@sema-agent/core 7.47.0 → 7.49.0

package/dist/core/runner/prepare-inherited-gate.js

@@ -1,6 +1,7 @@
 import { forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/subagent.js";
 import { isLiveQuestionFace } from "../ask-question.js";
 import { parentSpecSeatOf } from "../parent-spec-seat.js";
+import { childClampSeats, clampSourceOf } from "../child-clamp-seats.js";
 import { createPreToolUseConstraintPolicy } from "../hooks.js";
 import { continuesLineage } from "../session-policy-store.js";
 import { StubExecutionEnv } from "../stub-env.js";
@@ -91,7 +92,6 @@ export function prepareInheritedGate(input) {
     const ancestorRulesNow = () => inheritedAncestorRules === undefined ? undefined : inheritedAncestorRules.map((a, i) => ancestorSessionRulesRef.current.get(i) ?? a);
     const memoryAdmittedOrgScopesRef = { current: [] };
     const ownOrgVerdictRef = { current: undefined };
-    const orgAdmissionCheckpointState = () => inheritedAdmittedOrgScopes !== undefined || ownOrgVerdictRef.current !== undefined || orgGovernedProvenance;
     const faceCheckpointSection = () => {
         const resolvedReadFace = input.resolvedReadFace();
         const handsLessResolvedFace = input.handsLessResolvedFace();
@@ -110,15 +110,11 @@ export function prepareInheritedGate(input) {
         }
         return undefined;
     };
-    const faceCheckpointState = () => faceCheckpointSection() !== undefined;
     const writeFaceCheckpointSection = () => {
         const seat = input.resolvedWriteFace() ?? input.handsLessResolvedWriteFace();
         return seat === undefined ? undefined : seat.inForce() === "open" ? { face: "open" } : seat.fenced ? { face: "roots" } : undefined;
     };
     const skillGrantCheckpointSection = () => frozenSkillGrants(skillGrants);
-    const f012CheckpointState = () => (inheritedParentConstraints?.length ?? 0) > 0 ||
-        seedInheritedGate?.constraintChain !== undefined ||
-        internals?.delegationProvenance !== undefined;
     const frozenOnAsk = askSeat.value;
     const hookEnvSource = (ownedEnv ?? deps.executionEnv) != null ? executionEnv : undefined;
     const notifyOwnHookCrash = (err) => {
@@ -198,17 +194,23 @@ export function prepareInheritedGate(input) {
     };
     const carrierReadFace = () => input.resolvedReadFace() ?? input.handsLessResolvedFace();
     const carrierWriteFace = () => (input.resolvedWriteFace() ?? input.handsLessResolvedWriteFace())?.inForce();
+    const runClampSource = () => ({
+        ...clampSourceOf(spec, "clamp"),
+        readFace: carrierReadFace(),
+        writeFace: carrierWriteFace(),
+        readDenyPatterns: input.readDenyAdditionsNormalized(),
+        approvalReach: askSeat.reach,
+    });
     const fullShellReachable = handsEnabled &&
         !(executionEnv instanceof StubExecutionEnv) &&
         spec.handsReadOnly !== true &&
         spec.excludeAllTools !== true &&
-        !(toolFaceSnapshot.exclude?.includes("Bash") ?? false);
+        toolFaceSnapshot.selector.admits({ name: "Bash" });
     const { gateStopRef, stopForDenialLimit } = createDenialLimitStop({ sessionId, runId, onNotice: deps.onNotice, abort: abortRun });
     const delegationEntryCapsResolved = resolveDelegationEntryCaps(deps.delegationEntryCaps);
     const enrichSpecToolCtx = (ctx) => {
         const agentForkDenial = input.agentForkDenial();
         const observersActive = input.observersActive();
-        const readDenyAdditionsNormalized = input.readDenyAdditionsNormalized();
         const autoModeDecider = input.autoModeDecider();
         const centerAdoption = input.centerAdoption();
         return {
@@ -220,18 +222,14 @@ export function prepareInheritedGate(input) {
             thinkingLevel: harnessRef.current?.getThinkingLevel(),
             principal: spec.principal,
             ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
-            ...(askSeat.reach !== undefined ? { approvalReach: askSeat.reach } : {}),
+            ...childClampSeats(runClampSource()),
             ...(frozenOnQuestion !== undefined ? { onQuestion: frozenOnQuestion } : {}),
-            ...(spec.handsReadOnly === true ? { handsReadOnly: true } : {}),
-            ...(carrierReadFace() === "roots" ? { readFace: "roots" } : {}),
-            ...(carrierWriteFace() === "roots" ? { writeFace: "roots" } : {}),
-            ...(readDenyAdditionsNormalized.length > 0 ? { readDenyPatterns: Object.freeze(readDenyAdditionsNormalized.map((e) => ({ ...e }))) } : {}),
-            ...(spec.interactiveTools === false ? { interactiveTools: false } : {}),
             oneShot: spec.oneShot,
             mountsCallerTool,
+            ...(input.mountedMcp !== undefined ? { mountedMcp: input.mountedMcp } : {}),
             parentSpecSeat,
             ...(internals?.questionFaceStripped === true ? { questionFaceStripped: true } : {}),
-            excludeTools: toolFaceSnapshot.exclude,
+            toolSelector: toolFaceSnapshot.selector,
             deferTools: toolFaceSnapshot.defer,
             alwaysLoadTools: toolFaceSnapshot.alwaysLoad,
             ...(toolFaceSnapshot.restoreGated !== undefined ? { restoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
@@ -265,6 +263,7 @@ export function prepareInheritedGate(input) {
             ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),
             ...(spec.durableApproval !== undefined ? { durableApprovalForChildren: { ...spec.durableApproval } } : {}),
             ...(input.checkpointSeat !== undefined ? { checkpointStoreForChildren: input.checkpointSeat } : {}),
+            checkpointScopeForChildren: input.checkpointScope,
             taskId: hostTaskId,
             ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
             ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}),
@@ -305,5 +304,5 @@ export function prepareInheritedGate(input) {
             ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
         };
     };
-    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, skillGrantCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
+    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, runClampSource, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
 }

package/dist/core/runner/prepare-listings.d.ts

@@ -1,31 +1,11 @@
-/**
- * PrepareTask's LISTINGS phase: the sub-agent tool lists' audit (`sub-agent-deny-lists.ts`),
- * the agent-listing announce face read off the
- * delegation tool's roster (with its deferred / excluded / removal-to-zero arms), the two listing
- * opt-out advisories, the announced-listings mirror seeded from the once-per-session ledger, the
- * deferred roster's ToolSearch ride, and the date_change seam. The body is the driver's stretch moved
- * verbatim; the interface is the dependency list it had implicitly.
- *
- * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between
- * the disclosure mount before it and the context-lane seats after it (a stretch
- * with no await is extracted as a sync function — an `async` wrapper would open a microtask window).
- *
- * Throws pass through unchanged: `config.agent.unknown_tool` (a denied-tools entry that names no
- * tool — one judgment for every list a deployment writes, in `sub-agent-deny-lists.ts`).
- */
-import type { AgentTool } from "../../internal/harness.js";
 import type { TaskSpec } from "../types.js";
 import type { AnnounceOnceSink, DateAnchorRead, Prepared, PrepareResume, ToolFaceSnapshot } from "./contracts.js";
 import type { AnnouncedListingSnapshot } from "../../internal/harness.js";
 import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 export interface PrepareListingsInput {
-    /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `agents` (the audit's subject), `tools`
-     *  (the roster-bearing delegation tool, by its `agentListing` marker), `sessionId` (continuation
-     *  ⇒ seeded/removal projections), `attachments` (the two opt-outs). Never mutated. */
+    /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `tools` (the roster-bearing delegation tool, by its `agentListing`
+     *  marker), `sessionId` (continuation ⇒ seeded/removal projections), `attachments` (the two opt-outs). Never mutated. */
     spec: Pick<TaskSpec, "agents" | "tools" | "sessionId" | "attachments">;
-    /** borrowed-readonly — the FULLY ASSEMBLED mount array (names + aliases = the audit's universe).
-     *  Read only; this phase never mutates the roster. */
-    tools: ReadonlyArray<AgentTool>;
     /** borrowed-readonly — the once-per-session ledger: its deduplicated operator sink (`onError`) and
      *  the whole announced snapshot (`arms()`) the mirror is seeded from. */
     onceLedger: AnnounceOnceSink & {
@@ -33,12 +13,15 @@ export interface PrepareListingsInput {
     };
     /** borrowed-readonly — the acquired session's id (operator-line context). */
     sessionId: string;
-    /** borrowed-readonly — the frozen tool face: `exclude` / `defer` decide the roster face's arm. */
-    toolFaceSnapshot: Pick<ToolFaceSnapshot, "exclude" | "defer">;
+    /** borrowed-readonly — the frozen tool face: the selector and `defer` decide the roster face's arm. */
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector" | "defer">;
     /** borrowed-readonly — the activated deferred names as of prepare (transcript replay / checkpoint
      *  seed); only `has()` is read: an already-ACTIVE roster tool un-defers its listing face. The set
      *  keeps mutating mid-run (ToolSearch activations) — this phase reads it once, here. */
     activeTools: ReadonlySet<string>;
+    /** borrowed-readonly — the leg's EFFECTIVE deferred set (the defer classification's answer): a name the caller listed in `deferTools`
+     *  is deferred only if it is in here — a leg whose selector leaves ToolSearch out defers nothing, so its roster tool ships inline with its listing. */
+    deferred: ReadonlySet<string>;
     /** borrowed-readonly — the durable-resume carrier: presence (seedAnnounced) and
      *  `seed.announcedListings.agents` (the removal-to-zero projection's gate). */
     resume: Pick<PrepareResume, "seed"> | undefined;

package/dist/core/runner/prepare-listings.js

@@ -1,18 +1,17 @@
 import { formatLocalDate } from "../../prompts/default.js";
-import { auditSubAgentToolLists } from "./sub-agent-deny-lists.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { renderAgentListingDelta } from "./turn-attachments.js";
 export function prepareListings(input) {
-    const { spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingBudget, listingRideRef, renderWithDate, envFacts, tzValid, userTz, dateAnchor } = input;
-    auditSubAgentToolLists({ spec, tools, onceLedger, sessionId });
+    const { spec, onceLedger, sessionId, toolFaceSnapshot, activeTools, deferred, resume, skillsListing, listingBudget, listingRideRef, renderWithDate, envFacts, tzValid, userTz, dateAnchor } = input;
     const rosterBearingSpec = (spec.tools ?? []).find((t) => t.agentListing !== undefined && t.agentListing.length > 0);
     const rosterFaceDeferred = rosterBearingSpec !== undefined &&
-        !(toolFaceSnapshot.exclude?.includes(rosterBearingSpec.name) ?? false) &&
+        toolFaceSnapshot.selector.admits(rosterBearingSpec) &&
         (toolFaceSnapshot.defer?.includes(rosterBearingSpec.name) ?? false) &&
+        deferred.has(rosterBearingSpec.name) &&
         !activeTools.has(rosterBearingSpec.name);
     const agentListingSpec = rosterBearingSpec !== undefined &&
         !rosterFaceDeferred &&
-        !(toolFaceSnapshot.exclude?.includes(rosterBearingSpec.name) ?? false)
+        toolFaceSnapshot.selector.admits(rosterBearingSpec)
         ? rosterBearingSpec
         : undefined;
     const agentListing = agentListingSpec

package/dist/core/runner/prepare-memory-engine-session.d.ts

@@ -38,6 +38,8 @@ export interface PrepareMemoryEngineSessionInput {
     externalContentTargetActive: boolean;
     /** borrowed-readonly — the frozen preflight; only `mcp` (the declared entries the announcement walks). */
     lockedPreflight: Pick<LockedPreflight, "mcp">;
+    /** borrowed-readonly — the run's MCP mount, read at call time (present iff the run declared a server): the children a delegation tool spawns inherit it, so its tools are rows of their pool. */
+    mountedMcp?: () => import("../mounted-mcp.js").MountedMcp;
     /** borrowed-readonly — the materialized MCP handle; only `statuses` (the announcement's mounted-tool count). */
     mcp: Pick<MaterializedMcp, "statuses">;
     /** borrowed-readonly — the acquired session id (notice detail). */

package/dist/core/runner/prepare-memory-engine-session.js

@@ -1,4 +1,5 @@
 import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
+import { mountedMcpPoolRows } from "../mounted-mcp.js";
 import { narrowContentSafety, readCardAttestation } from "../memory-engine/delegation-provenance.js";
 import { recordSyncUnattestable, sessionSettlements } from "../memory-engine/delegation-settlement.js";
 import { protocolOf } from "../protocol-table.js";
@@ -8,7 +9,7 @@ import { fileArgPath } from "../../tools/fs/safety.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareMemoryEngineSession(input) {
-    const { memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef } = input;
+    const { memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mcp, mountedMcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef } = input;
     const tools = roster.tools;
     const delegationProvenanceChannel = internals?.delegationProvenance;
     if (memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined) {
@@ -53,7 +54,7 @@ export function prepareMemoryEngineSession(input) {
             const withFaces = t;
             if (withFaces.agentToolFaces === undefined && t.agentListing === undefined)
                 continue;
-            delegationByName.set(t.name, { faces: withFaces.agentToolFaces, pool: withFaces.agentToolPool });
+            delegationByName.set(t.name, { faces: withFaces.agentToolFaces, pool: withFaces.agentToolPool, inheritsMcp: t.agentToolInheritsMcp === true });
         }
         const poolToolPollutes = (t) => contentOriginPollutes(classifyToolContentOrigin({
             declared: t.contentOrigin,
@@ -128,7 +129,7 @@ export function prepareMemoryEngineSession(input) {
                         const external = delegationCallIsExternal({
                             requestedType: typeof requested === "string" ? requested : undefined,
                             faces: delegation.faces,
-                            pool: delegation.pool,
+                            pool: delegation.pool !== undefined && delegation.inheritsMcp && mountedMcp !== undefined ? [...delegation.pool, ...mountedMcpPoolRows(mountedMcp())] : delegation.pool,
                             isPolluting: poolToolPollutes,
                         });
                         const result = await inner(toolCallId, params, signal, onUpdate);

package/dist/core/runner/prepare-memory.d.ts

@@ -140,6 +140,9 @@ export interface PrepareMemoryInput {
      * record-query walk, so a source that flips WHILE the fork runs suppresses it live.
      */
     captureForkOrigin?: string;
+    /** borrowed-readonly — the occupant of {@link captureForkOrigin} the fork COPIED (`SessionMetadata.forkedFromIncarnation`);
+     *  absent ⇒ unknown, which binds the source's records whoever holds that id now. */
+    captureForkOriginIncarnation?: string;
     /** borrowed-readonly — design/383 §2.5 (rescan, codex adversarial round): the fork-lineage read itself FAULTED
      *  (session metadata unreadable): whether this session forks an opted-out source is unknowable,
      *  so the capture arm runs INDETERMINATE (suppress fail-closed, disclose, mint nothing) — a
@@ -156,6 +159,9 @@ export interface PrepareMemoryInput {
         sessionId: string;
         controlDir?: string;
     }>;
+    /** borrowed-readonly — the ACQUIRED session's own `incarnation` (prepare-task's one metadata read): the engines'
+     *  occupant seat answers this run's id from it and from nothing else; absent ⇒ unknown (binds). */
+    sessionIncarnation?: string;
     /**
      * borrowed-readonly — the org-memory admission context (ruled 2026-08-05), assembled by
      * prepare-task:

package/dist/core/runner/prepare-memory.js

@@ -1,7 +1,7 @@
 import { isAbsolute, sep } from "node:path";
 import { deliverEngineNotice } from "../types.js";
 import { admitMemoryScopes } from "../memory-admission.js";
-import { adoptLegacyRepoDirs, canonicalize, deriveRepoControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, isContainedIn, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
+import { adoptLegacyRepoDirs, canonicalize, deriveRepoControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, effectiveControlRootOf, enqueueMemoryAnnouncement, isContainedIn, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
 import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir, mergeHarvestReports, mergeInjections, needsDualRoots, parsedProjectPlane } from "../memory-engine/dual-root.js";
 import { memoryProjectScopeAbsentNotice, normalizeMemorySpec } from "../memory.js";
 import { deriveSupersededSet } from "../memory-engine/consolidation.js";
@@ -9,6 +9,7 @@ import { shadowNamesOf } from "../memory-engine/shadowing.js";
 import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_INDETERMINATE_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memoryRestoreWithheldNotice, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
 import { adjudicateCaptureOptOut, captureOptOutDeniedError, captureOptOutUnpersistedError } from "./memory-capture-optout.js";
 import { readSessionCaptureOptOut } from "../memory-engine/layout.js";
+import { sessionIncarnationResolver } from "../memory-engine/session-incarnation.js";
 import { createMemoryEngineTools } from "../memory-engine/tools.js";
 import { assertScopeContractPlacement, parseScopeKey, resolveProjectId } from "../memory-engine/scope-contract.js";
 import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
@@ -97,6 +98,8 @@ export async function prepareMemory(input) {
     if (useMemoryEngine && memorySpec) {
         try {
             const backend = deps.memoryBackend;
+            const lineageTokens = new Map(input.captureForkOrigin !== undefined && input.captureForkOriginIncarnation !== undefined ? [[input.captureForkOrigin, input.captureForkOriginIncarnation]] : []);
+            const incarnationOpt = { sessionIncarnation: sessionIncarnationResolver(sessionId, input.sessionIncarnation, lineageTokens) };
             const pinned = backend.directoryRoot;
             const engineRoot = resolveMemoryEngineRoot(deps.memoryEngineDir);
             const repoRoot = deps.rootPath ?? taskRootPath;
@@ -156,6 +159,7 @@ export async function prepareMemory(input) {
                 : identityKey !== undefined
                     ? deriveProjectMemoryDir(engineRoot, identityKey)
                     : deriveRepoMemoryDir(engineRoot, repoRoot);
+            const projectControlDir = identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot);
             const planes = memorySpec.scopeContract === "v2" ? classifyScopePlanes(memorySpec.scopes, memorySpec.writeScope) : undefined;
             const dual = planes !== undefined && needsDualRoots(planes);
             const personalOnly = planes !== undefined && !dual && planes.project.length === 0 && planes.writePlane !== "project" && (planes.personal.length > 0 || planes.writePlane === "personal");
@@ -170,15 +174,11 @@ export async function prepareMemory(input) {
             }
             const personalMemoryDir = derivePersonalMemoryDir(engineRoot);
             const personalControlDir = derivePersonalControlDir(engineRoot);
-            const effectiveControlDir = (b, fallback) => {
-                const pinnedCtl = b.controlPlaneRoot;
-                return typeof pinnedCtl === "string" && pinnedCtl ? pinnedCtl : fallback;
-            };
-            const captureStoreOpt = (b, fallback) => deps.memoryCaptureRecordStore !== undefined ? { captureRecordStore: deps.memoryCaptureRecordStore({ controlDir: effectiveControlDir(b, fallback) }) } : {};
+            const captureStoreOpt = (dir, b, configured) => deps.memoryCaptureRecordStore !== undefined ? { captureRecordStore: deps.memoryCaptureRecordStore({ controlDir: effectiveControlRootOf(dir, { pinnedBy: b, controlDir: configured }) }) } : {};
             const choosePersonalBackend = () => typeof pinned === "string" && pinned ? new FileMemoryEngineBackend(personalMemoryDir, { controlDir: personalControlDir }) : backend;
             const createPersonalEngine = (personalBackend) => {
                 return {
-                    engine: new MemoryEngine({ backend: personalBackend, memoryDir: personalMemoryDir, controlDir: personalControlDir, onIncident: onEngineIncident, provenance: input.memoryProvenance, ...captureStoreOpt(personalBackend, personalControlDir), ...(deps.memorySessionIncarnation !== undefined ? { sessionIncarnation: deps.memorySessionIncarnation } : {}), ...(input.deps.memoryConsolidation !== undefined ? { consolidation: input.deps.memoryConsolidation } : {}) }),
+                    engine: new MemoryEngine({ backend: personalBackend, memoryDir: personalMemoryDir, controlDir: personalControlDir, onIncident: onEngineIncident, provenance: input.memoryProvenance, ...captureStoreOpt(personalMemoryDir, personalBackend, personalControlDir), ...incarnationOpt, ...(input.deps.memoryConsolidation !== undefined ? { consolidation: input.deps.memoryConsolidation } : {}) }),
                     backend: personalBackend,
                 };
             };
@@ -341,8 +341,8 @@ export async function prepareMemory(input) {
             if (dual) {
                 const personalBackendChosen = choosePersonalBackend();
                 {
-                    const projCtl = effectiveControlDir(backend, identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot));
-                    const persCtl = effectiveControlDir(personalBackendChosen, personalControlDir);
+                    const projCtl = effectiveControlRootOf(memoryDir, { pinnedBy: backend, controlDir: projectControlDir });
+                    const persCtl = effectiveControlRootOf(personalMemoryDir, { pinnedBy: personalBackendChosen, controlDir: personalControlDir });
                     const overlap = (a, b) => isContainedIn(a, b) || isContainedIn(b, a);
                     const refuse = (what, a, b) => {
                         const e = new Error(`memory dual-root configuration error: ${what} overlap (${canonicalize(a)} vs ${canonicalize(b)}) — the planes' data roots and control planes must all be disjoint.`);
@@ -363,10 +363,10 @@ export async function prepareMemory(input) {
                 const projectEngine = new MemoryEngine({
                     backend,
                     memoryDir,
-                    controlDir: identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot),
+                    controlDir: projectControlDir,
                     onIncident: onEngineIncident,
                     provenance: input.memoryProvenance,
-                    ...captureStoreOpt(backend, identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot)), ...(deps.memorySessionIncarnation !== undefined ? { sessionIncarnation: deps.memorySessionIncarnation } : {}),
+                    ...captureStoreOpt(memoryDir, backend, projectControlDir), ...incarnationOpt,
                     ...(input.deps.memoryConsolidation !== undefined ? { consolidation: input.deps.memoryConsolidation } : {}),
                 });
                 const personal = createPersonalEngine(personalBackendChosen);
@@ -472,10 +472,10 @@ export async function prepareMemory(input) {
                 const engine = new MemoryEngine({
                     backend,
                     memoryDir,
-                    controlDir: identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot),
+                    controlDir: projectControlDir,
                     onIncident: onEngineIncident,
                     provenance: input.memoryProvenance,
-                    ...captureStoreOpt(backend, identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot)), ...(deps.memorySessionIncarnation !== undefined ? { sessionIncarnation: deps.memorySessionIncarnation } : {}),
+                    ...captureStoreOpt(memoryDir, backend, projectControlDir), ...incarnationOpt,
                     ...(input.deps.memoryConsolidation !== undefined ? { consolidation: input.deps.memoryConsolidation } : {}),
                 });
                 await armCaptureOptOut(engine);

package/dist/core/runner/prepare-offload-wrappers.d.ts

@@ -16,10 +16,15 @@ import { type ToolResultStore } from "../tool-result-store.js";
 import type { AgentTool } from "../../internal/harness.js";
 import type { NestedUsage, NestedUsageAccum, RunnerDeps, TaskSpec } from "../types.js";
 import type { PrepareResume } from "./contracts.js";
+import type { ToolSelector } from "../tool-face.js";
 export interface PrepareOffloadWrappersInput {
     /** borrowed-readonly — the REBOUND spec (the config-doors result); read for the per-task coarse
      *  offload knob only. */
     spec: Pick<TaskSpec, "toolResultThresholdChars">;
+    /** borrowed-readonly — the leg's compiled selector: an offloaded result is read back through the reader tool, so a leg whose selector
+     *  does not admit the reader (a sub-agent whose lists leave it out, a deployment that excludes it) offloads nothing — a preview that
+     *  sends the model to a tool it does not have is a dead end. */
+    selector: Pick<ToolSelector, "admits">;
     /** borrowed-readonly — the deployment's coarse offload knob and its injected store (used AS-IS when
      *  present; a Runner-shared instance is viewed per task, see the body). */
     deps: Pick<RunnerDeps, "toolResultThresholdChars" | "toolResultStore">;

package/dist/core/runner/prepare-offload-wrappers.js

@@ -1,8 +1,8 @@
-import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, withToolResultOffload, } from "../tool-result-store.js";
+import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, InMemoryToolResultStore, OFFLOAD_TOOL_NAME, RunnerSharedToolResultStore, ScopedToolResultStore, withToolResultOffload, } from "../tool-result-store.js";
 import { faceOf } from "../tool-roster.js";
 const FIRST_PARTY_OFFLOAD_THRESHOLD_CHARS = 50_000;
 export function prepareOffloadWrappers(input) {
-    const { spec, deps, resume, offloadScope, sessionId } = input;
+    const { spec, deps, resume, offloadScope, sessionId, selector } = input;
     const nestedStats = { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0, anyUnpriced: false };
     if (resume) {
         nestedStats.tokens = resume.seed.nestedStats.tokens;
@@ -21,7 +21,7 @@ export function prepareOffloadWrappers(input) {
     };
     const explicitGlobalThreshold = spec.toolResultThresholdChars ?? deps.toolResultThresholdChars;
     const offloadThreshold = explicitGlobalThreshold ?? DEFAULT_TOOL_RESULT_THRESHOLD_CHARS;
-    const offloadEnabled = Number.isFinite(offloadThreshold) && offloadThreshold > 0;
+    const offloadEnabled = Number.isFinite(offloadThreshold) && offloadThreshold > 0 && selector.admits({ name: OFFLOAD_TOOL_NAME });
     const rawOffloadStore = offloadEnabled ? (deps.toolResultStore ?? new InMemoryToolResultStore()) : undefined;
     const offloadStore = rawOffloadStore instanceof RunnerSharedToolResultStore
         ? new ScopedToolResultStore(rawOffloadStore, offloadScope)

package/dist/core/runner/prepare-park-ask.d.ts

@@ -42,9 +42,12 @@ export interface PrepareParkAskInput {
      *  `parkOnlyHandle` (the pause target), `suspendLoopCapHit`, `serializeCheckpointState`, `inFlightSpendMicroUsd`,
      *  `compensatePausedVM` (the pause-then-cut arm), `commitSuspendSaga` (the point of no return). */
     saga: SuspendSaga | undefined;
-    /** borrowed-readonly — the REBOUND spec. Read: `principal` (the question's source identity, the unattended re-scope, the
-     *  row's identity record), `retainBackgroundProcesses` (the park-only sweep gate). Never mutated. */
+    /** borrowed-readonly — the REBOUND spec. Read: `principal` (the question's source identity, the row's identity record),
+     *  `retainBackgroundProcesses` (the park-only sweep gate). Never mutated. */
     spec: Pick<TaskSpec, "principal" | "retainBackgroundProcesses">;
+    /** borrowed-readonly — this leg's checkpoint scope (the driver's one `checkpointScopeOf` derivation): the scope every row
+     *  this closure mints is filed under. */
+    checkpointScope: string;
     /** borrowed-readonly — the deployment's error face, as a Pick over the SAME `deps` object (receiver preserved for
      *  `deps.onError?.()`): the park refusals' disclosure, the pin failure. */
     deps: Pick<RunnerDeps, "onError">;
@@ -101,6 +104,8 @@ export interface PrepareParkAskInput {
     stampCallTarget: CallTargetStamp | undefined;
     /** borrowed-readonly — the SAME seat the live gate stamps from ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.advertisedWritableDirs}): a parked call's projection re-adjudication asks one question about one call, so it must ask it against the same admitted list. Read at park time, not written here. */
     advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
+    /** borrowed-readonly — the leg's ONE exempt root, the SAME list the live gate stamps ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.exemptRoots}). */
+    exemptRoots: readonly string[];
     /** borrowed-readonly — the run's offload store, or undefined (a volatile store holding results refuses the park). */
     offloadStore: ToolResultStore | undefined;
     /** borrowed-readonly — the per-task owned env, or undefined (a non-remote per-task env refuses the park). Never destroyed. */
@@ -138,12 +143,6 @@ export interface PrepareParkAskInput {
         totalBudgetMicroUsd?: number;
         totalTokens?: number;
     } | undefined;
-    /** borrowed-readonly — the inherited-gate phase's three version-stamp predicates (face / F-012 / org admission). */
-    faceCheckpointState: () => boolean;
-    /** borrowed-readonly — see `faceCheckpointState`. */
-    f012CheckpointState: () => boolean;
-    /** borrowed-readonly — see `faceCheckpointState`. */
-    orgAdmissionCheckpointState: () => boolean;
     /** borrowed-readonly — the policy-chain phase's rule-offer factory (the row's suggestion members). */
     ruleOffersOf: ReturnType<typeof createRuleOffersOf>;
     /** borrowed-readonly — the policy-chain phase's Skill-card binding factory: a parked `Skill` call's row carries the named skill and

package/dist/core/runner/prepare-park-ask.js

@@ -1,22 +1,22 @@
 import { uuidv7 } from "../../engine/session/uuid.js";
 import { Value } from "typebox/value";
-import { ASK_USER_QUESTION_TOOL_NAME, classifyQuestionOutcome, validateAskQuestions } from "../ask-question.js";
+import { classifyQuestionOutcome, validateAskQuestions } from "../ask-question.js";
 import { hasBackgroundShell, sweepBackgroundShells, sweepRunBoundaryBackgroundShells } from "../background-shell.js";
 import { boundInputHashOf } from "../canonical-json.js";
-import { buildRiskDescriptor, checkpointVersionFor, debitLedger, encodeAtFidelity, mintCheckpointId, mintCheckpointToken, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
+import { unencodableIn } from "../checkpoint-requirements.js";
+import { buildRiskDescriptor, debitLedger, encodeAtFidelity, mintCheckpointId, mintCheckpointToken, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { pauseOf } from "../pause-registry.js";
 import { askCarryRowMembers } from "../hooks.js";
 import { askMandateMember, ownedClearanceFacts } from "../ask-origin.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { advertisedWritableRootsSeat, isLiveApproverSeat, carriesBidiControls, describeThrown, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, exemptRootsSeat, isLiveApproverSeat, carriesBidiControls, describeThrown, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
 import { InMemoryToolResultStore, ScopedToolResultStore, isVolatileOffloadStore } from "../tool-result-store.js";
 import { raceAbort, raceSettlementAgainstSignal } from "./abort-race.js";
-import { checkpointScopeOf } from "./checkpoint-scope.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedTtlMs } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
-import { callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
-import { seatOf, wireOf } from "../tool-name-readings.js";
+import { approvalCardMemberOf, callFaceSeat, engineCardOf, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
+import { seatOf } from "../tool-name-readings.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
         super(message, options);
@@ -27,7 +27,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, checkpointScope, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, advertisedWritableDirs, exemptRoots, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -115,7 +115,8 @@ export function prepareParkAsk(input) {
     };
     const suspendAsk = parkLaneArmed && checkpointStore !== undefined
         ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, allowRuleShadowed, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, carry) => {
-            const syncFirstEligible = wireOf("park.syncFirstRoute", req) === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
+            const contentAsk = engineCardOf(req) === "question";
+            const syncFirstEligible = contentAsk ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
             if (syncFirstEligible &&
                 runtimeCaps?.forceDurableGate !== true &&
                 liveFaceUnavailable !== true &&
@@ -148,6 +149,9 @@ export function prepareParkAsk(input) {
                         `a durable approval row must hold an inert snapshot of exactly what a human approves and a resume executes`, { cause: captured.cause });
                 }
                 const parkedArgs = captured.value;
+                const unencodable = unencodableIn(parkedArgs, "pendingAction.args");
+                if (unencodable !== undefined)
+                    throw new ParkRefusal(`the arguments of "${req.toolName}" cannot be bound into the approval row's digest (${unencodable.kind} at ${unencodable.path}) — a durable approval row must hold an inert snapshot of exactly what a human approves and a resume executes`);
                 const projectionMovedArgs = backendFidelity !== "structured-clone" && !samePlainValue(parked.value, parkedArgs);
                 if (projectionMovedArgs && basePolicyForResumeEdit === undefined) {
                     throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and no policy is wired to re-adjudicate the stored shape ` +
@@ -167,6 +171,7 @@ export function prepareParkAsk(input) {
                         ...callFaceSeat(req.face),
                         ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...(handsRoot !== undefined ? { root: handsRoot } : {}),
                         ...advertisedWritableRootsSeat(advertisedWritableDirs),
+                        ...exemptRootsSeat(exemptRoots),
                     });
                     const withReading = stampCallTarget?.(reprojectedReq(), cutSignal);
                     const reprojectedRaced = await raceSettlementAgainstSignal(withReading === undefined ? Promise.resolve(basePolicyForResumeEdit.check(reprojectedReq(), cutSignal)) : withReading.then((r) => basePolicyForResumeEdit.check(r, cutSignal)), cutSignal);
@@ -252,6 +257,7 @@ export function prepareParkAsk(input) {
                                 ? `human approval required before safety-tightened tool "${req.toolName}"`
                                 : `real human approval required for tool "${req.toolName}" (non-budgetable: ${rowRealApproval.origin})`,
                             toolName: req.toolName,
+                            ...approvalCardMemberOf(req),
                             ...(safety !== undefined ? { safetyAxis: safety } : {}),
                             ...(rowRealApproval !== undefined ? { realApproval: rowRealApproval } : {}),
                             riskDescriptor,
@@ -261,15 +267,17 @@ export function prepareParkAsk(input) {
                                 kind: "human",
                                 reason: `human approval required for tool "${req.toolName}"`,
                                 toolName: req.toolName,
+                                ...approvalCardMemberOf(req),
                                 riskDescriptor,
                             }
                             : {
                                 kind: "irreversible_ask",
                                 reason: `human approval required before irreversible tool "${req.toolName}"`,
                                 toolName: req.toolName,
+                                ...approvalCardMemberOf(req),
                                 riskDescriptor,
                             };
-                const scope = durableApproval?.scope || checkpointScopeOf({ principal: spec.principal });
+                const scope = checkpointScope;
                 const ttlMs = sanitizedTtlMs(durableApproval?.ttlMs);
                 const checkpointState = serializeCheckpointState(remoteHandle, inFlightSpendMicroUsd());
                 if (rowRealApproval !== undefined && checkpointState.readFace !== undefined) {
@@ -294,7 +302,6 @@ export function prepareParkAsk(input) {
                 cp = {
                     token,
                     checkpointId: mintCheckpointId(),
-                    version: checkpointVersionFor({ resource: false, binding: true, token: approvalLedger.totalTokens !== undefined, orgAdmission: orgAdmissionCheckpointState(), f012: f012CheckpointState(), realApproval: rowRealApproval !== undefined, face: faceCheckpointState() }),
                     scope,
                     sessionId,
                     leafId,