@sema-agent/core 7.49.4 → 7.49.5

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 7.49.5 — 2026-10-13
+
+**Hard-breaking changes (#1701):** none. **Closed sets:** none. **Package exports:** +0 / −0 names (`posixModeBitsMeaningful` lives in `src/core/posix-mode-face.ts` and is not on the package index); member changes, all optional: `vetPeerRegistryDirectory(dir, { platform? })`, `judgePeerRecordFile(stat, selfUid, platform?)`, `new FileDurableRulePartitionProvider(dir, onError, { platform? })`. **Behavior:** on Windows the rule store and the peer registry stop reading the platform's `0o666` as "writable by group or others" — a loosening on exactly one platform, and the one that restores the store's purpose there (open to veto: it departs from "refuse what you cannot prove safe" for that platform); POSIX hosts are unchanged.
+
+### A platform with no POSIX permission bits is not "writable by everyone" (#1701; fix; security fail-open on Windows; hard-breaking: none, open to veto; exports: +0 / −0) (@test @server @cli @client-core)
+
+- **Before (7.49.4 and earlier).** The permission-rule store refused its whole directory when `(mode & 0o022) !== 0` — "writable by group or others" — and loaded ZERO rules. Windows has no POSIX permission bits: Node reports `0o666` for every file and directory there (a directory created with mode `0o700` too), so on a Windows host the check fired on every run. A persisted `deny` / `ask` row never applied (the engine disclosed "loading zero rules" and went on), no `allow` row was read either, the write face refused every write (an "always allow" could not be saved), and the org state file in the same directory was refused with it. The peer registry's directory chain (`vetPeerRegistryDirectory`) and a registration file (`judgePeerRecordFile`) judged the same bits and refused with `group_or_world_writable` on every Windows path. A POSIX host loaded normally.
+- **Now.** ONE predicate, `posixModeBitsMeaningful(platform = process.platform)` (`src/core/posix-mode-face.ts`: `platform !== "win32"`), is read by every site that tests those bits: the store's directory vetting (bucket read, org state read, the write face's lock, the adoption marker writer), the peer registry's chain walk and its file judge, and the execution env's file-mode report (`HAS_POSIX_MODE_FACE`, which already asked this question for itself and now reads the same predicate — no second spelling of the fact). Where the bits are not meaningful the group/other-writable judgment is not made. The owner judgment is unchanged (it was already skipped where `process.getuid` is absent); symlink, not-a-directory, unreadable, checksum and shape refusals are unchanged. On a platform with bits (macOS, Linux) nothing changes: a `0o777` directory is still refused whole. The store says it ONCE per store instance through its existing error disclosure (`onError`): the directory is not checked for being writable by other accounts, this platform reports no POSIX permission bits, so who else can write there is not verified here. The peer registry's two functions are pure verdicts with no disclosure seat; they only skip. There is no ACL-level check (KL-1701-a).
+- **Who needs it.** Every Windows host that persists permission rules (a `deny` / `ask` row, an org snapshot, a rule imported through the consent flow) — until now none of them took part in a decision there.
+- **Who is hurt.** None by design. What changes for a Windows host: persisted rows now take part — `allow` rows silence the asks they were approved to silence, `deny` / `ask` rows apply, org state loads — which is the contract on every other platform. A host that was (unknowingly) running with zero persisted rules will see asks and refusals appear and approved commands stop asking. A directory another Windows account can write to is no longer refused by this check (KL-1701-a).
+- **Compensation.** Nothing to do on POSIX. A Windows deployment that wants the old refusal on a shared machine has no switch for it (the old refusal was this bug, not a policy); restrict the rule directory's ACL to the engine's account.
+- **Consumers.** server / cli / client-core on Windows: the `onError` sink of `FileDurableRulePartitionProvider` now receives one extra sentence per provider instance on win32 (it contains the directory); a host that treats every `onError` line as an error should read this one as a notice. Nothing else on the wire or the card changes.
+- Pins: `test/backlog1701-win32-mode-bits.test.ts` (① the predicate; ② the rule store on a REAL `0o777` directory with the platform injected — win32 loads the deny row, says it once however many reads, says it again per instance, still refuses a symlink / corrupt bucket, the write face and the org read follow it; darwin / linux still refuse whole with no skip notice; a `0o700` darwin directory loads with no notice; a throwing sink changes nothing; ③ the same deny row on the real Runner — win32 refuses the command, a `0o777` darwin directory is the pre-fix reading and runs it; ④ the peer registry — the file judge and the chain walk with a `0o777` ancestor, the other arms unchanged; ⑤ no source file outside the predicate tests those bits without importing it, and the execution env's mode face flips with the platform its module loads under).
+
 ## 7.49.4 — 2026-10-13
 
 **Rebuild of 7.49.3 — no source change.** The npm tarball of 7.49.3 (shasum `77a7fd37…`, now deprecated) carried the `dist/` of 7.49.2: it was published with `--ignore-scripts` from a checkout whose `dist/` had not been rebuilt (the release-candidate build and gates had run on a detached gate copy). None of the four 7.49.3 entries below (#1685, #1691, #1692, #1693) were in that package. 7.49.4 is the same source as tag `v7.49.3` built in the publishing checkout and compared byte-for-byte with the gated dist before publish; every 7.49.3 entry, criterion (`docs/release-criteria/7.49.3.json`) and wire manifest applies to 7.49.4. **Hard-breaking changes:** none. **Closed sets:** none. **Package exports:** +0 / −0 (`npm run handoff:diff v7.49.3 HEAD`). Consumers pinned to 7.49.3 must move to 7.49.4 (@server @cli @web-admin @client-core @test).

package/dist/agents/peer-directory.d.ts

@@ -216,20 +216,25 @@ export type PeerRegistryDirectoryVerdict = {
     path: string;
 };
 /** Vet a registry directory and every ancestor. `uid` defaults to the process uid; on a platform with
- *  no uid (win32) the owner arm is skipped. Refuses on the FIRST failing ancestor (closest first). */
+ *  no uid (win32) the owner arm is skipped. Refuses on the FIRST failing ancestor (closest first).
+ *  `platform` (default: this process's) decides whether the permission bits are judged at all
+ *  ({@link posixModeBitsMeaningful}): where they are not meaningful the group/world-writable arm is skipped,
+ *  and nothing in this verdict says so — the caller that reads it owns any disclosure. */
 export declare function vetPeerRegistryDirectory(dir: string, opts?: {
     uid?: number;
     stopAt?: string;
+    platform?: NodeJS.Platform;
 }): Promise<PeerRegistryDirectoryVerdict>;
 /** §2.1 ③ — the read-side judgment on ONE registration file's stat facts (pure; the reader supplies
  *  the stat): owner must be this uid, mode must carry no group/world write bit, and it must be a
- *  regular file under the read cap. A refused file is skipped LOUDLY by the reader. */
+ *  regular file under the read cap. A refused file is skipped LOUDLY by the reader. The mode arm is judged
+ *  only where `platform` (default: this process's) has permission bits to judge ({@link posixModeBitsMeaningful}). */
 export declare function judgePeerRecordFile(stat: {
     uid?: number;
     mode: number;
     isFile: boolean;
     size: number;
-}, selfUid: number | undefined): {
+}, selfUid: number | undefined, platform?: NodeJS.Platform): {
     ok: true;
 } | {
     ok: false;

package/dist/agents/peer-directory.js

@@ -2,6 +2,7 @@ import { lstat } from "node:fs/promises";
 import { isAbsolute, dirname, resolve as resolvePath } from "node:path";
 import { formatPeerNameRef, mintPeerRef, normalizePeerName, parsePeerNameRef, PEER_REF_RE } from "./cross-session-ref.js";
 import { inlineUntrusted } from "../core/untrusted-text.js";
+import { posixModeBitsMeaningful } from "../core/posix-mode-face.js";
 export const PEER_SESSION_RECORD_SCHEMA_VERSION = 1;
 export const PEER_SESSION_RECORD_MAX_BYTES = 262_144;
 export const PEER_PRESENCE_MAX_CHARS = 120;
@@ -252,6 +253,7 @@ export async function vetPeerRegistryDirectory(dir, opts) {
     if (!isAbsolute(dir))
         return { ok: false, code: "not_absolute", path: dir };
     const uid = opts?.uid ?? (typeof process.getuid === "function" ? process.getuid() : undefined);
+    const judgeModeBits = posixModeBitsMeaningful(opts?.platform);
     const stopAt = opts?.stopAt !== undefined ? resolvePath(opts.stopAt) : undefined;
     let cursor = resolvePath(dir);
     for (;;) {
@@ -271,7 +273,7 @@ export async function vetPeerRegistryDirectory(dir, opts) {
         if (!isRoot) {
             if (uid !== undefined && st.uid !== uid)
                 return { ok: false, code: "foreign_owner", path: cursor };
-            if ((st.mode & 0o022) !== 0)
+            if (judgeModeBits && (st.mode & 0o022) !== 0)
                 return { ok: false, code: "group_or_world_writable", path: cursor };
         }
         if (isRoot)
@@ -279,12 +281,12 @@ export async function vetPeerRegistryDirectory(dir, opts) {
         cursor = parent;
     }
 }
-export function judgePeerRecordFile(stat, selfUid) {
+export function judgePeerRecordFile(stat, selfUid, platform) {
     if (!stat.isFile)
         return { ok: false, code: "not_regular" };
     if (selfUid !== undefined && stat.uid !== undefined && stat.uid !== selfUid)
         return { ok: false, code: "foreign_owner" };
-    if ((stat.mode & 0o022) !== 0)
+    if (posixModeBitsMeaningful(platform) && (stat.mode & 0o022) !== 0)
         return { ok: false, code: "group_or_world_writable" };
     if (stat.size > PEER_SESSION_RECORD_MAX_BYTES)
         return { ok: false, code: "too_large" };

package/dist/core/posix-mode-face.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Does this platform report POSIX permission bits worth judging? Windows' `Stats.mode` is a projection of
+ * the read-only attribute (`0o666` / `0o444`; a directory created with mode `0o700` reads `0o666` too), not
+ * permission bits — so a group/world-writable test over it fires on every file and says nothing about who may
+ * write. Every reader of `mode & 0o022` (and the file-mode report of the execution env) asks THIS predicate,
+ * so a platform never judges a bit it cannot have.
+ *
+ * `platform` is a parameter so a caller can ask about the platform it was told, not only the one it runs on.
+ */
+export declare function posixModeBitsMeaningful(platform?: NodeJS.Platform): boolean;

package/dist/core/posix-mode-face.js

@@ -0,0 +1,3 @@
+export function posixModeBitsMeaningful(platform = process.platform) {
+    return platform !== "win32";
+}

package/dist/engine/execution-env/node-execution-env.js

@@ -9,6 +9,7 @@ import { ExecutionError, err, FileError, ok, toError, } from "../harness/types.j
 import { killProcessTree, shutdownDebug } from "./kill-tree.js";
 import { __resetSecretEnvScrubNoticeAnnouncement, announceSecretEnvScrub, inheritEnvPolicyProblem, inheritedHostEnv, scrubSecretEnv } from "../../core/secret-env.js";
 import { physicalPathOfAsync } from "../../core/physical-path.js";
+import { posixModeBitsMeaningful } from "../../core/posix-mode-face.js";
 import { walkSymlinkChain } from "./symlink-chain.js";
 import { RollingTailBuffer, markTruncated, newStreamCursorState, sliceStreamIncrement, } from "../../core/exec-output-tail.js";
 import { BackgroundShellError } from "../../core/background-shell.js";
@@ -41,7 +42,7 @@ function fileKindFromStats(stats) {
     }
     return undefined;
 }
-const HAS_POSIX_MODE_FACE = process.platform !== "win32";
+const HAS_POSIX_MODE_FACE = posixModeBitsMeaningful();
 function fileInfoFromStats(path, stats) {
     const kind = fileKindFromStats(stats);
     if (!kind) {

package/dist/stores/file/permission-rule-store.d.ts

@@ -113,15 +113,23 @@ export type RuleAdoptionFile = {
 export declare function readRuleAdoptionFile(dir: string): RuleAdoptionFile | undefined;
 /** Atomically publish the adoption marker (same write-temp → fsync → rename discipline as the store). */
 export declare function writeRuleAdoptionFile(dir: string, content: RuleAdoptionFile): void;
+/** What a directory vetting reads from its host. Absent ⇒ this process's platform, and a skipped judgment goes unsaid. */
+interface DirVetting {
+    /** The platform whose permission bits are read (default: this process's — see {@link posixModeBitsMeaningful}). */
+    readonly platform?: NodeJS.Platform;
+    /** Said when the group/other-writable judgment was NOT made because the platform reports no permission bits. */
+    readonly modeBitsUnjudged?: (dir: string) => void;
+}
 /** One principal's rule file. */
 declare class FileDurableRulePartition implements WritableDurableRulePartition {
     private readonly dir;
     private readonly file;
     private readonly acquireWriteLock;
     private readonly onError?;
+    private readonly vetting?;
     readonly durability: StoreDurability;
     readonly fidelity: StoreFidelity;
-    constructor(dir: string, file: string, acquireWriteLock: () => void, onError?: ((message: string) => void) | undefined);
+    constructor(dir: string, file: string, acquireWriteLock: () => void, onError?: ((message: string) => void) | undefined, vetting?: DirVetting | undefined);
     /** Read and validate. Any refusal answers with an empty set AND says so — never a silent empty store. The answer's
      *  sentence names no location ({@link refusalText}); the disclosure that accompanies it does. */
     private read;
@@ -198,9 +206,13 @@ export declare class FileDurableRulePartitionProvider implements DurableRulePart
     private readonly onError?;
     private lock;
     private orgPersistence;
+    /** What every directory vetting of this instance reads; it says an unjudged mode check ONCE per instance. */
+    private readonly vetting;
     constructor(dir: string, onError?: ((message: string) => void) | undefined, opts?: {
         /** The data root whose adoption marker gates construction (design/183 I6). Absent ⇒ no root gate. */
         dataRoot?: string;
+        /** The platform whose permission bits the directory vetting reads. Absent ⇒ this process's platform. */
+        platform?: NodeJS.Platform;
     });
     /** The org partition's durable home in this directory (design/182 §7.4 contract; `org.json`). Shares
      *  this provider's writer lock — an install is a write. */

package/dist/stores/file/permission-rule-store.js

@@ -2,6 +2,7 @@ import { closeSync, constants as FS, existsSync, fsyncSync, lstatSync, mkdirSync
 import { join } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 import { isRuleBehavior } from "../../core/permission-rule-model.js";
+import { posixModeBitsMeaningful } from "../../core/posix-mode-face.js";
 import { PERMISSION_RULE_WRITER, applySyncJoin, applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, unknownRuleWriteDeltaError, } from "../../core/permission-rule-store.js";
 import { canonicalize } from "../../core/canonical-json.js";
 import { BootLock, FileStoreLockError } from "./fs-atomic.js";
@@ -118,13 +119,17 @@ const EMPTY_READ = { rules: [], tombstones: [], rev: 0 };
 function checksumOf(body) {
     return `sha256:${createHash("sha256").update(canonicalize(body), "utf8").digest("hex")}`;
 }
-function unsafeDirFault(dir) {
+function unsafeDirFault(dir, vetting) {
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     const st = lstatSync(dir);
     if (st.isSymbolicLink() || !st.isDirectory())
         return "is a symlink or not a directory";
     if (typeof process.getuid === "function" && st.uid !== process.getuid())
         return "is owned by another user";
+    if (!posixModeBitsMeaningful(vetting?.platform)) {
+        vetting?.modeBitsUnjudged?.(dir);
+        return undefined;
+    }
     if ((st.mode & 0o022) !== 0)
         return `is writable by group or others (mode ${(st.mode & 0o777).toString(8)}) — anyone who can write there can grant themselves permissions`;
     return undefined;
@@ -135,15 +140,18 @@ function assertSafeDir(dir) {
         throw new Error(`permission-rule store directory ${dir} ${fault}; refusing to use it`);
 }
 function refusalText(onError, sentence, location) {
+    discloseTo(onError, `${sentence} (at ${location})`);
+    return `${sentence}. The location is reported to the store's error disclosure (onError), not in this message.`;
+}
+function discloseTo(onError, message) {
     try {
-        onError?.(`${sentence} (at ${location})`);
+        onError?.(message);
     }
     catch {
     }
-    return `${sentence}. The location is reported to the store's error disclosure (onError), not in this message.`;
 }
-function assertSafeDirAtRequest(dir, onError, act) {
-    const fault = unsafeDirFault(dir);
+function assertSafeDirAtRequest(dir, onError, act, vetting) {
+    const fault = unsafeDirFault(dir, vetting);
     if (fault !== undefined)
         throw new Error(refusalText(onError, `the permission-rule store directory ${fault}; refusing to ${act} it`, dir));
 }
@@ -171,13 +179,15 @@ class FileDurableRulePartition {
     file;
     acquireWriteLock;
     onError;
+    vetting;
     durability = "durable";
     fidelity = "json";
-    constructor(dir, file, acquireWriteLock, onError) {
+    constructor(dir, file, acquireWriteLock, onError, vetting) {
         this.dir = dir;
         this.file = file;
         this.acquireWriteLock = acquireWriteLock;
         this.onError = onError;
+        this.vetting = vetting;
     }
     read() {
         const bucket = "this owner's permission-rule bucket";
@@ -185,7 +195,7 @@ class FileDurableRulePartition {
         const unreadable = (sentence, location = this.file) => ({ unreadable: refusalText(this.onError, sentence, location) });
         let raw;
         try {
-            const dirFault = unsafeDirFault(this.dir);
+            const dirFault = unsafeDirFault(this.dir, this.vetting);
             if (dirFault !== undefined)
                 return unreadable(`the permission-rule store directory ${dirFault}; loading zero rules`, this.dir);
             const st = lstatSync(this.file);
@@ -228,11 +238,7 @@ class FileDurableRulePartition {
         return { file: parsed };
     }
     disclose(message) {
-        try {
-            this.onError?.(message);
-        }
-        catch {
-        }
+        discloseTo(this.onError, message);
     }
     screenDurableRows(file) {
         const isSession = (scope) => scope?.kind === "session";
@@ -246,7 +252,7 @@ class FileDurableRulePartition {
         return { rules, tombstones, quarantined };
     }
     write(next) {
-        assertSafeDirAtRequest(this.dir, this.onError, "write through");
+        assertSafeDirAtRequest(this.dir, this.onError, "write through", this.vetting);
         atomicPublish(this.dir, this.file, JSON.stringify({ ...next, checksum: checksumOf(next) }, null, 2));
     }
     async list() {
@@ -392,11 +398,22 @@ export class FileDurableRulePartitionProvider {
     onError;
     lock;
     orgPersistence;
+    vetting;
     constructor(dir, onError, opts) {
         this.dir = dir;
         this.onError = onError;
         if (opts?.dataRoot !== undefined)
             assertAdoptionBootGate(opts.dataRoot, "FileDurableRulePartitionProvider");
+        let said = false;
+        this.vetting = {
+            platform: opts?.platform,
+            modeBitsUnjudged: (where) => {
+                if (said)
+                    return;
+                said = true;
+                discloseTo(this.onError, `the permission-rule store directory is not checked for being writable by other accounts: this platform reports no POSIX permission bits, so who else can write there is not verified here (at ${where})`);
+            },
+        };
     }
     adoptionMarker() {
         const judged = judgeRuleAdoptionFile(this.dir);
@@ -410,13 +427,13 @@ export class FileDurableRulePartitionProvider {
         return this.fileOrgPersistence();
     }
     fileOrgPersistence() {
-        this.orgPersistence ??= new FileOrgRuleStatePersistence(this.dir, this.acquireWriteLock, this.onError);
+        this.orgPersistence ??= new FileOrgRuleStatePersistence(this.dir, this.acquireWriteLock, this.onError, this.vetting);
         return this.orgPersistence;
     }
     acquireWriteLock = () => {
         if (this.lock !== undefined)
             return;
-        assertSafeDirAtRequest(this.dir, this.onError, "write through");
+        assertSafeDirAtRequest(this.dir, this.onError, "write through", this.vetting);
         const lock = new BootLock(join(this.dir, "PERMISSION-RULES-WRITER-LOCK"));
         try {
             lock.acquire();
@@ -437,11 +454,11 @@ export class FileDurableRulePartitionProvider {
                 return this.readOnlySourceView(principalRuleFileName(principal), principalRuleFileName(rec.toPrincipal), "adopted" in adoption || adoption.marker.phase >= 4);
             }
         }
-        return new FileDurableRulePartition(this.dir, join(this.dir, principalRuleFileName(principal)), this.acquireWriteLock, this.onError);
+        return new FileDurableRulePartition(this.dir, join(this.dir, principalRuleFileName(principal)), this.acquireWriteLock, this.onError, this.vetting);
     }
     readOnlySourceView(sourceName, targetName, flipped) {
         const pick = flipped ? targetName : existsSync(join(this.dir, sourceName)) ? sourceName : targetName;
-        return readOnlyRuleStoreView(new FileDurableRulePartition(this.dir, join(this.dir, pick), this.acquireWriteLock, this.onError));
+        return readOnlyRuleStoreView(new FileDurableRulePartition(this.dir, join(this.dir, pick), this.acquireWriteLock, this.onError, this.vetting));
     }
     forLocalOwner() {
         const adoption = this.adoptionMarker();
@@ -451,7 +468,7 @@ export class FileDurableRulePartitionProvider {
                 return this.readOnlySourceView(LOCAL_OWNER_FILE, principalRuleFileName(rec.toPrincipal), "adopted" in adoption || adoption.marker.phase >= 4);
             }
         }
-        return new FileDurableRulePartition(this.dir, join(this.dir, LOCAL_OWNER_FILE), this.acquireWriteLock, this.onError);
+        return new FileDurableRulePartition(this.dir, join(this.dir, LOCAL_OWNER_FILE), this.acquireWriteLock, this.onError, this.vetting);
     }
     dispose() {
         this.lock?.release();
@@ -462,12 +479,14 @@ class FileOrgRuleStatePersistence {
     dir;
     acquireWriteLock;
     onError;
+    vetting;
     file;
     writeChain = Promise.resolve();
-    constructor(dir, acquireWriteLock, onError) {
+    constructor(dir, acquireWriteLock, onError, vetting) {
         this.dir = dir;
         this.acquireWriteLock = acquireWriteLock;
         this.onError = onError;
+        this.vetting = vetting;
         this.file = join(dir, ORG_STATE_FILE);
     }
     readSync() {
@@ -477,7 +496,7 @@ class FileOrgRuleStatePersistence {
         const ioFault = (err) => `could not be read (${err?.code ?? err?.name ?? "unknown"})`;
         let dirFault;
         try {
-            dirFault = unsafeDirFault(this.dir);
+            dirFault = unsafeDirFault(this.dir, this.vetting);
         }
         catch (err) {
             return refuse(`the permission-rule store directory ${ioFault(err)}`, `${this.dir}: ${thrownText(err)}`);
@@ -524,7 +543,7 @@ class FileOrgRuleStatePersistence {
     }
     installOrgStateSync(state) {
         this.acquireWriteLock();
-        assertSafeDirAtRequest(this.dir, this.onError, "write through");
+        assertSafeDirAtRequest(this.dir, this.onError, "write through", this.vetting);
         state = jsonForm(state);
         const cur = this.readSync();
         if (cur !== undefined && state.revisionHighWater < cur.revisionHighWater) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.49.4",
+  "version": "7.49.5",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.49.5.json

@@ -0,0 +1,104 @@
+{
+  "repo": "core",
+  "version": "7.49.5",
+  "from": "40a79ac3341fc6750aae1664c64840a44abaa205",
+  "to": "9ba02c33f3eea253894b0132dca7ed98c390fb08",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 223,
+  "signatures": [
+    {
+      "name": "FileDurableRulePartitionProvider.constructor",
+      "at": [
+        "src/stores/file/permission-rule-store.ts:671"
+      ],
+      "from": [
+        "(dir: string, onError?: (message: string) => void, opts?: { dataRoot?: string; })"
+      ],
+      "to": [
+        "(dir: string, onError?: (message: string) => void, opts?: { dataRoot?: string; platform?: NodeJS.Platform; })"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "param 3 `opts` type widened: { dataRoot?: string; [ -> platform?: NodeJS.Platform; ]}",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "name": "judgePeerRecordFile",
+      "at": [
+        "src/agents/peer-directory.ts:484"
+      ],
+      "from": [
+        "(stat: { uid?: number; mode: number; isFile: boolean; size: number; }, selfUid: number | undefined): { ok: false; code: \"not_regular\" | \"foreign_owner\" | \"group_or_world_writable\" | \"too_large\"; } | { ok: true; }"
+      ],
+      "to": [
+        "(stat: { uid?: number; mode: number; isFile: boolean; size: number; }, selfUid: number | undefined, platform?: NodeJS.Platform): { ok: false; code: \"not_regular\" | \"foreign_owner\" | \"group_or_world_writable\" | \"too_large\"; } | { ok: true; }"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "+optional param `platform?: NodeJS.Platform`",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "name": "vetPeerRegistryDirectory",
+      "at": [
+        "src/agents/peer-directory.ts:452"
+      ],
+      "from": [
+        "(dir: string, opts?: { uid?: number; stopAt?: string; }): Promise<PeerRegistryDirectoryVerdict>"
+      ],
+      "to": [
+        "(dir: string, opts?: { uid?: number; stopAt?: string; platform?: NodeJS.Platform; }): Promise<PeerRegistryDirectoryVerdict>"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "param 2 `opts` type widened: …umber; stopAt?: string; [ -> platform?: NodeJS.Platform; ]}",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.classes",
+      "assertions": [
+        "G1.a",
+        "G2.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "FileDurableRulePartitionProvider"
+    ],
+    "server": [
+      "FileDurableRulePartitionProvider"
+    ],
+    "sdk": [],
+    "note": "scanned cli@7006be65 server@72f3abe9 sdk@f1b30d4 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it. Ledger files (**/docs/core-consumption/**, **/docs/wire-consumption/**, **/*LEDGER*.json) are not evidence of use — server: 2 name(s) matched ONLY in bookkeeping files and were set aside (judgePeerRecordFile, vetPeerRegistryDirectory)"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}