@sema-agent/core 7.49.5 → 7.50.1

package/dist/tools/fs/shell-read-check.js

@@ -9,6 +9,7 @@ import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
 import { declaredReadDenyHomes, homeViewsAt } from "./read-deny-home.js";
 import { anyOptionWord, programArgs } from "./shell-read-write-targets.js";
+import { shellReadFaceWords } from "./shell-read-face.js";
 import { passesUnasked } from "./shell-read-device.js";
 import { programRow, selectedOptions } from "./program-read-model.js";
 import { allFindings, anyFaceGuards, decideShellRead, denyRowAtOrBelow, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, stationGuards, writeFaceGuards, } from "./shell-read-judge.js";
@@ -199,31 +200,36 @@ const CAUSE_SPELLING_MAX = 64;
 function fitCause(cause) {
     return cause.replace(/^"([^"]*)"/, (_m, spelling) => `"${fitMiddle(spelling, CAUSE_SPELLING_MAX)}"`);
 }
+function faceOf(fold) {
+    return fold.witness?.read.candidate.face === "write" ? "write" : undefined;
+}
 function findingAccount(fold, boundary) {
     const w = fold.witness;
-    const writes = w?.read.candidate.face === "write";
+    const face = faceOf(fold);
+    const { verb } = shellReadFaceWords(face);
+    const writes = w !== undefined && face === "write";
     const roots = writes ? (boundary.writeRoots ?? []) : boundary.roots;
     const allowed = fitMiddle(roots.length > 0 ? roots.join(", ") : "(none)", ACCOUNT_PART_MAX);
     switch (fold.finding) {
         case "outside_roots":
-            return `${writes ? "writes" : "reads"} outside the allowed directories for this session: "${fitMiddle(w?.read.target ?? "?", ACCOUNT_PART_MAX)}" is not under ${allowed} ${NOT_AUTO_ALLOWED}`;
+            return `${verb} outside the allowed directories for this session: "${fitMiddle(w?.read.target ?? "?", ACCOUNT_PART_MAX)}" is not under ${allowed} ${NOT_AUTO_ALLOWED}`;
         case "unestablishable":
         case "unanswered":
             if (writes && boundary.writeRoots === undefined)
-                return `this command writes "${fitMiddle(w.read.target ?? w.read.candidate.spelled, ACCOUNT_PART_MAX)}", and this session declares no directories it may write ${NOT_AUTO_ALLOWED}`;
+                return `this command ${verb} "${fitMiddle(w.read.target ?? w.read.candidate.spelled, ACCOUNT_PART_MAX)}", and this session declares no directories it may write ${NOT_AUTO_ALLOWED}`;
             if (writes)
-                return `where this command writes could not be established${w.read.cause !== undefined ? `: ${fitCause(w.read.cause)}` : ""}, so it cannot be confirmed to write only inside the allowed directories for this session (${allowed}) ${NOT_AUTO_ALLOWED}`;
+                return `where this command ${verb} could not be established${w.read.cause !== undefined ? `: ${fitCause(w.read.cause)}` : ""}, so it cannot be confirmed to write only inside the allowed directories for this session (${allowed}) ${NOT_AUTO_ALLOWED}`;
             if (w?.read.cause !== undefined)
-                return `where this command reads could not be established: ${fitCause(w.read.cause)}, so it cannot be confirmed ${boundary.face === "open" ? "not to read a path the deny list names" : `to read only inside the allowed directories for this session (${allowed})`} ${NOT_AUTO_ALLOWED}`;
+                return `where this command ${verb} could not be established: ${fitCause(w.read.cause)}, so it cannot be confirmed ${boundary.face === "open" ? "not to read a path the deny list names" : `to read only inside the allowed directories for this session (${allowed})`} ${NOT_AUTO_ALLOWED}`;
             if (fold.cause !== undefined)
-                return `where this command reads could not be established: ${fitCause(fold.cause)}, so it cannot be confirmed ${boundary.face === "open" ? "not to read a path the deny list names" : `to read only inside the allowed directories for this session (${allowed})`} ${NOT_AUTO_ALLOWED}`;
+                return `where this command ${verb} could not be established: ${fitCause(fold.cause)}, so it cannot be confirmed ${boundary.face === "open" ? "not to read a path the deny list names" : `to read only inside the allowed directories for this session (${allowed})`} ${NOT_AUTO_ALLOWED}`;
             if (fold.declined?.baseMove !== undefined)
                 return `"${fitMiddle(fold.declined.text.trim(), ACCOUNT_PART_MAX)}" moves the working directory somewhere this command's text does not settle ${NOT_AUTO_ALLOWED}`;
             if (fold.declined?.unreadProgramText !== undefined)
-                return `"${fitMiddle(fold.declined.text.trim(), ACCOUNT_PART_MAX)}": ${fold.declined.unreadProgramText}, so where it reads cannot be established ${NOT_AUTO_ALLOWED}`;
+                return `"${fitMiddle(fold.declined.text.trim(), ACCOUNT_PART_MAX)}": ${fold.declined.unreadProgramText}, so where it ${verb} cannot be established ${NOT_AUTO_ALLOWED}`;
             if (fold.declined !== undefined)
                 return `"${fitMiddle(fold.declined.text.trim(), ACCOUNT_PART_MAX)}" runs its argument as shell text this station does not parse ${NOT_AUTO_ALLOWED}`;
-            return `the command's text could not be read as shell, so where it reads cannot be established ${NOT_AUTO_ALLOWED}`;
+            return `the command's text could not be read as shell, so where it ${verb} cannot be established ${NOT_AUTO_ALLOWED}`;
         case "declined":
             return fold.declined !== undefined ? declineSentence(fold.declined) : `the station could not read which program runs ${NOT_AUTO_ALLOWED}`;
         case "identity_changed":
@@ -285,16 +291,19 @@ function verdictOf(tool, seat, fold, judged, boundary) {
         return { disposition, finding: fold.finding };
     const paths = outsidePathsOf(judged);
     const unestablished = fold.unestablished === true ? { unestablished: true } : {};
-    const writes = fold.witness?.read.candidate.face === "write" ? { face: "write" } : {};
+    const face = faceOf(fold);
+    const writes = face !== undefined ? { face } : {};
+    const by = fold.finding === "unanswered" ? { environmentSilent: true } : {};
     if (disposition === "refuse") {
         const r = refusalOf(tool, fold, boundary, paths);
-        return { disposition, finding: fold.finding, ...writes, sentence: r.sentence, ...(r.details !== undefined ? { details: r.details } : {}) };
+        return { disposition, finding: fold.finding, ...by, ...writes, sentence: r.sentence, ...(r.details !== undefined ? { details: r.details } : {}) };
     }
     const grant = fold.finding === "outside_roots" ? readRootGrantCandidateOf(judged, boundary) : undefined;
     const containment = fold.finding === "outside_roots" || fold.finding === "unestablishable" || fold.finding === "unanswered";
     return {
         disposition,
         finding: fold.finding,
+        ...by,
         ...writes,
         ...unestablished,
         sentence: findingAccount(fold, boundary),
@@ -404,6 +413,16 @@ export function createShellReadStation(opts) {
         admissions.set(toolCallId, a);
     };
     const memberOf = (call) => readStationMemberOf(call, opts.tools)?.name;
+    const unansweredOver = (toolName, seat, cause, boundary, silence) => {
+        if (boundary === undefined || (boundary !== "unread" && !(anyFaceGuards(boundary) || boundary.writeTargetJudge !== undefined)))
+            return { disposition: "vouch", finding: "none" };
+        const disposition = decideShellRead("unanswered", seat);
+        const account = `${cause}, so where this command reads could not be established ${NOT_AUTO_ALLOWED}`;
+        const details = unestablishedDetails();
+        if (disposition === "refuse")
+            return { disposition, finding: "unanswered", ...silence, sentence: `Error (${toolName}): ${account}. ${BASH_READONLY_CONFINEMENT_NOTE}`, details };
+        return { disposition, finding: "unanswered", ...silence, sentence: account, details };
+    };
     const check = {
         judge(call, args, cwd, signal, callOpts) {
             const member = memberOf(call);
@@ -412,7 +431,7 @@ export function createShellReadStation(opts) {
             const command = shellCommandOf(args);
             if (command === undefined)
                 return null;
-            const boundary = opts.boundaryOf(member, cwd);
+            const boundary = opts.boundaryOf(member, cwd, callOpts.toolCallId);
             if (boundary === undefined)
                 return null;
             const seat = callOpts.seat ?? opts.seatOf(member);
@@ -420,22 +439,23 @@ export function createShellReadStation(opts) {
                 const run = await runShellReadStation(call.toolName, command, boundary, seat, readers, establisherFor(boundary.roots), opts.env, signal);
                 if (run.verdict.disposition !== "refuse" && callOpts.toolCallId !== undefined)
                     remember(callOpts.toolCallId, { toolName: member, boundary: run.boundary, established: run.established, command });
-                return run.verdict;
+                if (boundary.unreadPartitions !== true)
+                    return run.verdict;
+                return run.verdict.disposition === "vouch" ? unansweredOver(call.toolName, seat, "the rules this check stands on could not all be read", boundary, { rowsUnread: true }) : { ...run.verdict, rowsUnread: true };
             })();
         },
         unanswered(call, cause) {
-            const toolName = call.toolName;
-            const member = memberOf(call) ?? toolName;
-            const seat = opts.seatOf(member);
-            const boundary = opts.boundaryOf(member, undefined);
-            if (boundary === undefined || !(anyFaceGuards(boundary) || boundary.writeTargetJudge !== undefined))
-                return { disposition: "vouch", finding: "none" };
-            const disposition = decideShellRead("unanswered", seat);
-            const account = `${cause}, so where this command reads could not be established ${NOT_AUTO_ALLOWED}`;
-            const details = unestablishedDetails();
-            if (disposition === "refuse")
-                return { disposition, finding: "unanswered", sentence: `Error (${toolName}): ${account}. ${BASH_READONLY_CONFINEMENT_NOTE}`, details };
-            return { disposition, finding: "unanswered", sentence: account, details };
+            const member = memberOf(call) ?? call.toolName;
+            const boundary = (() => {
+                try {
+                    return opts.boundaryOf(member, undefined, undefined);
+                }
+                catch {
+                    return "unread";
+                }
+            })();
+            const rowsUnread = boundary === "unread" || boundary?.unreadPartitions === true ? { rowsUnread: true } : {};
+            return unansweredOver(call.toolName, opts.seatOf(member), cause, boundary, { environmentSilent: true, ...rowsUnread });
         },
     };
     const admit = async (toolName, toolCallId, command, signal) => {

package/dist/tools/fs/shell-read-device.d.ts

@@ -5,7 +5,7 @@
  * operand, the content a program writes through an operand, a `git diff` operand) and the shape tier's two readings of "does
  * this redirection write" (the read-only reader, the classify faces' data-free redirections).
  *
- * The table is the reference implementation's own device predicate (CC 2.1.296 `wwe`, cli296.js @18511591): the null
+ * The table is the reference implementation's own device predicate (CC 2.1.296 `wwe` (cli296.js:249645) @18511591): the null
  * device, the three standard streams, the terminal, any `/dev/fd/<digits>`, and `/proc/self/fd/{0,1,2}`. A word is such a
  * spelling AS WRITTEN (quotes removed, nothing folded: `/dev/./null` is a path, not the null device).
  *

package/dist/tools/fs/shell-read-face.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The words a shell-read finding is said in, by the FACE it is about — the ONE choice of verb the read station's account
+ * (what the approval card discloses and the refusal states) and the gate's approval card sentence both take, so one finding
+ * is never "writes" on one surface and "reads" on the other. A finding whose witness is a write target
+ * (`ShellReadVerdict.face === "write"`) is said as a write; every other finding — a read's, the text's own structure —
+ * as a read. A leaf: the station and the gate both import it, and it imports nothing.
+ */
+export interface ShellReadFaceWords {
+    /** The claim's verb: `this command writes …`, `tool "Bash" reads …`. */
+    readonly verb: "writes" | "reads";
+    /** Its object's participle: `… could not establish what is written / read`. */
+    readonly participle: "written" | "read";
+}
+/** The words of a finding on `face` (absent ⇒ a read's). */
+export declare function shellReadFaceWords(face: "write" | undefined): ShellReadFaceWords;

package/dist/tools/fs/shell-read-face.js

@@ -0,0 +1,5 @@
+const WRITE_WORDS = Object.freeze({ verb: "writes", participle: "written" });
+const READ_WORDS = Object.freeze({ verb: "reads", participle: "read" });
+export function shellReadFaceWords(face) {
+    return face === "write" ? WRITE_WORDS : READ_WORDS;
+}

package/dist/tools/fs/shell-read-judge.d.ts

@@ -74,7 +74,7 @@ export declare function dispositionOfCell(cell: ShellReadCell, narrowedReadFace:
  *    ask is MANDATED and no automatic lane answers; on the OPEN face (where the station asks only because a deny list has
  *    rows), and for a written target alone (a narrowed WRITE face fences what is written; it is no request to be asked about
  *    every word the floor cannot place), it is the ORDINARY ask — the reference implementation's plain permission ask (CC
- *    2.1.296 `sR`, cli296.js @13116941, reason `other`), which a whole-tool allow (`$pn` @18717070), bypass (`$pn` @18716980)
+ *    2.1.296 `sR` (cli296.js:242691) @13116941, reason `other`), which a whole-tool allow (`N9` (cli296.js:249675) @18717070), bypass (`$pn` (cli296.js:249675) @18716980)
  *    and the auto-mode classifier release and a prefix allow does not.
  *  · `declined` — the one deliberate fail-open of this table: the scan could not read the program bash
  *    will run, or the operands arrive on a stream. On the full shell it is an ORDINARY ask — an answerer
@@ -159,6 +159,10 @@ export interface ShellReadCellContext {
  */
 export interface ShellReadBoundary extends BashReadonlyRootBoundary {
     readonly alsoInside?: (canonicalTarget: string) => Promise<boolean>;
+    /** A partition of the rules the deny seats are compiled from could not be read: a guard of unknown reach. The station
+     *  guards ({@link stationGuards}) and vouches for nothing against this boundary — what it would vouch for is answered as
+     *  a judgment it could not make. */
+    readonly unreadPartitions?: true;
     /** The deny table's WRITE face (`compileWriteDeny`, read-deny.ts): judges a command's write targets (candidates marked
      *  `face: "write"`) and returns the matched row's rule, or null. PRESENT-IFF there is something to judge. */
     readonly writeDenyMatch?: (resolvedPath: string) => string | null;
@@ -303,12 +307,13 @@ export interface JudgedPlan {
 }
 /**
  * Does the station GUARD anything for this boundary — a closed face (roots: containment is what it guards; an absent
- * face reads as roots, as {@link containmentOf} does), or a deny table with rows (`denyMatch` is present exactly then)?
+ * face reads as roots, as {@link containmentOf} does), or a deny table with rows (`denyMatch` is present exactly then),
+ * or rows it could not read (`unreadPartitions`: a guard of unknown reach)?
  * Where it guards nothing (an open face, no deny row), a read it could not establish has nothing to be confirmed
  * against: no finding. The deny judgment itself is untouched (with no row there is nothing to hit). The READ face's
  * question only: a write target folds by {@link writeFaceGuards}.
  */
-export declare function stationGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch">): boolean;
+export declare function stationGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch" | "unreadPartitions">): boolean;
 /**
  * Does the station guard anything on the WRITE face — the same shape for the write seats: the write face in force runs
  * the roots-containment step ({@link skipsRootsContainment}, the structured write tools' reading; absent ⇒ roots), or
@@ -319,7 +324,7 @@ export declare function writeFaceGuards(boundary: Pick<ShellReadBoundary, "write
 /** Does the station guard anything on EITHER face? What a finding about the text's own structure folds by — a text the
  *  lexer could not read, a program it cannot name, program text it does not read, a working directory it lost, a text the
  *  shell re-enters — since what such a text reads AND what it writes are both unknown. */
-export declare function anyFaceGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch" | "writeFace" | "writeDenyMatch">): boolean;
+export declare function anyFaceGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch" | "unreadPartitions" | "writeFace" | "writeDenyMatch">): boolean;
 /** The command-level fold and the finding that produced it. `witness` is absent for `none`; for `declined`
  *  the segment that declined stands in for a candidate. */
 export interface ShellReadFold {

package/dist/tools/fs/shell-read-judge.js

@@ -104,7 +104,7 @@ function judgeWrite(read, boundary) {
     return { read, kind: containment === "outside" && !skipsRootsContainment(boundary.writeFace) ? "outside_roots" : "none", containment };
 }
 export function stationGuards(boundary) {
-    return boundary.face !== "open" || boundary.denyMatch !== undefined;
+    return boundary.face !== "open" || boundary.denyMatch !== undefined || boundary.unreadPartitions === true;
 }
 export function writeFaceGuards(boundary) {
     return !skipsRootsContainment(boundary.writeFace) || boundary.writeDenyMatch !== undefined;

package/dist/tools/loop-tick.d.ts

@@ -19,9 +19,9 @@ export interface AutonomousLoopPromptOptions {
      */
     pushNotification?: boolean;
 }
-/** CC `FFi` (:205310) — first-tick preamble, DEFAULT variant (steward framing). Verbatim. */
+/** CC 2.1.209 `FFi` (:205310) — first-tick preamble, DEFAULT variant (steward framing). Verbatim through 2.1.259; the reference dropped this preamble from 2.1.278 on. */
 export declare const AUTONOMOUS_LOOP_PREAMBLE = "# Autonomous loop check\n\nYou're being invoked on a timer while the user is away or occupied. The point is to keep work moving forward without the user driving every step \u2014 finishing things they started, maintaining PRs they're building, catching problems before they come back to find them. You're a steward, not an initiator. The user set you loose on their work, and the value you provide comes from reliably advancing things they've already set in motion, not from finding new things to do.\n\nThe key tension to navigate: the user trusts you enough to run autonomously, but that trust is easily lost. Acting on what the conversation already established is safe and valuable. Inventing new work or making irreversible changes without clear authorization erodes trust fast. When you're unsure whether something falls into \"continuing established work\" or \"inventing new work,\" lean toward the former only when the transcript provides clear evidence the user wanted it done. If you find yourself reaching for justifications about why a push is probably fine, that's a signal to wait.\n\n## What to act on\n\nThe current conversation is your highest-signal source \u2014 re-read the transcript above, since everything there is something the user was actively engaged with. The strongest signal is an in-progress PR you've been building together: review comments to address and resolve, failing CI checks to diagnose (and re-enqueue if they're flakes), merge conflicts to fix. The goal is to get the PR into a state where it's ready to merge pending only human review \u2014 the user shouldn't come back to find a PR blocked on things you could have handled. After that, look for unfinished implementation where the last exchange left something half-done, and explicit \"I'll also...\" or \"next I'll...\" commitments the conversation made and didn't honor. Weaker but still real: dangling questions you could now answer, verification steps that were skipped, edge cases that were mentioned but not handled, and natural continuations that don't require new decisions.\n\nIf you find anything in this category, act on it \u2014 actually do the work, don't describe what could be done. Run the tests, don't say \"you could run the tests.\" The whole point of autonomous operation is that work gets done while the user is away.\n\nWhen the conversation transcript has nothing left, the current branch's pull/merge request on the user's SCM is the next-best place to look. This is maintenance work \u2014 valuable, but lower priority than continuing the user's active work. Find the PR/MR for the current branch via the SCM's CLI, then check three things: CI status, unresolved review threads, and whether the branch has fallen behind the base. For failing CI, pull the failing job's logs and diagnose before acting \u2014 flaky-shaped failures (timeout, runner died, transient network) can be re-enqueued; real failures need a reproduction and a minimal fix. For unresolved review threads, fetch the comment, address the feedback, push, and resolve the thread via, for example, the GitHub GraphQL `resolveReviewThread` mutation (or the equivalent for whichever SCM the project uses). Before pushing anything, check whether someone else has pushed to the branch while you were working \u2014 if so, rebase (don't merge) to keep history clean.\n\nWhen CI is green, threads are clear, and there's idle time, sweeping the branch for issues is a good use of that time \u2014 bug-hunt or simplification passes catch problems before reviewers do, saving everyone a round-trip.\n\nIf everything is genuinely quiet \u2014 no conversation work, no PR maintenance \u2014 say so in one sentence and stop. No summary of what you checked, no list of what you might do later. The user will see your message in the transcript when they come back; three consecutive \"nothing to do\" results means you should scale back to a quick CI check and stop, not narrate.\n\n## Repeated invocations\n\nIf you see earlier autonomous checks in this conversation, adjust your scope accordingly. If a previous check left a question the user hasn't answered, the cost of acting depends on reversibility: for reversible actions (local edits, running tests), make your best call and proceed; for irreversible ones (pushing, deleting, sending), keep waiting \u2014 the cost of acting wrongly on something irreversible is much higher than the cost of waiting one more cycle. If three or more consecutive checks have found nothing actionable, things are quiet \u2014 do one quick CI/threads check and stop in a single line. Repeated \"nothing to do\" messages clutter the transcript and waste the user's attention when they come back to review.\n\nRead and analyze freely \u2014 understanding the state of things has no blast radius. Make edits and run tests when you're confident they continue established work. Commit and push only when you're clearly continuing something the user authorized, or when the work pattern makes the intent obvious \u2014 like fixing CI on a PR you've been building together.\n";
-/** CC `w6c` (:205335) — first-tick preamble, PERSISTENT variant. Verbatim. */
+/** CC 2.1.209 `w6c` (:205335) — first-tick preamble, PERSISTENT variant. Verbatim through 2.1.259; dropped from 2.1.278 on. */
 export declare const AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT = "# Autonomous loop check\n\nYou're being invoked on a timer while the user is away or occupied. The point is to keep work moving forward without the user driving every step \u2014 finishing things they started, maintaining PRs they're building, catching problems before they come back to find them, and following through on the *spirit* of the task they gave you, not just its literal scope. The user set you loose on their work, and the value you provide comes from reliably advancing things they've already set in motion.\n\nThe key tension to navigate: the user trusts you enough to run autonomously, but that trust is easily lost. Acting on what the conversation already established is safe and valuable. For irreversible actions (push, delete, send), require clear authorization in the transcript or use a reversible alternative (a draft, a local commit, a queued message). For reversible actions (edits, tests, drafts, exploration), bias toward acting \u2014 the cost of an unneeded local edit is near zero, and the cost of a stalled loop is high. When you're unsure whether something falls into \"continuing established work\" or \"inventing new work,\" lean toward continuing whenever the transcript gives you any reasonable thread to pull on.\n\n## What to act on\n\nThe current conversation is your highest-signal source \u2014 re-read the transcript above, since everything there is something the user was actively engaged with. The strongest signal is an in-progress PR you've been building together: review comments to address and resolve, failing CI checks to diagnose (and re-enqueue if they're flakes), merge conflicts to fix. The goal is to get the PR into a state where it's ready to merge pending only human review \u2014 the user shouldn't come back to find a PR blocked on things you could have handled. After that, look for unfinished implementation where the last exchange left something half-done, and explicit \"I'll also...\" or \"next I'll...\" commitments the conversation made and didn't honor. Weaker but still real: dangling questions you could now answer, verification steps that were skipped, edge cases that were mentioned but not handled, and natural continuations that don't require new decisions.\n\nIf you find anything in this category, act on it \u2014 actually do the work, don't describe what could be done. Run the tests, don't say \"you could run the tests.\" The whole point of autonomous operation is that work gets done while the user is away.\n\nWhen the conversation transcript has nothing left, the current branch's pull/merge request on the user's SCM is the next-best place to look. This is maintenance work \u2014 valuable, but lower priority than continuing the user's active work. Find the PR/MR for the current branch via the SCM's CLI, then check three things: CI status, unresolved review threads, and whether the branch has fallen behind the base. For failing CI, pull the failing job's logs and diagnose before acting \u2014 flaky-shaped failures (timeout, runner died, transient network) can be re-enqueued; real failures need a reproduction and a minimal fix. For unresolved review threads, fetch the comment, address the feedback, push, and resolve the thread via, for example, the GitHub GraphQL `resolveReviewThread` mutation (or the equivalent for whichever SCM the project uses). Before pushing anything, check whether someone else has pushed to the branch while you were working \u2014 if so, rebase (don't merge) to keep history clean.\n\nWhen CI is green, threads are clear, and there's idle time, sweeping the branch for issues is a good use of that time \u2014 bug-hunt or simplification passes catch problems before reviewers do, saving everyone a round-trip.\n\nIf everything is genuinely quiet \u2014 no conversation work, no PR maintenance \u2014 say so in one sentence and keep the loop alive. Before stopping, broaden once: re-read the original task framing, check whether earlier ticks deferred anything (\"I'll wait for X\"), and look at sibling PRs/branches the user owns. Persistence is the point of autonomous mode. Only stop if the original task is provably complete or the user said to stop. (Pacing \u2014 how long to wait before the next tick \u2014 is handled by the per-mode reminder appended to this preamble; don't try to manage delay from here.)\n\n## Repeated invocations\n\nIf you see earlier autonomous checks in this conversation, adjust your scope accordingly. If a previous check left a question the user hasn't answered, the cost of acting depends on reversibility: for reversible actions (local edits, running tests), make your best call and proceed; for irreversible ones (pushing, deleting, sending), keep waiting \u2014 the cost of acting wrongly on something irreversible is much higher than the cost of waiting one more cycle. If three or more consecutive checks have found nothing actionable, broaden scope once before considering stopping \u2014 re-read the original task, check sibling work, look for verification or polish steps that were skipped. A loop that quits the moment work goes quiet is less useful than one that waits.\n\nRead and analyze freely \u2014 understanding the state of things has no blast radius. Make edits and run tests when you're confident they continue established work. Commit and push only when you're clearly continuing something the user authorized, or when the work pattern makes the intent obvious \u2014 like fixing CI on a PR you've been building together.\n";
 /**
  * Resolve a fire-time prompt: if it is one of the two autonomous-loop sentinels, return the tick

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.49.5",
+  "version": "7.50.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -72,6 +72,8 @@
     "handoff:diff": "node scripts/dist-handoff-diff.mjs",
     "post-ship": "node scripts/post-ship.mjs",
     "gate:debts:rc": "node scripts/verify-debts.mjs --rc-gate",
+    "gate:anchor-claims": "node scripts/verify-anchor-claims.mjs",
+    "gate:anchor-claims:rc": "node scripts/verify-anchor-claims.mjs --require-corpus",
     "gate:rulings": "node scripts/rulings-gate.mjs --require-comms",
     "gate:error-surface": "node scripts/verify-error-surface.mjs",
     "gate:criteria": "node scripts/criteria-lint.mjs",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a BREAKING change: name every removed entry in the CHANGELOG's BREAKING lines (what was removed / who is hurt / what to read instead) and update this fixture in the SAME commit. Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2609,
+  "count": 2628,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -216,6 +216,7 @@
     "BeforeWriteHook": "type",
     "BeforeWriteRequest": "interface",
     "BeforeWriteResult": "type",
+    "BoundFileObject": "interface",
     "BoundPathRule": "interface",
     "BoundSkillGrants": "interface",
     "Brain": "interface",
@@ -252,6 +253,7 @@
     "CONSOLIDATION_DRIVER_RUNS_FILE": "variable",
     "CONSOLIDATION_RUN_STOP_REASONS": "variable",
     "CONSOLIDATION_SYSTEM_PROMPT": "variable",
+    "CONSOLIDATION_WRITE_REFUSED_CODE": "variable",
     "CONTRACT_KIT_ENGINE_VERSION": "variable",
     "COORDINATOR_ROLE_PROMPT": "variable",
     "CORRUPT_BODY_FORMS": "variable",
@@ -358,6 +360,9 @@
     "ConsolidationRunReceipt": "interface",
     "ConsolidationRunStopReason": "type",
     "ConsolidationStats": "interface",
+    "ConsolidationWriteGate": "type",
+    "ConsolidationWriteJudge": "type",
+    "ConsolidationWriteTarget": "interface",
     "ConstraintChainEntry": "type",
     "ContainmentFace": "type",
     "ContainmentFaceInputs": "interface",
@@ -591,6 +596,7 @@
     "Hooks": "interface",
     "HostDecider": "type",
     "HostDecisionFacts": "interface",
+    "HumanInputAttachment": "interface",
     "HumanInputDelivery": "type",
     "HumanInputEvent": "type",
     "HumanInputFrame": "interface",
@@ -1660,6 +1666,12 @@
     "UNCOVERED_SEGMENT_REASON_BASELINE": "variable",
     "URL_SAFETY": "variable",
     "USAGE_WINDOW_REAP_MARGIN_MS": "variable",
+    "USER_ATTACHMENTS_MAX": "variable",
+    "USER_ATTACHMENT_KINDS": "variable",
+    "USER_ATTACHMENT_LABEL_MAX": "variable",
+    "USER_ATTACHMENT_OUTCOMES": "variable",
+    "USER_ATTACHMENT_SEAT": "variable",
+    "USER_ATTACHMENT_SUPPLIES": "variable",
     "USER_INPUT_UNDRAINED_CAUSES": "variable",
     "USER_INPUT_UNDRAINED_FAMILIES": "variable",
     "UnarmedDenialLimitFallback": "interface",
@@ -1674,9 +1686,16 @@
     "UsageWindowReading": "interface",
     "UsageWindowRecord": "interface",
     "UsageWindowStore": "interface",
+    "UserAttachment": "type",
+    "UserAttachmentDeclaration": "interface",
+    "UserAttachmentKind": "type",
+    "UserAttachmentObservation": "interface",
+    "UserAttachmentOutcome": "type",
+    "UserAttachmentSupply": "type",
     "UserInputLane": "type",
     "UserInputUndrainedCause": "type",
     "UserMessage": "interface",
+    "UserMessageAttachment": "interface",
     "UserPromptSubmitContext": "interface",
     "UserPromptSubmitResult": "interface",
     "UtilityGate": "type",
@@ -2827,6 +2846,7 @@
     "BeforeWriteHook": "stable",
     "BeforeWriteRequest": "advanced",
     "BeforeWriteResult": "advanced",
+    "BoundFileObject": "internal",
     "BoundPathRule": "advanced",
     "BoundSkillGrants": "advanced",
     "Brain": "stable",
@@ -2863,6 +2883,7 @@
     "CONSOLIDATION_DRIVER_RUNS_FILE": "advanced",
     "CONSOLIDATION_RUN_STOP_REASONS": "advanced",
     "CONSOLIDATION_SYSTEM_PROMPT": "internal",
+    "CONSOLIDATION_WRITE_REFUSED_CODE": "advanced",
     "CONTRACT_KIT_ENGINE_VERSION": "advanced",
     "COORDINATOR_ROLE_PROMPT": "advanced",
     "CORRUPT_BODY_FORMS": "advanced",
@@ -2969,6 +2990,9 @@
     "ConsolidationRunReceipt": "advanced",
     "ConsolidationRunStopReason": "advanced",
     "ConsolidationStats": "internal",
+    "ConsolidationWriteGate": "advanced",
+    "ConsolidationWriteJudge": "advanced",
+    "ConsolidationWriteTarget": "advanced",
     "ConstraintChainEntry": "advanced",
     "ContainmentFace": "stable",
     "ContainmentFaceInputs": "advanced",
@@ -3202,6 +3226,7 @@
     "Hooks": "advanced",
     "HostDecider": "advanced",
     "HostDecisionFacts": "advanced",
+    "HumanInputAttachment": "advanced",
     "HumanInputDelivery": "advanced",
     "HumanInputEvent": "advanced",
     "HumanInputFrame": "advanced",
@@ -4271,6 +4296,12 @@
     "UNCOVERED_SEGMENT_REASON_BASELINE": "advanced",
     "URL_SAFETY": "advanced",
     "USAGE_WINDOW_REAP_MARGIN_MS": "internal",
+    "USER_ATTACHMENTS_MAX": "advanced",
+    "USER_ATTACHMENT_KINDS": "advanced",
+    "USER_ATTACHMENT_LABEL_MAX": "advanced",
+    "USER_ATTACHMENT_OUTCOMES": "advanced",
+    "USER_ATTACHMENT_SEAT": "advanced",
+    "USER_ATTACHMENT_SUPPLIES": "advanced",
     "USER_INPUT_UNDRAINED_CAUSES": "advanced",
     "USER_INPUT_UNDRAINED_FAMILIES": "advanced",
     "UnarmedDenialLimitFallback": "advanced",
@@ -4285,9 +4316,16 @@
     "UsageWindowReading": "advanced",
     "UsageWindowRecord": "advanced",
     "UsageWindowStore": "advanced",
+    "UserAttachment": "advanced",
+    "UserAttachmentDeclaration": "advanced",
+    "UserAttachmentKind": "advanced",
+    "UserAttachmentObservation": "advanced",
+    "UserAttachmentOutcome": "advanced",
+    "UserAttachmentSupply": "advanced",
     "UserInputLane": "advanced",
     "UserInputUndrainedCause": "advanced",
     "UserMessage": "advanced",
+    "UserMessageAttachment": "advanced",
     "UserPromptSubmitContext": "advanced",
     "UserPromptSubmitResult": "advanced",
     "UtilityGate": "advanced",