@sema-agent/core 7.48.0 → 7.49.0

package/dist/orchestration/run-workflow-tool.js

@@ -10,23 +10,24 @@ import { checkpointStoreOfSeat } from "../core/checkpoint-seat.js";
 import { buildWorkflowPrimitives } from "./workflow-primitives.js";
 import { stripSpawnTurnQuestionFace } from "../core/ask-question.js";
 import { parentSpecSeatOfCtx } from "../core/parent-spec-seat.js";
+import { CLAMP_SEATS, CLAMP_SET, assertClampRecord, clampRecordError, clampSourceOf, foldClampSources } from "../core/child-clamp-seats.js";
 import { assertNoRetiredKeys } from "../core/retired-keys.js";
 const RETIRED_RUN_WORKFLOW_TOOL_DEPS_KEYS = {
     principal: "the host run's principal rides `RunWorkflowToolDeps.parentSpecSeat.principal` (the parent SPEC seat the host's prepare mints), never a seat of its own",
     oneShot: "the host run's one-shot fact rides `RunWorkflowToolDeps.parentSpecSeat.oneShot` (only `true` travels), never a seat of its own",
+    builtinWorkflows: "the engine ships no built-in named workflows — `{name}` resolves only the deployment's `scriptStore`; register any named workflow there, or pass `script` inline",
+    parentExcludeTools: "the host run's tool selector layers ride `RunWorkflowToolDeps.parentToolCeiling` (`ToolExecuteContext.toolSelector.layers`, the host's prepare-time selector) and bound every agent the workflow spawns as its ceiling — an exclusion list is no longer handed down by name",
+    ...Object.fromEntries(CLAMP_SEATS.filter((seat) => CLAMP_SET[seat].carrier === "clamp").map((seat) => [
+        `parent${seat.charAt(0).toUpperCase()}${seat.slice(1)}`,
+        `the host's tighten-only clamps ride ONE getter, \`RunWorkflowToolDeps.parentClamps\` (every clamp row, present keys) — return \`${seat}\` from it`,
+    ])),
 };
 import { parseWorkflowMeta, splitWorkflowMeta, workflowScriptReadsClockOrRandom } from "./workflow-meta.js";
 import { mergeWorkflowArgs, normalizeStringArg } from "./workflow-script-store.js";
-import { builtinWorkflowListings, canonicalWorkflowName, resolveBuiltinWorkflow, workflowNameProbeOrder } from "./builtin-workflows.js";
 import { workflowSizeGuidelineSection } from "./workflow-size-guideline.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
 import { thrownText } from "../core/thrown-value.js";
 export const RUN_WORKFLOW_TOOL_NAME = "Workflow";
-function parentFaceSeat(ctxSeat, dep) {
-    if (ctxSeat !== "roots")
-        return dep;
-    return () => "roots";
-}
 function stripCodeFences(s) {
     const t = s.trim();
     const m = /^```[A-Za-z]*\r?\n([\s\S]*?)\r?\n?```$/.exec(t);
@@ -68,7 +69,7 @@ function workflowUsageBlock(run) {
         agents_error: agents.filter((a) => a.status === "failed").length,
         ...(agents.some((a) => a.status === "parked") ? { agents_parked: agents.filter((a) => a.status === "parked").length } : {}),
         agents_empty_result: agents.filter((a) => a.status === "completed" && (a.output === undefined || a.output === "")).length,
-        agents_replayed: agents.filter((a) => a.replayed === true).length,
+        agents_replayed: run.resume?.replayed ?? 0,
         ...(run.journalSkips !== undefined && run.journalSkips > 0 ? { journal_skipped: run.journalSkips } : {}),
         ...(run.resume !== undefined ? { resume_journal_entries: run.resume.journalEntries } : {}),
         subagent_tokens: run.stats.tokens + run.stats.nested.tokens,
@@ -131,59 +132,28 @@ export function renderNamedWorkflowListing(entries) {
     return ("Named workflows available via {name} (registered defaults merge UNDER your `args`; a top-level key you pass wins wholesale):\n" +
         lines.join("\n"));
 }
-async function collectNamedWorkflowListings(store, builtinsEnabled) {
-    const canonicalOf = (name) => (builtinsEnabled ? canonicalWorkflowName(name) : name);
+async function collectNamedWorkflowListings(store) {
     const byName = new Map();
-    const shadowSpellingBySlot = new Map();
-    if (builtinsEnabled) {
-        for (const b of builtinWorkflowListings()) {
-            let shadowedBy;
-            if (store?.resolveName) {
-                for (const probe of workflowNameProbeOrder(b.name)) {
-                    try {
-                        if ((await store.resolveName(probe)) !== undefined)
-                            shadowedBy = probe;
-                    }
-                    catch {
-                    }
-                    if (shadowedBy !== undefined)
-                        break;
-                }
-            }
-            if (shadowedBy !== undefined)
-                shadowSpellingBySlot.set(b.name, shadowedBy);
-            byName.set(b.name, shadowedBy === undefined
-                ? b
-                : {
-                    name: b.name,
-                    description: shadowedBy === b.name
-                        ? "deployment-registered workflow (shadows the built-in of the same name)"
-                        : `deployment-registered workflow (registered under the retired spelling ${JSON.stringify(shadowedBy)}; shadows the built-in)`,
-                });
-        }
-    }
     try {
         const listed = await store?.list?.();
         if (Array.isArray(listed)) {
             const rows = listed.filter((e) => Boolean(e) && typeof e.name === "string" && e.name.length > 0);
-            const listedNames = new Set(rows.map((e) => e.name));
-            for (const e of rows) {
+            for (const e of rows)
                 byName.set(e.name, e);
-                const canonical = canonicalOf(e.name);
-                if (canonical !== e.name && !listedNames.has(canonical)) {
-                    const slotShadow = shadowSpellingBySlot.get(canonical);
-                    if (slotShadow !== undefined && slotShadow !== canonical)
-                        byName.delete(canonical);
-                }
-            }
         }
     }
     catch {
     }
     return [...byName.values()];
 }
-export async function createRunWorkflowTool(d) {
+export function createRunWorkflowTool(d) {
     assertNoRetiredKeys(d, RETIRED_RUN_WORKFLOW_TOOL_DEPS_KEYS, "RunWorkflowToolDeps");
+    if (d.parentClamps !== undefined && typeof d.parentClamps !== "function") {
+        throw clampRecordError(`RunWorkflowToolDeps.parentClamps must be a getter returning the host's clamp source, got ${typeof d.parentClamps}`);
+    }
+    return mountRunWorkflowTool(d);
+}
+async function mountRunWorkflowTool(d) {
     if (d.scriptRunner.safeForUntrustedScripts !== true) {
         throw new Error("createRunWorkflowTool: refusing to mount run_workflow on a runner that is not safeForUntrustedScripts (design/98 fail-closed)");
     }
@@ -198,7 +168,7 @@ export async function createRunWorkflowTool(d) {
     const problem = governanceBaselineProblem(d.governanceBaseline);
     if (problem !== null)
         throw governanceBaselineError(problem);
-    const FACE_LIST_FIELDS = ["excludeTools", "deferTools", "alwaysLoadTools"];
+    const FACE_LIST_FIELDS = ["allowTools", "excludeTools", "deferTools", "alwaysLoadTools"];
     const dropNullFaces = (slot) => {
         let out = slot;
         for (const field of FACE_LIST_FIELDS) {
@@ -227,9 +197,6 @@ export async function createRunWorkflowTool(d) {
     const unionFaceList = (own, parent) => own === undefined ? [...new Set(parent)] : [...new Set([...own, ...parent])];
     const withParentFace = (base, inherit) => ({
         ...base,
-        ...(d.parentExcludeTools?.length
-            ? { excludeTools: unionFaceList(base.excludeTools ?? inherit?.excludeTools, d.parentExcludeTools) }
-            : {}),
         ...(d.parentDeferTools?.length
             ? { deferTools: unionFaceList(base.deferTools ?? inherit?.deferTools, d.parentDeferTools) }
             : {}),
@@ -253,7 +220,7 @@ export async function createRunWorkflowTool(d) {
         })(),
     });
     const withParentProfile = (base) => d.parentPromptProfile !== undefined && base.promptProfile === undefined ? { ...base, promptProfile: d.parentPromptProfile } : base;
-    const baselineWithParentFace = (d.parentExcludeTools?.length ?? 0) > 0 || (d.parentDeferTools?.length ?? 0) > 0 || (d.parentAlwaysLoadTools?.length ?? 0) > 0 || d.parentPromptProfile !== undefined || d.parentRestoreGatedTools !== undefined
+    const baselineWithParentFace = (d.parentDeferTools?.length ?? 0) > 0 || (d.parentAlwaysLoadTools?.length ?? 0) > 0 || d.parentPromptProfile !== undefined || d.parentRestoreGatedTools !== undefined
         ? {
             ...sanitizedBaseline,
             base: withParentProfile(withParentFace(sanitizedBaseline.base)),
@@ -263,8 +230,7 @@ export async function createRunWorkflowTool(d) {
         }
         : sanitizedBaseline;
     const governance = { baseline: baselineWithParentFace, models: d.models, caps: childCaps, onNotice: d.onNotice };
-    const builtinsEnabled = d.builtinWorkflows !== false;
-    const namedWorkflowSection = renderNamedWorkflowListing(await collectNamedWorkflowListings(d.scriptStore, builtinsEnabled));
+    const namedWorkflowSection = renderNamedWorkflowListing(await collectNamedWorkflowListings(d.scriptStore));
     const sizeGuidelineSection = workflowSizeGuidelineSection(d.sizeGuideline ?? lim.sizeGuideline);
     const structuredError = (message) => errorResult(JSON.stringify({ error: message }));
     return defineTool({
@@ -384,8 +350,8 @@ export async function createRunWorkflowTool(d) {
                     "(one entry per phase() call, titles matched exactly; `detail`/`model` optional; never bare strings).",
             })),
             name: Type.Optional(Type.String({
-                description: "Name of a predefined workflow (a saved script in the deployment's workflow store, or a built-in — " +
-                    "see the named-workflow list in this tool's description). Resolves to a self-contained script; the " +
+                description: "Name of a predefined workflow (a saved script in the deployment's workflow store — see the " +
+                    "named-workflow list in this tool's description). Resolves to a self-contained script; the " +
                     "registration's default args merge under your `args`.",
             })),
             scriptPath: Type.Optional(Type.String({
@@ -433,30 +399,19 @@ export async function createRunWorkflowTool(d) {
                 script = stripCodeFences(rawScript);
             }
             else if (typeof rawName === "string" && rawName.length > 0) {
-                if (!d.scriptStore?.resolveName && !builtinsEnabled) {
-                    return structuredError("named workflows require a deployment workflow script store — none is wired (and built-in workflows are disabled); pass `script` inline");
+                if (!d.scriptStore?.resolveName) {
+                    return structuredError("named workflows require a deployment workflow script store — none is wired; pass `script` inline");
                 }
                 let resolved;
-                const canonicalName = canonicalWorkflowName(rawName);
-                const probeNames = builtinsEnabled ? workflowNameProbeOrder(rawName) : [rawName];
-                if (d.scriptStore?.resolveName) {
-                    for (const probeName of probeNames) {
-                        try {
-                            resolved = await d.scriptStore.resolveName(probeName);
-                        }
-                        catch (err) {
-                            return structuredError(`failed to resolve workflow name: ${redactSecrets(thrownText(err)).slice(0, 300)}`);
-                        }
-                        const resolvedShape = resolved;
-                        if (resolvedShape !== undefined && (resolvedShape === null || typeof resolvedShape !== "object")) {
-                            return structuredError("the wired workflow script store's resolveName returned the retired bare-string form — the resolution shape is now { script, defaultArgs? } (one shape); upgrade the store implementation");
-                        }
-                        if (resolved !== undefined)
-                            break;
-                    }
+                try {
+                    resolved = await d.scriptStore.resolveName(rawName);
                 }
-                if (resolved === undefined && builtinsEnabled) {
-                    resolved = resolveBuiltinWorkflow(canonicalName);
+                catch (err) {
+                    return structuredError(`failed to resolve workflow name: ${redactSecrets(thrownText(err)).slice(0, 300)}`);
+                }
+                const resolvedShape = resolved;
+                if (resolvedShape !== undefined && (resolvedShape === null || typeof resolvedShape !== "object")) {
+                    return structuredError("the wired workflow script store's resolveName returned the retired bare-string form — the resolution shape is now { script, defaultArgs? } (one shape); upgrade the store implementation");
                 }
                 if (resolved === undefined)
                     return structuredError(`unknown workflow name: ${JSON.stringify(rawName)}`);
@@ -509,7 +464,11 @@ export async function createRunWorkflowTool(d) {
             const childParkSeat = ctx.checkpointStoreForChildren ?? d.parentCheckpointStore;
             const parkStore = checkpointStoreOfSeat(childParkSeat);
             const scriptFn = (wfCtx) => {
-                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, childParkSeat, parentFaceSeat(ctx.readFace, d.parentReadFace), parentFaceSeat(ctx.writeFace, d.parentWriteFace), d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false, ctx.approvalReach === "none" || d.parentApprovalReach === "none");
+                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, childParkSeat, () => {
+                    const host = d.parentClamps?.();
+                    assertClampRecord(host, "RunWorkflowToolDeps.parentClamps()", "clamp");
+                    return foldClampSources(clampSourceOf(ctx), host);
+                });
                 return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
             };
             if (ctx.signal?.aborted) {
@@ -580,6 +539,7 @@ export async function createRunWorkflowTool(d) {
                     ...((ctx.inheritedGateForChildren ?? d.inheritedGateForChildren) !== undefined
                         ? { inheritedGate: (ctx.inheritedGateForChildren ?? d.inheritedGateForChildren)() }
                         : {}),
+                    ...((ctx.toolSelector?.layers ?? d.parentToolCeiling) !== undefined ? { toolCeiling: (ctx.toolSelector?.layers ?? d.parentToolCeiling) } : {}),
                     ...(autoModeReview !== undefined ? { autoModeReview } : {}),
                 }, { workflowDepth: d.workflowDepth });
             }

package/dist/orchestration/workflow-governance.d.ts

@@ -22,7 +22,7 @@
  */
 import type { Model } from "../internal/llm.js";
 import type { EngineNotice, ImageInput, TaskSpec, ThinkingLevel, WorkflowGovernanceBaseline } from "../core/types.js";
-import { type ReadDenyEntry } from "../tools/fs/read-deny.js";
+import { type ClampValues, type ScriptSeat } from "../core/child-clamp-seats.js";
 /** Thrown when an LLM-authored script picks a `modelName` not in the workflow model allowlist (or no
  *  allowlist is configured). FAIL-CLOSED: a script can only ever name a model the deployment pre-approved. */
 export declare class WorkflowModelNotAllowedError extends Error {
@@ -30,13 +30,22 @@ export declare class WorkflowModelNotAllowedError extends Error {
     readonly code = "workflow.model_not_allowed";
     constructor(modelName: string, reason: string);
 }
+/** The clamp table's script-declarable rows as a script writes them on its spec (mutable members, the shape every other
+ *  spec field has). */
+type ScriptClampSeats = {
+    -readonly [K in ScriptSeat]?: ClampValues[K];
+};
 /**
  * The SAFE fields an LLM-authored workflow script may set per sub-agent — the WORK, never the control plane.
  * `model` is a NAME (string), NOT a `ModelRef`/`Model` object (a `Model` carries
  * `baseUrl`/`headers`/`extraBody` = endpoint + auth-header injection). No `modelRole`/`roles` (a `roles.select`
  * conditional selector is its own vector). The engine resolves `modelName` against the allowlist.
+ *
+ * The TIGHTEN-ONLY declarations a script may make are the clamp table's script-declarable rows (`ScriptSeat`), typed off
+ * the table (`ClampValues`: a restricting row as its restricting value only, an add-only row as its list) — never a second
+ * list here.
  */
-export interface WorkflowAgentSpec {
+export interface WorkflowAgentSpec extends ScriptClampSeats {
     objective: string;
     /**
      * The canonical spelling, and the only one this type expresses. At RUNTIME the spec ALSO accepts
@@ -58,28 +67,6 @@ export interface WorkflowAgentSpec {
         maxTokens?: number;
         maxCostUsd?: number;
     };
-    /**
-     * design/199 件A, TIGHTEN-ONLY: `"roots"` — the read-face containment judgment — is the ONLY value a
-     * script may set. `"open"` is the WIDENING direction (it removes the containment step), so it is
-     * stripped and announced rather than applied; the type states the asymmetry, and
-     * {@link pickWhitelist} enforces it on the untrusted value.
-     */
-    readFace?: "roots";
-    /**
-     * TIGHTEN-ONLY, the write seat's twin of {@link readFace}: `"roots"` — the write-face containment
-     * judgment — is the ONLY value a script may set. `"open"` is the WIDENING direction, so it is
-     * stripped and announced rather than applied.
-     */
-    writeFace?: "roots";
-    /**
-     * design/199 件B, TIGHTEN-ONLY: additional read-deny entries. Add-only at every layer a governed
-     * SCRIPT can reach: the baseline's entries and the deployment-ACTIVE built-in set are always in
-     * force and a script cannot remove or replace them (`compileReadDeny` treats additions as
-     * add-only; `tightenTaskSpec` unions). Which built-in tiers are active is a DEPLOYMENT seat
-     * (#245: `readDenyBuiltinTiers`/`readDenyBuiltinExclude` on RunnerDeps) that no script-side key
-     * reaches — so anything a script writes here can only ever narrow what the child may read.
-     */
-    readDenyPatterns?: readonly ReadDenyEntry[];
 }
 /**
  * The SINGLE source of truth for the whitelist (a test pins that it contains no control-plane key). `objective`
@@ -96,8 +83,16 @@ export interface WorkflowAgentSpec {
  * instead of evaporating. Turning the strip into a LOUD REFUSAL that fails the spawn is a deliberate
  * NON-GOAL of this window: it would break every existing script carrying a harmless extra field, and is held
  * for a BREAKING window.
+ *
+ * The TIGHTEN-ONLY half is DERIVED: every clamp-table row a script may declare (`SCRIPT_SEATS` — the rows whose `script`
+ * law is not `false`). Those declarations carry no capability — everything they can express makes the child strictly
+ * more restricted — and each is re-checked by `tightenTaskSpec`'s own tighten-only merge below; stripping them made a
+ * governed script's protective intent evaporate silently, the one direction a default-deny seam has no reason to block.
+ * Each crosses under its row's law, by VALUE in {@link pickWhitelist}, not by key: a restricting row only as its
+ * restricting value, an add-only row through the row's script and entry laws. A row marked inherited-only (its
+ * restricting value switches off an operator-side record) is outside this set and is stripped like any other key.
  */
-export declare const WHITELIST_KEYS: readonly ["objective", "modelName", "thinking", "systemPrompt", "images", "limits", "readFace", "writeFace", "readDenyPatterns"];
+export declare const WHITELIST_KEYS: readonly ("thinking" | "systemPrompt" | "objective" | "images" | "limits" | ScriptSeat | "modelName")[];
 /**
  * #505 ② — ACCEPTED ALIAS SPELLINGS on the spec: `alias → the {@link WHITELIST_KEYS} member it means`.
  *
@@ -244,3 +239,4 @@ export declare function resolveModelName(name: string, allowlist: string[] | und
  * sink can turn an announcement into a failed spawn.
  */
 export declare function buildGovernedChildSpec(scriptSpec: unknown, baseline: WorkflowGovernanceBaseline, models: Record<string, Model> | undefined, caps?: WorkflowChildCaps, onResourceClamp?: (notes: ResourceClampNote[]) => void, onNotice?: (n: EngineNotice) => void): TaskSpec;
+export {};

package/dist/orchestration/workflow-governance.js

@@ -1,7 +1,7 @@
 import { deliverEngineNotice } from "../core/types.js";
 import { tightenTaskSpec } from "../core/tighten-task-spec.js";
 import { sanitizeUntrustedText } from "../core/untrusted-text.js";
-import { compileReadDeny } from "../tools/fs/read-deny.js";
+import { CLAMP_SET, SCRIPT_SEATS } from "../core/child-clamp-seats.js";
 import { WorkflowScriptError } from "./workflow-meta.js";
 import { uuidv7 } from "../engine/session/uuid.js";
 import { retiredCheckpointStoreNull } from "../core/checkpoint-store.js";
@@ -15,18 +15,13 @@ export class WorkflowModelNotAllowedError extends Error {
         this.name = "WorkflowModelNotAllowedError";
     }
 }
-export const WHITELIST_KEYS = Object.freeze([
-    "objective",
-    "modelName",
-    "thinking",
-    "systemPrompt",
-    "images",
-    "limits",
-    "readFace",
-    "writeFace",
-    "readDenyPatterns",
-]);
+const WORK_FIELD_KEYS = ["objective", "modelName", "thinking", "systemPrompt", "images", "limits"];
+export const WHITELIST_KEYS = Object.freeze([...WORK_FIELD_KEYS, ...SCRIPT_SEATS]);
 const WHITELIST_KEY_SET = new Set(WHITELIST_KEYS);
+const RESTRICTING_SCRIPT_VALUES = SCRIPT_SEATS.flatMap((seat) => {
+    const row = CLAMP_SET[seat];
+    return row.law === "restricting" ? [`${seat}: ${JSON.stringify(row.value)}`] : [];
+}).join(", ");
 export const SPEC_KEY_ALIASES = new Map([["model", "modelName"]]);
 export const STRIPPED_KEYS_NOTICE_CODE = "workflow.governance_key_stripped";
 const MAX_STRIPPED_KEYS_ANNOUNCED = 20;
@@ -48,8 +43,8 @@ function emitStrippedKeysNotice(survey, onNotice) {
     const omitted = survey.total - shown.length;
     const list = shown.map((s) => JSON.stringify(s.key)).join(", ") + (omitted > 0 ? `, +${omitted} more` : "");
     const message = `workflow governance: ${survey.total} field(s) of an agent spec were NOT applied to the child (${list}). ` +
-        `A governed workflow script may set only: ${WHITELIST_KEYS.join(", ")} — and \`readFace\`/\`writeFace\` only as "roots" ` +
-        `(the containment-tightening direction; "open" widens and is never taken from a script). Every other field ` +
+        `A governed workflow script may set only: ${WHITELIST_KEYS.join(", ")} — and each tighten-only seat only in its ` +
+        `tightening direction (${RESTRICTING_SCRIPT_VALUES}; the list seats only add entries). Every other field ` +
         `of the child comes from the deployment baseline.`;
     try {
         deliverEngineNotice(onNotice, {
@@ -142,25 +137,7 @@ function pickImageInput(el, i) {
     }
     return { data, mimeType };
 }
-const MAX_SCRIPT_DENY_ENTRIES = 16;
-const MAX_SCRIPT_DENY_PATTERN_CHARS = 256;
-const MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT = 1;
 const MAX_SCRIPT_IMAGES = 32;
-function assertScriptDenyPatternBounded(pattern, at) {
-    if (pattern.length > MAX_SCRIPT_DENY_PATTERN_CHARS) {
-        throw new WorkflowScriptError(`${at} is ${pattern.length} characters — a workflow script's deny pattern is limited to ${MAX_SCRIPT_DENY_PATTERN_CHARS} (the matcher runs on every read of the child's run).`);
-    }
-    for (const segment of pattern.split("/")) {
-        const wildcards = segment.split("*").length - 1;
-        if (wildcards > MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT) {
-            throw new WorkflowScriptError(`${at} has a path segment with ${wildcards} \`*\` wildcards — a workflow script's deny pattern allows at most ` +
-                `${MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT} per path segment (the same expressiveness the engine's built-in deny table ` +
-                `uses). Each \`*\` compiles to a greedy match, and more than one in a single segment makes the judgment cost grow ` +
-                `superlinearly with the path length, on every read the child performs. Write the intent as separate entries ` +
-                `(the set is a union, so more entries deny strictly more) or anchor it with literal segments.`);
-        }
-    }
-}
 function mapUntrustedArray(value, at, atMost, why, build) {
     const declared = value.length;
     if (typeof declared !== "number" || !Number.isSafeInteger(declared) || declared < 0) {
@@ -174,29 +151,6 @@ function mapUntrustedArray(value, at, atMost, why, build) {
         out.push(build(value[i], i));
     return out;
 }
-function pickReadDenyEntry(el, i) {
-    const at = `agent(spec): \`readDenyPatterns[${i}]\``;
-    if (typeof el === "string") {
-        if (el.length === 0)
-            throw new WorkflowScriptError(`${at} must be a non-empty pattern string`);
-        assertScriptDenyPatternBounded(el, at);
-        return el;
-    }
-    if (typeof el !== "object" || el === null || Array.isArray(el)) {
-        throw new WorkflowScriptError(`${at} must be a pattern string or an object { pattern, caseSensitive? }`);
-    }
-    const o = el;
-    const pattern = o.pattern;
-    const caseSensitive = o.caseSensitive;
-    if (typeof pattern !== "string" || pattern.length === 0) {
-        throw new WorkflowScriptError(`${at}.pattern must be a non-empty string, e.g. ".ssh" or "secrets/*.json"`);
-    }
-    if (caseSensitive !== undefined && typeof caseSensitive !== "boolean") {
-        throw new WorkflowScriptError(`${at}.caseSensitive must be a boolean`);
-    }
-    assertScriptDenyPatternBounded(pattern, at);
-    return caseSensitive === undefined ? { pattern } : { pattern, caseSensitive };
-}
 function pickWhitelist(scriptSpec) {
     if (typeof scriptSpec !== "object" || scriptSpec === null || Array.isArray(scriptSpec)) {
         throw new WorkflowScriptError("agent(spec): spec must be an object with at least an `objective` string");
@@ -279,33 +233,39 @@ function pickWhitelist(scriptSpec) {
         readAxis("maxCostUsd", "spend ceiling");
         safe.limits = limits;
     }
-    for (const faceKey of ["readFace", "writeFace"]) {
-        const declared = s[faceKey];
+    for (const seat of SCRIPT_SEATS) {
+        const row = CLAMP_SET[seat];
+        const declared = s[seat];
         if (declared === undefined)
             continue;
-        if (declared === "roots") {
-            safe[faceKey] = "roots";
-        }
-        else {
-            stripped.total++;
-            stripped.sample.unshift({ key: faceKey, reason: "not_a_tightening_value" });
-            if (stripped.sample.length > MAX_STRIPPED_KEYS_ANNOUNCED)
-                stripped.sample.pop();
-        }
-    }
-    const readDenyPatternsRaw = s.readDenyPatterns;
-    if (readDenyPatternsRaw !== undefined) {
-        if (!Array.isArray(readDenyPatternsRaw)) {
-            throw new WorkflowScriptError('agent(spec): `readDenyPatterns` must be an array of deny entries (a "/"-separated segment run such as ".ssh", or { pattern, caseSensitive? })');
-        }
-        const entries = mapUntrustedArray(readDenyPatternsRaw, "agent(spec): `readDenyPatterns`", MAX_SCRIPT_DENY_ENTRIES, "Every entry is judged against every path the child reads, for the child's whole run; the deployment's own entries, and whichever built-in tiers the deployment has on (by default the credentials and home agent-config tiers), are in force on top of these.", pickReadDenyEntry);
-        try {
-            compileReadDeny(entries, "agent(spec).readDenyPatterns");
+        if (row.law === "restricting") {
+            if (declared === row.value)
+                Object.assign(safe, { [seat]: row.value });
+            else {
+                stripped.total++;
+                stripped.sample.unshift({ key: seat, reason: "not_a_tightening_value" });
+                if (stripped.sample.length > MAX_STRIPPED_KEYS_ANNOUNCED)
+                    stripped.sample.pop();
+            }
+            continue;
         }
-        catch (err) {
-            throw new WorkflowScriptError(thrownText(err));
+        const at = `agent(spec): \`${seat}\``;
+        if (!Array.isArray(declared))
+            throw new WorkflowScriptError(`${at} must be an array of ${row.script.shape}`);
+        const entries = mapUntrustedArray(declared, at, row.script.atMost, row.script.why, (el, i) => {
+            try {
+                return row.script.entry(el, `agent(spec): \`${seat}[${i}]\``);
+            }
+            catch (err) {
+                throw new WorkflowScriptError(thrownText(err));
+            }
+        });
+        for (const entry of entries) {
+            const problem = row.entry(entry, `agent(spec).${seat}`);
+            if (problem !== undefined)
+                throw new WorkflowScriptError(problem);
         }
-        safe.readDenyPatterns = entries;
+        Object.assign(safe, { [seat]: entries });
     }
     const readModelName = (raw, spelling) => {
         if (raw === undefined)

package/dist/orchestration/workflow-primitives.d.ts

@@ -13,10 +13,11 @@
  *    full `TaskSpec` straight through (the author IS the deployment).
  */
 import type { Model } from "../internal/llm.js";
-import type { TaskSpec, WorkflowGovernanceBaseline } from "../core/types.js";
+import type { WorkflowGovernanceBaseline } from "../core/types.js";
 import type { CheckpointStore } from "../core/checkpoint-store.js";
 import type { WorkflowAgentHandle, WorkflowRunContext } from "./workflow.js";
 import type { WorkflowPrimitives } from "./workflow-script-runner.js";
+import { type ChildClampSource } from "../core/child-clamp-seats.js";
 import { type WorkflowChildCaps } from "./workflow-governance.js";
 /** What an LLM-authored workflow needs to GOVERN each spawned sub-agent (design/98 §2.5). */
 export interface WorkflowGovernance {
@@ -42,24 +43,8 @@ export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governa
 /** The host run's RESOLVED checkpoint seat — the store object it parks in, else the word `"disabled"`.
  *  Every agent this workflow spawns inherits it; see the injection below. */
 parentCheckpointStore?: CheckpointStore | "disabled", 
-/** 5.30 merge-rescan (design/199 parity gap) — the host run's RESOLVED read-face containment
- *  (post deps/org/mount resolution, not the raw spec value). `TaskSpec.readFace`'s own JSDoc
- *  promises "roots pins this task, and via the tighten-only clamp, its whole delegation subtree" —
- *  a workflow child is that subtree; the Task/SendMessage delegation lane already carries this,
- *  the workflow lane was the one gap. Lazy (read at spawn time, after prepare has resolved it). */
-parentReadFace?: () => TaskSpec["readFace"], 
-/** The WRITE seat's twin of the above — the host run's RESOLVED write-face containment, folded
- *  stricter-wins into every spawned child on its own seat (the two seats never read each other). */
-parentWriteFace?: () => TaskSpec["writeFace"], 
-/** Twin of the above for the deny-set additions (the extra entries the host's own deployment/task
- *  layers stacked on; the built-in rows the DEPLOYMENT's tier selection activates apply beside them). */
-parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"], 
-/** #345 ③ — the HOST task's write-hands clamp is ON (`spec.handsReadOnly === true`). Injected
- *  tighten-only into every spawned child, like the read-face clamp above; see the injection
- *  below for why it outranks even a `worktreeBase: { handsReadOnly: false }` overlay. */
-parentHandsReadOnly?: boolean, 
-/** #345 ③ — the HOST task's hard-headless clamp is ON (`spec.interactiveTools === false`).
- *  Same tighten-only injection; only the disabling value ever arrives here as `true`. */
-parentInteractiveToolsOff?: boolean, 
-/** The HOST task declared that nobody on it can be asked (`approvalReach: "none"`). Same tighten-only injection. */
-parentApprovalReachNone?: boolean): WorkflowPrimitives;
+/** The host run's tighten-only clamps — every clamp-carrier row of the clamp table as the host holds it (RESOLVED
+ *  faces, the effective deny list, the approval declaration, the write-hands and hard-headless clamps). Lazy: read at
+ *  spawn time, after prepare has resolved them. Injected into every spawned child; see the injection below for why it
+ *  outranks even a `worktreeBase: { handsReadOnly: false }` overlay. */
+parentClamps?: () => ChildClampSource): WorkflowPrimitives;

package/dist/orchestration/workflow-primitives.js

@@ -1,5 +1,5 @@
 import { assertSupportedAgentIsolation } from "./workflow.js";
-import { childClampSeats, postureUnderClamps } from "../core/child-clamp-seats.js";
+import { childClampSeats, foldClampSources, postureUnderClamps } from "../core/child-clamp-seats.js";
 import { WorkflowScriptError } from "./workflow-meta.js";
 import { buildGovernedChildSpec, emitIgnoredAgentOptionsNotice, overlayWorktreeBaseline, MAX_ANNOUNCED_KEYS, SPEC_KEY_ALIASES, WHITELIST_KEYS, } from "./workflow-governance.js";
 const ACCEPTED_AGENT_OPTION_KEYS = ["label", "phase", "schema", "agentType", "isolation"];
@@ -66,7 +66,7 @@ function formatResourceClampNote(notes) {
     const parts = notes.map((n) => `${n.field}: requested ${n.requested === undefined ? "unset" : n.requested} → applied ${n.applied}`);
     return `workflow governance tightened this agent's resource limits (${parts.join("; ")})`;
 }
-export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentCheckpointStore, parentReadFace, parentWriteFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff, parentApprovalReachNone) {
+export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentCheckpointStore, parentClamps) {
     const agent = (spec, opts) => {
         if (typeof spec === "string")
             spec = { objective: spec };
@@ -78,17 +78,10 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentChe
         if (parentCheckpointStore !== undefined && (parentCheckpointStore === "disabled" || childSpec.checkpointStore === undefined)) {
             childSpec.checkpointStore = parentCheckpointStore;
         }
-        const pd = parentReadDenyPatterns?.();
-        const workflowChildClamps = childClampSeats({
-            handsReadOnly: parentHandsReadOnly,
-            interactiveTools: parentInteractiveToolsOff === true ? false : undefined,
-            approvalReach: parentApprovalReachNone === true ? "none" : undefined,
-            readFace: parentReadFace?.() === "roots" ? "roots" : childSpec.readFace,
-            writeFace: parentWriteFace?.() === "roots" ? "roots" : childSpec.writeFace,
-            readDenyPatterns: pd !== undefined && pd.length > 0 ? [...(childSpec.readDenyPatterns ?? []), ...pd] : childSpec.readDenyPatterns,
-        });
+        const hostClamps = parentClamps?.();
+        const workflowChildClamps = childClampSeats(foldClampSources(childSpec, hostClamps));
         Object.assign(childSpec, workflowChildClamps);
-        const posture = postureUnderClamps(childSpec.interactionPosture, { interactiveTools: parentInteractiveToolsOff === true ? false : undefined, approvalReach: parentApprovalReachNone === true ? "none" : undefined });
+        const posture = postureUnderClamps(childSpec.interactionPosture, { interactiveTools: workflowChildClamps.interactiveTools, approvalReach: workflowChildClamps.approvalReach });
         if (posture !== undefined)
             childSpec.interactionPosture = posture;
         if (onAgentSpawn) {

package/dist/orchestration/workflow-types.d.ts

@@ -619,7 +619,7 @@ export declare const WORKFLOW_AGENT_PARKED_ERROR_CODE = "workflow.agent_parked";
  * under the host's forwarded `durableApproval` (the workflow lane's park family, the background delegation's
  * twin): the wa* row records `status:"parked"` + `parkedCheckpointToken`, the journal records the parked leg at
  * its ordinal, and the RUN SUSPENDS — every later spawn is refused with this same error and the run's terminal
- * is this park whatever the script body returns (the team-discussion `teamPause` shape). Nothing after the
+ * is this park whatever the script body returns. Nothing after the
  * parked call runs; the script must not retry it (an identical call parks again). A resume of the run
  * (`resumeFromRunId`) with the host's decision for the token drives the parked child on and the script
  * continues from here; without a decision the ordinal re-parks.