Tenant` in one bag and `x-tenant` in another BOTH survived and both went on the wire, where
- * fetch's Headers folds them into one comma-joined value ("a, b"): neither writer's value, and the
- * later layer's documented override silently defeated. Now a later bag's entry replaces an earlier
- * case-variant; the WINNER'S spelling and value survive (a single-spelling config — every existing
- * deployment — is byte-identical on the wire).
+ * case-insensitive (RFC 9110), but a plain-object spread keys by exact spelling, so an `X-Tenant`
+ * in one bag and an `x-tenant` in another both reach the wire, where fetch's Headers folds them
+ * into one comma-joined value ("a, b") — neither writer's value, the later layer's documented
+ * override silently defeated. A later bag's entry replaces an earlier case-variant instead; the
+ * WINNER'S spelling and value survive (a single-spelling config is byte-identical on the wire).
  *
  * EXEMPT: the auth carriers (`authorization` / `x-api-key`, any case) pass through with plain
  * spread semantics (same-spelling override only, no case-fold dedup), so that the credential
  * enforcement (`applyRouteCredentialHeaders`, route-adjudicator.ts) stays the ONE authority over
  * auth spelling and this layer never becomes a second, subtly different one.
  *
- * RE-RULED, because the exemption used to be justified by a reason that does not hold: the
- * note claimed it protected "the header-only ANTHROPIC_AUTH_TOKEN shape, which must survive under its
- * own capital-A spelling". Dedup would not endanger that shape — it keeps the WINNER'S spelling, and a
- * lone `Authorization` has nothing to be deduped against, so it survives either way; nor does the
- * credential-replaces flow depend on the exemption, since the enforcement already deletes every
- * spelling present when a per-model credential wins. Measured, not reasoned:
+ * The exemption is NOT what keeps a header-only `ANTHROPIC_AUTH_TOKEN` alive: dedup keeps the
+ * winner's spelling, a lone `Authorization` has nothing to dedup against, and the credential
+ * enforcement already deletes every spelling present when a per-model credential wins. What the
+ * exemption really costs is measured, not reasoned:
  * `mergeHeaders({Authorization:A},{authorization:B})` keeps BOTH, and the platform `Headers` fold
  * sends `authorization: A, B`.
  *
@@ -61,20 +57,19 @@ export declare const AUTH_CARRIER_NAMES: ReadonlySet<string>;
  * PER-MODEL credential wins (an options- or entry-bag carrier), every carrier is stripped and only
  * the winning bag's re-asserted, so a cross-layer double spelling now folds to the winner. What
  * remains is the DEPLOYMENT-CONFIG arm — its bytes ride untouched by design — so a config bag that
- * itself spells the SAME auth carrier two ways still ships both, comma-folded. It is held, not
- * denied, on severity: no server accepts a comma-joined credential, so the failure is a LOUD 401
- * attributable to the misconfiguration, whereas the non-auth case this function exists for produced
- * a silently WRONG value (`X-Tenant: a, b` — neither writer's, the later layer's documented
- * override defeated). Tightening it changes which credential reaches the wire, so it belongs in a
- * window that discloses an auth-face behavior change.
+ * itself spells the SAME auth carrier two ways still ships both, comma-folded. Held, not denied, on
+ * severity: no server accepts a comma-joined credential, so that failure is a LOUD 401 attributable
+ * to the misconfiguration, while the non-auth case this function exists for produces a silently
+ * WRONG value (`X-Tenant: a, b`). Tightening it changes which credential reaches the wire, so it
+ * belongs in a window that discloses an auth-face behavior change.
  */
 /**
- * #343 (review r4) — assign a STRUCTURAL locked header under its canonical lowercase name, deleting
- * every case-variant spelling first. The brains hard-lock `content-type` / `anthropic-version` AFTER
- * the user-bag merge precisely so they "can NEVER be overridden" (council design/40) — but a valid
- * user bag carrying `Content-Type: text/plain` survived BESIDE the lowercase lock, and the platform
- * `Headers` fold turns the pair into `text/plain, application/json` on the wire: the lock decided
- * nothing. Auth carriers are deliberately NOT routed through here (credential replacement + the
+ * #343 — assign a STRUCTURAL locked header under its canonical lowercase name, deleting every
+ * case-variant spelling first. The brains hard-lock `content-type` / `anthropic-version` AFTER the
+ * user-bag merge precisely so they "can NEVER be overridden" (council design/40) — and without the
+ * delete a user bag carrying `Content-Type: text/plain` survives BESIDE the lowercase lock, the
+ * platform `Headers` fold turning the pair into `text/plain, application/json` on the wire: a lock
+ * that decides nothing. Auth carriers are deliberately NOT routed through here (credential replacement + the
  * header-only boot flow are the pinned jurisdiction of `applyRouteCredentialHeaders`,
  * route-adjudicator.ts).
  */

package/dist/brain/route-adjudicator.d.ts

@@ -2,10 +2,10 @@
  * key↔URL route pairing adjudication — the SINGLE source of the pairing law.
  *
  * The invariant: **the credential a request carries must belong to the URL the request targets.**
- * A request's URL half is per-ENTRY (`Model.baseUrl`, a required field) while the historical
- * credential fallback was per-BRAIN-INSTANCE (`options.apiKey ?? config.apiKey`): with more than one
- * entry flowing through one brain, the deployment credential silently followed EVERY entry's URL —
- * including a third-party host it was never meant for. This module is what the three first-party
+ * A request's URL half is per-ENTRY (`Model.baseUrl`, a required field) while the credential
+ * fallback is per-BRAIN-INSTANCE (`options.apiKey ?? config.apiKey`): unadjudicated, a deployment
+ * credential follows EVERY entry's URL through one brain — third-party hosts included. This module
+ * is what the three first-party
  * brains now consult before shaping a request, what the brain decorators re-walk per hop (each
  * hop/route re-resolves the three credential states for ITS model against ITS config), and what
  * external consumers (a server annotating a model roster, a conformance suite) import so there is

package/dist/brain/route-conformance.d.ts

@@ -10,8 +10,8 @@ import type { RouteAdjudication, RouteCredential, RoutePairingConfig } from "../
  * (the gold-corpus discipline):
  *  - CORE runs it as a regression test (`test/route-adjudication.test.ts`): every vector's `expect`
  *    MUST equal `adjudicateModelRoute(model, credential, config)` on the `ok`/`posture`/`code`
- *    axes. A change to the law fails the test and updates the corpus in lockstep with the engine
- *    version, so the published contract can never silently drift from the implementation.
+ *    axes, so a change to the law fails the test and updates the corpus in lockstep — the published
+ *    contract cannot silently drift from the implementation.
  *  - A CONSUMER imports this corpus from `@sema-agent/core` and runs it as a CONTRACT test against
  *    whatever face it wired the adjudicator into: for each vector, its surface's
  *    allow/annotate/refuse of the described route MUST match `expect.ok` (and forward

package/dist/brain/status-sink.d.ts

@@ -81,21 +81,19 @@ export declare function emitBrainTelemetry(t: BrainTelemetry): void;
  * belong to ONE outgoing request — the output cap that actually reached the wire and whether it was a
  * HARD bound. The runner's per-leg eager mint cannot know them without re-deriving the adapter's own
  * cap precedence chain (engine override > caller `options.maxTokens` > `model.maxTokens` >
- * brain-construction default), i.e. without standing up a SECOND source of truth that a deployment's
- * own brain, a construction-time default, or a per-attempt engine override would silently desync. So
- * the MINTER reports the facts it judged — the same law `SSERequest.outputCapTokens` already states
- * for the overflow recovery ("what the adapter actually put on the wire", never what a consumer
- * infers) — and the resolver stays the single predicate both faces read.
+ * brain-construction default) — a SECOND source of truth that a deployment's own brain, a
+ * construction-time default or a per-attempt engine override would silently desync. So the MINTER
+ * reports the facts it judged — the law `SSERequest.outputCapTokens` already states for the overflow
+ * recovery ("what the adapter actually put on the wire") — and the resolver stays one predicate.
  *
- * REVOKED ON SETTLEMENT, unlike its two siblings, because this sink WRITES to a seat that is later
- * read into a returned value instead of pushing an advisory frame. `AsyncLocalStorage.run` does not
- * revoke the store from async resources created inside `fn`: a brain call the engine ABANDONED (the
- * brain-call guardrail's whole purpose) keeps the scope alive in its own continuation and can call
- * `observe` long after the task settled — mutating a resolution whose `TaskResult` has already been
- * assembled and handed back, and emitting a trace correction after the task's terminal. The scope
- * therefore carries a liveness flag cleared when `fn`'s promise settles, which is also the "freeze
- * before result assembly" boundary: assembly runs after the brain-driving call resolves, so a report
- * that could still land is exactly one that arrives before the freeze.
+ * REVOKED ON SETTLEMENT, unlike its two siblings, because this sink WRITES to a seat later read into
+ * a returned value instead of pushing an advisory frame. `AsyncLocalStorage.run` does not revoke the
+ * store from async resources created inside `fn`: a brain call the engine ABANDONED (the guardrail's
+ * whole purpose) keeps the scope alive in its own continuation and can call `observe` long after the
+ * task settled — mutating a resolution whose `TaskResult` was already assembled and handed back. The
+ * scope therefore carries a liveness flag cleared when `fn`'s promise settles, which is also the
+ * "freeze before result assembly" boundary: assembly runs after the brain-driving call resolves, so
+ * a report that could still land is exactly one that arrives before the freeze.
  *
  * Passing a NO-OP `observe` is the documented way to SHIELD a nested internal brain call (compaction
  * summary, side query): it installs a fresh innermost scope for the duration, so the inner call's

package/dist/brain/terminal-cause.d.ts

@@ -4,22 +4,19 @@ import type { AssistantMessage } from "../internal/llm.js";
  * turn's human-readable `errorMessage` against an exported sentinel string.
  *
  * Why this file exists at all. The cut is a cross-LAYER signal: a brain stamps it, the loop's
- * recovery lane reacts, and the assembler maps it to a terminal code. Before
- * RB-464 the only carrier was the sentinel prose, compared by identity at six sites in two files.
- * Identity-comparing an exported constant is much safer than matching a prose fragment — the value
- * can be reworded freely and every site follows — but it still makes the CAUSE a string: a brain
- * that stamps the same sentence without importing the constant (a custom `Brain`, a message rebuilt
- * from a field whitelist, a re-encode through a host that normalizes whitespace) is invisible to all
- * six sites at once, silently, with every test still green because the tests import the constant too.
- * `errorKind` carries the cause as data instead; these predicates are the single place that knows how
- * to read it.
+ * recovery lane reacts, and the assembler maps it to a terminal code. Carrying it as sentinel prose
+ * — even an exported constant compared by identity, which at least reworders freely — makes the
+ * CAUSE a string: a brain that stamps the same sentence without importing the constant (a custom
+ * `Brain`, a message rebuilt from a field whitelist, a re-encode through a host that normalizes
+ * whitespace) is invisible to every reading site at once, silently, with the tests still green
+ * because they import the constant too. `errorKind` carries the cause as data instead; these
+ * predicates are the single place that knows how to read it.
  *
- * RB-482 #12 (ruled 2026-08-03, the RB-464 retirement condition met at this window): the transitional
- * `errorMessage`-sentinel fallback is DELETED — `errorKind` is the ONE read. The two shapes the
- * fallback served are closed the documented way: pre-RB-464 stored turns are the sacrificed-replay
- * class (RB-476-A precedent), and stamping `errorKind` on every cut turn is now a documented Brain
- * obligation (see the field's contract note on AssistantMessage). A custom brain that stamps only the
- * sentinel prose is no longer recognized — declared in the 5.1.0 CHANGELOG.
+ * There is no `errorMessage`-sentinel fallback: `errorKind` is the ONE read. The two shapes such a
+ * fallback served are closed the documented way — older stored turns are the sacrificed-replay class,
+ * and stamping `errorKind` on every cut turn is a documented Brain obligation (see the field's
+ * contract note on AssistantMessage). A custom brain that stamps only the sentinel prose is not
+ * recognized; the retirement was declared in the 5.1.0 CHANGELOG.
  */
 /** The subset of an assistant turn that carries a terminal cause. Accepts a full {@link AssistantMessage}. */
 export type TerminalCauseCarrier = Pick<AssistantMessage, "errorKind">;

package/dist/brain/timeout.d.ts

@@ -29,26 +29,25 @@ export declare const MAX_TIMER_DELAY_MS = 2147483647;
 export declare function resolveStallTimeoutMs(value: number | undefined, knob: string): number | undefined;
 /**
  * The engine's ADVISORY per-call stall watchdog values (`StreamOptions.stallTimeouts`), supplied on
- * every provider call. They are a GUARDRAIL, not part of any budget lane: TB2.0 run89's production
- * frame had an in-flight model call sit 680s with ZERO deltas, and `BrainTimeoutConfig` defaults
- * every watchdog to OFF, so nothing finer than the hour-scale {@link BRAIN_CALL_GUARDRAIL_DEFAULT_MS}
- * bounded it. A silent stream is never worth more than these bounds, whether or not the task declared
- * a time limit. All three surface as the brain's existing retryable `network` stall class (design/124
- * tier C retries a zero-content cut, so a transient gateway hang still recovers). 量纲:
+ * every provider call. They are a GUARDRAIL, not part of any budget lane: `BrainTimeoutConfig` defaults
+ * every watchdog to OFF, so without these an in-flight call that goes silent is bounded by nothing
+ * finer than the hour-scale {@link BRAIN_CALL_GUARDRAIL_DEFAULT_MS} (a measured production frame sat
+ * 680s with ZERO deltas). A silent stream is never worth more than these bounds, whether or not the
+ * task declared a time limit. All three surface as the brain's existing retryable `network` stall
+ * class (design/124 tier C retries a zero-content cut, so a transient gateway hang still recovers). 量纲:
  *   - connect 30s: bounds the fetch→response-HEADERS wait — the one segment every post-headers
  *     watchdog is blind to. On a streaming API the model's time is spent AFTER headers, so 30s with
  *     none at all is a hung gateway, not a slow model.
  *   - first-token 600s: bounds the headers→first-delta wait, NOT the model's thought (the first
  *     THINKING delta already counts as the first token, design/17 O5 — see
- *     {@link BrainTimeoutConfig.firstTokenTimeoutMs}), so a slow reasoner is safe. The old 120s rested
- *     on "2 minutes with literally NOTHING is a hung gateway", which is FALSE for a real class of
- *     backend: a self-hosted server working through a long prefill emits nothing at all for 2–3
- *     minutes, and the watchdog cancelled it — burning the prefill and re-sending a request that then
- *     burned it again. A guardrail whose reason is false for healthy traffic is not a guardrail. 600s
- *     is the same order of magnitude as the reference implementation's own request timeout, and the
- *     shapes this bound exists for (a gateway that accepted the request and then died) are still
- *     caught, just later; the task's own hard abort remains the outer bound for everything else.
- *     HONEST CEILING (measured, adversarial round): this watchdog is not the only clock over a
+ *     {@link BrainTimeoutConfig.firstTokenTimeoutMs}), so a slow reasoner is safe. A minutes-scale
+ *     bound would be FALSE for a real class of backend: a self-hosted server working through a long
+ *     prefill emits nothing at all for 2–3 minutes, and cancelling it burns the prefill and re-sends
+ *     a request that burns it again — a guardrail whose reason is false for healthy traffic is not a
+ *     guardrail. 600s is the same order of magnitude as the reference implementation's own request
+ *     timeout, and the shapes this bound exists for (a gateway that accepted the request and then
+ *     died) are still caught, just later; the task's own hard abort remains the outer bound.
+ *     HONEST CEILING (measured): this watchdog is not the only clock over a
  *     byte-silent stream, so 600s is the bound this engine ASKS FOR, not the silence a deployment is
  *     necessarily granted. On Node's own `fetch` — the default transport for both adapters, and the
  *     one a deployment gets by supplying no `fetchImpl` — undici destroys a body that has produced no
@@ -58,10 +57,9 @@ export declare function resolveStallTimeoutMs(value: number | undefined, knob: s
  *     takes any `fetch`, so a deployment needing the full 600s passes one built on an undici
  *     `Agent`/`Dispatcher` with its own `bodyTimeout`. Named here so the next reader who measures ~300s
  *     of tolerance does not conclude this number is a lie.
- *     The OTHER clock that used to sit below this one is fixed rather than disclosed:
- *     {@link import("../orchestration/workflow.js").WORKFLOW_AGENT_STALL_MS} is now DERIVED from
- *     {@link STALL_CONNECT_MS} + this value, so the coarse agent-restart no longer sits UNDER a single
- *     silent provider call by construction. Move this number and that one follows. It is a floor, not
+ *     {@link import("../orchestration/workflow.js").WORKFLOW_AGENT_STALL_MS} is DERIVED from
+ *     {@link STALL_CONNECT_MS} + this value, so the coarse agent-restart cannot sit UNDER a single
+ *     silent provider call. Move this number and that one follows. It is a floor, not
  *     a guarantee of ordering — see that constant's own comment for the cases that still invert.
  *   - idle 90s: mid-stream silence after output started — a healthy stream emits steadily
  *     (comfortably above any provider keep-alive cadence).

package/dist/core/auto-mode-directive.d.ts

@@ -29,16 +29,18 @@ export interface ApprovalPostureFacts {
     approverPosture?: ApproverPosture;
 }
 /**
- * The ONE composition, and the ONE invariant: **each segment the run's posture calls for is stated
+ * The ONE composition, and the ONE invariant: **the segment the run's posture calls for is stated
  * exactly once in the active model context**. `alreadyStated` is the transcript's ENGINE REGIONS (read
  * by metadata — a caller's own bytes are never in one, so a spliced copy cannot suppress the engine's);
  * a segment already standing there is not restated, and a segment that has left the context — compacted
  * away, or never delivered — is. Returns `undefined` when there is nothing left to say, which is both
  * "no posture declared" (zero bytes, byte-identical to the pre-seat shape) and "already said".
  *
- * Segment-wise rather than body-wise on purpose: a leg that gains the second fact must state the second
- * paragraph without restating the first. The caller wraps the result in the engine's marked reminder
- * shell; this module never wraps, so the mark stays owned by its own mint home.
+ * Segment-wise rather than body-wise on purpose: a leg whose posture CHANGES — it gains the bypass fact,
+ * so the segment it owes changes — must state the new segment without restating one already standing,
+ * and must be able to read a body an earlier leg minted under a composition that joined two. The caller
+ * wraps the result in the engine's marked reminder shell; this module never wraps, so the mark stays
+ * owned by its own mint home.
  */
 export declare function composeApprovalPostureDirective(facts: ApprovalPostureFacts, statedBodies?: readonly string[]): string | undefined;
 /** SHA-256 of a directive body — the pins' lock port, so the lock is computed the one way. */

package/dist/core/auto-mode-directive.js

@@ -15,11 +15,7 @@ export function refuseInvalidApproverPosture(spec) {
     return spec.approverPosture;
 }
 export function composeApprovalPostureDirective(facts, statedBodies = []) {
-    const parts = [];
-    if (facts.autoMode)
-        parts.push(AUTO_MODE_DIRECTIVE);
-    if (facts.approverPosture === "bypass")
-        parts.push(BYPASS_POSTURE_DIRECTIVE);
+    const parts = facts.approverPosture === "bypass" ? [BYPASS_POSTURE_DIRECTIVE] : facts.autoMode ? [AUTO_MODE_DIRECTIVE] : [];
     if (parts.length === 0)
         return undefined;
     const stated = new Set();

package/dist/core/engine-notice.d.ts

@@ -392,12 +392,19 @@ export interface EngineNotice {
      *
      *  - `"classifier.denial_limit"` (#548, CC 2.1.250 `FO`/"too many classifier denials in headless
      *    mode") — the auto-mode classifier's DENIAL LIMIT was reached (3 consecutive blocks, or 20 in the
-     *    run; `RunnerDeps.autoMode.denialLimit`) and the fallback ask it turns into had NO approver to go
-     *    to: none wired, a blanket `onAsk:"allow"` (refused for a real-approval ask), or an approver that
-     *    reported unavailable with no durable park to take it. The run was STOPPED — `TaskResult.status`
-     *    `"failed"`, `errorCode` the same code, `errorMessage` the limit sentence — rather than kept
-     *    spending on a model the classifier denies without end; the triggering call's own result is the
-     *    deny that stood. Once per run (the first headless fallback owns the terminal);
+     *    run; `RunnerDeps.autoMode.denialLimit`) and the fallback ask it turns into was never JUDGED by
+     *    anyone. Two lanes reach it. SYNCHRONOUS: no approver to go to — none wired, a blanket
+     *    `onAsk:"allow"` (refused for a real-approval ask), or an approver that reported unavailable with
+     *    no durable park to take it. DURABLE: the fallback PARKED, and the decide that resolved the row
+     *    reported a settlement the nobody-judged table reads as such (`hostDecision.decidedBy:"policy"` ⇒
+     *    `policy_refused`) — a machine answered where the bound had asked for a person, so the last resort
+     *    is the same one. A person's refusal (`"person"` ⇒ `human_refused`) is NOT this notice on either
+     *    lane: someone looked. The run was STOPPED — a `failed` terminal, `code` the same code, `message`
+     *    the limit sentence — rather than kept spending on a model the classifier denies without end; the
+     *    triggering call's own result is the deny that stood. The two lanes' sentences differ in ONE
+     *    clause (which of the two ways nobody answered), and the durable one states the counts the PARKED
+     *    row carried, so a resume in a fresh process reports the streak that actually happened. Once per
+     *    run leg (the first such fallback owns the terminal);
      *    `detail: { sessionId, runId, toolName, toolCallId, consecutive, total, limit }` — `limit` is
      *    `"consecutive"` | `"total"`, the bound that tripped. Audience `"user"` (the person whose run
      *    ended is the one entitled to hear why, and to review the transcript the sentence points at).