@sema-agent/core 7.36.0 → 7.37.1

package/dist/core/tool-name-readings.js

@@ -50,6 +50,7 @@ export const NAME_READINGS = {
     "report.riskAxes": seat("tier", CHAIN),
     "report.riskAxes.egress": any(CHAIN),
     "report.riskAxes.negatives": seat("member", CHAIN),
+    "report.markSources": any(CHAIN),
     "verify.wroteThisRun": wire(HANDLERS),
     "verify.wroteThisRunSeed": wire("src/core/runner/run-attachment-seats.ts"),
     "event.toolStartEnd": spelling(HANDLERS),

package/dist/core/tool-policy.d.ts

@@ -262,18 +262,9 @@ export declare function screenApproverAttribution(v: unknown): {
  * or `approver` member on its verdict is putting an unread property on it.
  * RB-479-B① (ruled 2026-08-02): the legacy `reason` field is REMOVED — one name for one thing.
  *
- * How far the TYPE carries that retirement (measured 2026-08-03, correcting this note's earlier claim
- * that a policy returning `{reason}` "compiles red for TS consumers"): TypeScript's excess-property
- * check fires only where the decision is a LITERAL in an ANNOTATED position — `const d: PermissionResult
- * = {…}`, or a `check` written with an explicit `: PermissionResult` return annotation. The ordinary
- * policy shape, `{ check: () => ({…}) }` with an INFERRED return type (also the method-syntax and
- * assign-then-return forms), compiles GREEN with a stray `reason`. That is not a hole to plug in the
- * type system — it is how contextual typing works — so the enforcement is at RUNTIME instead: every
- * point that CONSUMES a decision REFUSES one carrying an own `reason` property, fail-closed (deny, with
- * a migration message) — the {@link combinePolicies} fold, the PreToolUse hook face, and the durable
- * resume-edit rechecks (see {@link refuseOutOfContractDecision}). Same doctrine as the strict `approve`
- * / `onAsk` folds in this file: an out-of-contract value on the permission face is a loud rejection,
- * never a best-effort read.
+ * The TYPE carries that retirement only where a decision is a literal in an annotated position; an inferred `check`
+ * return compiles green with a stray `reason`, so the enforcement is at RUNTIME — every point that consumes a decision
+ * refuses one carrying an own `reason` property, fail-closed ({@link refuseOutOfContractDecision}).
  */
 export type PermissionResult = {
     action: "allow";
@@ -387,6 +378,13 @@ export type PermissionResult = {
      *  render the card by it. Optional on the TYPE only because a decision is caller-composable; every ask
      *  the gate hands to its resolver carries it. */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** The ask's CLASS — the first member of {@link classes} (see {@link AskRequest.askClass}). ENGINE-STAMPED at the
+     *  same single stamp as {@link origin}, from the class set the gate's lanes read; a policy that self-declares it is
+     *  overwritten there, and no lane reads it back (they read the classification itself). */
+    askClass?: import("./ask-origin.js").AskClass;
+    /** The ask's whole class set, in {@link import("./ask-origin.js").ASK_CLASSES} order (see
+     *  {@link AskRequest.classes}). Stamped beside {@link askClass}, under the same rule. */
+    classes?: readonly import("./ask-origin.js").AskClass[];
     /** WHICH integrity guard minted this ask — the unverifiable recursive delete or the session-transcript
      *  write. ENGINE-STAMPED by the two guard policies; a fold-internal fact the class derivation reads
      *  ({@link import("./ask-origin.js").classifyAsk}) so the two guards, which mint the same
@@ -737,63 +735,53 @@ export declare function constraintChainEntryOfSuppliedLayer(layer: ConstraintCha
  * different frozen deny data now digest differently.
  */
 export declare function constraintChainDigest(chain: readonly ConstraintChainEntry[]): string;
+/** Every member of the decision union — a member the union gains and this list lacks is a type error at `satisfies`.
+ *  The receipt walks it: a contract member not held as an own enumerable data property is refused if a descriptor on the
+ *  prototype chain holds one (an `undefined` data value spells absence). Not re-exported from `src/index.ts`. */
+export type DecisionMember = PermissionResult extends infer U ? (U extends unknown ? keyof U : never) : never;
+export declare const DECISION_MEMBERS: readonly DecisionMember[];
 /**
- * Refuse a decision that speaks the retired `reason` dialect (RB-479-B①, tripwire ruled 2026-08-03).
- *
- * Applied at every point a decision is CONSUMED, because no single fold sees them all (ruled
- * 2026-08-03): {@link combinePolicies} (the runner's gate path), the PreToolUse hook's result seam
- * (`hooks.ts` — a hook result reaches the gate decision without ever passing through a fold), and the
- * durable resume-edit rechecks (`runtask.ts` — direct `check()` calls on the caller's own policy). The
- * wording is face-neutral for that reason: one construction point, three consumers. The export exists
- * for those two engine modules only and is deliberately NOT re-exported from `src/index.ts`: this is an
- * internal screen on inputs the engine receives, not a facility deployments call.
- *
- * Why this is a DENY and not a best-effort read of the old field: the retirement is settled, so the
- * value is out-of-contract input to the permission face — the same class as an untyped `approve`
- * returning a truthy non-`true`, which this file already refuses fail-closed. Reading the old name
- * anyway would re-open the two-names-for-one-thing surface; ignoring it (the pre-tripwire behavior)
- * silently dropped the policy's own text and returned the per-site generic default, so a deployment
- * whose deny messages had quietly degraded looked healthy. The type system cannot carry this alone —
- * excess-property checking does not reach an inferred `check` return (see {@link PermissionResult}).
- *
- * OWN property only (`hasOwnProperty`, not `in`): a decision whose PROTOTYPE happens to expose
- * `reason` never wrote the retired field. A non-object decision is passed through untouched — reading
- * `.action` off it is the caller's existing failure, and inventing a second failure mode here would
- * change which error a broken policy raises.
- *
- * Any accumulated `updatedInput` is deliberately NOT carried onto this deny: it came from the same
- * out-of-contract decision object, so it is not a rewrite this layer is willing to report as audited.
- * (A rewrite from an EARLIER, contract-shaped policy still rides out — {@link combinePolicies} adds it
- * on the deny path per the observer contract.)
- *
- * The second arm screens `decisionReason` against the closed set ({@link DecisionReason}): a
- * deployment-authored `ToolPolicy.check` returning a value outside it would otherwise ride silently
- * into every consumer that BRANCHES on the word — provenance-keyed exclusions, audit rows, checkpoint
- * discriminants — each of which would treat the unclassifiable value as "none of the reasons I know",
- * a meaning the producing policy never chose. Same doctrine as the retired-field arm: out-of-contract
- * input to the permission face is refused loudly, not passed through as an accidental tenth reason.
- * An ABSENT `decisionReason` stays legal (it is optional; `undefined` is the typed spelling of
- * absence), and hook results never reach here with a foreign word — the hook seam stamps its own
- * (`hooks.ts`) — so this arm's live producers are exactly the deployment policies the tripwire exists
- * to screen. Unlike the retired-field arm this one reads the property PLAINLY (prototype chain
- * included), because it answers a different question: the retired arm asks whether the AUTHOR wrote
- * the old field (own property = authorship), this arm asks what a CONSUMER would read — and every
- * consumer branches on a plain `d.decisionReason` read, which the prototype can satisfy.
- *
- * SCOPE of the carrier check (ruled after three review rounds converged on the same root): it screens
- * STRUCTURALLY unstable carriers — getters, prototype-supplied values — i.e. shapes an ordinary
- * deployment can write by accident. It does NOT try to defeat a Proxy whose descriptor trap reports a
- * data property while its get trap stays stateful: same-process JavaScript has no trust boundary a
- * function can enforce (an untrusted party who ships such a Proxy can as easily patch this module), so
- * chasing that shape adds complexity without adding a guarantee. The screen's promise is against
- * drift and accident, not against a untrusted co-resident.
- *
- * `reasonIsNonInput` (the HOOK seam's spelling — merged-code scan, 5.28 window): at that seam the
- * field is documented as DISCARDED — every mint point downstream unconditionally re-stamps
- * `decisionReason:"hook"` (fold, deny arm, delegated twin), and the allow path never reads it — so
- * both reason arms are skipped there: refusing a value that cannot travel would fail-close a call
- * over a field with no consumer, which inverted the discard contract the stamp exists to enforce.
- * The retired-`reason` arm still applies (that one is about the MESSAGE channel, which does travel).
+ * The RECEIPT of a permission decision — the one point at which the engine takes a decision in from whoever composed it,
+ * on every lane: each layer of {@link combinePolicies}' fold, the gate's adjudication entry and its approved-edit re-check,
+ * the inherited lane's receipts of an ancestor policy's decision, the final-form re-check, the direct `check()` rechecks
+ * (the resume edit, the park re-projection, the changed-files probe), and the PreToolUse hook's result seam (its own
+ * reach, below). NOT re-exported from `src/index.ts`: an internal screen on inputs the engine receives.
+ *
+ * WHAT COMES BACK is the engine's own frozen copy, never the caller's object. A decision is caller-supplied data: a
+ * stateful accessor, a Proxy, or a policy that keeps and mutates an object it returned could otherwise answer two
+ * consumers with two values, and which consumer read which value would decide the call. So the caller's object is read
+ * ONCE, here, and every station after the receipt (the fold's ranking, the origin stamp, the classifier's eligibility, the
+ * mode arbitration, the approval request, the rewrite that executes) reads the copy; a copy handed to the screen again
+ * comes back as it is, unread. In order: (1) the CARRIER's type — a decision that is not an object (a string, a function
+ * holding the members) has no `action`; (2) the ONE READ — ONE function ({@link receiveContract}) for the decision and for the
+ * records it nests ({@link NESTED_CONTRACTS}), on an ORDINARY object (a Proxy, as the carrier or anywhere on its prototype
+ * chain, is refused before a trap of its could run): each contract member absent or an own enumerable DATA property, its value
+ * taken off the carrier's own descriptor (a member outside the contract is neither read nor carried — a policy's self-declared
+ * record on another name finds no reader); any other spelling refused by name — an accessor (never invoked), a member the
+ * prototype or a non-enumerable property supplies unless that descriptor spells absence (an `undefined` data value) — judged by
+ * descriptor, never read; (3) the retired `reason` field as an OWN property, judged without a read (authorship of the old
+ * spelling: a prototype exposing it never wrote it; ignoring it silently dropped the policy's text); (4) the VALUES, off the engine's
+ * one-read record, never a second read of the caller's object — the retired window absent, `action` in
+ * {@link DECISION_ACTIONS} (a consumer ranks a decision by testing two of its words, so any other value used to rank as an
+ * allow; a `canUseTool` result outside its set is a failure in CC) and `decisionReason` in {@link DECISION_REASONS} when
+ * present (absence stays legal); (5) the DETACH —
+ * the contract members' values structured-cloned ({@link tryCloneArgs}; one that cannot be, a function inside a rewrite,
+ * is refused), the engine's identity-keyed records carried across ({@link carryEngineAttestations}), the copy frozen and
+ * marked as this module's. A refusal is a deny in the screen's words, one code for every arm (`decisionReason: "rule"`),
+ * carrying no `updatedInput` from the refused object (a rewrite from an EARLIER, contract-shaped layer still rides out of
+ * {@link combinePolicies}' deny path). `null` / `undefined` carry nothing and take the carrier's refusal (the caller's own
+ * read of `.action` would throw instead, and that throw was being reported as an aborted check).
+ *
+ * SCOPE: the receipt runs NONE of the carrier's code — a Proxy (its traps are the caller's code) is refused unread, and on an
+ * ordinary object descriptor looks and `Object.getPrototypeOf` invoke nothing. What the receipt does not reach: code inside a
+ * member's VALUE, run by the detach itself (an accessor inside a rewrite is invoked by the structured clone, and what it answers
+ * there is what is cloned and what runs — one read, consistent) and by a refusal's rendering of a foreign word (`String(v)` on an
+ * out-of-set `action`, after the deny is decided). Same-process JavaScript has no trust boundary a function can enforce.
+ *
+ * `reasonIsNonInput` (the HOOK seam): a hook's `decisionReason` is DISCARDED there — every mint point downstream re-stamps
+ * `"hook"`, and the seam maps a hook's deny and ask and reads anything else as no objection, the policy still adjudicating
+ * the call — so that seam takes the two retired-field arms alone and its object back unchanged (`undefined` = no
+ * opinion): refusing a value that cannot travel would fail-close a call over a field with no consumer.
  */
 export declare function refuseOutOfContractDecision(d: PermissionResult, opts?: {
     reasonIsNonInput?: boolean;
@@ -911,22 +899,11 @@ export declare function createApprovalPolicy(opts: {
  */
 export declare function combinePolicies(...policies: ToolPolicy[]): ToolPolicy;
 /**
- * The shell tools whose `{ command }` arg a coarse command-name policy parses. Other tools are out of scope.
- *
- * `Monitor` belongs here. It takes a `command` and runs it through the
- * SAME `env.spawnBackground` seam as Bash, and prepare-task's own note says so in as many words — "Monitor
- * runs an arbitrary shell `command` through the SAME env seam — it must sit behind the SAME shellGate
- * tighten (else it becomes a policy side-door around a gated Bash)". The shellGate half was implemented;
- * this half — the two ALWAYS-ON, core-owned parity gates that a caller's policy cannot remove — was keyed
- * on a list containing only "Bash". The probe drove the whole thing end to end: the identical
- * `rm -rf $(cat targets)` was denied as Bash and executed as Monitor, deleting a real directory with no
- * gate at all; the same substitution makes `rm -rf ~/.ai-agent/sessions` a way to erase the audit trail.
- */
-/**
- * EXPORTED. A downstream governance layer keeps its own copy of this list so its
- * per-command ask-list gates the same tools core does, and it had no way to read the real one — its guard
- * had to probe a hand-written candidate list of names, which stays green for any name nobody thought to
- * put in it. The list itself is the fact; publishing it removes the guess.
+ * The shell tools whose `{ command }` arg a coarse command-name policy parses; other tools are out of scope. `Monitor`
+ * belongs here: it runs an arbitrary shell `command` through the same env seam as Bash, so the always-on parity gates
+ * keyed on this list reach it too (a list of `Bash` alone let the identical command run ungated as `Monitor`). EXPORTED:
+ * a downstream governance layer keeps its own copy of this list so its per-command ask-list gates the same tools core
+ * does — the list itself is the fact, and publishing it removes the guess.
  */
 export declare const COARSE_SHELL_TOOLS: string[];
 /**
@@ -1389,6 +1366,19 @@ export interface AskRequest {
      *  therefore reading the deployment's own claim about its own ask, which is the direction that cannot
      *  loosen anything. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
+    /** The ask's CLASS: the first member of {@link classes} in {@link import("./ask-origin.js").ASK_CLASSES} order — the
+     *  row key of {@link import("./ask-origin.js").MODE_ARBITRATION} a permission mode reads. Filled by every station that
+     *  fills {@link origin}, from the same classification the gate's lanes arbitrated this ask by; never written by a
+     *  caller or worker (a policy's self-declared value is replaced at the stamp), and a policy can move it only through
+     *  the tighten-only inputs the classification reads. ABSENT = unclassified: a request from a station that fills no
+     *  {@link origin} (the shared-artifact read confirmation), or a request built by a deployment itself. An approver
+     *  that answers by class treats absence as a class it will not answer. */
+    readonly askClass?: import("./ask-origin.js").AskClass;
+    /** Every class this ask belongs to, in {@link import("./ask-origin.js").ASK_CLASSES} order, `classes[0] ===
+     *  askClass`. One ask can carry several (an org verdict beside a hook's question); an approver that answers by class
+     *  reads the whole set — a class it will not answer anywhere in it is a question it does not answer. Present exactly
+     *  when {@link askClass} is. */
+    readonly classes?: readonly import("./ask-origin.js").AskClass[];
     /** Engine-judged risk axes of the action awaiting approval, for the human decision surface: a
      *  coarse `requiresRealApproval` cannot tell "cannot be undone" from "data leaves the machine",
      *  and those call for different scrutiny. Filled by the gate from the SAME resolved axes the

package/dist/core/tool-policy.js

@@ -13,6 +13,7 @@ import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
 import { thrownText } from "./thrown-value.js";
+import { receiveContract, refusedOutOfContract } from "./decision-receipt.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
 import { protocolOf } from "./protocol-table.js";
 import { isAbsoluteForFamily, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
@@ -244,56 +245,90 @@ function stableJson(v) {
 export function constraintChainDigest(chain) {
     return `cpv1:${createHash("sha256").update(stableJson(chain)).digest("hex")}`;
 }
-const ALLOW = { action: "allow" };
+const ALLOW = Object.freeze({ action: "allow" });
 const RETIRED_TEXT_FIELD = "reason";
 const RETIRED_WINDOW_MEMBER = "autoDenyAfterMs";
 const RETIRED_WINDOW_MEMBER_DENY_MESSAGE = `a permission decision's "denialLimitFallback" carries "${RETIRED_WINDOW_MEMBER}" — the decision names the counts only; ` +
     `the auto-deny window is decided by the ask's route (a live approver arms it, every other route runs none) and cannot be ` +
     `declared by a policy; denied fail-closed rather than silently replacing the declared number`;
+const carriesRetiredWindow = (fallback) => typeof fallback === "object" && fallback !== null && fallback[RETIRED_WINDOW_MEMBER] !== undefined;
+const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
+const DECISION_ACTION_SET = new Set(DECISION_ACTIONS);
+export const DECISION_MEMBERS = Object.keys({
+    action: 0, updatedInput: 0, message: 0, decisionReason: 0, requiresRealApproval: 0, denialLimitFallback: 0, persistedRuleShadowed: 0, probeReason: 0,
+    probeCause: 0, probeMandated: 0, mandated: 0, mandate: 0, probeReadRootCandidate: 0, matchedAskRule: 0, ruleEvidence: 0, segmentCoverage: 0,
+    origin: 0, askClass: 0, classes: 0, guard: 0, ruleUnreadable: 0, authoredBy: 0, foldedAskClasses: 0,
+});
+const OPERAND_MEMBERS = Object.keys({ shown: 0, total: 0 });
+const NESTED_CONTRACTS = [
+    ["", "denialLimitFallback", Object.keys({ consecutive: 0, total: 0, limit: 0, autoDenyAfterMs: 0 })],
+    ["", "probeCause", Object.keys({ code: 0, roots: 0, further: 0 })],
+    ["probeCause.", "roots", OPERAND_MEMBERS],
+    ["probeCause.", "further", OPERAND_MEMBERS],
+];
+const refusedAction = (what) => refusedOutOfContract(`a permission decision's "action" is ${what} — the closed set is ${DECISION_ACTIONS.join("/")}; denied fail-closed rather than reading a word outside it as an allow`);
+function renderForeignValue(v) {
+    try {
+        return JSON.stringify(String(v).slice(0, 64));
+    }
+    catch {
+        return `[unprintable ${typeof v}]`;
+    }
+}
 const RETIRED_TEXT_FIELD_DENY_MESSAGE = `a permission decision carries the retired "${RETIRED_TEXT_FIELD}" field — rename it to "message" (the one text field ` +
     `a decision carries); denied fail-closed rather than executing a decision whose text this layer cannot read`;
+const ENGINE_RECEIPTS = new WeakSet();
 export function refuseOutOfContractDecision(d, opts) {
+    if (opts?.reasonIsNonInput === true) {
+        if (d === null || d === undefined)
+            return d;
+        if (Object.prototype.hasOwnProperty.call(d, RETIRED_TEXT_FIELD))
+            return refusedOutOfContract(RETIRED_TEXT_FIELD_DENY_MESSAGE);
+        return carriesRetiredWindow(d.denialLimitFallback) ? refusedOutOfContract(RETIRED_WINDOW_MEMBER_DENY_MESSAGE) : d;
+    }
     if (typeof d !== "object" || d === null)
+        return refusedAction(`absent (the decision is ${d === null || d === undefined ? String(d) : `a ${typeof d}`}, not an object)`);
+    if (ENGINE_RECEIPTS.has(d))
         return d;
-    if (Object.prototype.hasOwnProperty.call(d, RETIRED_TEXT_FIELD)) {
-        return { action: "deny", message: RETIRED_TEXT_FIELD_DENY_MESSAGE, decisionReason: "rule" };
+    const decision = receiveContract(d, DECISION_MEMBERS, "");
+    if (decision.kind === "refused")
+        return decision.refused;
+    if (Object.prototype.hasOwnProperty.call(d, RETIRED_TEXT_FIELD))
+        return refusedOutOfContract(RETIRED_TEXT_FIELD_DENY_MESSAGE);
+    const contract = decision.held;
+    const records = Object.assign(Object.create(null), { "": contract });
+    for (const [holder, member, members] of NESTED_CONTRACTS) {
+        const held = records[holder];
+        if (held === undefined || typeof held[member] !== "object" || held[member] === null)
+            continue;
+        const nested = receiveContract(held[member], members, `${holder}${member}.`);
+        if (nested.kind === "refused")
+            return nested.refused;
+        held[member] = records[`${holder}${member}.`] = nested.held;
     }
-    const fb = d.denialLimitFallback;
-    if (typeof fb === "object" && fb !== null && fb.autoDenyAfterMs !== undefined) {
-        return { action: "deny", message: RETIRED_WINDOW_MEMBER_DENY_MESSAGE, decisionReason: "rule" };
+    if (carriesRetiredWindow(contract.denialLimitFallback))
+        return refusedOutOfContract(RETIRED_WINDOW_MEMBER_DENY_MESSAGE);
+    if (!DECISION_ACTION_SET.has(contract.action))
+        return refusedAction(contract.action === undefined ? "absent" : renderForeignValue(contract.action));
+    if (contract.decisionReason !== undefined && !DECISION_REASON_SET.has(contract.decisionReason)) {
+        return refusedOutOfContract(`a permission decision carries an unrecognized "decisionReason" value (${renderForeignValue(contract.decisionReason)}) — ` +
+            `the closed set is ${DECISION_REASONS.join("/")}; denied fail-closed rather than letting consumers branch on a value this layer cannot classify`);
     }
-    if (opts?.reasonIsNonInput === true)
-        return d;
-    const dr = d.decisionReason;
-    if (dr === undefined)
-        return d;
-    if (!DECISION_REASON_SET.has(dr)) {
-        let rendered;
-        try {
-            rendered = JSON.stringify(String(dr).slice(0, 64));
-        }
-        catch {
-            rendered = `[unprintable ${typeof dr}]`;
-        }
-        return {
-            action: "deny",
-            message: `a permission decision carries an unrecognized "decisionReason" value (${rendered}) — ` +
-                `the closed set is ${DECISION_REASONS.join("/")}; denied fail-closed rather than letting consumers ` +
-                `branch on a value this layer cannot classify`,
-            decisionReason: "rule",
-        };
+    const detached = tryCloneArgs(contract);
+    if (!detached.ok) {
+        return refusedOutOfContract(`a permission decision's members could not be detached from the policy that returned them (${detached.reason}) — ` +
+            `the engine keeps its own copy of what it read; denied fail-closed`);
     }
-    const carrier = Object.getOwnPropertyDescriptor(d, "decisionReason");
-    if (carrier === undefined || !("value" in carrier)) {
-        return {
-            action: "deny",
-            message: `a permission decision supplies "decisionReason" through ${carrier === undefined ? "its prototype" : "an accessor"} — ` +
-                `contract fields must be own data properties, so consumers re-reading the field cannot be shown a ` +
-                `different value than this screen validated; denied fail-closed`,
-            decisionReason: "rule",
-        };
+    const receipt = Object.freeze(detached.value);
+    const ownRecord = (o, k) => (typeof o === "object" && o !== null && Object.hasOwn(o, k) ? o[k] : undefined);
+    for (const [holder, member] of NESTED_CONTRACTS) {
+        const record = ownRecord(holder.split(".").filter(Boolean).reduce(ownRecord, receipt), member);
+        if (typeof record === "object" && record !== null)
+            Object.freeze(record);
     }
-    return d;
+    carryEngineAttestations(d, receipt);
+    ENGINE_RECEIPTS.add(receipt);
+    return receipt;
 }
 const DEADLINE_ELAPSED = Symbol("approval.deadline_elapsed");
 function withTimeout(p, ms, onTimeout) {

package/dist/engine/harness/agent-harness.d.ts

@@ -1,4 +1,5 @@
 import type { ActorAssertion, AssistantMessage, ImageContent, Model, UserMessage } from "../llm/index.js";
+import { type ToolTurnRepair } from "../llm/index.js";
 import type { HaltRemainingDirective } from "../loop/types.js";
 import type { AgentMessage, AgentTool, LoopMalformedToolUseRecovery, LoopThinkingOnlyRecovery, LoopTruncatedOutputRecovery, QueueMode, ThinkingLevel } from "../loop/types.js";
 import { type EngineSegment } from "../../core/untrusted-text.js";
@@ -189,6 +190,10 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     private thinkingLevel;
     /** RB-30 terminal fix — runner-set sink for engine-note payloads left undrained at agent_end. */
     onUndrainedEngineNotes?: (payloads: unknown[]) => void;
+    /** Runner-set sink for the provider boundary's tool-turn repairs ({@link ensureToolTurnInvariants}) — called
+     *  with every request view that needed one (the transcript is never rewritten, so a broken turn is repaired, and
+     *  reported, on each request; the sink owns its dedup). Advisory: a throwing sink never breaks the request. */
+    onToolTurnRepaired?: (repairs: readonly ToolTurnRepair[]) => void;
     /** backlog #259 — USER-authored queue remnants at agent_end: steers/follow-ups whose receipts said
      *  "queued" but that no turn will ever drain (the run ended first). The engine-note sweep above
      *  hands ENGINE payloads back for redelivery; user inputs have no redelivery semantics (a steer
@@ -226,6 +231,8 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *  gated: its splice opens a NEW run (idle-park redelivery), and a halt belongs to the run that
      *  minted it. */
     engineInjectionsHeld?: () => boolean;
+    /** The provider boundary's tool-turn law: the repaired view goes to the brain, the repairs to the runner's sink. */
+    private holdToolTurnLaw;
     /** RB-30 R2 belt-and-braces: runner-callable idempotent recovery for exit paths that reach
      *  neither agent_end nor abort() (a pre-prompt throw after prepare). Swept entries are removed,
      *  so a double call is a no-op. */

package/dist/engine/harness/agent-harness.js

@@ -1,4 +1,4 @@
-import { createAssistantMessageEventStream, snapshotActorAssertion, stripEngineMetadata } from "../llm/index.js";
+import { createAssistantMessageEventStream, ensureToolTurnInvariants, snapshotActorAssertion, stripEngineMetadata } from "../llm/index.js";
 import { runAgentLoop } from "../loop/agent-loop.js";
 import { resolveAgentCoreStreamFn } from "../loop/runtime-deps.js";
 import { normalizeEngineSegments } from "../../core/untrusted-text.js";
@@ -211,10 +211,22 @@ export class AgentHarness {
     modelRef;
     thinkingLevel;
     onUndrainedEngineNotes;
+    onToolTurnRepaired;
     onUndrainedUserInputs;
     onEngineNoteConsumed;
     onFrameCommitted;
     engineInjectionsHeld;
+    holdToolTurnLaw(messages) {
+        const view = ensureToolTurnInvariants(messages);
+        if (view.repairs.length > 0) {
+            try {
+                this.onToolTurnRepaired?.(view.repairs);
+            }
+            catch {
+            }
+        }
+        return view.messages;
+    }
     recoverUndrainedEngineNotes() {
         this.sweepUndrainedEngineNotes([this.drainedPendingInjection, this.nextTurnQueue, this.steerQueue, this.followUpQueue]);
     }
@@ -620,7 +632,7 @@ export class AgentHarness {
             ...(this.streamingToolExecution === true && (this.getHandlers("tool_call")?.size ?? 0) === 0
                 ? { streamingToolExecution: true }
                 : {}),
-            convertToLlm: (messages) => stripEngineMetadata(convertToLlm(messages)),
+            convertToLlm: (messages) => this.holdToolTurnLaw(stripEngineMetadata(convertToLlm(messages))),
             shouldStopAfterTurn: () => this.consultStopLatch("post_turn"),
             shouldHaltBeforeTurn: () => this.consultStopLatch("pre_turn"),
             transformContext: async (messages, signal) => {

package/dist/engine/llm/index.d.ts

@@ -9,3 +9,4 @@ export * from "./types.js";
 export * from "./diagnostics.js";
 export * from "./event-stream.js";
 export * from "./validation.js";
+export * from "./tool-turns.js";

package/dist/engine/llm/index.js

@@ -2,3 +2,4 @@ export * from "./types.js";
 export * from "./diagnostics.js";
 export * from "./event-stream.js";
 export * from "./validation.js";
+export * from "./tool-turns.js";

package/dist/engine/llm/tool-turns.d.ts

@@ -0,0 +1,20 @@
+import type { Message } from "./types.js";
+/** What the law restored — the `forms` of a `context.tool_turn_repaired` notice. */
+export declare const TOOL_TURN_REPAIR_FORMS: readonly ["trailing_text", "late_result", "missing_result", "duplicate_result"];
+export type ToolTurnRepairForm = (typeof TOOL_TURN_REPAIR_FORMS)[number];
+/** One restoration on one assistant message. */
+export interface ToolTurnRepair {
+    readonly form: ToolTurnRepairForm;
+    /** The calls concerned, in call order — for `trailing_text` every call of the message; otherwise the calls whose
+     *  result was moved up, synthesized, or folded with a second one. */
+    readonly toolCallIds: readonly string[];
+}
+export interface ToolTurnView {
+    /** The request view — the input array itself when {@link repairs} is empty. */
+    readonly messages: Message[];
+    readonly repairs: readonly ToolTurnRepair[];
+}
+/** The text standing between two results recorded for one call when the view folds them into one. */
+export declare const SECOND_RESULT_SEPARATOR = "[another result was recorded for this same call:]";
+/** Restore the tool-turn law on a provider-bound message list (see the module header). */
+export declare function ensureToolTurnInvariants(messages: Message[]): ToolTurnView;

package/dist/engine/llm/tool-turns.js

@@ -0,0 +1,91 @@
+import { interruptedResultMessage, interruptedResults, isInterruptedClose } from "../../core/session-reconcile.js";
+export const TOOL_TURN_REPAIR_FORMS = ["trailing_text", "late_result", "missing_result", "duplicate_result"];
+function callsOf(m) {
+    return m.role === "assistant" && Array.isArray(m.content) ? m.content.filter((c) => c?.type === "toolCall") : [];
+}
+export const SECOND_RESULT_SEPARATOR = "[another result was recorded for this same call:]";
+export function ensureToolTurnInvariants(messages) {
+    const anchor = [];
+    messages.forEach((m, i) => anchor.push(m.role === "toolResult" && i > 0 ? anchor[i - 1] : i));
+    const sites = new Map();
+    const ownerOf = new Map();
+    const resultsOf = new Map();
+    messages.forEach((m, i) => {
+        if (m.role === "assistant") {
+            for (const call of callsOf(m)) {
+                const list = sites.get(call.id) ?? [];
+                if (list.at(-1) !== i)
+                    list.push(i);
+                sites.set(call.id, list);
+            }
+            return;
+        }
+        if (m.role !== "toolResult")
+            return;
+        const all = sites.get(m.toolCallId) ?? [];
+        if (all.length === 0)
+            return;
+        const owner = all.at(-1);
+        ownerOf.set(i, owner);
+        const batch = resultsOf.get(owner);
+        if (batch === undefined)
+            resultsOf.set(owner, [i]);
+        else
+            batch.push(i);
+    });
+    const repairs = [];
+    const out = [];
+    messages.forEach((m, i) => {
+        if (ownerOf.has(i))
+            return;
+        const calls = callsOf(m);
+        if (calls.length === 0) {
+            out.push(m);
+            return;
+        }
+        const assistant = m;
+        const firstCall = assistant.content.findIndex((c) => c?.type === "toolCall");
+        const trails = assistant.content.slice(firstCall).some((c) => c?.type !== "toolCall");
+        out.push(trails ? { ...assistant, content: [...assistant.content.filter((c) => c?.type !== "toolCall"), ...calls] } : assistant);
+        if (trails)
+            repairs.push({ form: "trailing_text", toolCallIds: calls.map((c) => c.id) });
+        const byId = new Map();
+        for (const call of calls)
+            if (!byId.has(call.id))
+                byId.set(call.id, call);
+        const ids = [...byId.keys()];
+        const recorded = new Map();
+        for (const r of resultsOf.get(i) ?? []) {
+            const id = messages[r].toolCallId;
+            recorded.set(id, [...(recorded.get(id) ?? []), r]);
+        }
+        const sent = new Map();
+        const late = [];
+        const duplicate = [];
+        for (const [id, at] of recorded) {
+            const real = at.filter((r) => !isInterruptedClose(messages[r]));
+            const chosen = real.length > 0 ? real : at.slice(0, 1);
+            sent.set(id, chosen.map((r) => messages[r]).reduce(foldResults));
+            if (anchor[chosen[0]] !== i)
+                late.push(id);
+            if (at.length > 1)
+                duplicate.push(id);
+        }
+        out.push(...sent.values());
+        const missing = [...byId.values()].filter((c) => !sent.has(c.id));
+        for (const result of interruptedResults(missing.map((c) => ({ toolCallId: c.id, toolName: c.name })))) {
+            out.push(interruptedResultMessage(result, assistant.timestamp));
+        }
+        const inCallOrder = (set) => ids.filter((id) => set.includes(id));
+        if (late.length > 0)
+            repairs.push({ form: "late_result", toolCallIds: inCallOrder(late) });
+        if (missing.length > 0)
+            repairs.push({ form: "missing_result", toolCallIds: missing.map((c) => c.id) });
+        if (duplicate.length > 0)
+            repairs.push({ form: "duplicate_result", toolCallIds: inCallOrder(duplicate) });
+    });
+    return repairs.length === 0 ? { messages, repairs } : { messages: out, repairs };
+}
+function foldResults(first, second) {
+    return { ...first, content: [...first.content, { type: "text", text: SECOND_RESULT_SEPARATOR }, ...second.content], isError: first.isError && second.isError };
+}

package/dist/index.d.ts

@@ -192,7 +192,7 @@ export { createAllowDenyPolicy, createApprovalPolicy,
 type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { type ReadRootGrantScreen } from "./core/read-root-grant-screen.js";
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, type PersistedRuleMandate, isPersistedRuleMandate } from "./core/ask-origin.js";
-export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, RELEASABLE_ASK_CLASSES, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
+export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, type ModeReleaseReason, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, type ModePolicy, PERMISSION_MODE_FOLD_REASONS, type PermissionModeFoldReason, type PermissionModeReceipt, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export { readDenyClassifierRules, renderClassifierDenyRules, type DerivedDenyRule } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource, type AutoModeDenySource } from "./core/runtime-caps.js";

package/dist/index.js

@@ -157,7 +157,7 @@ export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.
 export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export {} from "./core/read-root-grant-screen.js";
 export { ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, isPersistedRuleMandate } from "./core/ask-origin.js";
-export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, RELEASABLE_ASK_CLASSES, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";
+export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, PERMISSION_MODE_FOLD_REASONS, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export { readDenyClassifierRules, renderClassifierDenyRules } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./core/runtime-caps.js";

package/dist/internal/llm.d.ts

@@ -4,5 +4,5 @@
  * design/118 ①②: the layer is now first-party (`src/engine/llm/`, naturalized out of the vendored
  * llm-core); the facade stays so consumers never notice which side a symbol lives on.
  */
-export { createAssistantMessageEventStream, snapshotActorAssertion, stripEngineMetadata } from "../engine/llm/index.js";
-export type { ActorAssertion, AnthropicMessagesCompat, OpenAICompletionsCompat, OpenAIResponsesCompat, AssistantMessage, AssistantMessageDiagnostic, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, Model, ResilienceOptions, RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePairingConfig, RoutePairingPosture, RouteRefusalCode, RouteRefusalDetail, SimpleStreamOptions, StallTimeouts, StopReason, StreamFn, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage, Usage, UserMessage, } from "../engine/llm/index.js";
+export { createAssistantMessageEventStream, ensureToolTurnInvariants, snapshotActorAssertion, stripEngineMetadata } from "../engine/llm/index.js";
+export type { ActorAssertion, AnthropicMessagesCompat, OpenAICompletionsCompat, OpenAIResponsesCompat, AssistantMessage, AssistantMessageDiagnostic, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, Model, ResilienceOptions, RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePairingConfig, RoutePairingPosture, RouteRefusalCode, RouteRefusalDetail, SimpleStreamOptions, StallTimeouts, StopReason, StreamFn, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage, ToolTurnRepair, Usage, UserMessage, } from "../engine/llm/index.js";

package/dist/internal/llm.js

@@ -1 +1 @@
-export { createAssistantMessageEventStream, snapshotActorAssertion, stripEngineMetadata } from "../engine/llm/index.js";
+export { createAssistantMessageEventStream, ensureToolTurnInvariants, snapshotActorAssertion, stripEngineMetadata } from "../engine/llm/index.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.36.0",
+  "version": "7.37.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",