@sema-agent/core 7.4.0 → 7.5.1

package/dist/core/runner/prepare-tool-disclosure-mount.d.ts

@@ -0,0 +1,111 @@
+/**
+ * design/390 §1.2 M14 — prepareTask's TOOL-DISCLOSURE-MOUNT phase, verbatim from the driver: the deferred registry
+ * and its placeholders, the ToolSearch mount with its serialized activation section, the materialize strategy's
+ * two-layer resolution (spec over the env channel, the safety interlock, the loud arms for a discarded env value), the
+ * per-tool static exemption with its monotone ledger, the activation seed from the transcript / compaction snapshots /
+ * checkpoint, the callable-names accessor the offload preview and ToolSearch share, the delta ref with its failed-server
+ * arm, and the RefreshMcpTools rebuild seam's two arms. The env-channel announce ledger (per sink, per line) moved with
+ * the segment — only this phase announces through it. The interface is the dependency list the segment had implicitly
+ * (design/238 R-1).
+ *
+ * ASYNC PHASE: with deferred names present the segment awaits the session's context and branch (the activation seed),
+ * exactly where the driver awaited them; with nothing deferred the body has no await of its own. The phase adds no yield
+ * BEFORE the first of those awaits (the reserved-name refusal, the env screen and the registry build run synchronously
+ * as they did). Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
+ *
+ * The roster is READ here, never written (the writer table is on {@link Prepared.tools}); `harnessTools` is the derived
+ * list the harness is built from, and the placeholders live only in it.
+ */
+import type { AgentHarness, AgentTool } from "../../internal/harness.js";
+import { type ToolFingerprintInput } from "../cache-break-detector.js";
+import type { MaterializedMcp, McpServerStatus } from "../mcp.js";
+import type { StoredSession } from "../session.js";
+import type { RunnerDeps, TaskSpec } from "../types.js";
+import type { Prepared, PrepareResume } from "./contracts.js";
+export interface PrepareToolDisclosureMountInput {
+    /** borrowed-readonly — the REBOUND spec. Read: `toolMaterializeStrategy` (the requested strategy, spec wins) and
+     *  `deferSelfResolve` (the direct-call lane, the interlock). Never mutated. */
+    spec: Pick<TaskSpec, "toolMaterializeStrategy" | "deferSelfResolve">;
+    /** borrowed-readonly — the deployment seats: only `onNotice` (the env-channel discard announcements). */
+    deps: Pick<RunnerDeps, "onNotice">;
+    /** borrowed-readonly — the acquired session: `buildContext` and `getBranch` seed the activation set (deferred names only). */
+    session: Pick<StoredSession, "buildContext" | "getBranch">;
+    /** borrowed-readonly — the resume leg, or undefined: `seed.activeTools` is the authoritative activation reseed. */
+    resume: Pick<PrepareResume, "seed"> | undefined;
+    /** borrowed-readonly — the deferred classification (post-exclusion names): read for size, membership and iteration. */
+    deferred: ReadonlySet<string>;
+    /** borrowed-readonly — the run's shared roster (`Prepared.tools`): READ here — the registry build, the reserved-name
+     *  check, the live resolution the placeholders and the static face perform at call time. Never written by this phase. */
+    tools: AgentTool[];
+    /** borrowed-readonly — the once-per-session ledger's failed-server projection (current failures minus the pairs this
+     *  session already announced). */
+    onceLedger: {
+        mcpFailuresToAnnounce(statuses: ReadonlyArray<McpServerStatus>): Array<{
+            name: string;
+            error?: string;
+        }>;
+    };
+    /** borrowed-readonly — the materialized MCP handle; only `statuses` (the failed-server arm's source). */
+    mcp: Pick<MaterializedMcp, "statuses">;
+    /** borrowed-mutable — the assembled-prompt manifest (`Prepared.promptManifest`). Writer here: ONE assignment of
+     *  `toolDisclosure` (deferred names only). */
+    promptManifest: Prepared["promptManifest"];
+    /** borrowed-mutable — the offload preview's reachability accessor seat. Writer here: `current` ← the callable-names
+     *  accessor (deferred names only); the offload wrappers read it at each offload. */
+    offloadReachableToolsRef: {
+        current?: () => ReadonlySet<string>;
+    };
+    /** borrowed-readonly — the content-origin wrap seat; both rebuild arms CALL `current` at run time, never write it. */
+    contentOriginWrapRef: {
+        current?: () => void;
+    };
+    /** borrowed-mutable — the RefreshMcpTools rebuild seam. Writer here: `current` ← the deferred arm's rematerialize or the
+     *  default arm's bare setTools (exactly one of the two, decided by `deferred.size`). */
+    rebuildHarnessToolsRef: {
+        current?: () => Promise<void>;
+    };
+    /** borrowed-readonly — the harness seat; the rebuild arms and the direct-call lane read `current` at run time. */
+    harnessRef: {
+        current?: AgentHarness;
+    };
+}
+export interface PrepareToolDisclosureMountResult {
+    /** owned — the activation set (`Prepared.activeTools`): seeded here; ToolSearch and the direct lane add at run time. */
+    activeTools: Set<string>;
+    /** borrowed-mutable — the cache-fingerprint seat. Writer: the driver, once, when the fingerprint is built; the rebuild
+     *  arms refresh its `tools` at run time. */
+    fpRef: {
+        current?: {
+            systemPrompt: string;
+            tools: ToolFingerprintInput[];
+        };
+    };
+    /** borrowed-mutable — the turn-snapshot identity seat. Writer: the driver's turn wiring, once; the rebuild arms call
+     *  `refreshTools` on it at run time. */
+    turnSnapshotRef: {
+        current?: import("../../prompt-assembly/turn-snapshot.js").TurnPromptSnapshot;
+    };
+    /** owned — the list the harness is built from: the roster with placeholders in the deferred slots plus ToolSearch (or the
+     *  roster itself when nothing is deferred). */
+    harnessTools: AgentTool[];
+    /** owned — the boundary delta ref (`Prepared.toolsDeltaRef`), minted when anything is deferred OR a server failed. */
+    toolsDeltaRef: Prepared["toolsDeltaRef"];
+    /** owned — the effective strategy (`Prepared.toolMaterializeStatic`). */
+    toolMaterializeStatic: boolean;
+    /** owned — the direct-call lane's presence (`Prepared.deferDirectCall`). */
+    deferDirectCall: boolean;
+    /** owned — the per-tool static exemption seat (`Prepared.staticFaceFor` reads its `current`). */
+    staticFaceForRef: {
+        current?: (name: string) => boolean;
+    };
+    /** borrowed-mutable — the listing-ride seam: the ToolSearch tool and the direct lane call `current` at run time. Writer:
+     *  the listings phase, once, after the roster face is classified. */
+    listingRideRef: {
+        current?: (newly: readonly string[]) => string | undefined;
+    };
+}
+/** Test seam (mirrors `__resetToolModelGateAnnouncements`): never called by production code.
+ *  Re-arms BOTH arms (a WeakMap has no clear — it is re-minted). */
+export declare function __resetMaterializeEnvAnnouncements(): void;
+/** The M14 phase body — prepareTask's tool-disclosure-mount stretch, verbatim (see the module header). */
+export declare function prepareToolDisclosureMount(input: PrepareToolDisclosureMountInput): Promise<PrepareToolDisclosureMountResult>;

package/dist/core/runner/prepare-tool-disclosure-mount.js

@@ -0,0 +1,219 @@
+import { readCompactionActiveTools } from "../../internal/harness.js";
+import { toolsToFingerprintInputs } from "../cache-break-detector.js";
+import { deliverEngineNotice } from "../types.js";
+import { TOOL_SEARCH_NAME, buildDeferredRegistry, extractDiscoveredToolNames, createPlaceholderTool, createToolSearchTool, staticSchemaRenderable } from "./tool-disclosure.js";
+let announcedMaterializeEnvBySink = new WeakMap();
+const announcedMaterializeEnvConsole = new Set();
+function materializeEnvLedger(onNotice) {
+    if (typeof onNotice !== "function")
+        return announcedMaterializeEnvConsole;
+    let lines = announcedMaterializeEnvBySink.get(onNotice);
+    if (lines === undefined) {
+        lines = new Set();
+        announcedMaterializeEnvBySink.set(onNotice, lines);
+    }
+    return lines;
+}
+export function __resetMaterializeEnvAnnouncements() {
+    announcedMaterializeEnvBySink = new WeakMap();
+    announcedMaterializeEnvConsole.clear();
+}
+function emitMaterializeEnvNotice(onNotice, message, detail) {
+    const ledger = materializeEnvLedger(onNotice);
+    if (ledger.has(message))
+        return;
+    ledger.add(message);
+    deliverEngineNotice(onNotice, { code: "config.materialize_env_discarded", message, detail });
+}
+export async function prepareToolDisclosureMount(input) {
+    const { spec, deps, session, resume, deferred, tools, onceLedger, mcp, promptManifest, offloadReachableToolsRef, contentOriginWrapRef, rebuildHarnessToolsRef, harnessRef } = input;
+    const activeTools = new Set();
+    const fpRef = {};
+    const turnSnapshotRef = {};
+    let harnessTools = tools;
+    const failedMcpServers = onceLedger.mcpFailuresToAnnounce(mcp.statuses);
+    let toolsDeltaRef;
+    let toolMaterializeStatic = false;
+    let deferDirectCall = false;
+    const staticFaceForRef = {};
+    if (deferred.size > 0 || failedMcpServers.length > 0) {
+        toolsDeltaRef = { pending: [], pendingRemoved: [], pendingReadded: [], pendingFailed: failedMcpServers };
+    }
+    const listingRideRef = {};
+    {
+        const raw = process.env.SEMA_TOOL_MATERIALIZE_STRATEGY;
+        if (raw !== undefined && raw !== "swap" && raw !== "static" && deferred.size === 0) {
+            const line = `SEMA_TOOL_MATERIALIZE_STRATEGY=${JSON.stringify(raw)} is not "swap" or "static" — inert on this task (no deferred tools), but a deferring task WITHOUT an explicit spec strategy will refuse to prepare under it (an explicit legal spec outranks and discards it, loudly). Fix or unset the flag.`;
+            emitMaterializeEnvNotice(deps.onNotice, line, { raw });
+        }
+    }
+    if (deferred.size > 0) {
+        if (deferred.has(TOOL_SEARCH_NAME) || tools.some((t) => t.name === TOOL_SEARCH_NAME)) {
+            const e = new Error(`Tool name "${TOOL_SEARCH_NAME}" is reserved when deferred tools are present.`);
+            e.code = "config.reserved_tool_name";
+            throw e;
+        }
+        const registry = buildDeferredRegistry(deferred, tools);
+        const rawEnvStrategy = process.env.SEMA_TOOL_MATERIALIZE_STRATEGY;
+        const envStrategyInvalid = rawEnvStrategy !== undefined && rawEnvStrategy !== "swap" && rawEnvStrategy !== "static";
+        if (envStrategyInvalid && spec.toolMaterializeStrategy === undefined) {
+            const e = new Error(`SEMA_TOOL_MATERIALIZE_STRATEGY must be "swap" or "static" (got ${JSON.stringify(rawEnvStrategy)}).`);
+            e.code = "config.tool_materialize_invalid";
+            throw e;
+        }
+        if (envStrategyInvalid) {
+            const line = `SEMA_TOOL_MATERIALIZE_STRATEGY=${JSON.stringify(rawEnvStrategy)} was ignored — not "swap" or "static", and the task spec pins toolMaterializeStrategy=${JSON.stringify(spec.toolMaterializeStrategy)} which outranks it. Fix or unset the env flag.`;
+            emitMaterializeEnvNotice(deps.onNotice, line, { raw: rawEnvStrategy, specStrategy: spec.toolMaterializeStrategy });
+        }
+        const envStrategy = envStrategyInvalid ? undefined : rawEnvStrategy;
+        const requestedStrategy = spec.toolMaterializeStrategy ?? envStrategy ?? "swap";
+        const laneDegrade = requestedStrategy === "static" && spec.deferSelfResolve === false;
+        const materializeStatic = requestedStrategy === "static" && !laneDegrade;
+        toolMaterializeStatic = materializeStatic;
+        deferDirectCall = spec.deferSelfResolve !== false;
+        promptManifest.toolDisclosure = {
+            deferredTools: deferred.size,
+            strategy: materializeStatic ? "static" : "swap",
+            source: laneDegrade ? "degraded_no_direct_lane" : spec.toolMaterializeStrategy !== undefined ? "spec" : envStrategy !== undefined ? "env" : "default",
+        };
+        const everExempt = new Set();
+        const staticFaceFor = (name) => {
+            if (!materializeStatic)
+                return false;
+            if (everExempt.has(name))
+                return false;
+            if (staticSchemaRenderable(tools.find((t) => t.name === name)?.parameters))
+                return true;
+            everExempt.add(name);
+            return false;
+        };
+        staticFaceForRef.current = staticFaceFor;
+        let activationChain = Promise.resolve();
+        const serializeActivation = (section) => {
+            const p = activationChain.then(section);
+            activationChain = p.then(() => undefined, () => undefined);
+            return p;
+        };
+        const directCallFor = (name) => {
+            if (spec.deferSelfResolve === false)
+                return undefined;
+            const executionMode = tools.find((t) => t.name === name)?.executionMode;
+            return {
+                resolveReal: () => {
+                    const real = tools.find((t) => t.name === name);
+                    if (real === undefined)
+                        return undefined;
+                    return {
+                        parameters: real.parameters,
+                        invoke: (toolCallId, params, signal, onUpdate) => real.execute(toolCallId, params, signal, onUpdate),
+                    };
+                },
+                ...(executionMode !== undefined ? { executionMode } : {}),
+                staticFace: () => staticFaceFor(name),
+                activate: async () => serializeActivation(async () => {
+                    if (activeTools.has(name))
+                        return undefined;
+                    activeTools.add(name);
+                    try {
+                        await rematerialize(activeTools);
+                    }
+                    catch (e) {
+                        activeTools.delete(name);
+                        throw e;
+                    }
+                    return listingRideRef.current?.([name]);
+                }),
+            };
+        };
+        const placeholders = new Map([...registry.values()].map((i) => [i.name, createPlaceholderTool(i, directCallFor(i.name))]));
+        const { messages } = await session.buildContext();
+        for (const n of extractDiscoveredToolNames(messages, registry)) {
+            if (deferred.has(n))
+                activeTools.add(n);
+        }
+        for (const entry of await session.getBranch()) {
+            if (entry.type !== "compaction" || entry.fromHook === true)
+                continue;
+            for (const n of readCompactionActiveTools(entry.details)) {
+                if (deferred.has(n))
+                    activeTools.add(n);
+            }
+        }
+        if (resume) {
+            for (const n of resume.seed.activeTools)
+                if (deferred.has(n))
+                    activeTools.add(n);
+        }
+        const callableToolNames = () => {
+            const s = new Set(tools.map((t) => t.name));
+            for (const n of deferred)
+                if (!activeTools.has(n))
+                    s.delete(n);
+            s.add(TOOL_SEARCH_NAME);
+            return s;
+        };
+        offloadReachableToolsRef.current = callableToolNames;
+        let toolSearch;
+        const buildToolList = (active) => {
+            const list = tools.map((t) => (deferred.has(t.name) && (staticFaceFor(t.name) || !active.has(t.name)) ? placeholders.get(t.name) : t));
+            list.push(toolSearch);
+            return list;
+        };
+        const announcedTools = new Set(activeTools);
+        const withdrawnTools = new Set();
+        const deltaRef = toolsDeltaRef;
+        const rematerialize = async (active) => {
+            contentOriginWrapRef.current?.();
+            const list = buildToolList(active);
+            await harnessRef.current.setTools(list, list.map((t) => t.name));
+            if (fpRef.current)
+                fpRef.current.tools = toolsToFingerprintInputs(list);
+            turnSnapshotRef.current?.refreshTools(toolsToFingerprintInputs(list));
+            const live = new Set(list.map((t) => t.name));
+            for (const n of [...announcedTools]) {
+                if (!live.has(n)) {
+                    announcedTools.delete(n);
+                    withdrawnTools.add(n);
+                    deltaRef.pendingRemoved.push(n);
+                }
+            }
+            for (const n of active) {
+                if (!live.has(n))
+                    continue;
+                if (!announcedTools.has(n)) {
+                    announcedTools.add(n);
+                    if (withdrawnTools.delete(n))
+                        deltaRef.pendingReadded.push(n);
+                    else
+                        deltaRef.pending.push(n);
+                }
+            }
+        };
+        rebuildHarnessToolsRef.current = () => rematerialize(activeTools);
+        toolSearch = createToolSearchTool({
+            registry,
+            active: activeTools,
+            rematerialize,
+            listingRide: (newly) => listingRideRef.current?.(newly),
+            mountedNames: callableToolNames,
+            directCallEnabled: spec.deferSelfResolve !== false,
+            isMounted: (name) => tools.some((t) => t.name === name),
+            ...(materializeStatic
+                ? { staticSchemaFor: (name) => (staticFaceFor(name) ? tools.find((t) => t.name === name)?.parameters : undefined) }
+                : {}),
+            serializeActivation,
+        });
+        harnessTools = buildToolList(activeTools);
+    }
+    else {
+        rebuildHarnessToolsRef.current = async () => {
+            contentOriginWrapRef.current?.();
+            const list = [...tools];
+            await harnessRef.current.setTools(list, list.map((t) => t.name));
+            if (fpRef.current)
+                fpRef.current.tools = toolsToFingerprintInputs(list);
+            turnSnapshotRef.current?.refreshTools(toolsToFingerprintInputs(list));
+        };
+    }
+    return { activeTools, fpRef, turnSnapshotRef, harnessTools, toolsDeltaRef, toolMaterializeStatic, deferDirectCall, staticFaceForRef, listingRideRef };
+}

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -0,0 +1,184 @@
+/**
+ * design/390 §1.2 M18 — prepareTask's WIRING-MANIFEST phase, verbatim from the driver: the run's own frozen approver
+ * seat, the loud ungated-write warning (hand band / destructive MCP / first-party write tools with no effect-aware gate,
+ * deduped per deployment and tool-set shape), the PreToolUse context stash and the blocked-call set, the settlement and
+ * bare-rejection sidebands, the turn halt fact, the suspend infrastructure predicates (restore surface gap, durable
+ * infra, the task-axis lane with its INACTIVE line), usage governance, the platform-suspend arming, the synthesized
+ * durableApproval, the effective wiring manifest, the peer lane's ask fold and drain binding, the park predicate as ONE
+ * named const, the durable-gate-unavailable notice, the hook identity mint and the hook env face. The four helpers only
+ * this segment called moved with it (usage governance, the per-deployment warn ledger, the MCP manifest projection, the
+ * durable-gate notice). The interface is the dependency list the segment had implicitly (design/238 R-1).
+ *
+ * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the policy-chain
+ * station before it and the gate registration after it (design/390 §1.5: a stretch with no await is extracted as a sync
+ * function). Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
+ *
+ * One read changed spelling and nothing else: the manifest's MCP face read `mcp?.statuses ?? []` while `mcp` had long
+ * been the protocol-tools phase's non-null handle; the optional chain was dead and is now the plain member read.
+ */
+import type { AgentHarness, ExecutionEnv } from "../../internal/harness.js";
+import { type PeerLaneRefs } from "../../agents/peer-session-drain.js";
+import type { OnQuestion } from "../ask-question.js";
+import type { CheckpointStore } from "../checkpoint-store.js";
+import { type HookEnvCapabilities, type HookInvocationIdentity, type Hooks } from "../hooks.js";
+import type { LockedPreflight } from "../locked-config.js";
+import type { MaterializedMcp } from "../mcp.js";
+import type { SessionStore } from "../session.js";
+import { type ToolResultStore } from "../tool-result-store.js";
+import { type ApprovalSettledBy, type OnAsk } from "../tool-policy.js";
+import type { RunnerDeps, RuntimeCaps, TaskSpec, ToolEffect, ToolExecuteContext } from "../types.js";
+import { type UsageWindow } from "../usage-window-store.js";
+import { type AutoModeArmReason, type WiringManifest, type WiringManifestMcpEntry } from "../wiring-manifest.js";
+import type { AnnounceOnceSink, Prepared, PrepareResume, RunInternals, UsageGovernance } from "./contracts.js";
+export interface PrepareWiringManifestInput {
+    /** borrowed-readonly — the REBOUND spec. Read: `onAsk` (the own seat), `onQuestion` (the question seam), `handsReadOnly` / `tools` (the ungated scan),
+     *  `resourceSuspend` (the task-axis lane), `durableApproval` / `principal` (the synthesis and the notice), `interactiveTools` /
+     *  `mcp` / `checkpointStore` (manifest cells and the notice's cause). Never mutated. */
+    spec: Pick<TaskSpec, "onAsk" | "onQuestion" | "handsReadOnly" | "tools" | "resourceSuspend" | "durableApproval" | "principal" | "interactiveTools" | "mcp" | "checkpointStore">;
+    /** borrowed-readonly — the deployment seats, whole: `onAsk` (the seat's deps half), `onError` (the warning), `executionEnv`
+     *  (the hook-env predicate), `checkpointStore` (durable infra), the manifest's dozen wiring facts (`backgroundAgentStore`,
+     *  `permissionRuleStore`, `permissionRuleSyncWired`, `onBackgroundChildEvent`, `lockedConfig`, `compliancePostureResolver`,
+     *  `memoryScopeAdmission`, `retentionPolicy`, `onElicit`), `onNotice`, and the usage-governance seats (`usageWindowStore`,
+     *  `now`, `onUsageGovernance`…) the helper reads through the whole record. */
+    deps: RunnerDeps;
+    /** borrowed-readonly — the trusted spawn-side channel: `questionFaceStripped`, `isDelegatedChild`, `onTaskNotification`,
+     *  `peerSelfRef`, `explicitAgentName` (the drain), `insideFork` / `agentName` / `parentToolCallId` (the identity). */
+    internals: Pick<RunInternals, "questionFaceStripped" | "isDelegatedChild" | "onTaskNotification" | "peerSelfRef" | "explicitAgentName" | "insideFork" | "agentName" | "parentToolCallId"> | undefined;
+    /** borrowed-readonly — the resume leg, or undefined (the manifest's leg derivation reads presence only). */
+    resume: Pick<PrepareResume, "seed"> | undefined;
+    /** borrowed-readonly — the acquired session id. */
+    sessionId: string;
+    /** borrowed-readonly — the run's invocation id. */
+    runId: string;
+    /** borrowed-readonly — the per-task identity (the hook identity's taskId). */
+    hostTaskId: string;
+    /** borrowed-readonly — the registry scope the peer drain binds under. */
+    taskScope: string;
+    /** borrowed-readonly — the resolved hook record (`spec.hooks ?? deps.hooks`): the effect-aware-gate term, the tracked flag
+     *  and the hook-env face's consumer test. */
+    hooks: Hooks | undefined;
+    /** borrowed-readonly — whether the deployment declared its screening face observational (then it is no gate). */
+    preToolUseObservational: boolean;
+    /** borrowed-readonly — the caller-facing policy layers; only their COUNT is read (an effect-aware gate exists). */
+    policyLayers: ReadonlyArray<unknown>;
+    /** borrowed-readonly — whether an execution env is wired (the hand band exists at all). */
+    handsEnabled: boolean;
+    /** borrowed-readonly — the materialized MCP handle: `tools` (the destructive-ungated scan) and `statuses` (the manifest face). */
+    mcp: Pick<MaterializedMcp, "tools" | "statuses">;
+    /** borrowed-readonly — the assembled safety vocabulary (the ungated scans and the manifest's armed cell). Read only. */
+    irreversibleTools: ReadonlySet<string>;
+    /** borrowed-readonly — see `irreversibleTools`. */
+    egressTools: ReadonlySet<string>;
+    /** borrowed-readonly — the effect collection; read only here (the ungated scans). */
+    toolEffects: ReadonlyMap<string, ToolEffect>;
+    /** borrowed-readonly — the per-task owned env when a factory minted one (durable infra, the hook-env predicate). */
+    ownedEnv: ExecutionEnv | undefined;
+    /** borrowed-readonly — the run's resolved env (the hook env face is built over it). */
+    executionEnv: ExecutionEnv;
+    /** borrowed-readonly — the run's offload store, or undefined (a volatile store disqualifies durable suspend). */
+    offloadStore: ToolResultStore | undefined;
+    /** borrowed-readonly — the once-per-session ledger's operator sink (the INACTIVE line, once per session). */
+    onceLedger: Pick<AnnounceOnceSink, "onError">;
+    /** borrowed-readonly — the resolved usage windows, or undefined. */
+    usageWindows: readonly UsageWindow[] | undefined;
+    /** borrowed-readonly — the env-lifetime suspend instant, or undefined (platform-suspend arming). */
+    envLifetimeSuspendAt: number | undefined;
+    /** borrowed-readonly — the resolved per-principal entitlements (forceDurableGate). */
+    runtimeCaps: RuntimeCaps | undefined;
+    /** borrowed-readonly — the resolved interaction posture (a manifest cell). */
+    resolvedInteractionPosture: ToolExecuteContext["interactionPosture"];
+    /** borrowed-readonly — the question-face phase's durable-face decision (the composition-lie detector reuses it). */
+    durableQuestionFace: boolean;
+    /** borrowed-readonly — the live question face, or undefined (the notice's effective fact). */
+    liveQuestionFace: OnQuestion | undefined;
+    /** borrowed-readonly — the leg's checkpoint store, resolved once by the question-face phase. */
+    checkpointStore: CheckpointStore | undefined;
+    /** borrowed-readonly — the session store (durability declaration and transcript tier). */
+    sessions: SessionStore;
+    /** borrowed-readonly — the model gate's per-leg read face, or undefined. */
+    modelGateManifest: WiringManifest["modelGate"];
+    /** borrowed-readonly — the arming outcome the caps phase minted (the manifest's auto-mode face). */
+    autoModeArmReason: AutoModeArmReason;
+    /** borrowed-readonly — the frozen preflight; only `mcp` (the declared servers the manifest face joins). */
+    lockedPreflight: Pick<LockedPreflight, "mcp">;
+    /** borrowed-mutable — the peer lane's late-bound facts. Writer here: `askEffective` ← the manifest's ask derivation (the
+     *  one fold of this session's permission-mode class). */
+    peerLaneRefs: PeerLaneRefs;
+    /** borrowed-readonly — the peer lane's mount verdict (the drain binds only while mounted). */
+    peerLaneActive: boolean;
+    /** borrowed-readonly — the built harness the peer drain binds to. */
+    harness: AgentHarness;
+    /** borrowed-readonly — the durable-suspend holder; the drain's parked predicate reads `token` at run time. Not written here. */
+    suspendRef: Prepared["suspendRef"];
+    /** borrowed-readonly — the review holder; same read. Not written here. */
+    reviewRef: Prepared["reviewRef"];
+    /** borrowed-readonly — the FROZEN approver seat (the notice's liveApprover fact). */
+    frozenOnAsk: OnAsk | undefined;
+    /** borrowed-readonly — the LIVE half of the inherited chain (the notice reads its content mandates). */
+    liveInheritedGate: RunInternals["inheritedGate"];
+    /** borrowed-readonly — the effective delegation facts (the identity's isDelegatedChild). */
+    delegation: {
+        isDelegatedChild: boolean;
+    };
+}
+export interface PrepareWiringManifestResult {
+    /** owned — the run's own approver seat (spec over deps), read by the gate-fold station. */
+    onAsk: OnAsk | undefined;
+    /** borrowed-mutable — PreToolUse `additionalContext` per call id. Writers: the gate (phase 1 stash), the post-tool handler
+     *  (one-shot drain). */
+    preToolContexts: Map<string, string[]>;
+    /** borrowed-mutable — the call ids the gate blocked or suspended (`Prepared.blockedToolCalls`). Writers: the gate; readers
+     *  delete one-shot. */
+    blockedToolCalls: Set<string>;
+    /** borrowed-mutable — the settlement sideband (`Prepared.approvalSettlement`). Writer: the gate; the frame mint reads and
+     *  deletes. Nothing else may write it. */
+    approvalSettlement: Map<string, {
+        settledBy?: ApprovalSettledBy;
+        approver?: string;
+        resolution?: import("../tool-policy.js").AskDenyResolution;
+        autoDenied?: true;
+    }>;
+    /** borrowed-mutable — the bare-human-rejection sideband. Writer: resolveAskBound; the gate handler consumes one-shot. */
+    humanBareRejections: Set<string>;
+    /** borrowed-mutable — the turn's halt fact (`Prepared.batchHaltRef`). Writer: the judgment site; cleared at the next request. */
+    batchHaltRef: Prepared["batchHaltRef"];
+    /** owned — whether any consumer of the blocked set is wired (populate only then). */
+    blockedTracked: boolean;
+    /** owned — the restore-surface gap of a declared-suspendable adapter, or undefined for a complete / non-suspendable one. */
+    incompleteSuspendAdapter: readonly ("resumeVM" | "postResumeInit")[] | undefined;
+    /** owned — the infrastructure half of suspend eligibility (no task opt-in in it). */
+    durableSuspendInfraReady: boolean;
+    /** owned — the task-axis lane: the infrastructure plus the caller's opt-in. */
+    resourceSuspendEligible: boolean;
+    /** owned — the run's usage-governance handle, or undefined (`Prepared.usageGovernance`). */
+    usageGovernance: UsageGovernance | undefined;
+    /** owned — whether the suspend saga must be armed for a PLATFORM cause. */
+    platformSuspendArmed: boolean;
+    /** owned — the effective durable-approval opt-in: the caller's, or the scope synthesized for a forced durable gate. */
+    durableApproval: TaskSpec["durableApproval"];
+    /** owned — this leg's EFFECTIVE wiring manifest (`Prepared.wiringManifest`). */
+    wiringManifest: WiringManifest;
+    /** owned — THE park predicate as one named const (`parkLane.effective === true`). */
+    parkLaneArmed: boolean;
+    /** owned — THE identity mint of this leg (`Prepared.hookIdentity`), one frozen envelope every hook station reuses. */
+    hookIdentity: HookInvocationIdentity;
+    /** owned — the read-only env capability face every hook context carries, or undefined (no hook consumer, or no env wired). */
+    hookEnvFace: HookEnvCapabilities | undefined;
+}
+/**
+ * The wiring manifest's per-server MCP read face for one leg ({@link WiringManifest.mcp}): every
+ * server the leg's FROZEN entry snapshot declared, in declaration order, joined by name to this leg's
+ * materialization statuses. Pure projection — no connection logic, no second look at any transport:
+ *  · a status `connected` ⇒ `connected` with the mounted roster size (the intake's post-filter count);
+ *  · a status `failed` ⇒ `failed` with the class the materialization stamped ({@link McpFailureCode})
+ *    and the remote text SECRET-REDACTED (an HTTP endpoint's error body rides the SDK's message
+ *    verbatim, and a body that echoes the bearer it rejected must not reach a stream consumer),
+ *    then neutralized + bounded to the reminder's own 240 (the same bound the once-per-session
+ *    ledger applies to that text — one face, one width);
+ *  · no status at all ⇒ `skipped` (the declaration stands, this leg produced no attempt record for it).
+ * `source` is echoed from the declaration (single-line, bounded; core reads nothing off it). The
+ * entries are fresh objects so the manifest never aliases the status records the refresh face mutates.
+ */
+export declare function mcpManifestEntries(entries: ReadonlyArray<import("../types.js").McpServerSpec> | undefined, statuses: ReadonlyArray<import("../mcp.js").McpServerStatus>): WiringManifestMcpEntry[];
+/** The M18 phase body — prepareTask's wiring-manifest stretch, verbatim (see the module header). */
+export declare function prepareWiringManifest(input: PrepareWiringManifestInput): PrepareWiringManifestResult;