@sema-agent/core 7.49.4 → 7.50.0

package/dist/tools/fs/repo-map.d.ts

@@ -1,8 +1,9 @@
 import type { AgentTool } from "../../internal/harness-types.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type RootsSeat } from "./safety.js";
-import type { ReadDenyMatcher } from "./read-deny.js";
+import { type ReadDenyMatcher } from "./read-deny.js";
 import type { ContainmentFace } from "./containment-face.js";
+import type { CwdRef } from "./fs-shared.js";
 /** Extract top-level symbol names (deduped, in first-seen order) from source text. A lightweight
  *  comment/docstring state machine skips column-0 declaration-like lines that are really inside a
  *  `/* … *​/` block comment or a Python `"""`/`'''` docstring — otherwise e.g. a module docstring
@@ -14,4 +15,4 @@ import type { ContainmentFace } from "./containment-face.js";
  *  (src/core/auto-promote.ts) consumes it in ESCALATE-ONLY mode — a clean scan contributes nothing;
  *  it can only ever raise an escalation, never clear one. */
 export declare function extractSymbols(text: string): string[];
-export declare function createRepoMapTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: RootsSeat, readDeny?: ReadDenyMatcher, readFace?: ContainmentFace): AgentTool;
+export declare function createRepoMapTool(env: ExecutionEnv, rootCanonical: string, rootsSeat?: RootsSeat, denySeat?: ReadDenyMatcher, readFace?: ContainmentFace, cwdRef?: CwdRef, readAdmission?: (toolCallId: string | undefined, canonicalKey: string) => boolean): AgentTool;

package/dist/tools/fs/repo-map.js

@@ -2,7 +2,10 @@ import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
 import { resolveKey, violationText, violationDetails } from "./safety.js";
 import { buildIgnore, denyWithheldNote, walk, walkIsPartial } from "./search.js";
+import { seatForCall } from "./read-deny.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
+import { pathTargetBaseOf } from "../../core/effective-path-target.js";
+import { pathTargetValue } from "../../core/tool-registry.js";
 const DEFAULT_MAX_CHARS = 16_000;
 const DEFAULT_MAX_FILES = 400;
 const FILE_SCAN_MAX_BYTES = 256 * 1024;
@@ -80,7 +83,8 @@ function rankEntries(a, b) {
         return b.symbols.length - a.symbols.length;
     return a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0;
 }
-export function createRepoMapTool(env, rootCanonical, additionalRoots, readDeny, readFace) {
+export function createRepoMapTool(env, rootCanonical, rootsSeat, denySeat, readFace, cwdRef, readAdmission) {
+    const declaredTarget = toolFace("repo-map").pathTarget;
     return defineTool({
         name: "RepoMap",
         ...toolFace("repo-map"),
@@ -94,12 +98,16 @@ export function createRepoMapTool(env, rootCanonical, additionalRoots, readDeny,
             max_files: Type.Optional(Type.Number({ description: `Max files to scan (default ${DEFAULT_MAX_FILES}).` })),
         }),
         execute: async (args, ctx) => {
+            const readDeny = seatForCall(denySeat, ctx.toolCallId);
+            const additionalRoots = seatForCall(rootsSeat, ctx.toolCallId);
             const a = args;
             const signal = ctx.signal;
             const rootPrefix = rootCanonical.replace(/[\\/]+$/, "") + (rootCanonical.includes("\\") ? "\\" : "/");
             let start = rootCanonical;
-            if (a.path !== undefined) {
-                const r = await resolveKey(env, rootCanonical, a.path, signal, rootCanonical, additionalRoots, undefined, readDeny, readFace);
+            const scopeSpelling = declaredTarget === undefined ? undefined : pathTargetValue(a, declaredTarget);
+            if (scopeSpelling !== undefined) {
+                const baseCwd = pathTargetBaseOf(declaredTarget, { root: rootCanonical, cwd: cwdRef?.current });
+                const r = await resolveKey(env, rootCanonical, scopeSpelling, signal, baseCwd, additionalRoots, readAdmission && ((key) => readAdmission(ctx.toolCallId, key)), readDeny, readFace);
                 if (!r.ok)
                     return errorResult(violationText("RepoMap", r.violation), violationDetails(r.violation));
                 start = r.key;

package/dist/tools/fs/safety.d.ts

@@ -1,3 +1,4 @@
+import { type DenyFace } from "./read-deny.js";
 import { type HomeViewSource } from "./read-deny-home.js";
 import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
@@ -520,12 +521,36 @@ export declare function violationDetails(v: FsViolation): {
     code: "path_not_in_root";
     target: string;
     roots: readonly string[];
-} | {
+} | ReadPathDeniedCard | undefined;
+/** The read face's refusal card: which target, which deny pattern. */
+export type ReadPathDeniedCard = {
     type: "read_path_denied";
     code: "read_path_denied";
     target: string;
     pattern: string;
-} | undefined;
+};
+/**
+ * The ONE mint of the `read_path_denied` card. `type` is the CC_DETAIL_TYPES discriminator, so the refusal's
+ * coordinates reach `tool_end.structured`, not just prose; `code` carries the same value for in-process readers.
+ * Every site that refuses a read on a deny row — the tools' own resolution, the shell station, the gate's rule lanes —
+ * mints it here.
+ */
+export declare function readPathDeniedCard(target: string, pattern: string): ReadPathDeniedCard;
+/**
+ * Where one deny row refused a call: the row's text, the view of the target it met, and the face the call is on.
+ * Minted once, by the judge that found the row; every exit of the gate reads it and judges nothing again.
+ */
+export interface PathDenialEvidence {
+    readonly rule: string;
+    readonly view: string;
+    readonly face: DenyFace;
+}
+/**
+ * The card a gate-side path refusal carries: the read face's own ({@link readPathDeniedCard}); the write face has none
+ * (as in the tools' own resolution, where a write refusal's `write_path_denied` code carries no card). The card's
+ * presence follows the FACE, never the station that refused.
+ */
+export declare function pathDenialCardOf(evidence: PathDenialEvidence | undefined): ReadPathDeniedCard | undefined;
 /**
  * Does `p` sit inside ANY of the canonical containment roots? Exposed for the Bash
  * tool's post-`cd` disclosure note (fs-bash.ts): the note reuses the SAME segment-aware `within`
@@ -534,6 +559,20 @@ export declare function violationDetails(v: FsViolation): {
  * design; fs-bash canonical-confirms before claiming "outside").
  */
 export declare function withinAnyRoot(rootsCanonical: readonly string[], p: string): boolean;
+/**
+ * THE store-isolation rule, one judgment for every root admission point (the Artifact mount over the prepare-time
+ * roots, an in-flight read-root grant over the granted root, a person's read directory where a run's read roots are
+ * read): a root that CONTAINS the local artifact store, lies INSIDE it, or IS it hands the file tools the store's ledger
+ * and stored files. Returns the first such root, or undefined.
+ *
+ * `storePhysical` is the store's physical path on THIS process's filesystem (`physicalPathOfExisting`, resolved
+ * once per run by the Artifact phase); a root is the execution env's canonical key. The judgment touches no
+ * filesystem — the grant runs after the approver's wait under the call's cut, and a synchronous lookup on a stalled
+ * store mount would block the event loop past that cut. The two are compared as identities only when both spell the
+ * same family (`within` reads both under the root's family); a root of the other family names a filesystem the store
+ * cannot be on, and no claim is made against it.
+ */
+export declare function rootAdmittingArtifactStore(storePhysical: string, rootsCanonical: readonly string[]): string | undefined;
 /**
  * The escape-hatch tail for the `path_not_in_root` refusal: like its three sibling hints below, it
  * names a sanctioned next step, so the model does not oscillate between "the boundary is hard" and

package/dist/tools/fs/safety.js

@@ -659,16 +659,25 @@ export function violationText(toolName, v) {
     return `Error (${toolName}): ${v.message}`;
 }
 export function violationDetails(v) {
-    if (v.code === "read_path_denied" && v.target !== undefined && v.pattern !== undefined) {
-        return { type: "read_path_denied", code: "read_path_denied", target: v.target, pattern: v.pattern };
-    }
+    if (v.code === "read_path_denied" && v.target !== undefined && v.pattern !== undefined)
+        return readPathDeniedCard(v.target, v.pattern);
     return v.code === "path_not_in_root" && v.target !== undefined
         ? { type: "path_not_in_root", code: "path_not_in_root", target: v.target, roots: v.roots ?? [] }
         : undefined;
 }
+export function readPathDeniedCard(target, pattern) {
+    return { type: "read_path_denied", code: "read_path_denied", target, pattern };
+}
+export function pathDenialCardOf(evidence) {
+    return evidence?.face === "read" ? readPathDeniedCard(evidence.view, evidence.rule) : undefined;
+}
 export function withinAnyRoot(rootsCanonical, p) {
     return rootsCanonical.some((r) => within(r, p));
 }
+export function rootAdmittingArtifactStore(storePhysical, rootsCanonical) {
+    const storeFamily = pathFamilyOf({ root: storePhysical });
+    return rootsCanonical.find((root) => pathFamilyOf({ root }) === storeFamily && (withinAnyRoot([root], storePhysical) || withinAnyRoot([storePhysical], root)));
+}
 export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access; a deployment that wants reads or writes open everywhere can declare readFace / writeFace: \"open\" instead of listing directories.)";
 export function requireRead(state, key) {
     const entry = state.get(key);

package/dist/tools/fs/shell-read-check.d.ts

@@ -44,6 +44,14 @@ export type ShellReadRefusalDetails = NonNullable<ReturnType<typeof violationDet
 export interface ShellReadVerdict {
     readonly disposition: ShellReadDisposition;
     readonly finding: ShellReadFinding;
+    /** The environment did not answer the judgment — a resolver, a listing or an identity lookup gave no answer, a bound was
+     *  reached, the judge itself did not answer: present on the `unanswered` finding the fold or the fallback gives. The gate
+     *  classes the question as shell text the engine cannot read. */
+    readonly environmentSilent?: true;
+    /** Rows the station's boundary stands on could not be read (`ShellReadBoundary.unreadPartitions`, or a boundary the seat
+     *  could not hand over): present on ANY verdict judged beside them, whatever its finding. The gate classes the question as
+     *  a rule that could not be read. */
+    readonly rowsUnread?: true;
     /** `write` ⇔ the finding is about where the command WRITES — its witness is a write target (a redirection's, or a word
      *  the program's row writes), judged against the write roots. Absent ⇒ a read's finding (or `vouch`). */
     readonly face?: "write";
@@ -146,9 +154,10 @@ export interface ShellReadStationOptions {
     readonly tools: ReadonlySet<string>;
     /** The trust-policy seat a tool is judged on. */
     readonly seatOf: (toolName: string) => ShellReadStationSeat;
-    /** The boundary for a call, read per call (the tracked working directory moves). `undefined` ⇒ no
-     *  boundary declared, nothing to be outside of — the station vouches. */
-    readonly boundaryOf: (toolName: string, cwd: string | undefined) => ShellReadBoundary | undefined;
+    /** The boundary for a call, read per call (the tracked working directory moves; the call's own tables, by its id —
+     *  `undefined` where no call is judged). `undefined` ⇒ no boundary declared, nothing to be outside of — the station
+     *  vouches. */
+    readonly boundaryOf: (toolName: string, cwd: string | undefined, toolCallId: string | undefined) => ShellReadBoundary | undefined;
     /** The listed read verbs (decides whether a segment is read by verb slots or word by word). */
     readonly readers?: ReadonlySet<string>;
     /** `true` ⇔ every root `boundaryOf` returns is already a canonical identity (the Runner's): the station never

package/dist/tools/fs/shell-read-check.js

@@ -286,15 +286,17 @@ function verdictOf(tool, seat, fold, judged, boundary) {
     const paths = outsidePathsOf(judged);
     const unestablished = fold.unestablished === true ? { unestablished: true } : {};
     const writes = fold.witness?.read.candidate.face === "write" ? { face: "write" } : {};
+    const by = fold.finding === "unanswered" ? { environmentSilent: true } : {};
     if (disposition === "refuse") {
         const r = refusalOf(tool, fold, boundary, paths);
-        return { disposition, finding: fold.finding, ...writes, sentence: r.sentence, ...(r.details !== undefined ? { details: r.details } : {}) };
+        return { disposition, finding: fold.finding, ...by, ...writes, sentence: r.sentence, ...(r.details !== undefined ? { details: r.details } : {}) };
     }
     const grant = fold.finding === "outside_roots" ? readRootGrantCandidateOf(judged, boundary) : undefined;
     const containment = fold.finding === "outside_roots" || fold.finding === "unestablishable" || fold.finding === "unanswered";
     return {
         disposition,
         finding: fold.finding,
+        ...by,
         ...writes,
         ...unestablished,
         sentence: findingAccount(fold, boundary),
@@ -404,6 +406,16 @@ export function createShellReadStation(opts) {
         admissions.set(toolCallId, a);
     };
     const memberOf = (call) => readStationMemberOf(call, opts.tools)?.name;
+    const unansweredOver = (toolName, seat, cause, boundary, silence) => {
+        if (boundary === undefined || (boundary !== "unread" && !(anyFaceGuards(boundary) || boundary.writeTargetJudge !== undefined)))
+            return { disposition: "vouch", finding: "none" };
+        const disposition = decideShellRead("unanswered", seat);
+        const account = `${cause}, so where this command reads could not be established ${NOT_AUTO_ALLOWED}`;
+        const details = unestablishedDetails();
+        if (disposition === "refuse")
+            return { disposition, finding: "unanswered", ...silence, sentence: `Error (${toolName}): ${account}. ${BASH_READONLY_CONFINEMENT_NOTE}`, details };
+        return { disposition, finding: "unanswered", ...silence, sentence: account, details };
+    };
     const check = {
         judge(call, args, cwd, signal, callOpts) {
             const member = memberOf(call);
@@ -412,7 +424,7 @@ export function createShellReadStation(opts) {
             const command = shellCommandOf(args);
             if (command === undefined)
                 return null;
-            const boundary = opts.boundaryOf(member, cwd);
+            const boundary = opts.boundaryOf(member, cwd, callOpts.toolCallId);
             if (boundary === undefined)
                 return null;
             const seat = callOpts.seat ?? opts.seatOf(member);
@@ -420,22 +432,23 @@ export function createShellReadStation(opts) {
                 const run = await runShellReadStation(call.toolName, command, boundary, seat, readers, establisherFor(boundary.roots), opts.env, signal);
                 if (run.verdict.disposition !== "refuse" && callOpts.toolCallId !== undefined)
                     remember(callOpts.toolCallId, { toolName: member, boundary: run.boundary, established: run.established, command });
-                return run.verdict;
+                if (boundary.unreadPartitions !== true)
+                    return run.verdict;
+                return run.verdict.disposition === "vouch" ? unansweredOver(call.toolName, seat, "the rules this check stands on could not all be read", boundary, { rowsUnread: true }) : { ...run.verdict, rowsUnread: true };
             })();
         },
         unanswered(call, cause) {
-            const toolName = call.toolName;
-            const member = memberOf(call) ?? toolName;
-            const seat = opts.seatOf(member);
-            const boundary = opts.boundaryOf(member, undefined);
-            if (boundary === undefined || !(anyFaceGuards(boundary) || boundary.writeTargetJudge !== undefined))
-                return { disposition: "vouch", finding: "none" };
-            const disposition = decideShellRead("unanswered", seat);
-            const account = `${cause}, so where this command reads could not be established ${NOT_AUTO_ALLOWED}`;
-            const details = unestablishedDetails();
-            if (disposition === "refuse")
-                return { disposition, finding: "unanswered", sentence: `Error (${toolName}): ${account}. ${BASH_READONLY_CONFINEMENT_NOTE}`, details };
-            return { disposition, finding: "unanswered", sentence: account, details };
+            const member = memberOf(call) ?? call.toolName;
+            const boundary = (() => {
+                try {
+                    return opts.boundaryOf(member, undefined, undefined);
+                }
+                catch {
+                    return "unread";
+                }
+            })();
+            const rowsUnread = boundary === "unread" || boundary?.unreadPartitions === true ? { rowsUnread: true } : {};
+            return unansweredOver(call.toolName, opts.seatOf(member), cause, boundary, { environmentSilent: true, ...rowsUnread });
         },
     };
     const admit = async (toolName, toolCallId, command, signal) => {

package/dist/tools/fs/shell-read-device.d.ts

@@ -5,7 +5,7 @@
  * operand, the content a program writes through an operand, a `git diff` operand) and the shape tier's two readings of "does
  * this redirection write" (the read-only reader, the classify faces' data-free redirections).
  *
- * The table is the reference implementation's own device predicate (CC 2.1.296 `wwe`, cli296.js @18511591): the null
+ * The table is the reference implementation's own device predicate (CC 2.1.296 `wwe` (cli296.js:249645) @18511591): the null
  * device, the three standard streams, the terminal, any `/dev/fd/<digits>`, and `/proc/self/fd/{0,1,2}`. A word is such a
  * spelling AS WRITTEN (quotes removed, nothing folded: `/dev/./null` is a path, not the null device).
  *

package/dist/tools/fs/shell-read-judge.d.ts

@@ -74,7 +74,7 @@ export declare function dispositionOfCell(cell: ShellReadCell, narrowedReadFace:
  *    ask is MANDATED and no automatic lane answers; on the OPEN face (where the station asks only because a deny list has
  *    rows), and for a written target alone (a narrowed WRITE face fences what is written; it is no request to be asked about
  *    every word the floor cannot place), it is the ORDINARY ask — the reference implementation's plain permission ask (CC
- *    2.1.296 `sR`, cli296.js @13116941, reason `other`), which a whole-tool allow (`$pn` @18717070), bypass (`$pn` @18716980)
+ *    2.1.296 `sR` (cli296.js:242691) @13116941, reason `other`), which a whole-tool allow (`N9` (cli296.js:249675) @18717070), bypass (`$pn` (cli296.js:249675) @18716980)
  *    and the auto-mode classifier release and a prefix allow does not.
  *  · `declined` — the one deliberate fail-open of this table: the scan could not read the program bash
  *    will run, or the operands arrive on a stream. On the full shell it is an ORDINARY ask — an answerer
@@ -159,6 +159,10 @@ export interface ShellReadCellContext {
  */
 export interface ShellReadBoundary extends BashReadonlyRootBoundary {
     readonly alsoInside?: (canonicalTarget: string) => Promise<boolean>;
+    /** A partition of the rules the deny seats are compiled from could not be read: a guard of unknown reach. The station
+     *  guards ({@link stationGuards}) and vouches for nothing against this boundary — what it would vouch for is answered as
+     *  a judgment it could not make. */
+    readonly unreadPartitions?: true;
     /** The deny table's WRITE face (`compileWriteDeny`, read-deny.ts): judges a command's write targets (candidates marked
      *  `face: "write"`) and returns the matched row's rule, or null. PRESENT-IFF there is something to judge. */
     readonly writeDenyMatch?: (resolvedPath: string) => string | null;
@@ -303,12 +307,13 @@ export interface JudgedPlan {
 }
 /**
  * Does the station GUARD anything for this boundary — a closed face (roots: containment is what it guards; an absent
- * face reads as roots, as {@link containmentOf} does), or a deny table with rows (`denyMatch` is present exactly then)?
+ * face reads as roots, as {@link containmentOf} does), or a deny table with rows (`denyMatch` is present exactly then),
+ * or rows it could not read (`unreadPartitions`: a guard of unknown reach)?
  * Where it guards nothing (an open face, no deny row), a read it could not establish has nothing to be confirmed
  * against: no finding. The deny judgment itself is untouched (with no row there is nothing to hit). The READ face's
  * question only: a write target folds by {@link writeFaceGuards}.
  */
-export declare function stationGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch">): boolean;
+export declare function stationGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch" | "unreadPartitions">): boolean;
 /**
  * Does the station guard anything on the WRITE face — the same shape for the write seats: the write face in force runs
  * the roots-containment step ({@link skipsRootsContainment}, the structured write tools' reading; absent ⇒ roots), or
@@ -319,7 +324,7 @@ export declare function writeFaceGuards(boundary: Pick<ShellReadBoundary, "write
 /** Does the station guard anything on EITHER face? What a finding about the text's own structure folds by — a text the
  *  lexer could not read, a program it cannot name, program text it does not read, a working directory it lost, a text the
  *  shell re-enters — since what such a text reads AND what it writes are both unknown. */
-export declare function anyFaceGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch" | "writeFace" | "writeDenyMatch">): boolean;
+export declare function anyFaceGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch" | "unreadPartitions" | "writeFace" | "writeDenyMatch">): boolean;
 /** The command-level fold and the finding that produced it. `witness` is absent for `none`; for `declined`
  *  the segment that declined stands in for a candidate. */
 export interface ShellReadFold {

package/dist/tools/fs/shell-read-judge.js

@@ -104,7 +104,7 @@ function judgeWrite(read, boundary) {
     return { read, kind: containment === "outside" && !skipsRootsContainment(boundary.writeFace) ? "outside_roots" : "none", containment };
 }
 export function stationGuards(boundary) {
-    return boundary.face !== "open" || boundary.denyMatch !== undefined;
+    return boundary.face !== "open" || boundary.denyMatch !== undefined || boundary.unreadPartitions === true;
 }
 export function writeFaceGuards(boundary) {
     return !skipsRootsContainment(boundary.writeFace) || boundary.writeDenyMatch !== undefined;

package/dist/tools/loop-tick.d.ts

@@ -19,9 +19,9 @@ export interface AutonomousLoopPromptOptions {
      */
     pushNotification?: boolean;
 }
-/** CC `FFi` (:205310) — first-tick preamble, DEFAULT variant (steward framing). Verbatim. */
+/** CC 2.1.209 `FFi` (:205310) — first-tick preamble, DEFAULT variant (steward framing). Verbatim through 2.1.259; the reference dropped this preamble from 2.1.278 on. */
 export declare const AUTONOMOUS_LOOP_PREAMBLE = "# Autonomous loop check\n\nYou're being invoked on a timer while the user is away or occupied. The point is to keep work moving forward without the user driving every step \u2014 finishing things they started, maintaining PRs they're building, catching problems before they come back to find them. You're a steward, not an initiator. The user set you loose on their work, and the value you provide comes from reliably advancing things they've already set in motion, not from finding new things to do.\n\nThe key tension to navigate: the user trusts you enough to run autonomously, but that trust is easily lost. Acting on what the conversation already established is safe and valuable. Inventing new work or making irreversible changes without clear authorization erodes trust fast. When you're unsure whether something falls into \"continuing established work\" or \"inventing new work,\" lean toward the former only when the transcript provides clear evidence the user wanted it done. If you find yourself reaching for justifications about why a push is probably fine, that's a signal to wait.\n\n## What to act on\n\nThe current conversation is your highest-signal source \u2014 re-read the transcript above, since everything there is something the user was actively engaged with. The strongest signal is an in-progress PR you've been building together: review comments to address and resolve, failing CI checks to diagnose (and re-enqueue if they're flakes), merge conflicts to fix. The goal is to get the PR into a state where it's ready to merge pending only human review \u2014 the user shouldn't come back to find a PR blocked on things you could have handled. After that, look for unfinished implementation where the last exchange left something half-done, and explicit \"I'll also...\" or \"next I'll...\" commitments the conversation made and didn't honor. Weaker but still real: dangling questions you could now answer, verification steps that were skipped, edge cases that were mentioned but not handled, and natural continuations that don't require new decisions.\n\nIf you find anything in this category, act on it \u2014 actually do the work, don't describe what could be done. Run the tests, don't say \"you could run the tests.\" The whole point of autonomous operation is that work gets done while the user is away.\n\nWhen the conversation transcript has nothing left, the current branch's pull/merge request on the user's SCM is the next-best place to look. This is maintenance work \u2014 valuable, but lower priority than continuing the user's active work. Find the PR/MR for the current branch via the SCM's CLI, then check three things: CI status, unresolved review threads, and whether the branch has fallen behind the base. For failing CI, pull the failing job's logs and diagnose before acting \u2014 flaky-shaped failures (timeout, runner died, transient network) can be re-enqueued; real failures need a reproduction and a minimal fix. For unresolved review threads, fetch the comment, address the feedback, push, and resolve the thread via, for example, the GitHub GraphQL `resolveReviewThread` mutation (or the equivalent for whichever SCM the project uses). Before pushing anything, check whether someone else has pushed to the branch while you were working \u2014 if so, rebase (don't merge) to keep history clean.\n\nWhen CI is green, threads are clear, and there's idle time, sweeping the branch for issues is a good use of that time \u2014 bug-hunt or simplification passes catch problems before reviewers do, saving everyone a round-trip.\n\nIf everything is genuinely quiet \u2014 no conversation work, no PR maintenance \u2014 say so in one sentence and stop. No summary of what you checked, no list of what you might do later. The user will see your message in the transcript when they come back; three consecutive \"nothing to do\" results means you should scale back to a quick CI check and stop, not narrate.\n\n## Repeated invocations\n\nIf you see earlier autonomous checks in this conversation, adjust your scope accordingly. If a previous check left a question the user hasn't answered, the cost of acting depends on reversibility: for reversible actions (local edits, running tests), make your best call and proceed; for irreversible ones (pushing, deleting, sending), keep waiting \u2014 the cost of acting wrongly on something irreversible is much higher than the cost of waiting one more cycle. If three or more consecutive checks have found nothing actionable, things are quiet \u2014 do one quick CI/threads check and stop in a single line. Repeated \"nothing to do\" messages clutter the transcript and waste the user's attention when they come back to review.\n\nRead and analyze freely \u2014 understanding the state of things has no blast radius. Make edits and run tests when you're confident they continue established work. Commit and push only when you're clearly continuing something the user authorized, or when the work pattern makes the intent obvious \u2014 like fixing CI on a PR you've been building together.\n";
-/** CC `w6c` (:205335) — first-tick preamble, PERSISTENT variant. Verbatim. */
+/** CC 2.1.209 `w6c` (:205335) — first-tick preamble, PERSISTENT variant. Verbatim through 2.1.259; dropped from 2.1.278 on. */
 export declare const AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT = "# Autonomous loop check\n\nYou're being invoked on a timer while the user is away or occupied. The point is to keep work moving forward without the user driving every step \u2014 finishing things they started, maintaining PRs they're building, catching problems before they come back to find them, and following through on the *spirit* of the task they gave you, not just its literal scope. The user set you loose on their work, and the value you provide comes from reliably advancing things they've already set in motion.\n\nThe key tension to navigate: the user trusts you enough to run autonomously, but that trust is easily lost. Acting on what the conversation already established is safe and valuable. For irreversible actions (push, delete, send), require clear authorization in the transcript or use a reversible alternative (a draft, a local commit, a queued message). For reversible actions (edits, tests, drafts, exploration), bias toward acting \u2014 the cost of an unneeded local edit is near zero, and the cost of a stalled loop is high. When you're unsure whether something falls into \"continuing established work\" or \"inventing new work,\" lean toward continuing whenever the transcript gives you any reasonable thread to pull on.\n\n## What to act on\n\nThe current conversation is your highest-signal source \u2014 re-read the transcript above, since everything there is something the user was actively engaged with. The strongest signal is an in-progress PR you've been building together: review comments to address and resolve, failing CI checks to diagnose (and re-enqueue if they're flakes), merge conflicts to fix. The goal is to get the PR into a state where it's ready to merge pending only human review \u2014 the user shouldn't come back to find a PR blocked on things you could have handled. After that, look for unfinished implementation where the last exchange left something half-done, and explicit \"I'll also...\" or \"next I'll...\" commitments the conversation made and didn't honor. Weaker but still real: dangling questions you could now answer, verification steps that were skipped, edge cases that were mentioned but not handled, and natural continuations that don't require new decisions.\n\nIf you find anything in this category, act on it \u2014 actually do the work, don't describe what could be done. Run the tests, don't say \"you could run the tests.\" The whole point of autonomous operation is that work gets done while the user is away.\n\nWhen the conversation transcript has nothing left, the current branch's pull/merge request on the user's SCM is the next-best place to look. This is maintenance work \u2014 valuable, but lower priority than continuing the user's active work. Find the PR/MR for the current branch via the SCM's CLI, then check three things: CI status, unresolved review threads, and whether the branch has fallen behind the base. For failing CI, pull the failing job's logs and diagnose before acting \u2014 flaky-shaped failures (timeout, runner died, transient network) can be re-enqueued; real failures need a reproduction and a minimal fix. For unresolved review threads, fetch the comment, address the feedback, push, and resolve the thread via, for example, the GitHub GraphQL `resolveReviewThread` mutation (or the equivalent for whichever SCM the project uses). Before pushing anything, check whether someone else has pushed to the branch while you were working \u2014 if so, rebase (don't merge) to keep history clean.\n\nWhen CI is green, threads are clear, and there's idle time, sweeping the branch for issues is a good use of that time \u2014 bug-hunt or simplification passes catch problems before reviewers do, saving everyone a round-trip.\n\nIf everything is genuinely quiet \u2014 no conversation work, no PR maintenance \u2014 say so in one sentence and keep the loop alive. Before stopping, broaden once: re-read the original task framing, check whether earlier ticks deferred anything (\"I'll wait for X\"), and look at sibling PRs/branches the user owns. Persistence is the point of autonomous mode. Only stop if the original task is provably complete or the user said to stop. (Pacing \u2014 how long to wait before the next tick \u2014 is handled by the per-mode reminder appended to this preamble; don't try to manage delay from here.)\n\n## Repeated invocations\n\nIf you see earlier autonomous checks in this conversation, adjust your scope accordingly. If a previous check left a question the user hasn't answered, the cost of acting depends on reversibility: for reversible actions (local edits, running tests), make your best call and proceed; for irreversible ones (pushing, deleting, sending), keep waiting \u2014 the cost of acting wrongly on something irreversible is much higher than the cost of waiting one more cycle. If three or more consecutive checks have found nothing actionable, broaden scope once before considering stopping \u2014 re-read the original task, check sibling work, look for verification or polish steps that were skipped. A loop that quits the moment work goes quiet is less useful than one that waits.\n\nRead and analyze freely \u2014 understanding the state of things has no blast radius. Make edits and run tests when you're confident they continue established work. Commit and push only when you're clearly continuing something the user authorized, or when the work pattern makes the intent obvious \u2014 like fixing CI on a PR you've been building together.\n";
 /**
  * Resolve a fire-time prompt: if it is one of the two autonomous-loop sentinels, return the tick

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.49.4",
+  "version": "7.50.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -72,6 +72,8 @@
     "handoff:diff": "node scripts/dist-handoff-diff.mjs",
     "post-ship": "node scripts/post-ship.mjs",
     "gate:debts:rc": "node scripts/verify-debts.mjs --rc-gate",
+    "gate:anchor-claims": "node scripts/verify-anchor-claims.mjs",
+    "gate:anchor-claims:rc": "node scripts/verify-anchor-claims.mjs --require-corpus",
     "gate:rulings": "node scripts/rulings-gate.mjs --require-comms",
     "gate:error-surface": "node scripts/verify-error-surface.mjs",
     "gate:criteria": "node scripts/criteria-lint.mjs",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a BREAKING change: name every removed entry in the CHANGELOG's BREAKING lines (what was removed / who is hurt / what to read instead) and update this fixture in the SAME commit. Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2609,
+  "count": 2628,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -216,6 +216,7 @@
     "BeforeWriteHook": "type",
     "BeforeWriteRequest": "interface",
     "BeforeWriteResult": "type",
+    "BoundFileObject": "interface",
     "BoundPathRule": "interface",
     "BoundSkillGrants": "interface",
     "Brain": "interface",
@@ -252,6 +253,7 @@
     "CONSOLIDATION_DRIVER_RUNS_FILE": "variable",
     "CONSOLIDATION_RUN_STOP_REASONS": "variable",
     "CONSOLIDATION_SYSTEM_PROMPT": "variable",
+    "CONSOLIDATION_WRITE_REFUSED_CODE": "variable",
     "CONTRACT_KIT_ENGINE_VERSION": "variable",
     "COORDINATOR_ROLE_PROMPT": "variable",
     "CORRUPT_BODY_FORMS": "variable",
@@ -358,6 +360,9 @@
     "ConsolidationRunReceipt": "interface",
     "ConsolidationRunStopReason": "type",
     "ConsolidationStats": "interface",
+    "ConsolidationWriteGate": "type",
+    "ConsolidationWriteJudge": "type",
+    "ConsolidationWriteTarget": "interface",
     "ConstraintChainEntry": "type",
     "ContainmentFace": "type",
     "ContainmentFaceInputs": "interface",
@@ -591,6 +596,7 @@
     "Hooks": "interface",
     "HostDecider": "type",
     "HostDecisionFacts": "interface",
+    "HumanInputAttachment": "interface",
     "HumanInputDelivery": "type",
     "HumanInputEvent": "type",
     "HumanInputFrame": "interface",
@@ -1660,6 +1666,12 @@
     "UNCOVERED_SEGMENT_REASON_BASELINE": "variable",
     "URL_SAFETY": "variable",
     "USAGE_WINDOW_REAP_MARGIN_MS": "variable",
+    "USER_ATTACHMENTS_MAX": "variable",
+    "USER_ATTACHMENT_KINDS": "variable",
+    "USER_ATTACHMENT_LABEL_MAX": "variable",
+    "USER_ATTACHMENT_OUTCOMES": "variable",
+    "USER_ATTACHMENT_SEAT": "variable",
+    "USER_ATTACHMENT_SUPPLIES": "variable",
     "USER_INPUT_UNDRAINED_CAUSES": "variable",
     "USER_INPUT_UNDRAINED_FAMILIES": "variable",
     "UnarmedDenialLimitFallback": "interface",
@@ -1674,9 +1686,16 @@
     "UsageWindowReading": "interface",
     "UsageWindowRecord": "interface",
     "UsageWindowStore": "interface",
+    "UserAttachment": "type",
+    "UserAttachmentDeclaration": "interface",
+    "UserAttachmentKind": "type",
+    "UserAttachmentObservation": "interface",
+    "UserAttachmentOutcome": "type",
+    "UserAttachmentSupply": "type",
     "UserInputLane": "type",
     "UserInputUndrainedCause": "type",
     "UserMessage": "interface",
+    "UserMessageAttachment": "interface",
     "UserPromptSubmitContext": "interface",
     "UserPromptSubmitResult": "interface",
     "UtilityGate": "type",
@@ -2827,6 +2846,7 @@
     "BeforeWriteHook": "stable",
     "BeforeWriteRequest": "advanced",
     "BeforeWriteResult": "advanced",
+    "BoundFileObject": "internal",
     "BoundPathRule": "advanced",
     "BoundSkillGrants": "advanced",
     "Brain": "stable",
@@ -2863,6 +2883,7 @@
     "CONSOLIDATION_DRIVER_RUNS_FILE": "advanced",
     "CONSOLIDATION_RUN_STOP_REASONS": "advanced",
     "CONSOLIDATION_SYSTEM_PROMPT": "internal",
+    "CONSOLIDATION_WRITE_REFUSED_CODE": "advanced",
     "CONTRACT_KIT_ENGINE_VERSION": "advanced",
     "COORDINATOR_ROLE_PROMPT": "advanced",
     "CORRUPT_BODY_FORMS": "advanced",
@@ -2969,6 +2990,9 @@
     "ConsolidationRunReceipt": "advanced",
     "ConsolidationRunStopReason": "advanced",
     "ConsolidationStats": "internal",
+    "ConsolidationWriteGate": "advanced",
+    "ConsolidationWriteJudge": "advanced",
+    "ConsolidationWriteTarget": "advanced",
     "ConstraintChainEntry": "advanced",
     "ContainmentFace": "stable",
     "ContainmentFaceInputs": "advanced",
@@ -3202,6 +3226,7 @@
     "Hooks": "advanced",
     "HostDecider": "advanced",
     "HostDecisionFacts": "advanced",
+    "HumanInputAttachment": "advanced",
     "HumanInputDelivery": "advanced",
     "HumanInputEvent": "advanced",
     "HumanInputFrame": "advanced",
@@ -4271,6 +4296,12 @@
     "UNCOVERED_SEGMENT_REASON_BASELINE": "advanced",
     "URL_SAFETY": "advanced",
     "USAGE_WINDOW_REAP_MARGIN_MS": "internal",
+    "USER_ATTACHMENTS_MAX": "advanced",
+    "USER_ATTACHMENT_KINDS": "advanced",
+    "USER_ATTACHMENT_LABEL_MAX": "advanced",
+    "USER_ATTACHMENT_OUTCOMES": "advanced",
+    "USER_ATTACHMENT_SEAT": "advanced",
+    "USER_ATTACHMENT_SUPPLIES": "advanced",
     "USER_INPUT_UNDRAINED_CAUSES": "advanced",
     "USER_INPUT_UNDRAINED_FAMILIES": "advanced",
     "UnarmedDenialLimitFallback": "advanced",
@@ -4285,9 +4316,16 @@
     "UsageWindowReading": "advanced",
     "UsageWindowRecord": "advanced",
     "UsageWindowStore": "advanced",
+    "UserAttachment": "advanced",
+    "UserAttachmentDeclaration": "advanced",
+    "UserAttachmentKind": "advanced",
+    "UserAttachmentObservation": "advanced",
+    "UserAttachmentOutcome": "advanced",
+    "UserAttachmentSupply": "advanced",
     "UserInputLane": "advanced",
     "UserInputUndrainedCause": "advanced",
     "UserMessage": "advanced",
+    "UserMessageAttachment": "advanced",
     "UserPromptSubmitContext": "advanced",
     "UserPromptSubmitResult": "advanced",
     "UtilityGate": "advanced",

package/wire-changes/core@7.49.5.json

@@ -0,0 +1,104 @@
+{
+  "repo": "core",
+  "version": "7.49.5",
+  "from": "40a79ac3341fc6750aae1664c64840a44abaa205",
+  "to": "9ba02c33f3eea253894b0132dca7ed98c390fb08",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 223,
+  "signatures": [
+    {
+      "name": "FileDurableRulePartitionProvider.constructor",
+      "at": [
+        "src/stores/file/permission-rule-store.ts:671"
+      ],
+      "from": [
+        "(dir: string, onError?: (message: string) => void, opts?: { dataRoot?: string; })"
+      ],
+      "to": [
+        "(dir: string, onError?: (message: string) => void, opts?: { dataRoot?: string; platform?: NodeJS.Platform; })"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "param 3 `opts` type widened: { dataRoot?: string; [ -> platform?: NodeJS.Platform; ]}",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "name": "judgePeerRecordFile",
+      "at": [
+        "src/agents/peer-directory.ts:484"
+      ],
+      "from": [
+        "(stat: { uid?: number; mode: number; isFile: boolean; size: number; }, selfUid: number | undefined): { ok: false; code: \"not_regular\" | \"foreign_owner\" | \"group_or_world_writable\" | \"too_large\"; } | { ok: true; }"
+      ],
+      "to": [
+        "(stat: { uid?: number; mode: number; isFile: boolean; size: number; }, selfUid: number | undefined, platform?: NodeJS.Platform): { ok: false; code: \"not_regular\" | \"foreign_owner\" | \"group_or_world_writable\" | \"too_large\"; } | { ok: true; }"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "+optional param `platform?: NodeJS.Platform`",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "name": "vetPeerRegistryDirectory",
+      "at": [
+        "src/agents/peer-directory.ts:452"
+      ],
+      "from": [
+        "(dir: string, opts?: { uid?: number; stopAt?: string; }): Promise<PeerRegistryDirectoryVerdict>"
+      ],
+      "to": [
+        "(dir: string, opts?: { uid?: number; stopAt?: string; platform?: NodeJS.Platform; }): Promise<PeerRegistryDirectoryVerdict>"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "param 2 `opts` type widened: …umber; stopAt?: string; [ -> platform?: NodeJS.Platform; ]}",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.classes",
+      "assertions": [
+        "G1.a",
+        "G2.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "FileDurableRulePartitionProvider"
+    ],
+    "server": [
+      "FileDurableRulePartitionProvider"
+    ],
+    "sdk": [],
+    "note": "scanned cli@7006be65 server@72f3abe9 sdk@f1b30d4 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it. Ledger files (**/docs/core-consumption/**, **/docs/wire-consumption/**, **/*LEDGER*.json) are not evidence of use — server: 2 name(s) matched ONLY in bookkeeping files and were set aside (judgePeerRecordFile, vetPeerRegistryDirectory)"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}