@sema-agent/core 7.41.0 → 7.41.2

package/CHANGELOG.md

@@ -1,3 +1,35 @@
+## 7.41.2 — 2026-10-05
+
+**Hard-breaking changes:** none. **Closed sets:** none added. **Package exports:** +1 / −0 — `steerPriorityOf`. **Behavior narrowing:** none (one reading replaces two; a replay that spelled the default is no longer refused).
+
+### A steer's priority has one reading: absent means `next` (#1361; fix; +1 export) (@server @client-core)
+
+- **Before (v7.41.1).** The live acceptance check (`sameAcceptedSteerInput`) compared the admission's normalized priority (`priority ?? "next"`), while the parked replay check (`samePendingSteerPayload`) compared the row's raw member — a row parked without a priority (every row a ≤7.115.0 server parked, or a client that omits the field) against a retry that spelled `"next"` read as a different instruction: `409 steering.duplicate_input_id`, after which a client re-issuing under a fresh id queued the same instruction twice (server S-1121, reproduced on 7.41.1 with `appendPendingSteer`).
+- **Now.** `steerPriorityOf(x)` (src/core/task-notification.ts, the priority word's home; exported) is the one reading — `x.priority ?? "next"` — used by both comparators and by the admission default; `omitted→next`, `next→omitted` and `omitted→omitted` are the idempotent replay (queue unchanged), `next→later` / `next→now` still refuse. Parked rows are written as before (the field stays optional); old rows read through the same default.
+- **Who is hurt.** Nobody: a refusal that was never correct goes away; a real priority change still refuses.
+- **Consumers.** server — S-1121: pin `7.41.2`, flip the probe cell, delete the MIGRATION / contract sentence about this boundary; client-core — none (one export added).
+- Pins: `test/backlog1361-steer-priority-one-reading.test.ts` (A–F from the reproduction; base 7.41.1 red on omitted↔next and on the live check); `test/export-surface.snapshot.json` (+1 name).
+
+## 7.41.1 — 2026-10-05
+
+**Hard-breaking changes:** none. **Closed sets:** none added (two existing sets become reachable from the package root). **Package exports:** +5 / −0 — `SKILL_GRANT_ORIGINS`, `SKILL_ENTRY_INERT_REASONS`, types `SkillGrantOrigin`, `SkillEntryInertReason` (all defined in 7.41.0, re-exported now), and `mintNamespacePrefix` (#1355, defined since the namespace minting landed, re-exported now).
+
+### The two skill-grant vocabularies are on the package root (#1347; surface only; +4 exports) (@client-core @server)
+
+- **Before (v7.41.0).** `SKILL_GRANT_ORIGINS` (`model` / `user` / `inherited`) and `SKILL_ENTRY_INERT_REASONS` (`wildcard_all` / `namespace_wildcard` / `path_pattern` / `domain` / `content_unsupported` / `grammar`) and their two types were declared in `dist/core/skill-grant.d.ts` and not re-exported from `index.d.ts`; the 7.41.0 ship post called them consumable closed sets because the wire manifest scans every `dist/` file, not the package root.
+- **Now.** Both constants and both types are re-exported from the package root beside `RULE_TOOL_NAME_VERDICTS`; the consumer smoke probe asserts their presence.
+- **Who is hurt.** Nobody: additive.
+- **Consumers.** client-core — generate the two mirrors from the package root (CC-338). server — none.
+- Pins: `test/export-surface.snapshot.json` (+4 names); `scripts/consumer-smoke-probe.mjs` (two new object entries, run by `gate:blackbox`).
+
+### The peer-segment minter is on the package root (#1355 part one; surface only; +1 export) (@server)
+
+- **Before (v7.41.0).** A covering-form rule such as `mcp__github.com` (two segments, accepted since #1156) or `mcp__github.com__*` was compiled and stored as written, while the engine mints the peer segment normalized (character set, length clamp with a digest suffix, separator fold: `mcp__github_com__`). The rule's segment and the minted segment are compared byte for byte, so such a rule never matches — a deny that reads protective and is inert. Nothing on the package root let a rule writer ask "is this segment one the engine mints?".
+- **Now.** `mintNamespacePrefix(ns, peer)` (src/core/protocol-naming.ts) is re-exported from the package root beside `PROTOCOL_TABLE` / `MCP_NAMESPACE` / `A2A_NAMESPACE`: a rule writer mints the prefix for the rule's peer and compares it with the rule's own spelling. Part two (7.42.0): `judgeRuleToolName` gains the verdict `unmintable_segment` with the minted spelling as `currentName`, and both rule compilers refuse through that one judge.
+- **Who is hurt.** Nobody: additive.
+- **Consumers.** server — S-1113: judge `permissions.deny` / `APPROVAL_DENY` covering-form rules at the door until the 7.42.0 verdict lands.
+- Pins: `test/export-surface.snapshot.json` (+1 name); `scripts/consumer-smoke-probe.mjs` (one new function entry, run by `gate:blackbox`).
+
 ## 7.41.0 — 2026-10-04
 
 **Hard-breaking changes:** one — #1303. **#1303 — Before:** a skill that declared `allowed-tools` (or a host's `SkillSpec.manifest.allowTools`) narrowed the whole task once activated: every unlisted tool was refused (`allowPaths` fenced writes to directories), the listed ones still asked where they always asked, and activating it asked nobody. **#1303 — Who is hurt:** a deployment that relied on a skill's list to fence the model — an unlisted tool is now judged as usual (asked under an asking mode, run under `bypassPermissions` or a deployment allow) and a listed one runs without asking for the rest of the run; a host that hand-built `SkillSpec.manifest` (now refused by name: `config.spec_retired_key`) or wrote `allowPaths` (the write fence is gone), imported the deleted `SkillManifest` type or `skillScopeWriteToolNames`, passed the retired `deployedTools` option to `createSkillsFromDirectory` (refused: `config.deps_retired_key`) or matched on one of its three removed warning codes, or built an auto-promote record with `manifest` / `gate3Scoped` / `lineageId` or passed a manifest to `deriveTripwire`; an embedder with no approver under an asking mode (activating a skill that declares a list is now a card nobody answers — refused); a deployment policy that returns an unmarked `ask` (class `ordinary`) for a listed tool (the list clears it, as a stored allow rule would); a delegation tool that read `ctx.activeSkillScope()` (renamed `ctx.activeSkillGrants()`). **#1303 — Compensation:** fence tools with deny rules (a deployment deny list, a person's deny row) or a delegated agent definition's `allowTools`; fence write paths with session `allowDirs` / the write face (`createSessionRulePolicy`, the fs-write gate); mark a policy's question `mandated` / `requiresRealApproval` (or write an ask rule) when it must reach a person; with no approver, name `Skill` in an allow list or run `bypassPermissions`; move `manifest.allowTools` to `SkillSpec.allowedTools`; drop `deployedTools` (the loader copies every entry and the run's grant table reads it); give `deriveTripwire` the artifact's `{ allowedTools }` and drop `manifest` / `gate3Scoped` / `lineageId` from the promoted record. Everything else in this version adds, tightens or re-words: #1118 adds optional members and text lines; #1294 changes which hook seats fire for a call approved on a parked checkpoint (a PreToolUse seat now sees that call again on the resumed leg); #1307 / #1308 re-word request-time refusals of the file stores (no on-disk location in the sentence; the location rides the store's disclosure seat); #1309 turns a session's enumeration over its own damaged row from a short list into a refusal; #1310 and #1314 change model-facing text only; #1156 refuses a retired or prefix-less `__` tool name at the session-rules write (it used to fail every later run instead); #1328 refuses a resumed `Skill` call whose final arguments select another skill than the card named. **Closed sets:** `DecisionReason` +1 `skill`; `ASK_CLASSES` / `AskClass` +1 `requires_user_interaction` (`MODE_ARBITRATION` +1 row; `RELEASABLE_ASK_CLASSES` and `PERSISTED_RULE_MANDATES` unchanged); `ENGINE_NOTICE_CODES` +1 `skills.allowed_tool_not_granted` (audience `operator`, minter `engine`); trace kinds +1 `permission.skill_allowed`; config refusal codes +1 `config.user_invoked_skill_unknown`; `CheckpointErrorReason` +1 `skill_grants_damaged` and `CheckpointError.detail.field` +1 `boundGrantDigest` (both on the existing `checkpoint.invalid_outcome`); `SessionPolicyError.code` +1 `legacy_tool_name` (with `detail: { field, name, verdict, currentName? }`); new closed set `RULE_TOOL_NAME_VERDICTS` (`current` / `retired` / `unprefixed_namespace`). **Package exports:** +22 / −2 (the entry's count 2558 → 2578). Added — #1118: `readAgentState`, `agentStateSourceOfRecord`, `agentStateSummary`, types `AgentState`, `AgentApproval`, `AgentApprovalState`, `AgentStateRow`, `AgentStateSource`, `TranscriptStep`; #1303: types `SkillGrantRecord`, `SkillGrantHit`, `SkillGrantLane`, `SkillGateSeats`, `PermissionSeatInputs`, `PermissionSeatReading`; #1308: type `FileUsageWindowStoreOptions`; #1156: `judgeRuleToolName`, `RULE_TOOL_NAME_VERDICTS`, `assertSessionRuleNamesCurrent`, types `RuleToolNameVerdict`, `SessionPolicyStoreOptions`, `SessionRuleNameRefusal`. Removed — #1303: `SkillManifest`, `skillScopeWriteToolNames`. Members — new and optional: `TaskSpec.userInvokedSkills`, `SkillSpec.allowedTools` / `disallowedTools`, `CheckpointState.skillGrants`, the `tool_approval` pending action's `boundGrantDigest`, `ToolGateInput.requiresUserInteraction`, `UnifiedTaskOutput.agentState`, `AgentPollDetailsInput.agentState`, `ListAgentsRow.agentState`, `serveDurableAgentRowLane(row, agentState?)`, `checkpointSeat` on `AgentTranscriptToolOptions` / `ListAgentsToolOptions` / `TaskToolOptions` / `TaskPollOptions`, `TaskRegistry.agentStateSource` (new method), `FileUsageWindowStore`'s constructor options and `createFileTaskListStore`'s `onCorruptRead`, `mountedToolNames` on both session-rules stores (`FileStorageBackendOptions.sessionPolicy` forwards it), `loosenReasons`' third parameter; `AgentTranscriptToolOptions.registry` widens to `Pick<TaskRegistry, "getAccessibleTask"> & Partial<Pick<TaskRegistry, "agentStateSource">>` (a full `TaskRegistry` still fits). Removed (the hard-breaking change above): `SkillSpec.manifest` (a host still passing it is refused by name), `SkillsDirectoryOptions.deployedTools` (refused by name), three `SkillsDirectoryWarningCode` words (`allowed_tool_pattern_unsupported`, `allowed_tool_not_mounted`, `disallowed_tools_unenforced`), `PromotedRecord.manifest` / `gate3Scoped` / `lineageId`; `deriveTripwire`'s second parameter is `Pick<SkillSpec, "allowedTools">` (was `SkillManifest`).

package/dist/core/checkpoint-store.d.ts

@@ -1,7 +1,7 @@
 import type { GateOutcome } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
 import type { CheckpointPause } from "./pause-registry.js";
-import type { SystemInjectionPriority } from "./task-notification.js";
+import { type SystemInjectionPriority } from "./task-notification.js";
 import { type QuestionAnswer } from "./ask-question.js";
 import type { ReadEntry } from "../tools/fs/safety.js";
 import type { RepairBundle } from "../agents/repair-loop.js";

package/dist/core/checkpoint-store.js

@@ -7,6 +7,7 @@ import { isAskOrigin, isPersistedRuleMandate } from "./ask-origin.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
+import { steerPriorityOf } from "./task-notification.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { isPermissionMode } from "./ask-origin.js";
 import { wireOf } from "./tool-name-readings.js";
@@ -547,7 +548,7 @@ export function readPendingSteerQueue(state) {
 function samePendingSteerPayload(a, b) {
     return (a.text === b.text &&
         a.trusted === b.trusted &&
-        a.priority === b.priority &&
+        steerPriorityOf(a) === steerPriorityOf(b) &&
         a.actor?.id === b.actor?.id &&
         a.actor?.hostAsserted === b.actor?.hostAsserted &&
         a.actor?.issuer === b.actor?.issuer);

package/dist/core/runner/steer-admission.js

@@ -1,3 +1,4 @@
+import { steerPriorityOf } from "../task-notification.js";
 const humanInputOrdinals = new WeakMap();
 export function nextHumanInputSeq(key) {
     let box = humanInputOrdinals.get(key);
@@ -18,7 +19,7 @@ export function announceAcceptance(record) {
 export function sameAcceptedSteerInput(a, b) {
     return (a.payload === b.payload &&
         a.trusted === b.trusted &&
-        a.priority === b.priority &&
+        steerPriorityOf(a) === steerPriorityOf(b) &&
         a.actor?.id === b.actor?.id &&
         a.actor?.hostAsserted === b.actor?.hostAsserted &&
         a.actor?.issuer === b.actor?.issuer);

package/dist/core/runner/stream-steer-verb.js

@@ -3,7 +3,7 @@ import { snapshotActorAssertion } from "../../internal/llm.js";
 import { MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
-import { isSystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
+import { isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
 import { announceAcceptance, armAcceptance, nextHumanInputSeq, sameAcceptedSteerInput } from "./steer-admission.js";
@@ -29,7 +29,7 @@ export function streamSteerVerb(input) {
         if (priorityIn !== undefined && !isSystemInjectionPriority(priorityIn)) {
             throw steeringError(`priority must be one of ${SYSTEM_INJECTION_PRIORITIES.join("/")} when supplied`, "steering.invalid_content");
         }
-        const priority = priorityIn ?? "next";
+        const priority = steerPriorityOf({ priority: priorityIn });
         const actorIn = options?.actor;
         const actor = actorIn === undefined ? undefined : snapshotActorAssertion(actorIn);
         const projected = projectHumanInput({ text, actor, source: "steer" });

package/dist/core/task-notification.d.ts

@@ -30,6 +30,12 @@ export declare const SYSTEM_INJECTION_PRIORITIES: readonly SystemInjectionPriori
  *  no-subscriber retain path indexes `queues[priority]` and the park path stores it verbatim, so an
  *  unknown value used to travel until something downstream failed on it (or didn't, and lied). */
 export declare function isSystemInjectionPriority(value: unknown): value is SystemInjectionPriority;
+/** The ONE reading of a steer's priority: a parked row or an accepted input that carries none means `"next"`
+ *  (the default the live admission has always applied) — so a retry that spells the default and a row parked
+ *  without it are the same instruction, whichever side normalized. */
+export declare function steerPriorityOf(x: {
+    readonly priority?: SystemInjectionPriority;
+}): SystemInjectionPriority;
 export interface TaskNotificationPayload {
     task_id: string;
     /** design/144 §2: `"external"` is CORE-MINTED ONLY — `TaskStream.notify()` casts it onto every

package/dist/core/task-notification.js

@@ -10,6 +10,9 @@ export const SYSTEM_INJECTION_PRIORITIES = ["now", "next", "later"];
 export function isSystemInjectionPriority(value) {
     return typeof value === "string" && SYSTEM_INJECTION_PRIORITIES.includes(value);
 }
+export function steerPriorityOf(x) {
+    return x.priority ?? "next";
+}
 const TASK_NOTIFICATION_TAGS = [
     "task-notification",
     "task-id",

package/dist/index.d.ts

@@ -145,7 +145,7 @@ export { judgeRuleToolName, RULE_TOOL_NAME_VERDICTS, type RuleToolNameVerdict }
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, type NotificationInjectionOutcome, // the injector's outcome words (`parked_durably` = the session's durable box took the frame)
 NOTIFICATION_INJECTION_OUTCOMES, // …and their value half + guard, so a host wiring its own uplink validates a reported outcome without duplicating the vocabulary
-isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
+isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, type RosterBoundMembers, type RosterBoundCode, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
@@ -198,7 +198,9 @@ export { type AskOrigin, ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL,
 export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, type ModeReleaseReason, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, type ModePolicy, PERMISSION_MODE_FOLD_REASONS, type PermissionModeFoldReason, type PermissionModeReceipt, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export type { PermissionSeatInputs, PermissionSeatReading } from "./core/mode-policy.js";
-export type { SkillGateSeats, SkillGrantHit, SkillGrantLane, SkillGrantRecord } from "./core/skill-grant.js";
+export type { SkillEntryInertReason, SkillGateSeats, SkillGrantHit, SkillGrantLane, SkillGrantOrigin, SkillGrantRecord } from "./core/skill-grant.js";
+export { SKILL_ENTRY_INERT_REASONS, SKILL_GRANT_ORIGINS } from "./core/skill-grant.js";
+export { mintNamespacePrefix } from "./core/protocol-naming.js";
 export { readDenyClassifierRules, renderClassifierDenyRules, type DerivedDenyRule } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource, type AutoModeDenySource } from "./core/runtime-caps.js";
 export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_PARTIES, type SettlementParty, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome } from "./core/gate-outcome.js";

package/dist/index.js

@@ -117,7 +117,7 @@ export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE } from "./co
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { judgeRuleToolName, RULE_TOOL_NAME_VERDICTS } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, HANDBACK_STATES, COMPACTION_KINDS, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, HANDBACK_STATES, COMPACTION_KINDS, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
@@ -162,6 +162,8 @@ export {} from "./core/read-root-grant-screen.js";
 export { ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, PERMISSION_MODE_FOLD_REASONS, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
+export { SKILL_ENTRY_INERT_REASONS, SKILL_GRANT_ORIGINS } from "./core/skill-grant.js";
+export { mintNamespacePrefix } from "./core/protocol-naming.js";
 export { readDenyClassifierRules, renderClassifierDenyRules } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./core/runtime-caps.js";
 export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_PARTIES, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.41.0",
+  "version": "7.41.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2578,
+  "count": 2584,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -1337,6 +1337,8 @@
     "SHELL_READ_FINDING_RANK": "variable",
     "SHELL_READ_SEATS": "variable",
     "SHELL_WRAPPER_TABLE": "variable",
+    "SKILL_ENTRY_INERT_REASONS": "variable",
+    "SKILL_GRANT_ORIGINS": "variable",
     "SKILL_TOOL_NAME": "variable",
     "STALE_RUNNING_REAP_ATTRIBUTION": "variable",
     "STARTER_RULES": "variable",
@@ -1448,9 +1450,11 @@
     "SideQueryResult": "interface",
     "SideQuerySpec": "interface",
     "SideQueryToolDef": "interface",
+    "SkillEntryInertReason": "type",
     "SkillGateSeats": "interface",
     "SkillGrantHit": "interface",
     "SkillGrantLane": "interface",
+    "SkillGrantOrigin": "type",
     "SkillGrantRecord": "interface",
     "SkillSpec": "interface",
     "SkillsDirectoryOptions": "interface",
@@ -2228,6 +2232,7 @@
     "mintCheckpointToken": "function",
     "mintExposurePartitionedPlan": "function",
     "mintLlmConsolidationPlan": "function",
+    "mintNamespacePrefix": "function",
     "mintPeerRef": "function",
     "mintPeerSessionCandidates": "function",
     "mintReminderMark": "function",
@@ -2510,6 +2515,7 @@
     "splitWorkflowMeta": "function",
     "sqliteQuery": "function",
     "startWorkflow": "function",
+    "steerPriorityOf": "function",
     "storeReadBackShapeContract": "function",
     "stripEngineMetadata": "function",
     "stripFormatCharacters": "function",
@@ -3917,6 +3923,8 @@
     "SHELL_READ_FINDING_RANK": "advanced",
     "SHELL_READ_SEATS": "advanced",
     "SHELL_WRAPPER_TABLE": "advanced",
+    "SKILL_ENTRY_INERT_REASONS": "advanced",
+    "SKILL_GRANT_ORIGINS": "advanced",
     "SKILL_TOOL_NAME": "internal",
     "STALE_RUNNING_REAP_ATTRIBUTION": "advanced",
     "STARTER_RULES": "advanced",
@@ -4028,9 +4036,11 @@
     "SideQueryResult": "advanced",
     "SideQuerySpec": "advanced",
     "SideQueryToolDef": "advanced",
+    "SkillEntryInertReason": "advanced",
     "SkillGateSeats": "advanced",
     "SkillGrantHit": "advanced",
     "SkillGrantLane": "advanced",
+    "SkillGrantOrigin": "advanced",
     "SkillGrantRecord": "advanced",
     "SkillSpec": "stable",
     "SkillsDirectoryOptions": "advanced",
@@ -4808,6 +4818,7 @@
     "mintCheckpointToken": "advanced",
     "mintExposurePartitionedPlan": "advanced",
     "mintLlmConsolidationPlan": "advanced",
+    "mintNamespacePrefix": "advanced",
     "mintPeerRef": "advanced",
     "mintPeerSessionCandidates": "advanced",
     "mintReminderMark": "advanced",
@@ -5090,6 +5101,7 @@
     "splitWorkflowMeta": "advanced",
     "sqliteQuery": "advanced",
     "startWorkflow": "advanced",
+    "steerPriorityOf": "advanced",
     "storeReadBackShapeContract": "advanced",
     "stripEngineMetadata": "advanced",
     "stripFormatCharacters": "advanced",

package/wire-changes/core@7.41.1.json

@@ -0,0 +1,159 @@
+{
+  "repo": "core",
+  "version": "7.41.1",
+  "from": "e91ad31a94f1ea1688241d5bb9e5e278986f3d23",
+  "to": "08eee448c5a848592a8c12684867cd423eac5d95",
+  "added": [
+    {
+      "name": "SKILL_ENTRY_INERT_REASONS",
+      "kind": "variable",
+      "tier": "advanced",
+      "at": [
+        "src/core/skill-grant.ts:65",
+        "src/index.ts:1470"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "SKILL_GRANT_ORIGINS",
+      "kind": "variable",
+      "tier": "advanced",
+      "at": [
+        "src/core/skill-grant.ts:46",
+        "src/index.ts:1470"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "SkillEntryInertReason",
+      "kind": "type",
+      "tier": "advanced",
+      "at": [
+        "src/core/skill-grant.ts:66",
+        "src/index.ts:1469"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "SkillGrantOrigin",
+      "kind": "type",
+      "tier": "advanced",
+      "at": [
+        "src/core/skill-grant.ts:47",
+        "src/index.ts:1469"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "mintNamespacePrefix",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/protocol-naming.ts:114",
+        "src/index.ts:1471"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    }
+  ],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 225,
+  "signatures": [],
+  "declarationMoves": [
+    {
+      "name": "SKILL_ENTRY_INERT_REASONS",
+      "kind": "variable",
+      "onSurface": true,
+      "from": [
+        "src/core/skill-grant.ts"
+      ],
+      "to": [
+        "src/core/skill-grant.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "SKILL_GRANT_ORIGINS",
+      "kind": "variable",
+      "onSurface": true,
+      "from": [
+        "src/core/skill-grant.ts"
+      ],
+      "to": [
+        "src/core/skill-grant.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "SkillEntryInertReason",
+      "kind": "type",
+      "onSurface": true,
+      "from": [
+        "src/core/skill-grant.ts"
+      ],
+      "to": [
+        "src/core/skill-grant.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "SkillGrantOrigin",
+      "kind": "type",
+      "onSurface": true,
+      "from": [
+        "src/core/skill-grant.ts"
+      ],
+      "to": [
+        "src/core/skill-grant.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "mintNamespacePrefix",
+      "kind": "function",
+      "onSurface": true,
+      "from": [
+        "src/core/protocol-naming.ts"
+      ],
+      "to": [
+        "src/core/protocol-naming.ts",
+        "src/index.ts"
+      ]
+    }
+  ],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "ProtocolNamespace.makeName",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ProtocolNamespace.prefix",
+      "assertions": [
+        "G1.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@e790a1ca server@4160110a sdk@ee3b981 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}

package/wire-changes/core@7.41.2.json

@@ -0,0 +1,54 @@
+{
+  "repo": "core",
+  "version": "7.41.2",
+  "from": "b8c8666207a044498ac37fb36d14304a66ea5a92",
+  "to": "96a0ef21bc1d7887c1016b1762fcb9efaae02252",
+  "added": [
+    {
+      "name": "steerPriorityOf",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/task-notification.ts:49",
+        "src/index.ts:1004"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    }
+  ],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 225,
+  "signatures": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "PendingSteerEntry.inputId",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "PendingSteerEntry.priority",
+      "assertions": [
+        "G1.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@e790a1ca server@4160110a sdk@bc45b50 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}