@sema-agent/core 7.48.0 → 7.49.1

package/dist/core/runner/tool-progress-lane.d.ts

@@ -7,19 +7,25 @@
  * opaque here — the runner knows only that it started and has not ended — so this lane runs a slow beat for
  * any in-flight call silent for {@link TOOL_HEARTBEAT_MS}.
  *
- * THE LANE OWNS TIME, the producer owns FACTS. A producer reports what it has seen (the tail, the totals),
- * never how long it has run: `elapsedTimeSeconds` is computed HERE from one origin per call, because the two
- * producers do not start their clocks together — the station registers a call when it ENTERS EXECUTION, a
- * shell command's own clock could only start at its spawn. With two origins a 30 s beat could be followed
- * moments later by a shell tick reporting 1 s, breaking the monotonicity the frame promises.
+ * THE CALLS IN FLIGHT ARE THE LEG'S OCCURRENCES (`tool-occurrence.ts`), not a set of this lane's own: the record
+ * that carries a call's start frame carries its elapsed origin, its silence clock and its wait on the person, so
+ * the beat can never describe a call the frames say ended, nor miss one they say started.
+ *
+ * ONE ORIGIN PER CALL, the producer owns FACTS. A producer reports what it has seen (the tail, the totals),
+ * never how long it has run: `elapsedTimeSeconds` is computed HERE from the occurrence's origin — its
+ * announcement — because a shell command's own clock could only start at its spawn. With two origins a 30 s
+ * beat could be followed moments later by a shell tick reporting 1 s, breaking the monotonicity the frame promises.
  *
  * THE CADENCE HAS ONE ENFORCEMENT POINT, same reason: a producer's timer is a SAMPLING clock, not the
  * contract. `emit` drops a frame landing inside {@link TOOL_PROGRESS_MIN_INTERVAL_MS} of that call's last.
  *
- * ONE RULE FOR THE BEAT: a call is beaten when nothing has been emitted FOR IT for a whole interval,
+ * ONE RULE FOR THE BEAT: a call is beaten when nothing has been heard FROM IT for a whole interval,
  * counting its own start as the first such event — covering both "it only just started" and "the tool
  * already ticks faster than this". The interval is the RUN's, so a first beat lands anywhere in
  * [TOOL_HEARTBEAT_MS, 2 × TOOL_HEARTBEAT_MS): the price of one timer per run, stated rather than hidden.
+ * And the beat reads the one activity fact: when EVERY call in flight is waiting on the person, nothing is
+ * working and nothing is beaten; a call back from the person is heard from at that moment, so its silence
+ * is counted afresh.
  *
  * THE CLOCK IS MONOTONIC: every predicate here is a DIFFERENCE of two readings (is this call due a beat, is
  * this offer inside the floor, how long has it run), and off the wall clock a backward step — NTP, a
@@ -30,6 +36,7 @@
  * every emission is fault-contained. */
 import type { TaskEvent, TaskEventIdentity } from "../types.js";
 import type { ToolProgressLane } from "./contracts.js";
+import { type ToolOccurrenceTable } from "./tool-occurrence.js";
 /** How long a tool call may stay silent before this lane beats for it, in ms. ONE SOURCE, and CC
  *  2.1.259's own per-tool heartbeat interval (`Cct`) — this engine keeps the cadence and folds the beat
  *  into the one progress frame instead of minting a second shape (registered divergence). */
@@ -38,5 +45,6 @@ export declare const TOOL_HEARTBEAT_MS = 30000;
  *  nowhere else so it holds across producers rather than inside each one. */
 export declare const TOOL_PROGRESS_MIN_INTERVAL_MS = 1000;
 /** Build the lane over the run's content pusher (`pushContent` — the ONE seat that puts a frame on this
- *  run's queue and, for a sub-agent, forwards it to the parent's sink) and its identity mint. */
-export declare function createToolProgressLane(push: (e: TaskEvent) => void, ident: () => TaskEventIdentity): ToolProgressLane;
+ *  run's queue and, for a sub-agent, forwards it to the parent's sink), its identity mint and the leg's
+ *  occurrence table (the calls in flight). */
+export declare function createToolProgressLane(push: (e: TaskEvent) => void, ident: () => TaskEventIdentity, occurrences: ToolOccurrenceTable): ToolProgressLane;

package/dist/core/runner/tool-progress-lane.js

@@ -1,8 +1,7 @@
+import { occurrenceClock } from "./tool-occurrence.js";
 export const TOOL_HEARTBEAT_MS = 30_000;
 export const TOOL_PROGRESS_MIN_INTERVAL_MS = 1_000;
-const monotonicNow = () => (typeof performance !== "undefined" ? performance.now() : Date.now());
-export function createToolProgressLane(push, ident) {
-    const inFlight = new Map();
+export function createToolProgressLane(push, ident, occurrences) {
     let timer;
     const arm = () => {
         if (timer !== undefined)
@@ -10,51 +9,43 @@ export function createToolProgressLane(push, ident) {
         timer = setInterval(beat, TOOL_HEARTBEAT_MS);
         timer.unref?.();
     };
+    const disarm = () => {
+        if (timer === undefined)
+            return;
+        clearInterval(timer);
+        timer = undefined;
+    };
+    occurrences.onOpen(arm);
     const emit = (body) => {
-        const now = monotonicNow();
-        let live = inFlight.get(body.toolCallId);
-        if (live === undefined) {
-            live = { toolName: body.toolName, startedAt: now, lastAt: now - TOOL_PROGRESS_MIN_INTERVAL_MS };
-            inFlight.set(body.toolCallId, live);
-            arm();
-        }
-        if (now - live.lastAt < TOOL_PROGRESS_MIN_INTERVAL_MS)
+        const now = occurrenceClock();
+        const unseen = occurrences.get(body.toolCallId) === undefined;
+        const occ = occurrences.ensure({ toolCallId: body.toolCallId, spelledName: body.toolName, args: undefined });
+        if (!unseen && now - occ.lastHeardAt < TOOL_PROGRESS_MIN_INTERVAL_MS)
             return;
-        live.lastAt = now;
+        occurrences.heard(occ.toolCallId);
         try {
-            push({ type: "tool_progress", ...body, elapsedTimeSeconds: Math.floor((now - live.startedAt) / 1000), ...ident() });
+            push({ type: "tool_progress", ...body, elapsedTimeSeconds: Math.floor((now - occ.startedAt) / 1000), ...ident() });
         }
         catch {
         }
     };
     function beat() {
-        const now = monotonicNow();
-        for (const [toolCallId, live] of inFlight) {
-            if (now - live.lastAt < TOOL_HEARTBEAT_MS)
+        const now = occurrenceClock();
+        const inFlight = occurrences.live().filter((o) => o.beating);
+        if (inFlight.length === 0)
+            return disarm();
+        if (inFlight.every((o) => o.awaitingUser > 0))
+            return;
+        for (const o of inFlight) {
+            if (now - o.lastHeardAt < TOOL_HEARTBEAT_MS)
                 continue;
-            emit({ toolCallId, toolName: live.toolName });
+            emit({ toolCallId: o.toolCallId, toolName: o.spelledName });
         }
     }
-    const disarm = () => {
-        if (timer === undefined)
-            return;
-        clearInterval(timer);
-        timer = undefined;
-    };
     return {
         emit,
-        noteStart(toolCallId, toolName) {
-            const startedAt = monotonicNow();
-            inFlight.set(toolCallId, { toolName, startedAt, lastAt: startedAt });
-            arm();
-        },
-        noteEnd(toolCallId) {
-            inFlight.delete(toolCallId);
-            if (inFlight.size === 0)
-                disarm();
-        },
         clear() {
-            inFlight.clear();
+            occurrences.quiesce();
             disarm();
         },
     };

package/dist/core/runner/tool-turn-repair-seat.d.ts

@@ -1,15 +1,39 @@
 import type { EngineNotice } from "../engine-notice.js";
-import { type ToolTurnIncompleteCause, type ToolTurnRepair } from "../../internal/llm.js";
+import { type ToolTurnRepair } from "../../internal/llm.js";
 /** The notice's attribution ids — the same pair, for the same reason, as the fold seat's. */
 export interface ToolTurnRepairSeatIds {
     sessionId: string;
     runId: string;
 }
+/** What the message says became of a turn that dropped calls: the run ended on it (`model_output_invalid`), or the next
+ *  request asks the model to re-issue them. */
+export type ToolTurnOutcome = "terminal" | "reissued";
+/** One thing the person is told, per cause. A dropped-call cause carries the outcome when its message states one (else
+ *  `undefined`: nothing is said about the run's fate); the others have none. */
+export type ToolTurnIncompleteItem = {
+    cause: "truncated";
+    count: number;
+    outcome: ToolTurnOutcome | undefined;
+} | {
+    cause: "unnamed";
+    count: number;
+    outcome: ToolTurnOutcome | undefined;
+} | {
+    cause: "bad_frame";
+    count: number;
+} | {
+    cause: "missing_result_synthesized";
+    count: number;
+    toolCallIds: readonly string[];
+};
+/** Does a turn's content carry a tool call? A tool-calling turn GUARANTEES a next request (its results go back to the
+ *  model): the engine's one continuation fact — the harness's boundary gates and the dropped-call line read it here. */
+export declare function turnCarriesToolCall(content: unknown): boolean;
 /** The person's line for one cause — once per run per cause, whichever observer saw it first. */
 export interface ToolTurnIncompleteSeat {
-    /** Announce `count` items of `cause` (and, for a missing result, the calls) unless this run already said it. */
-    announce(cause: ToolTurnIncompleteCause, count: number, toolCallIds?: readonly string[]): void;
-    /** Observe one assistant message: announces each stream drop it reports (`streamDropsOf`). */
+    /** Announce `item` unless this run already said its cause. */
+    announce(item: ToolTurnIncompleteItem): void;
+    /** Observe one assistant message: announces each stream drop it reports (`streamDropsOf`), worded by what became of the turn. */
     observe(message: {
         readonly diagnostics?: unknown;
     }): void;

package/dist/core/runner/tool-turn-repair-seat.js

@@ -1,6 +1,8 @@
 import { deliverEngineNotice } from "../engine-notice.js";
 import { isProviderEchoShape } from "../../brain/errors.js";
 import { streamDropsOf } from "../../internal/llm.js";
+import { readMember } from "../thrown-value.js";
+import { modelOutputInvalidOfMessage } from "./terminal-account.js";
 const FORM_SENTENCE = {
     trailing_text: "a block after an assistant's tool calls was moved ahead of them",
     late_result: "a result recorded later was moved up behind its call",
@@ -9,30 +11,51 @@ const FORM_SENTENCE = {
     duplicate_call: "a second call with the same id in one assistant message was left out (its results answer the first)",
     orphan_result: "a result that answers no call before it was left out",
 };
+const afterDroppedCalls = (outcome) => outcome === "reissued" ? "; the model was asked to re-issue them" : outcome === "terminal" ? "; the run ended with this turn (model_output_invalid)" : "";
 const INCOMPLETE_SENTENCE = {
-    truncated: (n) => `${n} tool call(s) the model made were cut off before their arguments were complete, so they did not run; the model was asked to re-issue them`,
-    unnamed: (n) => `${n} tool call(s) the model made arrived with no tool name, so they did not run; the model was asked to re-issue them`,
-    bad_frame: (n) => `${n} frame(s) of the model's streamed response could not be read and were dropped, so the response may be missing content; the model was told`,
-    missing_result_synthesized: (n) => `${n} earlier tool call(s) have no recorded result, so the model was told their outcome is unknown`,
+    truncated: (i) => `${i.count} tool call(s) the model made were cut off before their arguments were complete, so they did not run${afterDroppedCalls(i.outcome)}`,
+    unnamed: (i) => `${i.count} tool call(s) the model made arrived with no tool name, so they did not run${afterDroppedCalls(i.outcome)}`,
+    bad_frame: (i) => `${i.count} frame(s) of the model's streamed response could not be read and were dropped, so the response may be missing content; the model was told`,
+    missing_result_synthesized: (i) => `${i.count} earlier tool call(s) have no recorded result, so the model was told their outcome is unknown`,
 };
+export function turnCarriesToolCall(content) {
+    try {
+        return Array.isArray(content) && content.some((c) => c?.type === "toolCall");
+    }
+    catch {
+        return false;
+    }
+}
+function outcomeOf(message) {
+    const stop = readMember(message, "stopReason");
+    if (stop === "error")
+        return modelOutputInvalidOfMessage(message) !== undefined ? "terminal" : undefined;
+    if (stop === "aborted")
+        return undefined;
+    return turnCarriesToolCall(readMember(message, "content")) || stop === "toolUse" || stop === "length" ? "reissued" : undefined;
+}
 export function createToolTurnIncompleteSeat(onNotice, ids) {
     const announced = new Set();
-    const announce = (cause, count, toolCallIds) => {
-        if (announced.has(cause))
+    const announce = (item) => {
+        if (announced.has(item.cause))
             return;
-        announced.add(cause);
-        const shown = (toolCallIds ?? []).filter((id) => isProviderEchoShape(id));
+        announced.add(item.cause);
+        const shown = "toolCallIds" in item ? item.toolCallIds.filter((id) => isProviderEchoShape(id)) : [];
         deliverEngineNotice(onNotice, {
             code: "task.tool_turn_incomplete",
-            message: `${INCOMPLETE_SENTENCE[cause](count)}. Announced once per run for this cause.`,
-            detail: { cause, count, ...(shown.length > 0 ? { toolCallIds: shown } : {}), sessionId: ids.sessionId, runId: ids.runId },
+            message: `${INCOMPLETE_SENTENCE[item.cause](item)}. Announced once per run for this cause.`,
+            detail: { cause: item.cause, count: item.count, ...("outcome" in item && item.outcome !== undefined ? { outcome: item.outcome } : {}), ...(shown.length > 0 ? { toolCallIds: shown } : {}), sessionId: ids.sessionId, runId: ids.runId },
         });
     };
     return {
         announce,
         observe(message) {
-            for (const drop of streamDropsOf(message))
-                announce(drop.cause, drop.count);
+            const drops = streamDropsOf(message);
+            if (drops.length === 0)
+                return;
+            const outcome = outcomeOf(message);
+            for (const drop of drops)
+                announce(drop.cause === "bad_frame" ? { cause: "bad_frame", count: drop.count } : { cause: drop.cause, count: drop.count, outcome });
         },
     };
 }
@@ -42,7 +65,7 @@ export function createToolTurnRepairSeat(onNotice, ids) {
     return (repairs) => {
         const missing = repairs.filter((repair) => repair.form === "missing_result" && repair.beforeRun !== true).flatMap((repair) => repair.toolCallIds);
         if (missing.length > 0)
-            incomplete.announce("missing_result_synthesized", missing.length, missing);
+            incomplete.announce({ cause: "missing_result_synthesized", count: missing.length, toolCallIds: missing });
         const fresh = repairs.filter((repair) => {
             const key = `${repair.form}\u0000${[...repair.toolCallIds].sort().join("\u0000")}`;
             if (announced.has(key))

package/dist/core/runner/turn-attachments.d.ts

@@ -983,7 +983,7 @@ export declare const MCP_INSTRUCTIONS_MAX_CHARS: number;
  * re-derived here. The earlier shape did re-derive it — a local `sanitizeUntrustedText` pre-pass with
  * the DEFAULT (reminder-only) tag set, measured against the cap — and that mirror silently stopped
  * matching once the fence widened its neutralization to the whole authority-envelope family: each
- * widened-family tag occurrence adds a ZWSP the pre-count never saw, so a server could land its text
+ * widened-family tag occurrence adds an entity the pre-count never saw, so a server could land its text
  * in the `(cap − N, cap]` window and get the body clipped with the honesty note withheld, N being its
  * own choice of tag count. One measurement, taken where the cut happens, is the only shape that cannot
  * drift.

package/dist/core/runner/write-protection-station.d.ts

@@ -22,20 +22,32 @@
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RunnerDeps } from "../runner-deps.js";
+import type { TaskSpec } from "../task-spec.js";
 import type { ToolRoster } from "../tool-roster.js";
+import type { ToolPolicy } from "../tool-policy.js";
 import { type WriteProtectionMount } from "../write-protect.js";
 import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
-/** The leg's mount plus the same judge over a bare ABSOLUTE target — what the shell station asks about each write target
- *  a command names (`ShellReadBoundary.writeProtectionJudge`): `true` ⇔ a row covers it. */
-export interface LegWriteProtection extends WriteProtectionMount {
-    readonly judgeTarget: NonNullable<ShellReadBoundary["writeProtectionJudge"]>;
+/** The leg's write judgment, read by its two readers: the gate's tighten over the always-on table (`mount`, absent when that
+ *  table is empty) and the shell station's ONE question about each write target a command names (`judgeWriteTarget`, over
+ *  the table and the chain's guarded write rows together; absent when neither has a row). */
+export interface LegWriteProtection {
+    readonly mount: WriteProtectionMount | undefined;
+    readonly judgeWriteTarget: ShellReadBoundary["writeTargetJudge"];
+}
+/** The leg's write-guard seats: its one exempt root (the leg's single resolution of `RunnerDeps.memoryEngineDir`, the same
+ *  list every policy adjudication of the leg is stamped with) and the chain policies' guarded write rows. */
+export interface LegWriteGuard {
+    readonly exemptRoots: readonly string[];
+    readonly rows: ToolPolicy["writeGuardRows"];
 }
 export declare function mountWriteProtection(input: {
     /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
-     *  table, `[]` ⇒ opted out), the data root the memory library is materialized under
-     *  (`memoryEngineDir`; absent ⇒ the resolver's env/default chain), the configuration root the host
-     *  declared (`agentConfigDir`) and the operator sink. */
-    deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "agentConfigDir" | "onNotice">;
+     *  table, `[]` ⇒ opted out), the configuration root the host declared (`agentConfigDir`) and the operator sink. */
+    deps: Pick<RunnerDeps, "writeProtectedPaths" | "agentConfigDir" | "onNotice">;
+    /** borrowed-readonly — the leg's one exempt root and the chain's guarded write rows ({@link LegWriteGuard}). */
+    guard: LegWriteGuard;
+    /** borrowed-readonly — the request's own rows (already judged at the task layer's door). */
+    spec: Pick<TaskSpec, "writeProtectedAdditions">;
     /** The HANDS' environment, or `undefined` with no hands — the driver's own predicate, not a second
      *  reading of the env seats, so the judge sees exactly the environment the write tools do. */
     env: ExecutionEnv | undefined;
@@ -45,4 +57,4 @@ export declare function mountWriteProtection(input: {
     roster: ToolRoster;
     sessionId: string;
     runId: string;
-}): LegWriteProtection | undefined;
+}): LegWriteProtection;

package/dist/core/runner/write-protection-station.js

@@ -1,11 +1,13 @@
 import { deliverEngineNotice } from "../engine-notice.js";
+import { unionAddOnly } from "../child-clamp-seats.js";
 import { protectivePathTargetOf } from "../tool-registry.js";
-import { compileWriteProtection, writeProtectionMountOver } from "../write-protect.js";
+import { compileLegWriteJudgment, resolveWriteProtectedTable, writeProtectionMountOver } from "../write-protect.js";
 const ABSENCE_REASON = { symlink: "unresolved-symlink", target: "unresolvable-target" };
 export function mountWriteProtection(input) {
     const announced = new Set();
-    const matcher = compileWriteProtection(input.deps.writeProtectedPaths, {
-        ...(input.deps.memoryEngineDir !== undefined ? { dataRoot: input.deps.memoryEngineDir } : {}),
+    const judgment = compileLegWriteJudgment(unionAddOnly("writeProtectedAdditions", resolveWriteProtectedTable(input.deps.writeProtectedPaths), input.spec.writeProtectedAdditions), {
+        exemptRoots: input.guard.exemptRoots,
+        ...(input.guard.rows !== undefined ? { guardRows: input.guard.rows } : {}),
         ...(input.deps.agentConfigDir !== undefined ? { agentConfigDir: input.deps.agentConfigDir } : {}),
         ...(input.env !== undefined ? { env: input.env } : {}),
         rootPath: input.rootPath,
@@ -15,22 +17,23 @@ export function mountWriteProtection(input) {
                 return;
             announced.add(reason);
             deliverEngineNotice(input.deps.onNotice, {
-                code: "config.write_protection_unresolved",
-                message: `This run's write-protection judge could not resolve a write target in its execution environment ` +
-                    `(${reason === ABSENCE_REASON.symlink ? "a symlink whose real target is unknowable" : "the environment refused or errored on the spelling"}: ${absence.cause}). ` +
-                    `A view that cannot answer does not vote, so that write was judged by its SPELLING against the table and nothing else — ` +
-                    `a target reaching a protected path only through an alias, a bind mount or a ".." walk is cleared. Nothing about this run was ` +
-                    `refused because of it, and nothing here is a defect in the write itself: an environment that cannot answer path questions is a ` +
-                    `deployment fact. Announced once per leg per reason; later writes of the same shape are judged the same way, silently.`,
+                code: "config.path_view_unresolved",
+                message: `This run's write-protection judge did not get an answer from its execution environment for one lookup of a write's judgment ` +
+                    `(${reason === ABSENCE_REASON.symlink ? "a symlink whose real target is unknowable" : "the environment refused, errored or did not answer in time"}: ${absence.cause}). ` +
+                    `A write whose target's real destination (or link chain) could not be determined is refused where the table has rows — the ` +
+                    `table cannot say it is not a protected path; a root whose key did not come back exempts and places nothing; guarded write rows ` +
+                    `a deployment's policy did not return are held, so the writes they could guard are not placed. Every row a source that did ` +
+                    `answer met stays met. An environment that cannot answer path questions is a deployment fact: fix the environment (or the ` +
+                    `link) and the same writes are judged again. Announced once per leg per reason; later writes of the same shape are judged ` +
+                    `the same way, silently.`,
                 detail: { reason, cause: absence.cause, sessionId: input.sessionId, runId: input.runId },
             });
         },
     });
-    if (matcher === undefined)
-        return undefined;
-    const mount = { ...writeProtectionMountOver(matcher, input.rootPath), judgeTarget: async (target, opts) => (await matcher.judge(target, { ...(opts?.signal !== undefined ? { signal: opts.signal } : {}), ...(opts?.canonical === true ? { canonical: true } : {}) })).kind === "hit" };
-    if (mount.targetView !== "spelling-only")
-        return mount;
+    const matcher = judgment.matcher;
+    const leg = { mount: matcher === undefined ? undefined : writeProtectionMountOver(matcher, input.rootPath), judgeWriteTarget: judgment.judgeWriteTarget };
+    if (leg.mount === undefined || leg.mount.targetView !== "spelling-only")
+        return leg;
     const covered = input.roster.entries
         .filter((e) => [e.name, ...e.aliases].some((name) => {
         const target = protectivePathTargetOf({ toolName: name, args: {}, face: e.pathTarget !== undefined ? { pathTarget: e.pathTarget } : {} });
@@ -39,7 +42,7 @@ export function mountWriteProtection(input) {
         .map((e) => e.name)
         .sort();
     if (covered.length === 0)
-        return mount;
+        return leg;
     deliverEngineNotice(input.deps.onNotice, {
         code: "config.write_protection_target_view_absent",
         message: `This run mounted path-confinable write tools [${covered.join(", ")}] while its write-protection judge has NO execution environment, ` +
@@ -50,5 +53,5 @@ export function mountWriteProtection(input) {
             `writeProtection.targetView.`,
         detail: { tools: covered, sessionId: input.sessionId, runId: input.runId },
     });
-    return mount;
+    return leg;
 }

package/dist/core/runner-deps.d.ts

@@ -249,8 +249,9 @@ export interface RunnerDeps {
      * approval flows the ordinary ask-resolution chain — classifier, blanket `onAsk`, durable park —
      * with no `requiresRealApproval` mandate). Absent =
      * {@link import("./write-protect.js").WRITE_PROTECTED_DEFAULT_TABLE} (the CC triple verbatim +
-     * the two argued sema rows). This key IS the whole-table escape hatch, deployment seat ONLY (no
-     * TaskSpec twin, no governed-workflow channel): `[]` = no table (explicit and legal); a non-empty
+     * the two argued sema rows). This key IS the whole-table escape hatch, deployment seat ONLY — the
+     * task layer's twin is add-only ({@link TaskSpec.writeProtectedAdditions}: its rows UNION this
+     * table and can remove none), and no governed-workflow channel reaches either: `[]` = no table (explicit and legal); a non-empty
      * list REPLACES the built-in table whole (compose additions as
      * `[...WRITE_PROTECTED_DEFAULT_TABLE, …]`; drop rows by filtering the exported table — the
      * visible/deletable admin face). Bad values refuse loudly at prepare (#123): garbage shapes,
@@ -355,14 +356,6 @@ export interface RunnerDeps {
     memoryCaptureRecordStore?: (plane: {
         controlDir: string;
     }) => import("./memory-engine/layout.js").SessionCaptureRecordStore;
-    /** which occupant of a session id is running now (a purge may delete a session tree and the
-     *  id be handed out again; without this seat a standing opt-out or pollution record binds the NEXT
-     *  occupant too). An opaque token, STABLE for one occupant's life, DIFFERENT for the next, only
-     *  ever compared ({@link import("./memory-engine/layout.js").sessionRecordBindsIncarnation}).
-     *  ABSENT ⇒ records bind by id (the pre-incarnation bytes); an empty or throwing answer reads the same. */
-    memorySessionIncarnation?: (session: {
-        sessionId: string;
-    }) => string | undefined;
     /**
      * design/339 §6.1 — the v3 memory-consolidation switch, threaded verbatim to the engine seat
      * ({@link import("../core/memory-engine/engine.js").MemoryEngineOptions.consolidation} — same
@@ -689,7 +682,8 @@ export interface RunnerDeps {
      * denied capability that the spec explicitly requests refuses the prepare loudly
      * (`config.compliance_denied`, or `config.compliance_required` when the refusal came from the
      * resolver fault rather than an adjudicated posture). `undefined` (no resolver / no posture for
-     * the principal) = no compliance restriction — existing deployments are untouched.
+     * the principal) = no compliance restriction from the deployment — existing deployments are untouched. The run's deny
+     * set is this posture's UNION the request's own denies ({@link TaskSpec.complianceAdditionalDenies}, add-only).
      */
     compliancePostureResolver?: (principal: string | undefined) => import("./compliance.js").CompliancePosture | undefined | Promise<import("./compliance.js").CompliancePosture | undefined>;
     /**
@@ -1031,12 +1025,8 @@ export interface RunnerDeps {
     /** B5/F2 + design/140 §6 1a — the script-persistence / named-registry seam, threaded into the auto-mounted
      *  run_workflow tool: every invocation's resolved script is persisted (iterate via `{scriptPath}`), `{name}`
      *  resolves a saved workflow, and a registration's `defaultArgs` merge under the call-time args. Opt-in
-     *  (absent ⇒ inline `script` + built-in names only). */
+     *  (absent ⇒ inline `script` only — the engine ships no built-in named workflows). */
     workflowScriptStore?: import("../orchestration/workflow-script-store.js").WorkflowScriptStore;
-    /** design/140 §6 1c — `false` removes the BUILT-IN named workflows (`discussion`, …) from the
-     *  auto-mounted run_workflow tool (the `builtinAgents:false` analog; default ON). A deployment
-     *  `workflowScriptStore` registration of the same name shadows a built-in regardless. */
-    builtinWorkflows?: boolean;
     /**
      * design/97 CORE-9 (Part B) — a TRUSTED deployment sink for the steerable handle of every agent an LLM-authored
      * (`run_workflow` tool) workflow spawns. When set, the tool's `agent()` primitive runs each agent STEERABLE and
@@ -1044,12 +1034,12 @@ export interface RunnerDeps {
      * the handle — no host-context leak into the runner); the deployment registers it by `runId`+`label` to route a
      * human/cross-replica steer to `handle.steer(...)`. Unset ⇒ agents run non-steerable (no overhead). Opt-in.
      *
-     * **Interaction with {@link workflowJournalStore}**: a steerable agent runs via
-     * `agentStream`, whose results ARE RECORDED in the journal since 1.355 (complete read-face: the journal
-     * API / diagnostics coordinate show every agent) but are NEVER REPLAYED — `resumeFromRunId` on a
-     * steerable workflow still re-runs agents LIVE (steer input is not deterministic; a cache would replay
-     * a result the operator steered). Pre-1.355 the stream lane recorded NOTHING — with both deps set the
-     * journal read empty on every workflow (the zero-write case), silently.
+     * **Interaction with {@link workflowJournalStore}**: a steerable agent runs via `agentStream`, which reads the
+     * resume journal exactly as the non-steerable lane does — recorded under the same call key, replayed by the same
+     * unchanged-prefix rule. A completed agent a `resumeFromRunId` replays is emitted here as an already-settled
+     * handle: `result()` resolves at once to the journaled result, `steer()` is refused `steering.not_running`.
+     * A result the operator steered replays as what it was — the run's record of the work, like any model answer
+     * that would come out differently if asked again.
      */
     onWorkflowAgentSpawn?: (handle: import("../orchestration/workflow.js").WorkflowAgentHandle) => void;
     /** design/72 §2.2 (B): deployment default for the suspend-loop cap (see `TaskSpec.maxSuspends`).

package/dist/core/secret-env.d.ts

@@ -6,18 +6,25 @@
  * deleted whole, never rewritten; `"all"` and a `string[]` allow list are the caller's explicit alternatives
  * ({@link inheritedHostEnv}). One judgment per variable ({@link classifySecretEnvEntry}), the first rule that answers:
  *   1. exempt — git's environment config and the proxy variables, handed on as written ({@link isExemptEnvName});
- *   2. `exact-name` — a known credential name ({@link CREDENTIAL_ENV_NAMES});
+ *   2. `exact-name` — a known credential name (the vocabulary's exact env names);
  *   3. `prefix-rule` — the OpenTelemetry settings ({@link OTEL_ENV_RE});
  *   4. `namespace-rule` — a credential word as any segment of a name in the engine's own `SEMA_` namespace;
- *   5. `name-rule` — a credential-shaped name ({@link nameIsCredentialShaped}) off {@link NON_SECRET_ENV_EXACT_NAMES};
- *   6. `value-rule` — a value that carries a credential ({@link valueCarriesCredential}).
- * {@link isSecretEnvKey} and {@link scrubSecretEnv} both answer with this one judgment. The exempt families, the
+ *   5. `name-rule` — a credential-shaped name ({@link nameIsCredentialShaped}) off the vocabulary's non-secret exact names;
+ *   6. `value-rule` — a value that carries a credential ({@link looksLikeCredentialValue}).
+ * {@link isSecretEnvKey} and {@link scrubSecretEnv} both answer with this one judgment; rules 2–5 are its name half
+ * ({@link isSensitiveName}), rule 6 its value half, and rule 1 the env-entry exemption read before both. The exempt families, the
  * credential names, the name shape and the value predicate follow the reference implementation's subprocess-env scrub
  * as written, three ways stricter: plural `TOKENS` is a credential word unless a count word touches it, the GitHub
  * token names are not held back from the name shape, and the name shape always runs.
  */
-import type { RedactionConfidence, RedactionSource } from "./arg-summary.js";
+import { type RedactionConfidence, type RedactionSource } from "./credential-vocabulary.js";
 import { type EngineNotice } from "./engine-notice.js";
+/** Does a value carry a credential? A URL userinfo (after every `scheme://`, and a leading `//`) with a password or a
+ *  token-like user; a scheme-less `user:password@host`; a credential assignment; a webhook URL; a Sonar login; a
+ *  private-key header; an `Authorization` header, `token …`, `Bearer …` or `Basic …` with credential-shaped content.
+ *  Reads the first {@link VALUE_SCAN_LIMIT} code units. The value half of the judgment, exported apart from the env
+ *  entry's exemptions ({@link isExemptEnvName}): a caller holding a value that is no environment variable asks this. */
+export declare function looksLikeCredentialValue(value: string): boolean;
 /** Which rule withheld an entry. */
 export type SecretEnvFindingKind = "exact-name" | "name-rule" | "namespace-rule" | "prefix-rule" | "value-rule";
 /** One env entry the `"scrub"` policy withheld (deleted): its name — never its value, so the record is loggable —, the
@@ -28,6 +35,10 @@ export interface SecretEnvFinding {
     confidence: RedactionConfidence;
     source: RedactionSource;
 }
+/** Does `key` name a credential? The name half of the judgment ({@link sensitiveNameKind}), exported apart from the env
+ *  entry's exemptions ({@link isExemptEnvName}): a caller holding a key that is no environment variable (a member of a
+ *  record) asks this, and an exempt name is no exception there. */
+export declare function isSensitiveName(key: string): boolean;
 /** Does the `"scrub"` policy withhold `key`? With `value`, exactly the answer {@link scrubSecretEnv} gives for that
  *  entry; without it, the answer for its name alone (the value rule then has nothing to read). */
 export declare function isSecretEnvKey(key: string, value?: string): boolean;