@sema-agent/core 7.38.3 → 7.39.1

package/dist/core/runner/run-leg.js

@@ -5,21 +5,22 @@ import { CheckpointError, readPendingSteerQueue, realApprovalOrgFact, remainingB
 import { normalizePersistedRuleHit } from "../gate-lanes.js";
 import { decidersNote, SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
-import { buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
+import { buildAppliedHumanInputEvent, buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { applyPersistedTightening, disclosedRuleSet } from "../persisted-rule-arms.js";
 import { computeCostMicroUsd } from "../pricing.js";
-import { composeApprovalPostureDirective } from "../auto-mode-directive.js";
-import { mintSystemReminder, statedReminderBodiesOf } from "../reminder-mint.js";
+import { mintSystemReminder } from "../reminder-mint.js";
 import { hasDestroy } from "../remote-env.js";
-import { advertisedWritableRootsSeat, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
 import { callFaceSeat, judgeParkedToolIdentity, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
 import { deliverEngineNotice } from "../types.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
 import { errorCodeOf } from "./assemble-result.js";
 import { DEFAULT_PRECALL_OUTPUT_TOKENS, platformLimitTerminal } from "./clock-and-limits.js";
+import { mintOutputStyleReminder, owedPostureText } from "./compaction-restate.js";
 import { deepJsonEqual, resumeContinuation } from "./decide-continuation.js";
 import { settleExecutionRecord } from "./execution-record.js";
+import { holdPrompt } from "./prompt-block.js";
 import { mintGateOutcome } from "./gate-exit.js";
 import { withGateTimeout } from "../gate-bounded-await.js";
 import { resolveGitLegDelivery, wrapGitFrame } from "./git-leg-delivery.js";
@@ -137,6 +138,12 @@ export async function runLeg(input) {
                         }
                     }
                 }
+                const postureText = await owedPostureText(prepared, "always");
+                if (postureText !== undefined)
+                    continuation += "\n\n" + postureText;
+                const outputStyleWrapped = mintOutputStyleReminder(prepared);
+                if (outputStyleWrapped !== undefined)
+                    continuation += "\n\n" + outputStyleWrapped;
                 const engineSegments = continuation.length > 0 ? [{ start: 0, end: continuation.length }] : [];
                 const parkedSteers = readPendingSteerQueue(resume.cp.state);
                 const resumeFrames = [
@@ -223,16 +230,7 @@ export async function runLeg(input) {
                     if (steer.trusted)
                         engineSegments.push({ start, end: continuation.length });
                     appliedEvents.push({
-                        ...buildHumanInputEvent({
-                            carrier: source,
-                            source,
-                            delivery: "applied",
-                            sessionSeq: nextHumanInputSeq(prepared.harness),
-                            inputId: steer.inputId,
-                            ...(steer.actor !== undefined ? { actor: steer.actor } : {}),
-                            ...(steer.actor?.issuer !== undefined ? { issuer: steer.actor.issuer } : {}),
-                            ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
-                        }),
+                        ...buildAppliedHumanInputEvent({ carrier: source, source, sessionSeq: nextHumanInputSeq(prepared.harness), inputId: steer.inputId, actor: steer.actor, principal: spec.principal }),
                         ...ident(),
                     });
                 }
@@ -260,6 +258,10 @@ export async function runLeg(input) {
                             },
                         });
                     }
+                    if (outputStyleWrapped !== undefined) {
+                        const preview = redactThenCut(prepared.outputStyleFrame, 220);
+                        prepared.frameReceipts.pending.push({ source: "output_style", text: continuation, commit: () => void (queue.push({ type: "steering_injected", source: "output_style", preview, ...ident() }), (rs.attach.attachmentsInjected += 1)) });
+                    }
                     final = await withBrainSinks(() => prepared.harness.prompt(continuation, {
                         engineSegments,
                         settleUnansweredToolCalls: rejectionHalt !== undefined ? { halt: rejectionHalt } : {},
@@ -292,16 +294,18 @@ export async function runLeg(input) {
                             catch {
                             }
                         }
-                        prepared.blockedRef.reason = formatHookFeedback(promptSeat.cause === "timeout"
+                        const timedOut = promptSeat.cause === "timeout";
+                        holdPrompt(prepared.blockedRef, prepared.reminderMark, timedOut ? "timeout" : "cancelled", timedOut
                             ? `the deployment's userPromptSubmit hook did not answer within its ${prepared.hookTimeoutMs}ms bound while screening this prompt; ` +
                                 `the prompt was NOT submitted (fail-closed)`
                             : `the task was cancelled while the deployment's userPromptSubmit hook was still screening this prompt; ` +
-                                `the prompt was NOT submitted (fail-closed)`, prepared.reminderMark);
+                                `the prompt was NOT submitted (fail-closed)`);
                         promptBlocked = true;
                     }
                     const decision = promptSeat.expired ? undefined : promptSeat.value;
-                    if (decision?.block) {
-                        prepared.blockedRef.reason = formatHookFeedback(decision.block, prepared.reminderMark);
+                    const blockWords = decision?.block;
+                    if (blockWords) {
+                        holdPrompt(prepared.blockedRef, prepared.reminderMark, "block", blockWords);
                         promptBlocked = true;
                     }
                     else if (decision?.additionalContext) {
@@ -315,8 +319,7 @@ export async function runLeg(input) {
                     }
                     catch {
                     }
-                    prepared.blockedRef.reason = formatHookFeedback(`the deployment's userPromptSubmit hook crashed while screening this prompt (${err.message}); ` +
-                        `the prompt was NOT submitted (fail-closed)`, prepared.reminderMark);
+                    holdPrompt(prepared.blockedRef, prepared.reminderMark, "crashed", `the deployment's userPromptSubmit hook crashed while screening this prompt (${err.message}); ` + `the prompt was NOT submitted (fail-closed)`);
                     promptBlocked = true;
                 }
             }
@@ -383,16 +386,14 @@ export async function runLeg(input) {
                     }
                 }
             }
+            if (prepared.outputStyleFrame !== undefined)
+                firstFrames.push({ source: "output_style", body: prepared.outputStyleFrame, commit: () => undefined, disclose: () => undefined });
             if (firstFrames.length > 0) {
                 effectiveObjective = `${firstFrames.map((f) => mintSystemReminder(sanitizeUntrustedText(f.body, attachmentEnvelopeTags(f.source)), prepared.reminderMark)).join("\n")}\n${effectiveObjective}`;
             }
-            if (composeApprovalPostureDirective(prepared.approvalPosture) !== undefined) {
-                const postureDirective = composeApprovalPostureDirective(prepared.approvalPosture, await statedReminderBodiesOf(prepared.session, prepared.reminderMark));
-                if (postureDirective !== undefined) {
-                    prepared.postureFrameRef.protectedText = mintSystemReminder(postureDirective, prepared.reminderMark);
-                    effectiveObjective = `${prepared.postureFrameRef.protectedText}\n${effectiveObjective}`;
-                }
-            }
+            const postureText = await owedPostureText(prepared, "always");
+            if (postureText !== undefined)
+                effectiveObjective = `${postureText}\n${effectiveObjective}`;
             const gitQueuedChars = gitLegDelivered !== undefined && gitLegDelivered.standalone ? gitLegDelivered.wrapped.length : 0;
             const precallMicroUsd = rs.budget.maxCostMicroUsd === undefined
                 ? 0
@@ -615,10 +616,17 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs),
             ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)),
         }, prepared.abortController.signal));
+        const personUnanswered = policyCannotAnswer(rechecked, outcome.hostDecision.decidedBy);
         const beltUnsafe = rechecked.action === "deny" ||
-            (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, resolvedArgs));
+            (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, resolvedArgs)) ||
+            personUnanswered;
         if (beltUnsafe) {
-            const editedDenial = formatHookFeedback(`The approver EDITED this call's input; the edited call is refused by the deployment's tool policy and was not executed${rechecked.action === "deny" && rechecked.message ? `: ${rechecked.message}` : " (the policy rewrote the edit to a value that was not approved)"}.`, prepared.reminderMark);
+            const why = rechecked.action === "deny"
+                ? (rechecked.message ? `: ${rechecked.message}` : "")
+                : personUnanswered
+                    ? " (the edited call requires a person's approval, and this decision was the deployment's policy)"
+                    : " (the policy rewrote the edit to a value that was not approved)";
+            const editedDenial = formatHookFeedback(`The approver EDITED this call's input; the edited call is refused by the deployment's tool policy and was not executed${why}.`, prepared.reminderMark);
             await settleEnd(true, { content: editedDenial }, vetoed("policy"));
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, editedDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
@@ -646,6 +654,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
                 orgWaitCancelled = cause === "aborted";
             },
         });
+        const unanswered = policyCannotAnswer(org, outcome.hostDecision.decidedBy);
         const blocked = org.status === "unavailable"
             ? realApprovalOrgFact(gateRealApproval) === "unavailable"
                 ? undefined
@@ -654,12 +663,14 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
                     : "this deployment is org-governed and cannot currently adjudicate against an organization policy snapshot"
             : org.verdict?.behavior === "deny"
                 ? `an organization policy rule (${org.verdict.rule}) denies it`
-                : undefined;
+                : unanswered
+                    ? `an organization policy rule (${org.verdict?.rule})${org.verdict?.unreadable !== undefined ? ` may reach this call, which could not be read against it (${org.verdict.unreadable}), so it` : ""} requires a person's approval for this call, and the decision recorded for it was the deployment's policy, not a person's`
+                    : undefined;
         if (blocked !== undefined) {
             const orgDisclosures = org.status === "unavailable" && org.disclosures.length > 0
                 ? ` Governance disclosures: ${inlineUntrusted(org.disclosures.join("; "), ORG_DISCLOSURE_MAX_CHARS)}.`
                 : "";
-            const orgDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${blocked}.${orgDisclosures} This approval is spent — the call has to be re-issued and approved again once organization policy permits it.`, prepared.reminderMark);
+            const orgDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${blocked}.${orgDisclosures} This approval is spent — the call has to be re-issued and ${unanswered ? "decided by a person" : "approved again once organization policy permits it"}.`, prepared.reminderMark);
             await settleEnd(true, { content: orgDenial }, vetoed("org"));
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, orgDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);

package/dist/core/runner/run-settle-and-teardown.js

@@ -10,7 +10,7 @@ import { hasDestroy, isIsolated } from "../remote-env.js";
 import { resolveTaskModel } from "../roles.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { emitTrace } from "../trace.js";
-import { deliverEngineNotice, settleOwedUserInput } from "../types.js";
+import { deliverEngineNotice, parentLegIds, settleOwedUserInput } from "../types.js";
 import { assembleResult } from "./assemble-result.js";
 import { discloseUnconsumedHalt } from "./halt-attribution.js";
 import { forwardSafely } from "./forward-sink.js";
@@ -111,6 +111,7 @@ export async function runSettleAndTeardown(input) {
             budgetHit: rs.limits.budgetHit,
             budgetAxis: rs.limits.budgetAxis,
             blockedReason: prepared.blockedRef.reason,
+            blockedDetail: prepared.blockedRef.detail,
             conflict: prepared.conflictRef.hit,
             gitCoreOverBudget: prepared.gitStatusRef.terminalCode === "irreducible_core_over_budget",
             outputInvalid: rs.degrade.outputInvalid,
@@ -147,7 +148,7 @@ export async function runSettleAndTeardown(input) {
                 amendTerminal(result, "resume.reopen_failed_unstarted", (m) => `${m ?? "the resume leg did not complete"} — the approved action never started, and reopening the checkpoint FAILED: its state is unprovable from here. Re-read it before deciding; do NOT issue a fresh approval on the assumption the old one is dead`);
             }
         }
-        settleOwedUserInput(owedUserInput, rowReturned, { taskId: spec.taskId ?? prepared.sessionId, sessionId: prepared.sessionId, runId: prepared.runId }, runner.deps.onNotice);
+        settleOwedUserInput(owedUserInput, rowReturned, { taskId: spec.taskId ?? prepared.sessionId, sessionId: prepared.sessionId, runId: prepared.runId, parent: parentLegIds(internals) }, runner.deps.onNotice);
         prepared.sealReadStateSeat?.(ownCommittedTailRef.current);
         {
             const wss = prepared.workspaceStateSettle;
@@ -293,7 +294,7 @@ export async function runSettleAndTeardown(input) {
         }
     }
     finally {
-        settleOwedUserInput(owedUserInput, !prepared.suspendProgressRef.executedApproved, { taskId: spec.taskId ?? prepared.sessionId, sessionId: prepared.sessionId, runId: prepared.runId }, runner.deps.onNotice);
+        settleOwedUserInput(owedUserInput, !prepared.suspendProgressRef.executedApproved, { taskId: spec.taskId ?? prepared.sessionId, sessionId: prepared.sessionId, runId: prepared.runId, parent: parentLegIds(internals) }, runner.deps.onNotice);
         const writeDateAnchor = owedDateAnchor(prepared.session, prepared.dateChange, rs.attach.dateState);
         if (writeDateAnchor !== undefined)
             await settleTeardownLeg(writeDateAnchor, "date anchor (settle leg)", (e) => runner.deps.onError?.(e, { phase: "degraded", sessionId: prepared.sessionId }));

package/dist/core/runner/run-turn-boundary.js

@@ -13,7 +13,7 @@ import { droppedToolDigest, withAnnounceDigests } from "./announce-once-ledger.j
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
 import { workflowSizeGuidelineChangeNotice } from "../../orchestration/workflow-size-guideline.js";
 import { awaitChargeWithSlowDisclosure, discloseUnevaluableWindow, ENV_DUE_GOVERNANCE_READ_BUDGET_MS, GOVERNANCE_READ_STALLED, LIMIT_APPROACH_DEFAULT_THRESHOLDS, limitApproachFrames, platformLimitTerminal, raceUntilDeadline } from "./clock-and-limits.js";
-import { compactionRestateOptions } from "./compaction-restate.js";
+import { appendBoundaryFrames, compactionRestateOptions } from "./compaction-restate.js";
 import { COMPACTION_FREED_EPSILON, COMPACTION_REGROWTH_FACTOR, MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
 import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions } from "./compaction-seams.js";
 import { contextUsageSections } from "../../prompt-assembly/section-usage.js";
@@ -197,6 +197,8 @@ export function createTurnBoundary(input) {
             }
             emitTrace(rs.telemetry.tracer, () => ({ kind: "review.dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
         }
+        if (!noNextRequest() && !prepared.abortController.signal.aborted)
+            await appendBoundaryFrames(prepared, rs.turn.lastTurnHadToolCalls);
         if (prepared.lspDiagnostics &&
             !prepared.lspDiagnostics.registry.isEmpty() &&
             !prepared.abortController.signal.aborted &&
@@ -283,13 +285,11 @@ export function createTurnBoundary(input) {
                     cadenceTurn: rs.counters.cadenceTurns,
                     todoMounted: todoToolMounted,
                     taskListMounted: taskToolsMounted,
-                    planActive: prepared.permissionMode.current === "plan",
                     config: {
                         todoReminder: rs.attach.attachmentsCfg?.todoReminder === true,
                         ...(rs.attach.attachmentsCfg?.todoReminderMode !== undefined ? { todoReminderMode: rs.attach.attachmentsCfg.todoReminderMode } : {}),
                         toolSearchReminder: toolSearchReminderOn,
                         changedFiles: changedFilesOn,
-                        planModeReminder: rs.attach.attachmentsCfg?.planModeReminder === true,
                         budgetUsd: budgetUsdOn,
                         totalTokensReminder: totalTokensOn,
                         ...(rs.attach.attachmentsCfg?.totalTokensReminderMode !== undefined
@@ -301,6 +301,7 @@ export function createTurnBoundary(input) {
                         skillsListing: rs.attach.skillsListingOn,
                         mcpInstructions: mcpInstructionsOn,
                     },
+                    ...(prepared.outputStyleFrame !== undefined && rs.turn.lastTurnHadToolCalls ? { outputStyle: prepared.outputStyleFrame } : {}),
                     ...(undiscoveredTools !== undefined && undiscoveredTools.length > 0
                         ? { undiscoveredTools, deferDirectCall: prepared.deferDirectCall }
                         : {}),

package/dist/core/runner/runtask.d.ts

@@ -198,8 +198,10 @@ export declare class Runner implements RunnerSelfSeat {
      *   during the resume — pre-CAS/edit-re-adjudication legs leave the checkpoint pending and resumable,
      *   the post-claim leg leaves it consumed; the message says which), `reopen_failed` (an aborted resume
      *   needed to reopen the checkpoint and the store refused, or the reopen failed in flight — the message
-     *   distinguishes terminally-consumed from state-unprovable). Each code's full contract is on
-     *   {@link CheckpointError.code}.
+     *   distinguishes terminally-consumed from state-unprovable), `config_refused` (pre-CAS: the re-supplied
+     *   config or a mode the row recorded is one prepare would refuse — `detail.code` is prepare's own code,
+     *   `detail.field` says whether the config or the row carries it; the checkpoint stays pending and
+     *   unchanged). Each code's full contract is on {@link CheckpointError.code}.
      */
     resume(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, 
     /** Same TRUSTED run-internals seam as {@link resumeStream} — the convenience wrapper

package/dist/core/runner/steer-admission.d.ts

@@ -10,6 +10,15 @@
  */
 import type { AcceptedSteerInput } from "./contracts.js";
 export declare function nextHumanInputSeq(key: object): number;
+/** The identity keys a published `queued` frame carried beyond its own `eventId` (`parentToolCallId`, `sourceTaskId`): one fact, stated
+ *  once by the frame's publisher and handed to whoever mints that input's other frames, so two frames of one input are never stamped
+ *  by two computations. */
+export type AcceptanceIdentity = {
+    parentToolCallId?: string;
+    sourceTaskId?: string;
+};
+export declare function armAcceptance(record: object, publish: () => AcceptanceIdentity): void;
+export declare function announceAcceptance(record: object): AcceptanceIdentity | undefined;
 /** Is a repeat under an already-accepted `inputId` the SAME
  *  instruction (an idempotent retry) or a different one wearing a used key? Compared field for field,
  *  exactly like the parked leg's replay check: the key alone is never evidence of a replay, and two

package/dist/core/runner/steer-admission.js

@@ -7,6 +7,14 @@ export function nextHumanInputSeq(key) {
     }
     return ++box.n;
 }
+const acceptanceSeats = new WeakMap();
+export function armAcceptance(record, publish) {
+    let published;
+    acceptanceSeats.set(record, () => (published ??= publish()));
+}
+export function announceAcceptance(record) {
+    return acceptanceSeats.get(record)?.();
+}
 export function sameAcceptedSteerInput(a, b) {
     return (a.payload === b.payload &&
         a.trusted === b.trusted &&

package/dist/core/runner/stream-steer-verb.js

@@ -6,7 +6,7 @@ import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "
 import { isSystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
-import { nextHumanInputSeq, sameAcceptedSteerInput } from "./steer-admission.js";
+import { announceAcceptance, armAcceptance, nextHumanInputSeq, sameAcceptedSteerInput } from "./steer-admission.js";
 import { asThrownError } from "../thrown-value.js";
 export function streamSteerVerb(input) {
     const { spec, internals, queue, acceptedSteerInputs, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, steeringError, runner } = input;
@@ -44,11 +44,8 @@ export function streamSteerVerb(input) {
         let payload;
         let mintsAFrame;
         let replay;
-        const noteAccepted = (h) => {
-            if (!mintsAFrame)
-                return;
-            if (typeof inputId === "string")
-                acceptedSteerInputs.set(inputId, replay);
+        const publishQueued = (h) => {
+            const identity = internals?.parentToolCallId !== undefined ? { parentToolCallId: internals.parentToolCallId, ...(spec.taskId !== undefined ? { sourceTaskId: spec.taskId } : {}) } : {};
             queue.push({
                 ...buildHumanInputEvent({
                     carrier: "steer",
@@ -61,10 +58,16 @@ export function streamSteerVerb(input) {
                     ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
                 }),
                 eventId: uuidv7(),
-                ...(internals?.parentToolCallId !== undefined
-                    ? { parentToolCallId: internals.parentToolCallId, ...(spec.taskId !== undefined ? { sourceTaskId: spec.taskId } : {}) }
-                    : {}),
+                ...identity,
             });
+            return identity;
+        };
+        const noteAccepted = () => {
+            if (!mintsAFrame)
+                return;
+            if (typeof inputId === "string")
+                acceptedSteerInputs.set(inputId, replay);
+            announceAcceptance(parkRecord);
         };
         const deliver = async () => {
             if (live.resultValue)
@@ -130,13 +133,15 @@ export function streamSteerVerb(input) {
             }
             const injectFramed = async () => {
                 const noteOptions = { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) };
+                if (mintsAFrame)
+                    armAcceptance(parkRecord, () => publishQueued(h));
                 if (priority === "later") {
                     await h.harness.followUp(payload, noteOptions);
-                    noteAccepted(h);
+                    noteAccepted();
                     return;
                 }
                 const frame = await h.harness.steer(payload, { ...noteOptions, ...(priority === "now" ? { immediate: true } : {}) });
-                noteAccepted(h);
+                noteAccepted();
                 if (priority === "now" && frame !== undefined && h.harness.interruptTurn(frame)) {
                     deliverEngineNotice(runner.deps.onNotice, {
                         code: "task.turn_interrupted",

package/dist/core/runner/synthetic-tools.d.ts

@@ -1,6 +1,7 @@
 import { type TSchema } from "typebox";
 import type { AgentTool } from "../../internal/harness-types.js";
 import type { SkillManifest } from "../types.js";
+import type { TerminalBlockedDetail } from "../terminal-cause.js";
 import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import type { ActiveSkillScope } from "./active-skill-scope.js";
 /** Reserved name of the injected structured-output tool (CC 2.1.187 `StructuredOutput`; batch-A rename — old
@@ -21,6 +22,9 @@ export declare const OUTPUT_DEFAULT_RETRIES = 2;
 export declare function resolveOutputRetries(outputRetries?: number): number;
 export interface BlockedRef {
     reason?: string;
+    /** Written by the engine when a hook seat kept the prompt back (never by the `ReportBlocked` tool): the terminal's
+     *  `detail`. Absent = the model's own report. */
+    detail?: TerminalBlockedDetail;
 }
 /** Captures the validated object a `submit_output` call submitted (structured output, 1.41). `set` is
  *  flipped so we can tell "model submitted {}" from "never called". Mirrors `BlockedRef`. */

package/dist/core/runner/tool-turn-repair-seat.js

@@ -40,7 +40,7 @@ export function createToolTurnRepairSeat(onNotice, ids) {
     const announced = new Set();
     const incomplete = createToolTurnIncompleteSeat(onNotice, ids);
     return (repairs) => {
-        const missing = repairs.filter((repair) => repair.form === "missing_result").flatMap((repair) => repair.toolCallIds);
+        const missing = repairs.filter((repair) => repair.form === "missing_result" && repair.beforeRun !== true).flatMap((repair) => repair.toolCallIds);
         if (missing.length > 0)
             incomplete.announce("missing_result_synthesized", missing.length, missing);
         const fresh = repairs.filter((repair) => {

package/dist/core/runner/turn-attachments.d.ts

@@ -18,10 +18,6 @@ export declare const TODO_REMINDER_CONFIG: {
     readonly TURNS_SINCE_WRITE: 10;
     readonly TURNS_BETWEEN_REMINDERS: 10;
 };
-export declare const PLAN_MODE_ATTACHMENT_CONFIG: {
-    readonly TURNS_BETWEEN_ATTACHMENTS: 5;
-    readonly FULL_REMINDER_EVERY_N_ATTACHMENTS: 5;
-};
 /** CC 2.1.220 tool-search reminder cadence, the shipped defaults of its `juniper_shoal`
  *  config block (`sru = 15` / `aru = 10` @185913-185914, read as `{everyNTurns, maxNames}` @185836-185849).
  *  `EVERY_N_TURNS` gates BOTH windows (since-last-ToolSearch and since-last-reminder, @608920);
@@ -80,7 +76,7 @@ export declare const CHANGED_FILES_MTIME_EPS_MS = 2000;
 /** Per-boundary byte cap over the bundle's CLIPPABLE frames (weak-model context economics). Intact-class
  *  frames ride outside it — see {@link ATTACHMENT_DELIVERY_CLASS}. */
 export declare const ATTACHMENT_BYTE_CAP: number;
-export type AttachmentSource = "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "plan_mode" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "total_tokens_reminder" | "background_tasks" | "tools_delta" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools";
+export type AttachmentSource = "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "output_style" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "total_tokens_reminder" | "background_tasks" | "tools_delta" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools";
 /** How the bundle cap treats a source — see {@link ATTACHMENT_DELIVERY_CLASS}. */
 export type AttachmentDeliveryClass = {
     readonly class: "clippable";
@@ -114,7 +110,7 @@ export declare const ATTACHMENT_DELIVERY_CLASS: {
     readonly changed_files: {
         readonly class: "clippable";
     };
-    readonly plan_mode: {
+    readonly output_style: {
         readonly class: "clippable";
     };
     readonly budget_usd: {
@@ -238,10 +234,6 @@ export interface AttachmentState {
     /** Cadence-clock value at the last tool_search_usage_reminder emitted (CC 220 `cFy`'s
      *  `turnsSinceLastReminder`, found by scanning back for the attachment entry itself). */
     lastToolSearchReminderTurn: number;
-    /** plan_mode attachments emitted so far — drives CC's full/sparse rotation (1st, 6th, 11th… = full).
-     *  0 also encodes "never attached": CC always attaches on the FIRST plan-mode boundary, then throttles. */
-    planAttachmentCount: number;
-    lastPlanReminderTurn: number;
     /** changed_files per-path dedup: the last mtime already surfaced for a path — the same (path, mtime)
      *  is never reported twice. Evicted alongside readFileState's ENOENT eviction (LOW-9: bounded by it). */
     surfacedMtime: Map<string, number>;
@@ -296,7 +288,7 @@ export interface AttachmentState {
      *    leg's real remaining — the CC re-anchor arm, not a floor violation; the floor deliberately
      *    does NOT ride the checkpoint, since a carried floor against a fresh slice window would freeze
      *    the readout at "0 tokens left" over an allowance the run genuinely holds). Same lifecycle
-     *    reasoning as the plan_mode lane's `countPlanModeAttachmentsSinceLastExit` note.
+     *    reasoning applies to every per-leg counter here.
      *  - the ROLLOVER (`rollOverContext`, which adds each compacted-away context back so the count keeps
      *    advancing) is likewise not owed: sema feeds a CUMULATIVE spend coordinate (`stats.tokens`),
      *    which a compaction never rewinds, where CC feeds the live context size.
@@ -412,17 +404,19 @@ export interface AttachmentInputs {
      *  multi-block turn consumes one unit PER block, so the windows run 2-3× faster than physical
      *  turns on real transcripts (text+tool_use is the norm). Write anchors ({@link stampWriteAnchor})
      *  are stamped in this SAME coordinate. Omitted ⇒ falls back to `turn` (correct only for the
-     *  degenerate one-non-thinking-block-per-turn transcript). plan_mode keeps `turn` (its cadence is
-     *  a recorded sema deviation already — assistant turns, not CC human turns). */
+     *  degenerate one-non-thinking-block-per-turn transcript). */
     cadenceTurn?: number;
     /** Whether TodoWrite is mounted (CC gate: no tool ⇒ no reminder, ever). */
     todoMounted: boolean;
     /** Whether the task-family tools are mounted. Both mounted ⇒ task_reminder wins (CC isTodoV2 branch). */
     taskListMounted: boolean;
-    /** Whether the leg's effective permission mode is `plan` right now (the one mode seat, whichever entrance set it:
-     *  the spec's word, a steer, the model's EnterPlanMode). A false here simply stops the producer — no re-entry cycle
-     *  reset (documented deviation from CC's countPlanModeAttachmentsSinceLastExit). */
-    planActive: boolean;
+    /**
+     * The output-style frame's body, rendered once at prepare from `TaskSpec.outputStyle` (output-style.ts);
+     * present ⇒ the frame is due at this boundary. The reference implementation's producer has no window: it
+     * attaches at every attachment cycle while a non-default style is active, so the run loop passes it at every
+     * continuing boundary and this producer holds no state for it.
+     */
+    outputStyle?: string;
     /** SR-3 budget_usd lane (CC 198 `QFm` producer :480424-480428 + renderer :600225; 220 `_Fy` @609096
      *  with the mount at @607474): the run's cost progress against its $ ceiling, in USD. Only passed
      *  when `config.budgetUsd` opted in AND the task actually carries a ceiling (CC gate
@@ -466,7 +460,6 @@ export interface AttachmentInputs {
          *  `toolSearchReminder` config resolves non-null, @607450-607456 / `cXi` @185859). */
         toolSearchReminder?: boolean;
         changedFiles: boolean;
-        planModeReminder: boolean;
         /** SR-3: budget_usd progressive reminder lane (opt-in, default OFF like every 133 member). CC fires
          *  it on EVERY attachment cycle while `maxBudgetUsd` is set; there is NO threshold ladder and no
          *  throttle window (QFm/`_Fy` are unconditional) — the "progression" is the numbers advancing with
@@ -625,11 +618,11 @@ export interface AttachmentInputs {
  * splitting "decide" from "mark sent" would just invite a drift between the two.
  *
  * Returns attachments in EVIDENCE-STRENGTH order (todo/task → tool_search_usage_reminder →
- * plan_mode → budget_usd → total_tokens_reminder → background_tasks → tools_delta → agent_listing →
+ * output_style → budget_usd → total_tokens_reminder → background_tasks → tools_delta → agent_listing →
  * skills_listing → mcp_instructions → mcp_dropped_tools → changed_files), which is also the §R3
  * MED-6 truncation order read backwards: under the 8KB cap changed_files is sacrificed first, the
  * todo/task list last. The G1/续批 members are registry/engine ground truth (strong), but the
- * todo/plan lane keeps priority: it carries the run's own work-tracking state, which the model can
+ * todo/task lane keeps priority: it carries the run's own work-tracking state, which the model can
  * least afford to lose.
  */
 export declare function collectDueAttachments(state: AttachmentState, inp: AttachmentInputs): readonly TurnAttachment[];
@@ -856,8 +849,9 @@ export declare function agentListingDeltaHeader(toolName: string): string;
  *
  * ShowConcurrencyNote, honest attribution: `entries.length > 1` is a sema APPROXIMATION, not
  * CC semantics. 220's real predicate (@607882) is `Aa() !== "pro" && Cq() === "default"` — subscription
- * tier is not "pro" AND the output style is the default one. Neither axis exists in core (BYOM has no
- * subscription plane; there is no output-style plane at all), so the predicate is untranslatable, and
+ * tier is not "pro" AND the output style is the default one. The tier axis does not exist in core (BYOM has no
+ * subscription plane) and the style axis is only a declared seat (`TaskSpec.outputStyle`), so the predicate is
+ * untranslatable as a whole, and
  * 220's intent — "show the parallel-launch hint to users who have not already been told it elsewhere" —
  * has no sema carrier either. The roster-size proxy is kept because it is the one honest thing core can
  * say: a single-type roster cannot be launched concurrently with a different type, so the note would be

package/dist/core/runner/turn-attachments.js

@@ -1,4 +1,3 @@
-import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
 import { readMember } from "../thrown-value.js";
 import { delimitUntrustedWithClip, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { protocolOf } from "../protocol-table.js";
@@ -10,10 +9,6 @@ export const TODO_REMINDER_CONFIG = {
     TURNS_SINCE_WRITE: 10,
     TURNS_BETWEEN_REMINDERS: 10,
 };
-export const PLAN_MODE_ATTACHMENT_CONFIG = {
-    TURNS_BETWEEN_ATTACHMENTS: 5,
-    FULL_REMINDER_EVERY_N_ATTACHMENTS: 5,
-};
 export const TOOL_SEARCH_REMINDER_CONFIG = {
     EVERY_N_TURNS: 15,
     MAX_NAMES: 10,
@@ -35,7 +30,7 @@ export const ATTACHMENT_DELIVERY_CLASS = {
     task_reminder: { class: "clippable" },
     tool_search_usage_reminder: { class: "clippable" },
     changed_files: { class: "clippable" },
-    plan_mode: { class: "clippable" },
+    output_style: { class: "clippable" },
     budget_usd: { class: "clippable" },
     total_tokens_reminder: { class: "clippable" },
     background_tasks: { class: "clippable" },
@@ -68,8 +63,6 @@ export function createAttachmentState() {
         lastTodoReminderTurn: 0,
         lastTaskReminderTurn: 0,
         lastToolSearchReminderTurn: 0,
-        planAttachmentCount: 0,
-        lastPlanReminderTurn: 0,
         surfacedMtime: new Map(),
         postCompactPending: false,
     };
@@ -193,16 +186,8 @@ export function collectDueAttachments(state, inp) {
             (out ??= []).push({ source: "tool_search_usage_reminder", body: renderToolSearchUsageReminder(inp.undiscoveredTools, inp.deferDirectCall !== false) });
         }
     }
-    if (inp.config.planModeReminder && inp.planActive) {
-        const due = state.planAttachmentCount === 0 ||
-            inp.turn - state.lastPlanReminderTurn >= PLAN_MODE_ATTACHMENT_CONFIG.TURNS_BETWEEN_ATTACHMENTS;
-        if (due) {
-            state.planAttachmentCount += 1;
-            state.lastPlanReminderTurn = inp.turn;
-            const full = state.planAttachmentCount % PLAN_MODE_ATTACHMENT_CONFIG.FULL_REMINDER_EVERY_N_ATTACHMENTS === 1;
-            (out ??= []).push({ source: "plan_mode", body: full ? PLAN_MODE_FULL_BODY : PLAN_MODE_SPARSE_BODY });
-        }
-    }
+    if (inp.outputStyle !== undefined)
+        (out ??= []).push({ source: "output_style", body: inp.outputStyle });
     if (inp.config.budgetUsd && inp.budgetUsd !== undefined) {
         (out ??= []).push({ source: "budget_usd", body: renderBudgetUsd(inp.budgetUsd.used, inp.budgetUsd.total) });
     }
@@ -761,8 +746,6 @@ function mcpDroppedToolsBound(inp) {
     const single = first === undefined ? 0 : MCP_DROPPED_FIXED_MAX_BYTES + bytes(first.tool) + bytes(first.server) + bytes(first.reason) + 32;
     return Math.max(MCP_DROPPED_BATCH_MAX_BYTES, single);
 }
-const PLAN_MODE_FULL_BODY = `Plan mode is active. The user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system — every such call asks the user first, and is refused where nobody can answer. This supercedes any other instructions you have received. Instead, you should: research and analyze with read-only tools, and when you have formed a concrete plan, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. That tool inherently requests plan approval — never ask for approval via plain text.`;
-const PLAN_MODE_SPARSE_BODY = `Plan mode still active (see full instructions earlier in conversation). Read-only: no edits, commits, or config changes. When your plan is ready, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. Never ask about plan approval via plain text.`;
 const TRUNCATION_MARKER = "\n…[truncated]";
 const MIN_KEEP_BYTES = 160;
 function capAttachments(atts) {

package/dist/core/runner-deps.d.ts

@@ -718,7 +718,7 @@ export interface RunnerDeps {
      */
     /**
      * The deployment's A2A peer switches. `isolatePeers: true` makes every A2A peer skill's egress default an
-     * OPERATOR mandate: its ask is `operator_forced` (kept under `bypassPermissions`, not settled by `dontAsk`)
+     * OPERATOR mandate: its ask is `operator_forced` (kept under `bypassPermissions`; `dontAsk` refuses it like every ask)
      * instead of the releasable `tool_marks_a2a`. Absent ⇒ the default (a permission mode may release it, disclosed).
      */
     a2a?: {

package/dist/core/store-contracts/checkpoint-store-contract.d.ts

@@ -27,6 +27,14 @@ export declare const ALLOW: Extract<ResumeOutcome, {
 export declare const EXECUTED_ALLOW: GateOutcome;
 export declare const EXECUTED_ALLOW_REORDERED: GateOutcome;
 export declare const VETOED_BY_POLICY: GateOutcome;
+/** The other decider: the record a `policy_ask` allow the deployment's own POLICY decided files
+ *  (`policy_allowed`, `who.party: "policy"` with the seat that answered) — the decision's own record on the
+ *  resolved winner, and the execution record once the call ran — and the decide that carries it. A backend keeps
+ *  the record verbatim; nothing in it may be re-derived from the person's shape. */
+export declare const POLICY_ALLOWED: GateOutcome;
+export declare const POLICY_ALLOW: Extract<ResumeOutcome, {
+    gate: "policy_ask";
+}>;
 /**
  * The full cross-backend contract for {@link CheckpointStore} — the SAME assertions for every
  * backend. Entries are a 1:1 port of the vitest originals (assertion semantics unchanged).

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -41,6 +41,12 @@ const SETTLED = { kind: "human_allowed", who: { party: "person" }, when: 1_700_0
 export const EXECUTED_ALLOW = Object.freeze({ disposition: Object.freeze({ kind: "allowed" }), settlement: Object.freeze({ ...SETTLED, who: Object.freeze({ ...SETTLED.who }) }), origin: "policy" });
 export const EXECUTED_ALLOW_REORDERED = Object.freeze({ origin: "policy", settlement: Object.freeze({ when: 1_700_000_000_500, who: Object.freeze({ party: "person" }), kind: "human_allowed" }), disposition: Object.freeze({ kind: "allowed" }) });
 export const VETOED_BY_POLICY = Object.freeze({ disposition: Object.freeze({ kind: "denied", deniedBy: "policy" }), settlement: Object.freeze({ ...SETTLED, who: Object.freeze({ ...SETTLED.who }) }), origin: "policy" });
+export const POLICY_ALLOWED = Object.freeze({
+    disposition: Object.freeze({ kind: "allowed" }),
+    settlement: Object.freeze({ kind: "policy_allowed", who: Object.freeze({ party: "policy", approver: "unattended_class_answer" }), when: 1_700_000_000_500 }),
+    origin: "policy",
+});
+export const POLICY_ALLOW = { ...ALLOW, hostDecision: { decidedBy: "policy", approver: "unattended_class_answer" }, gateOutcome: POLICY_ALLOWED };
 export async function checkpointStoreContract(make, runAssertion) {
     const { run, settle } = beginContract(runAssertion);
     run("kit prerequisites: reopen/setPendingSteer/listByScope are implemented (REQUIRED by this kit)", async () => {
@@ -399,6 +405,23 @@ export async function checkpointStoreContract(make, runAssertion) {
         assert.equal("askClass" in bare, false, "an absent askClass must stay OMITTED on the row");
         assert.equal("classes" in bare, false, "an absent classes must stay OMITTED on the row");
     });
+    run("decider pair: a policy-decided allow resolves like a person's — its `policy_allowed` record (party `policy`, the attribution) round-trips verbatim on the resolved winner and as the execution record; the same record is already_recorded, a person's record for that row conflicts", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        assert.equal(await store.resolve(cp.token, cp.scope, POLICY_ALLOW), true, "a policy-decided allow is a decision the CAS takes like any other");
+        const resolved = (await store.get(cp.token));
+        assert.equal(resolved.status, "resolved");
+        assert.equal(resolved.resolvedOutcome.decision, "allow");
+        assert.deepEqual(resolved.resolvedOutcome.gateOutcome, POLICY_ALLOWED, "the decision's record rides the winner verbatim — the party word and the attribution included");
+        assert.equal(await store.recordExecutionOutcome(cp.token, cp.scope, POLICY_ALLOWED), "recorded");
+        const filed = (await store.get(cp.token));
+        assert.deepEqual(filed.executionOutcome, POLICY_ALLOWED, "the policy's execution record is kept verbatim");
+        assert.deepEqual(executionVerdict(filed), { kind: "executed", gate: POLICY_ALLOWED });
+        assert.equal(await store.recordExecutionOutcome(cp.token, cp.scope, structuredClone(POLICY_ALLOWED)), "already_recorded", "an unfrozen structural twin is the same record");
+        await assert.rejects(store.recordExecutionOutcome(cp.token, cp.scope, EXECUTED_ALLOW), (e) => e.code === "checkpoint.execution_outcome_conflict", "a person's record for a row the policy decided is a different record");
+        assert.deepEqual((await store.get(cp.token)).executionOutcome, POLICY_ALLOWED);
+    });
     await settle();
 }
 const sortByToken = (a, b) => a.token.localeCompare(b.token);