@sema-agent/core 7.4.0 → 7.5.1

package/dist/engine/harness/types.d.ts

@@ -585,12 +585,42 @@ export interface PromptEpochEntry extends SessionTreeEntryBase, PromptEpochDescr
  * replay remain as the second/third rungs of the resume-seed ladder for pre-entry sessions.
  * Present-only arms — an absent arm means "no announcement recorded for that face", same Q5
  * discipline as the checkpoint mirror.
+ *
+ * Two further arms ride the same snapshot for the prepare-time ONE-SHOT announcements, which are
+ * per-SESSION facts even though prepare runs once per run (a serving layer maps one user message to
+ * one run, so a per-run count re-announces them on every message):
+ *  - `mcpFailed`: the MCP servers whose connect failure the model has been TOLD about, as the
+ *    `{name, error}` pairs the reminder printed. The next run announces only the pairs that are not
+ *    in this set (a changed error text is a new pair); a server that is no longer failing is dropped
+ *    from the set without any "recovered" line, so a later failure of the same server announces again.
+ *  - `advisories`: digests of the operator-lane advisory lines already emitted on this branch
+ *    (the `(code, message)` of each `onError` warning, plus the model-facing dropped-tool entries)
+ *    — the same `(code, text)` is emitted once per session. Grow-only, bounded (oldest dropped).
  */
-export interface AnnouncedListingEntry extends SessionTreeEntryBase {
+export interface AnnouncedListingEntry extends SessionTreeEntryBase, AnnouncedListingSnapshot {
     type: "announced_listing";
+}
+/** One announced MCP connect failure — the pair the reminder line printed (both fields already
+ *  neutralized + bounded at intake; compared field-wise, CC `deferred_tools_delta` form). */
+export interface AnnouncedMcpFailure {
+    name: string;
+    error?: string;
+}
+/** The announced-listing snapshot's arms (see {@link AnnouncedListingEntry}). Present-only. */
+export interface AnnouncedListingSnapshot {
     agents?: string[];
     skills?: string[];
     models?: string[];
+    mcpFailed?: AnnouncedMcpFailure[];
+    advisories?: string[];
+}
+/** The same snapshot as an APPEND input (borrowed arrays; the store copies through the shape gate). */
+export interface AnnouncedListingSnapshotInput {
+    agents?: readonly string[];
+    skills?: readonly string[];
+    models?: readonly string[];
+    mcpFailed?: ReadonlyArray<AnnouncedMcpFailure>;
+    advisories?: readonly string[];
 }
 /**
  * REF-D3/D4 merge target: the active EnterWorktree session (M22 live-CC anchor —
@@ -732,6 +762,10 @@ export declare function normalizeWorkspaceState(value: unknown): WorkspaceState
  *  a "name" is a short identifier, never a document. Oversize ⇒ structurally invalid (forgery signal). */
 export declare const ANNOUNCED_LISTING_MAX_NAMES = 500;
 export declare const ANNOUNCED_LISTING_MAX_NAME_CHARS = 200;
+/** Bound (in CODE POINTS, the producer's unit) for an announced MCP failure's `error` text — intake
+ *  caps it at 240 code points plus the truncation ellipsis; anything past this bound never came from
+ *  the engine's own projection. The `name` rides the listing name bound, also counted in code points. */
+export declare const ANNOUNCED_MCP_ERROR_MAX_CHARS = 400;
 export declare function normalizeCompactionStateCarrier(v: unknown): {
     thinkingLevel?: string;
     model?: {
@@ -790,11 +824,7 @@ export declare function isSyntheticApiErrorMessage(m: unknown): boolean;
  *  the contamination lands on disk and every later `open()` throws a raw `TypeError` (not even a `SessionError`).
  *  Unrecoverable through the API, which is why this belongs at the import door. */
 export declare function isOptionalDisplayString(v: unknown, max?: number): boolean;
-export declare function normalizeAnnouncedListing(v: unknown): {
-    agents?: string[];
-    skills?: string[];
-    models?: string[];
-} | undefined;
+export declare function normalizeAnnouncedListing(v: unknown): AnnouncedListingSnapshot | undefined;
 /** All persisted session tree entry variants. */
 export type SessionTreeEntry = MessageEntry | ThinkingLevelChangeEntry | ModelChangeEntry | CompactionEntry | CustomEntry | CustomMessageEntry | LabelEntry | SessionInfoEntry | LeafEntry | PromptEpochEntry | AnnouncedListingEntry | GitAnnouncementEntry | WorkspaceStateEntry | ReminderMarkEntry;
 export interface SessionContext {
@@ -916,18 +946,10 @@ export interface Session<TMetadata extends SessionMetadata = SessionMetadata> {
     appendSessionName(name: string): Promise<string>;
     /** design/150 (RB-25): persist the listing announced name-sets as a first-class
      *  {@link AnnouncedListingEntry} (snapshot semantics; see `Session.appendAnnouncedListing`). */
-    appendAnnouncedListing(snapshot: {
-        agents?: readonly string[];
-        skills?: readonly string[];
-        models?: readonly string[];
-    }): Promise<string>;
+    appendAnnouncedListing(snapshot: AnnouncedListingSnapshotInput): Promise<string>;
     /** design/150 (RB-25): nearest announced-listing snapshot on the active branch (first rung of the
      *  resume-seed ladder); undefined ⇒ pre-entry session. */
-    getAnnouncedListing(): Promise<{
-        agents?: string[];
-        skills?: string[];
-        models?: string[];
-    } | undefined>;
+    getAnnouncedListing(): Promise<AnnouncedListingSnapshot | undefined>;
     /** design/155: persist the settle-time workspace state (tracked cwd + active worktree) as a
      *  first-class {@link WorkspaceStateEntry} (snapshot semantics; see `Session.appendWorkspaceState`). */
     appendWorkspaceState(state: WorkspaceState): Promise<string>;

package/dist/engine/harness/types.js

@@ -127,6 +127,7 @@ export function normalizeWorkspaceState(value) {
 }
 export const ANNOUNCED_LISTING_MAX_NAMES = 500;
 export const ANNOUNCED_LISTING_MAX_NAME_CHARS = 200;
+export const ANNOUNCED_MCP_ERROR_MAX_CHARS = 400;
 const THINKING_LEVELS = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
 export function normalizeCompactionStateCarrier(v) {
     if (typeof v !== "object" || v === null)
@@ -180,14 +181,37 @@ export function normalizeAnnouncedListing(v) {
         }
         return out;
     };
+    const cps = (t) => [...t].length;
+    const failureArm = (a) => {
+        if (a === undefined)
+            return undefined;
+        if (!Array.isArray(a) || a.length > ANNOUNCED_LISTING_MAX_NAMES)
+            return null;
+        const out = [];
+        for (const e of a) {
+            if (typeof e !== "object" || e === null)
+                return null;
+            const { name, error } = e;
+            if (typeof name !== "string" || cps(name) > ANNOUNCED_LISTING_MAX_NAME_CHARS)
+                return null;
+            if (error !== undefined && (typeof error !== "string" || cps(error) > ANNOUNCED_MCP_ERROR_MAX_CHARS))
+                return null;
+            out.push({ name, ...(error !== undefined ? { error } : {}) });
+        }
+        return out;
+    };
     const agents = arm(src.agents);
     const skills = arm(src.skills);
     const models = arm(src.models);
-    if (agents === null || skills === null || models === null)
+    const mcpFailed = failureArm(src.mcpFailed);
+    const advisories = arm(src.advisories);
+    if (agents === null || skills === null || models === null || mcpFailed === null || advisories === null)
         return undefined;
     return {
         ...(agents !== undefined ? { agents } : {}),
         ...(skills !== undefined ? { skills } : {}),
         ...(models !== undefined ? { models } : {}),
+        ...(mcpFailed !== undefined ? { mcpFailed } : {}),
+        ...(advisories !== undefined ? { advisories } : {}),
     };
 }

package/dist/engine/session/session.d.ts

@@ -1,6 +1,6 @@
 import type { ImageContent, TextContent } from "../llm/index.js";
 import type { AgentMessage } from "../loop/types.js";
-import type { GitAnnouncementState, Session, SessionContext, SessionMetadata, SessionStorage, SessionTreeEntry, WorkspaceState } from "../harness/types.js";
+import type { AnnouncedListingSnapshot, AnnouncedListingSnapshotInput, GitAnnouncementState, Session, SessionContext, SessionMetadata, SessionStorage, SessionTreeEntry, WorkspaceState } from "../harness/types.js";
 import type { BuildContextOptions } from "../harness/types.js";
 import type { PromptEpochDescriptor } from "../../prompt-assembly/epoch.js";
 /** Build model context from the active session branch and its latest state markers.
@@ -40,11 +40,7 @@ export declare class StoredSession<TMetadata extends SessionMetadata = SessionMe
      * Called best-effort at every listing COMMIT point (the run loop's announce mirror sites) —
      * an append failure degrades to the checkpoint-mirror/transcript-probe rungs, never fails the run.
      */
-    appendAnnouncedListing(snapshot: {
-        agents?: readonly string[];
-        skills?: readonly string[];
-        models?: readonly string[];
-    }): Promise<string>;
+    appendAnnouncedListing(snapshot: AnnouncedListingSnapshotInput): Promise<string>;
     /**
      * Git-status frame announced state (branch-authority mirror): persist the `(kind, hash)` tuple —
      * announced form carries the frame's own entry id; a compaction restates the tuple as `pending`
@@ -121,11 +117,7 @@ export declare class StoredSession<TMetadata extends SessionMetadata = SessionMe
      * loss). A floor-anchor seam (the getEpochAnchor analog) is deliberately deferred until a real
      * deployment hits that window.
      */
-    getAnnouncedListing(): Promise<{
-        agents?: string[];
-        skills?: string[];
-        models?: string[];
-    } | undefined>;
+    getAnnouncedListing(): Promise<AnnouncedListingSnapshot | undefined>;
     /**
      * Recover the pinned prompt epoch for the ACTIVE branch (stage S3). Walks the branch from the
      * leaf backwards: the nearest `compaction` entry's `details.promptEpoch` restatement wins (the

package/dist/index.d.ts

@@ -50,6 +50,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, type AutoProm
 export { runCascade, type CascadeRung, type CascadeConfig, type CascadeAttempt, type CascadeRunResult, type GateVerdict, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
+export { MCP_FAILURE_CODES, mcpFailureCodeOf, type McpFailureCode } from "./core/mcp.js";
 export { materializeA2aTools, A2aRpcError, type MaterializedA2a, type A2aPeerStatus, type A2aRefreshResult, type A2aToolAxis } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
@@ -119,7 +120,7 @@ export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/f
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
-export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, type AutoModeArmReason, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, type AutoModeArmReason, type WiringManifest, type WiringManifestMcpEntry, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
@@ -145,7 +146,9 @@ export { createSchedulerTools, type SchedulerToolContext, SCHEDULE_WAKEUP_TOOL_N
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, type AutonomousLoopPromptOptions, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
 export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, type AskDenyResolution, ASK_DENY_RESOLUTION_VALUES, isAskDenyResolution, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
-export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
+export { type AskOrigin, ASK_ORIGINS, isAskOrigin, classifierMayAnswer } from "./core/ask-origin.js";
+export { type AskCarry } from "./core/hooks.js";
+export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -168,13 +171,14 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * allowed and widening is not.
  */
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
-export { InMemorySessionRuleOverlay, type SessionRuleOverlay, type SessionRuleOverlayAdd, type SessionRuleOverlayApplyResult, } from "./core/permission-rule-session.js";
-export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRuleOverlay, type OrgOverlayResolution, type OrgOverlayStatus, type EffectivePermissionRule, } from "./core/permission-rule-org.js";
+export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
+export { InMemorySessionRulePartition, type SessionRulePartition, type SessionRuleAdd, type SessionRuleApplyResult, } from "./core/permission-rule-session.js";
+export { orgRuleVerdictFor, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRulePartitionConfig, type OrgRuleResolution, type OrgRuleStatus, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, precheckEditedRuleText, type EditedRuleTextPrecheck, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleOffer2, type StaleRuleApprovalRecord, type RuleConsentDeps, type RedeemResult, type RedeemedBatchMember, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, } from "./core/permission-rule-consent.js";
-export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-store.js";
+export { FileDurableRulePartitionProvider, ORG_STATE_FILE } from "./stores/file/permission-rule-store.js";
 export { adoptFilePermissionRuleStore, type AdoptFileRuleStoreResult } from "./stores/file/permission-rule-adopt.js";
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, type AdoptionErrorCode, type AdoptionSource, type AdoptionReport, type AdoptionReceipt, type AdoptionLegReport, type AffectedDeploymentConfig, type RootAdoptionFile, } from "./stores/file/adoption/marker.js";
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";

package/dist/index.js

@@ -38,6 +38,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, } from "./cor
 export { runCascade, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
+export { MCP_FAILURE_CODES, mcpFailureCodeOf } from "./core/mcp.js";
 export { materializeA2aTools, A2aRpcError } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, } from "./core/session-policy-store.js";
@@ -120,7 +121,9 @@ export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTIN
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
 export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, ASK_DENY_RESOLUTION_VALUES, isAskDenyResolution, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
-export { parseAutoModeResponse, createAutoModeDecider, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, } from "./core/auto-mode.js";
+export { ASK_ORIGINS, isAskOrigin, classifierMayAnswer } from "./core/ask-origin.js";
+export {} from "./core/hooks.js";
+export { parseAutoModeResponse, createAutoModeDecider, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -128,13 +131,14 @@ export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoMo
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
-export { InMemorySessionRuleOverlay, } from "./core/permission-rule-session.js";
-export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
+export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, } from "./core/permission-rule-provider.js";
+export { InMemorySessionRulePartition, } from "./core/permission-rule-session.js";
+export { orgRuleVerdictFor, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, precheckEditedRuleText, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, } from "./core/permission-rule-consent.js";
-export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-store.js";
+export { FileDurableRulePartitionProvider, ORG_STATE_FILE } from "./stores/file/permission-rule-store.js";
 export { adoptFilePermissionRuleStore } from "./stores/file/permission-rule-adopt.js";
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, } from "./stores/file/adoption/marker.js";
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";

package/dist/internal/harness.d.ts

@@ -23,6 +23,7 @@ export { InMemorySessionStorage } from "../engine/session/memory-storage.js";
 export { InMemorySessionRepo } from "../engine/session/memory-repo.js";
 export { uuidv7 } from "../engine/session/uuid.js";
 export { SessionError } from "../engine/harness/types.js";
+export type { AnnouncedListingSnapshot, AnnouncedListingSnapshotInput, AnnouncedMcpFailure } from "../engine/harness/types.js";
 export { normalizeGitAnnouncement } from "../engine/harness/types.js";
 export { gitFrameContextVisible } from "../engine/session/session.js";
 export { isSyntheticApiErrorMessage } from "../engine/harness/types.js";

package/dist/stores/file/adoption/adopt.d.ts

@@ -38,7 +38,7 @@
  *     independent store faces — `new FileMemoryStore(root)`, the mailbox family). It keeps its open
  *     handles, and I6 is a construction-time gate, not a write-time one;
  *   · a NEW construction whose anchor is not the data root. Two faces take a directory that need not
- *     BE the data root — `FilePermissionRuleStoreProvider` (the rule bucket) and
+ *     BE the data root — `FileDurableRulePartitionProvider` (the rule bucket) and
  *     `createFileTaskListStore` (the document's own directory) — so each takes its root anchor as an
  *     explicit option, and a caller that omits it constructs unGATED during a freeze. That default is
  *     what this arc's own nested rule leg rides (it must reach the bucket while the marker is in

package/dist/stores/file/adoption/marker.d.ts

@@ -197,7 +197,7 @@ export declare function writeRootAdoptionFile(root: string, content: RootAdoptio
  *
  * WHO calls it, precisely: every store constructor whose argument IS the data root (that is most of
  * the family — they derive their own subdirectory from it). The two faces whose argument is a
- * caller-chosen directory instead — `FilePermissionRuleStoreProvider` (a rule bucket) and
+ * caller-chosen directory instead — `FileDurableRulePartitionProvider` (a rule bucket) and
  * `createFileTaskListStore` (the document's directory) — cannot anchor on their argument, so each
  * takes the data root as an explicit option and is gated only when given one. `root` here is always
  * the ANCHOR, never "wherever this store keeps its bytes": passing a subdirectory reads a marker that

package/dist/stores/file/permission-rule-adopt.js

@@ -1,8 +1,9 @@
 import { existsSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { writerOf } from "../../core/permission-rule-store.js";
+import { createPermissionRuleStoreProvider } from "../../core/permission-rule-provider.js";
 import { syncPermissionRules } from "../../core/permission-rule-sync.js";
-import { FilePermissionRuleStoreProvider, LOCAL_OWNER_FILE, principalRuleFileName, readRuleAdoptionFile, writeRuleAdoptionFile, } from "./permission-rule-store.js";
+import { FileDurableRulePartitionProvider, LOCAL_OWNER_FILE, principalRuleFileName, readRuleAdoptionFile, writeRuleAdoptionFile, } from "./permission-rule-store.js";
 export async function adoptFilePermissionRuleStore(opts) {
     if (typeof opts.toPrincipal !== "string" || opts.toPrincipal === "") {
         throw new Error("adoptFilePermissionRuleStore requires the adopting principal — adoption is the act of giving this bucket an identity");
@@ -26,7 +27,7 @@ export async function adoptFilePermissionRuleStore(opts) {
     else if (existsSync(targetFile)) {
         throw new Error(`the target bucket for "${opts.toPrincipal}" already exists — merging two existing buckets goes through an explicit sync join, not a rename`);
     }
-    const provider = new FilePermissionRuleStoreProvider(opts.dir, opts.onError);
+    const provider = new FileDurableRulePartitionProvider(opts.dir, opts.onError);
     try {
         const lockProbe = writerOf(provider.forPrincipal(opts.toPrincipal));
         if (lockProbe === undefined)
@@ -55,7 +56,7 @@ export async function adoptFilePermissionRuleStore(opts) {
         if (phase < 5) {
             try {
                 syncResult = await syncPermissionRules({
-                    provider,
+                    provider: createPermissionRuleStoreProvider({ durable: provider }),
                     principal: opts.toPrincipal,
                     transport: opts.transport,
                     ...(opts.now !== undefined ? { now: opts.now } : {}),

package/dist/stores/file/permission-rule-store.d.ts

@@ -1,5 +1,18 @@
 /**
- * design/179 §5/§8 — the file backend for persisted allow rules.
+ * design/179 §5/§8 / design/389 — the file backend of the permission-rule store's DURABLE partition (one
+ * bucket file per owner), plus the file home of the ORG partition's durable state (`org.json`).
+ *
+ * ## Schema 3 and the one-time migration
+ *
+ * Pre-389 files (schema 1/2) kept the org last-known-good snapshot as an `org` block INSIDE each
+ * principal's bucket file — deployment-wide policy stored per person. Schema 3 drops that block; the org
+ * state lives in one `org.json` beside the buckets. `FileDurableRulePartitionProvider` migrates every
+ * legacy bucket file ONCE at construction (under the writer lock: the migration is a write, and a live
+ * older writer over the same directory is refused rather than raced), folding each file's `org` block
+ * into `org.json` by the anti-rollback rule (the highest high-water wins; an equal revision with
+ * different content keeps what is already installed and discloses). After that the reader accepts
+ * schema 3 ONLY — a 1/2/4 file is refused whole, loudly (zero rules + disclosure). There is no second
+ * read path for the old shapes: the migrator is the only code that reads them, and it runs once.
  *
  * ## Why this store builds its own symlink refusal
  *
@@ -43,23 +56,18 @@
  * For this backend the trust is host = user, exactly as for the settings file it mirrors.
  */
 import type { PersistedAllowRule, RuleTombstone } from "../../core/permission-rule-model.js";
-import type { PermissionRuleStore, PermissionRuleStoreProvider, PermissionRuleWriter, QuarantinedRuleAdd, RuleOwner, RuleSyncFrontier, StoredAllowRules, WritablePermissionRuleStore } from "../../core/permission-rule-store.js";
+import type { DurableRulePartition, DurableRulePartitionProvider, PermissionRuleWriter, QuarantinedRuleAdd, RuleOwner, RuleSyncFrontier, StoredAllowRules, WritableDurableRulePartition } from "../../core/permission-rule-store.js";
 import { PERMISSION_RULE_WRITER } from "../../core/permission-rule-store.js";
-import type { PersistedOrgRuleState } from "../../core/permission-rule-org.js";
+import type { OrgRuleStatePersistence, PersistedOrgRuleState } from "../../core/permission-rule-org.js";
 import type { StoreDurability, StoreFidelity } from "../../core/checkpoint-store.js";
 /**
- * The on-disk shape. `schemaVersion` is the only field a future reader may rely on before validating.
- *
- * v1 → v2 (design/182 §8.3): three OPTIONAL blocks — `sync` (observation vector + round timestamp),
- * `org` (last-known-good org snapshot + anti-rollback high-water) and `quarantined` (rows moved out of
- * the live view, bytes preserved). The five v1 fields are byte-identical in meaning. A file only ever
- * ESCALATES to v2 when a write actually carries v2 content (a sync round, an org install, a
- * quarantine): a deployment that never syncs keeps writing v1 files forever, and a v1 reader handed a
- * v2 file refuses the whole file loudly (zero rules + disclosure — fail-closed, more asks, and the
- * documented cost of rolling the engine back under an already-synced store).
+ * The on-disk shape of one bucket. `schemaVersion` is the only field a future reader may rely on before
+ * validating. Schema 3 (design/389): the five core fields plus the OPTIONAL `sync` block (observation
+ * vector + round timestamp) and `quarantined` area (rows moved out of the live view, bytes preserved).
+ * The org state is NOT here — see {@link OrgStateFile}.
  */
 interface RuleFile {
-    schemaVersion: 1 | 2;
+    schemaVersion: 3;
     actor: string;
     counter: number;
     rev: number;
@@ -69,10 +77,27 @@ interface RuleFile {
         observedVector?: RuleSyncFrontier;
         lastRoundAtMs?: number;
     };
-    org?: PersistedOrgRuleState;
     quarantined?: QuarantinedRuleAdd[];
     checksum: string;
 }
+/** The deployment-wide org state file: last-known-good snapshot + anti-rollback high-water, one blob. */
+interface OrgStateFile {
+    schemaVersion: 1;
+    state: PersistedOrgRuleState;
+    checksum: string;
+}
+/** The org partition's durable home in a rule directory. */
+export declare const ORG_STATE_FILE = "org.json";
+/** Written once the directory is known to hold only schema-3 buckets. Its presence ends the legacy
+ *  scan for good: a schema 1/2 bucket that appears AFTERWARDS (an older engine writing after the
+ *  cutover) is refused by the reader on every later construction too, never re-admitted by a restart. */
+export declare const SCHEMA3_MARKER_FILE = ".rule-schema-3";
+/** The anti-rollback contract's DESIGNED refusal (a lower high-water mark, or different content under
+ *  the same revision) — distinguished by class from every other install failure, because the two are
+ *  handled in opposite directions by the migration: a refusal means the block is superseded and may be
+ *  dropped; anything else means the block has no second home yet and the legacy copy must be kept. */
+export declare class OrgRevisionRefusal extends Error {
+}
 /** The local-owner bucket's FIXED file name — never a principal-hash path (identity absence is a
  *  structural position, not a name; design/182 §4.5). Cannot collide with `forPrincipal` names, which
  *  are 64 hex characters. */
@@ -100,7 +125,7 @@ export declare function readRuleAdoptionFile(dir: string): RuleAdoptionFile | un
 /** Atomically publish the adoption marker (same write-temp → fsync → rename discipline as the store). */
 export declare function writeRuleAdoptionFile(dir: string, content: RuleAdoptionFile): void;
 /** One principal's rule file. */
-declare class FilePermissionRuleStore implements WritablePermissionRuleStore {
+declare class FileDurableRulePartition implements WritableDurableRulePartition {
     private readonly dir;
     private readonly file;
     private readonly acquireWriteLock;
@@ -126,12 +151,6 @@ declare class FilePermissionRuleStore implements WritablePermissionRuleStore {
     list(): Promise<StoredAllowRules>;
     /** The quarantine area (design/182 §5.2/§8.3): introspection only — never part of `list()`. */
     quarantined(): Promise<QuarantinedRuleAdd[]>;
-    /** design/182 §7.4 — the durable org block: last-known-good snapshot + anti-rollback high-water,
-     *  installed in ONE atomic publish, surviving restarts. Reading takes no lock (the gate reads);
-     *  installing takes the writer lock (it is a write) but does not move `rev` — nothing about the
-     *  PERSONAL rule set changed, and an OCC holder must not be disturbed (the `nextDot` precedent). */
-    readOrgState(): Promise<PersistedOrgRuleState | undefined>;
-    installOrgState(state: PersistedOrgRuleState): Promise<void>;
     /**
      * The current file, for a WRITE.
      *
@@ -180,17 +199,38 @@ declare class FilePermissionRuleStore implements WritablePermissionRuleStore {
  * provider without a `dataRoot` precisely because it runs while the marker is in flight, and the
  * bucket-level marker (read in `forPrincipal`/`forLocalOwner`) is what governs writes inside that arc.
  */
-export declare class FilePermissionRuleStoreProvider implements PermissionRuleStoreProvider {
+export declare class FileDurableRulePartitionProvider implements DurableRulePartitionProvider {
     private readonly dir;
     private readonly onError?;
     private lock;
+    private orgPersistence;
     constructor(dir: string, onError?: ((message: string) => void) | undefined, opts?: {
         /** The data root whose adoption marker gates construction (design/183 I6). Absent ⇒ no root gate. */
         dataRoot?: string;
     });
+    /**
+     * Fold every legacy bucket file in `dir` into schema 3 and its `org` block into `org.json`. A no-op on a
+     * directory with no legacy file (zero writes, the lock untouched — the second construction over a
+     * migrated directory is byte-silent). A legacy file whose checksum or shape does not hold is NOT
+     * migrated: its bytes stay where they are for a person to look at, and the reader keeps refusing it
+     * whole. A live writer holding the directory (an older engine still running over it, or a directory
+     * this process cannot write) DEFERS the migration: the construction succeeds as a read face, the
+     * deferral is disclosed, and the marker stays unwritten so the next construction that can take the
+     * lock performs the cutover. Two engine versions writing one rule directory is still not a supported
+     * shape — the old engine's buckets are refused whole until they are migrated.
+     */
+    private migrateLegacyBuckets;
+    /** Publish the schema-3 completion marker (idempotent, atomic, no lock: its content never changes and
+     *  a concurrent writer of the same bytes is harmless). A failure to write it is disclosed, not thrown —
+     *  the next construction simply scans again, which is the safe direction. */
+    private writeSchema3Marker;
+    /** The org partition's durable home in this directory (design/182 §7.4 contract; `org.json`). Shares
+     *  this provider's writer lock — an install is a write. */
+    orgStatePersistence(): OrgRuleStatePersistence;
+    private fileOrgPersistence;
     /** Take the writer lock, once, on first use of a write face. Reading never calls this. */
     private acquireWriteLock;
-    forPrincipal(principal: string | undefined): PermissionRuleStore;
+    forPrincipal(principal: string | undefined): DurableRulePartition;
     /** The read-only resolution of an adoption SOURCE: post-flip (phase ≥ 4 / terminal) always the
      *  target; pre-flip, whichever path currently holds the bytes (source first — it is the pre-flip
      *  truth when both somehow exist, which the resume path refuses loudly anyway). */
@@ -202,7 +242,7 @@ export declare class FilePermissionRuleStoreProvider implements PermissionRuleSt
      * reads, not the other way round, so a crash between marker and host-config change cannot fork writes
      * into a retired bucket. A corrupt marker throws (fail-closed) rather than guessing an owner.
      */
-    forLocalOwner(): PermissionRuleStore;
+    forLocalOwner(): DurableRulePartition;
     /** Release the writer lock. A long-lived deployment holds it for its lifetime; a test or a short-lived
      *  tool releases so the next holder is not told a live process owns the directory. */
     dispose(): void;
@@ -211,4 +251,4 @@ export declare class FilePermissionRuleStoreProvider implements PermissionRuleSt
  *  and the resolver can never disagree about where a principal lives. */
 export declare function principalRuleFileName(principal: string): string;
 export { LOCAL_OWNER_FILE };
-export type { FilePermissionRuleStore, RuleFile };
+export type { FileDurableRulePartition, RuleFile, OrgStateFile };