@sema-agent/core 7.5.0 → 7.5.1

package/dist/core/runner/contracts.js

@@ -0,0 +1 @@
+export {};

package/dist/core/runner/denial-limit-arms.d.ts

@@ -3,7 +3,7 @@ import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { PermissionResult, ResolvedAsk, ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
 import { type AskOrigin } from "../ask-origin.js";
-import type { Prepared } from "./prepare-task.js";
+import type { Prepared } from "./contracts.js";
 /**
  * #548 — the classifier DENIAL-LIMIT arms of the tool gate's inherited (delegation) lane, extracted
  * from `prepareTask` as a phase module (design/238 D-7: extract, don't accrete). The gate's OWN

package/dist/core/runner/derived-route-fallback.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The derived-leg route pre-flight shared by prepareTask's two derived seats: the compaction-summary model (the
+ * driver's own seat, resolved before the offload prelude) and the auto-mode classifier model (the caps-and-workflow
+ * phase's arming). Moved whole out of the orchestrator so the phase reaches DOWN for it instead of the two callers
+ * spelling it twice. The judgment law itself lives in the brain's route adjudicator; this is the one guarded seat
+ * around it.
+ */
+import type { Model } from "../../internal/llm.js";
+import type { RunnerDeps, TaskSpec } from "../types.js";
+/**
+ * The derived-leg pairing pre-flight as ONE guarded seat: judge the derived model where its route
+ * differs from the primary's, announce the fallback on a broken pairing, and ABSTAIN (keep the
+ * derived model) on ANY throw. The pre-flight is advisory — the brain's request gate re-runs the
+ * same law — so neither a throwing judge face nor a garbage catalog value (the route-identity
+ * normalization throws a TypeError on a non-string baseUrl) may widen into "task preparation
+ * failed": at the compaction seat the session is already acquired and the throw-cleanup contract
+ * is not yet armed, so a throw here would leak the acquired session view, and the garbage value
+ * still earns its loud refusal at the request gate the moment the derived leg is actually used.
+ * Returns whether the seat should fall back to the primary model.
+ */
+export declare function derivedRouteFallsBack(args: {
+    seat: string;
+    derived: Model;
+    primary: Model;
+    brain: RunnerDeps["brain"];
+    getApiKeyAndHeaders: TaskSpec["getApiKeyAndHeaders"];
+    onNotice: RunnerDeps["onNotice"];
+    /** #433 — the run this seat resolution belongs to; carried onto the notice as its routing key
+     *  (the audience stays operator: correlation, not entitlement). Absent ⇒ nothing is fabricated. */
+    sessionId?: string;
+    /** #499 — the INVOCATION this seat resolution belongs to. The session cannot stand in for it: two
+     *  runs of one session that both fall back on the same seat mint otherwise byte-identical lines. */
+    runId?: string;
+}): Promise<boolean>;

package/dist/core/runner/derived-route-fallback.js

@@ -0,0 +1,16 @@
+import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity } from "../../brain/route-adjudicator.js";
+import { deliverEngineNotice } from "../types.js";
+export async function derivedRouteFallsBack(args) {
+    try {
+        if (sameRouteIdentity(args.derived, args.primary))
+            return false;
+        const verdict = await adjudicateDerivedRoute({ brain: args.brain, model: args.derived, getApiKeyAndHeaders: args.getApiKeyAndHeaders });
+        if (verdict === undefined || verdict.ok)
+            return false;
+        deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ seat: args.seat, from: args.derived.id, to: args.primary.id, verdict, ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}), ...(args.runId !== undefined ? { runId: args.runId } : {}) }));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/core/runner/prepare-acquire-reconcile.d.ts

@@ -22,7 +22,7 @@ import { StoredSession } from "../session.js";
 import type { AcquiredSession, SessionStore } from "../session.js";
 import { type RecoveredOrphan } from "../session-reconcile.js";
 import type { TaskSpec, ToolEffect } from "../types.js";
-import type { PrepareResume } from "./prepare-task.js";
+import type { PrepareResume } from "./contracts.js";
 export interface PrepareAcquireReconcileInput {
     /** borrowed-mutable (service port) — the deployment's session store. This phase's verbs on it are
      *  the acquire/forget half of the session resource protocol: `acquire` per attempt, `forget` to

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -0,0 +1,170 @@
+/**
+ * design/390 §1.2 M4 — prepareTask's CAPS-AND-WORKFLOW phase, verbatim from the driver: the caller-tool roster
+ * map (the defineTool-product branch and the rich-ctx wrap through the large-result wrapper), the ReportBlocked /
+ * ReportFindings / plan-pair mounts, the per-principal runtime caps resolve with its fail-closed degrade and value
+ * screen, the compliance posture veto with its two refusal codes, the fork verdict and the observers grant, the
+ * auto-mode arming (classifier model, lane rule, decider + denial tracker + persisted recipe) with its manifest
+ * reason, the self-orchestration gate with its governance note, and the Workflow mount with its size-guideline
+ * seat. The three arming helpers and the parent-capture-state join moved with the segment (only this phase calls
+ * them). The interface is the dependency list the segment had implicitly (design/238 R-1).
+ *
+ * ASYNC PHASE: the segment awaits the two resolvers, the classifier route pre-flight and the Workflow factory,
+ * exactly where the driver awaited them; the roster map and the synthetic mounts before the first of those awaits
+ * run synchronously as they did. Read-stability of the host handles for the call: {@link RunInternals}
+ * (`@contract prepare.deps-read-stable`).
+ *
+ * THE ROSTER IS MINTED HERE (`tools`): every later phase that mounts pushes into this same array — the writer table
+ * lives on {@link Prepared.tools} (design/238 R-3). LATE-BOUND SEATS: the Workflow mount's call-time getters read
+ * three facts later stations resolve (the memory session, the center adoption, the hands mount's deny additions);
+ * each enters as a getter on the Input and is read exactly where the driver's getter read the variable.
+ */
+import type { AgentHarness, AgentTool, ThinkingLevel } from "../../internal/harness.js";
+import type { Model } from "../../internal/llm.js";
+import { forkGovernanceDenial } from "../../agents/subagent.js";
+import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
+import { createRunWorkflowTool } from "../../orchestration/run-workflow-tool.js";
+import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
+import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
+import { type AutoModeDecider, type AutoModeDenialTracker } from "../auto-mode.js";
+import { type ComplianceCapability } from "../compliance.js";
+import type { LockedPreflight } from "../locked-config.js";
+import type { StoredSession } from "../session.js";
+import type { OnAsk } from "../tool-policy.js";
+import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
+import type { AutoModeArmReason } from "../wiring-manifest.js";
+import type { ReadFace } from "../../tools/fs/index.js";
+import type { InheritedGate, Prepared, RunInternals, ToolFaceSnapshot } from "./contracts.js";
+import { type BlockedRef } from "./synthetic-tools.js";
+/** The runner the Workflow mount accepts — spelled as the factory's own option type so this phase names no runner
+ *  module of its own (the narrow `RunnerSelfSeat` contract is a design decision still open; see the layering registry). */
+type WorkflowMountRunner = Parameters<typeof createRunWorkflowTool>[0]["runner"];
+export interface PrepareCapsAndWorkflowInput {
+    /** borrowed-readonly — the REBOUND spec, whole: the roster map reads `tools`; the mounts read `enableBlockedReport`,
+     *  `enablePlanMode`, `interactiveTools`, `checkpointStore`; the caps/compliance stations read `principal`, `selfOrchestration`,
+     *  `enableFork`, `getApiKeyAndHeaders`; the Workflow mount forwards `oneShot`, `handsReadOnly`, `interactiveTools`. The
+     *  self-orchestration predicate takes the whole spec. Never mutated. */
+    spec: TaskSpec;
+    /** borrowed-readonly — the deployment seats, whole: `runtimeCapsResolver`, `compliancePostureResolver`, `onError`, `onNotice`,
+     *  `autoMode`, `brain`, `models`, `checkpointStore` (the plan-pair face), and the Workflow mount's dozen deps (`workflowScriptRunner`,
+     *  `workflowGovernanceBaseline`, `workflowRunStore`, `workflowJournalStore`, `workflowScriptStore`, `builtinWorkflows`,
+     *  `onWorkflowAgentSpawn`, `workflowCompletionNotifier`, `workflowLimits`, `agents`, `builtinAgents`, `onBackgroundChildEvent`).
+     *  The self-orchestration predicate takes the whole record. */
+    deps: RunnerDeps;
+    /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
+     *  `onTaskNotification`, `workflowDepth`, and the capture-floor getter reads `memoryCaptureAncestors`. */
+    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors"> | undefined;
+    /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
+    session: Pick<StoredSession, "buildContext">;
+    /** borrowed-readonly — the acquired session id (operator-line context, the refusal codes' phase record). */
+    sessionId: string;
+    /** borrowed-readonly — the run's invocation id (the classifier route pre-flight's notice names it). */
+    runId: string;
+    /** borrowed-readonly — the per-task identity the Workflow mount registers its children under. */
+    hostTaskId: string;
+    /** borrowed-readonly — the registry scope the Workflow mount registers in. */
+    taskScope: string;
+    /** borrowed-readonly — the SETTLED task root the Workflow mount hands its children as `parentCwd`. */
+    taskRootFinal: string;
+    /** borrowed-readonly — the run's resolved model: the classifier leg's fallback and the route pre-flight's primary. */
+    model: Model;
+    /** borrowed-readonly — the run's resolved thinking level, when one is (the Workflow mount's parentThinking fallback). */
+    thinking: ThinkingLevel | undefined;
+    /** borrowed-readonly — the frozen preflight; only `mcp` (the compliance veto's mcp_servers conflict check). */
+    lockedPreflight: Pick<LockedPreflight, "mcp">;
+    /** borrowed-mutable — the effect collection (`Prepared.toolEffects`). Writer here: ONE set, `Workflow → write`, at its mount.
+     *  Every other writer is the safety scan (the seed) and the later mounts (see the roster table on `Prepared.tools`). */
+    toolEffects: Prepared["toolEffects"];
+    /** borrowed-readonly — the frozen tool-face snapshot the Workflow mount forwards (exclude / defer / alwaysLoad / restoreGated). */
+    toolFaceSnapshot: ToolFaceSnapshot;
+    /** borrowed-readonly — the resolved prompt profile (the Workflow mount's parentPromptProfile). */
+    promptProfile: ToolExecuteContext["promptProfile"];
+    /** borrowed-readonly — the resolved interaction posture (the Workflow mount's parentInteractionPosture; absent ⇒ no key). */
+    resolvedInteractionPosture: ToolExecuteContext["interactionPosture"];
+    /** borrowed-readonly — the harness seat; the Workflow mount's parentModel / parentThinking getters read it call-time. */
+    harnessRef: {
+        current?: AgentHarness;
+    };
+    /** borrowed-readonly — the FROZEN approver seat (the Workflow mount's parentOnAsk). */
+    frozenOnAsk: OnAsk | undefined;
+    /** borrowed-readonly — the ONE read-face carrier expression (the Workflow mount's parentReadFace getter calls it). */
+    carrierReadFace: () => ReadFace | undefined;
+    /** borrowed-readonly — the filtered display-forwarding wrapper (the Workflow mount's forwardEvent; absent ⇒ no key). */
+    forwardEvent: ((e: TaskEvent) => void) | undefined;
+    /** borrowed-readonly — the child-chain assembly (the Workflow mount's inheritedGateForChildren). */
+    inheritedGateForChildren: () => InheritedGate;
+    /** borrowed-readonly — the caller-tool ctx enrichment the roster map wraps every raw ToolSpec with. */
+    enrichSpecToolCtx: (ctx: ToolExecuteContext) => ToolExecuteContext;
+    /** borrowed-readonly — the large-result wrapper every roster entry passes through (per-tool policy honored inside). */
+    maybeOffload: (tool: AgentTool, perTool?: {
+        offload?: boolean;
+        offloadThresholdChars?: number;
+    }) => AgentTool;
+    /** borrowed-readonly — the plan-review primitive the ExitPlanMode tool calls. */
+    requestReview: (opts?: {
+        reason?: string;
+    }) => void;
+    /** borrowed-readonly — the plan-mode primitive the EnterPlanMode tool calls. */
+    enterPlanMode: () => void;
+    /** borrowed-readonly — the auto-mode INTENT (own seat ∨ chain ∨ checkpoint), the arming's first arm. */
+    autoModeIntent: boolean;
+    /** borrowed-readonly — the peer lane's mount verdict (the classifier's cross-session rule fills only while mounted). */
+    peerLaneActive: boolean;
+    /** borrowed-readonly — whether the BUILT-IN SendMessage is on this face (the lane rule's second term). */
+    peerSendMessageBuiltIn: boolean;
+    /** borrowed-readonly — the trusted Runner self-reference the Workflow mount executes children through; undefined when
+     *  prepareTask runs standalone (then Workflow is simply not mounted). */
+    runnerSelf: WorkflowMountRunner | undefined;
+    /** borrowed-readonly — LATE-BOUND: the memory-engine session; the Workflow mount's capture-floor getter reads it at ITS call time. */
+    memoryEngineSession: () => Prepared["memoryEngineSession"];
+    /** borrowed-readonly — LATE-BOUND: the adopted center artifact; the Workflow mount's two center getters read it at THEIR call time. */
+    centerAdoption: () => {
+        artifact: PromptEpochArtifact;
+        sourceRevision?: string;
+    } | undefined;
+    /** borrowed-readonly — LATE-BOUND: the normalized deny additions; the Workflow mount's parentReadDenyPatterns getter reads it at call time. */
+    readDenyAdditionsNormalized: () => ReadonlyArray<{
+        pattern: string;
+        caseSensitive: boolean;
+    }>;
+}
+export interface PrepareCapsAndWorkflowResult {
+    /** owned — THE run's roster, minted here from the caller's tools; every later mount pushes into this same array
+     *  (`Prepared.tools`, whose JSDoc carries the writer table). Writers here: the map that mints it, then the ReportBlocked,
+     *  ReportFindings, ExitPlanMode, EnterPlanMode and Workflow pushes. */
+    tools: AgentTool[];
+    /** borrowed-mutable — the ReportBlocked tool's write seat (`Prepared.blockedRef`). Writer: the tool at run time; read at
+     *  result assembly. */
+    blockedRef: BlockedRef;
+    /** owned — the per-principal entitlements as resolved (or the fail-closed degrade), undefined = no restriction. */
+    runtimeCaps: RuntimeCaps | undefined;
+    /** owned — whether the caps resolve FAULTED (throw or value screen) — never read off a coined explicit value. */
+    runtimeCapsFaulted: boolean;
+    /** owned — the compliance deny set (every capability under a resolver fault). */
+    complianceDenies: ReadonlySet<ComplianceCapability>;
+    /** owned — whether the compliance resolve faulted (the refusal code distinguishes it). */
+    complianceDegraded: boolean;
+    /** owned — the fork-governance verdict (present only when denied; the ctx reads it call-time). */
+    agentForkDenial: ReturnType<typeof forkGovernanceDenial>;
+    /** owned — the observers grant (`allowObservers === true`, explicit opt-in). */
+    observersActive: boolean;
+    /** owned — the arming outcome as a closed reason (the manifest's auto-mode face). */
+    autoModeArmReason: AutoModeArmReason;
+    /** owned — the armed classifier, or undefined when any arming arm failed. */
+    autoModeDecider: AutoModeDecider | undefined;
+    /** owned — the denial tracker built beside the decider (same face, same arming). */
+    autoModeDenialTracking: AutoModeDenialTracker | undefined;
+    /** owned — the serializable arming recipe (persistArming opt-in only). */
+    autoModeArming: AutoModeArmingRecipe | undefined;
+    /** owned — self-orchestration is ACTIVE for this leg (deployment ready ∧ not entitlement-denied); drives the prompt injection. */
+    selfOrchestrationActive: boolean;
+    /** owned — the Workflow tool is on the roster (the delegation surface's second door). */
+    workflowToolsActive: boolean;
+    /** owned — the mid-session size-guideline seat, armed with the Workflow mount (`Prepared.workflowSizeGuideline`). */
+    workflowSizeGuideline: {
+        legGuideline: WorkflowSizeGuideline;
+        current: () => WorkflowSizeGuideline;
+    } | undefined;
+}
+/** The M4 phase body — prepareTask's caps-and-workflow stretch, verbatim (see the module header). */
+export declare function prepareCapsAndWorkflow(input: PrepareCapsAndWorkflowInput): Promise<PrepareCapsAndWorkflowResult>;
+export {};

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -0,0 +1,255 @@
+import { isSyntheticApiErrorMessage } from "../../internal/harness.js";
+import { createHash } from "node:crypto";
+import { forkGovernanceDenial } from "../../agents/subagent.js";
+import { CROSS_SESSION_CLASSIFIER_RULE } from "../../agents/cross-session-envelope.js";
+import { createRunWorkflowTool, RUN_WORKFLOW_TOOL_NAME } from "../../orchestration/run-workflow-tool.js";
+import { isSelfOrchestrationActive } from "../../orchestration/workflow-script-runner.js";
+import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
+import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
+import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
+import { createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
+import { resolveCheckpointStore } from "../checkpoint-store.js";
+import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, resolveComplianceDenies } from "../compliance.js";
+import { createPresentPlanTool, createEnterPlanModeTool } from "../present-plan-tool.js";
+import { resolveTaskModel } from "../roles.js";
+import { brainToRuntime } from "../runtime.js";
+import { defaultTaskRegistry } from "../task-registry.js";
+import { defineTool, isDefineToolProduct } from "../tools.js";
+import { derivedRouteFallsBack } from "./derived-route-fallback.js";
+import { REPORT_FINDINGS_TOOL_NAME, createReportBlockedTool, createReportFindingsTool } from "./synthetic-tools.js";
+function assembleParentCaptureState(o, i, ctl, ancestors) {
+    const build = (optedOut, indeterminate) => ({
+        optedOut: optedOut === true,
+        indeterminate: indeterminate === true,
+        ...(ctl !== undefined ? { controlDir: ctl } : {}),
+        ancestors,
+    });
+    return o instanceof Promise || i instanceof Promise ? Promise.all([o, i]).then(([ov, iv]) => build(ov, iv)) : build(o, i);
+}
+function screenAutoModeCap(caps, onError, sessionId) {
+    if (caps === undefined)
+        return { caps, faulted: false };
+    if (typeof caps !== "object" || caps === null || Array.isArray(caps)) {
+        onError?.(new Error(`runtimeCapsResolver returned a non-record value (${JSON.stringify(caps)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain). Return a RuntimeCaps object or undefined.`), { phase: "config", sessionId });
+        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
+    }
+    const record = caps;
+    if (record.autoMode === undefined || typeof record.autoMode === "boolean")
+        return { caps: record, faulted: false };
+    onError?.(new Error(`runtimeCapsResolver returned a non-boolean autoMode (${JSON.stringify(record.autoMode)}) — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Return true, false, or omit the key.`), { phase: "config", sessionId });
+    return { caps: { ...record, autoMode: false }, faulted: true };
+}
+function mintPersistedArming(am, laneRule, classifierSystemPrompt, onError, sessionId) {
+    const arming = autoModeArmingRecipeOf(laneRule ? { ...am, crossSessionMessagesRule: true } : am, {
+        promptDigest: `apv1:${createHash("sha256").update(classifierSystemPrompt).digest("hex")}`,
+    });
+    if (arming === undefined) {
+        onError?.(new Error("RunnerDeps.autoMode.persistArming is set but the auto-mode face did not canonicalize into an arming recipe " +
+            "(a rule list carrying a non-string, or a non-finite/out-of-range timeoutMs / failureThreshold / window bound) — " +
+            "NO arming recipe is recorded on this run's parked constraint chain, and a cross-process redemption keeps the " +
+            "conservative behavior (the ancestor classifier answers unavailable and the inherited ask flows to a human)"), { phase: "config", sessionId });
+    }
+    return arming;
+}
+function autoModeArmReasonOf(intent, facePresent, capsAutoMode, capsFaulted) {
+    if (!intent)
+        return "no_intent";
+    if (!facePresent)
+        return "no_face";
+    if (capsAutoMode === false)
+        return capsFaulted ? "resolver_fault" : "denied";
+    return "armed";
+}
+export async function prepareCapsAndWorkflow(input) {
+    const { spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const tools = (spec.tools ?? []).map((t) => {
+        if (isDefineToolProduct(t)) {
+            return maybeOffload(t, t);
+        }
+        return maybeOffload(defineTool({
+            ...t,
+            execute: (args, ctx) => t.execute(args, enrichSpecToolCtx(ctx)),
+        }), t);
+    });
+    const blockedRef = {};
+    if (spec.enableBlockedReport !== false) {
+        tools.push(createReportBlockedTool(blockedRef));
+    }
+    if (!(spec.tools ?? []).some((t) => t.name === REPORT_FINDINGS_TOOL_NAME || t.aliases?.includes(REPORT_FINDINGS_TOOL_NAME))) {
+        tools.push(createReportFindingsTool());
+    }
+    if (spec.enablePlanMode === true && spec.interactiveTools !== false) {
+        const planReviewFace = resolveCheckpointStore(spec, deps) !== undefined;
+        if (spec.interactiveTools === true || planReviewFace) {
+            tools.push(defineTool(createPresentPlanTool(requestReview)));
+            if (planReviewFace) {
+                tools.push(defineTool(createEnterPlanModeTool(enterPlanMode)));
+            }
+        }
+    }
+    let runtimeCaps;
+    let runtimeCapsFaulted = false;
+    if (deps.runtimeCapsResolver) {
+        try {
+            runtimeCaps = (await deps.runtimeCapsResolver(spec.principal)) ?? undefined;
+        }
+        catch (err) {
+            deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
+            runtimeCaps = { allowWorkflows: false, allowFork: false, autoMode: false };
+            runtimeCapsFaulted = true;
+        }
+        const screened = screenAutoModeCap(runtimeCaps, deps.onError, sessionId);
+        runtimeCaps = screened.caps;
+        runtimeCapsFaulted ||= screened.faulted;
+    }
+    let complianceDenies = new Set();
+    let complianceDegraded = false;
+    if (deps.compliancePostureResolver) {
+        try {
+            const posture = (await deps.compliancePostureResolver(spec.principal)) ?? undefined;
+            if (posture !== undefined)
+                complianceDenies = resolveComplianceDenies(posture);
+        }
+        catch (err) {
+            deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
+            complianceDenies = new Set(COMPLIANCE_CAPABILITIES);
+            complianceDegraded = true;
+        }
+        const complianceRefuse = (capability, requested) => {
+            const e = new Error(`${requested} is denied for this principal by the compliance posture (capability "${capability}"` +
+                `${complianceDegraded ? "; the posture resolver is currently failing, so every managed capability is denied fail-closed" : ""}) — ` +
+                `the task is refused rather than silently narrowed.`);
+            e.code = complianceDegraded ? "config.compliance_required" : "config.compliance_denied";
+            throw e;
+        };
+        if (complianceDenies.has("mcp_servers") && lockedPreflight.mcp?.length) {
+            complianceRefuse("mcp_servers", "TaskSpec.mcp (MCP server materialization)");
+        }
+        if (complianceDenies.has("workflows") && spec.selfOrchestration === true) {
+            complianceRefuse("workflows", "TaskSpec.selfOrchestration (workflow self-orchestration)");
+        }
+        if (complianceDenies.has("web_fetch")) {
+            const webTool = (spec.tools ?? []).find((t) => t.name === WEB_FETCH_TOOL_NAME || (t.aliases ?? []).includes(WEB_FETCH_TOOL_NAME));
+            if (webTool !== undefined) {
+                complianceRefuse("web_fetch", `TaskSpec.tools["${webTool.name}"] (the WebFetch tool face)`);
+            }
+        }
+    }
+    const agentForkDenial = forkGovernanceDenial(spec.enableFork, runtimeCaps?.allowFork);
+    const observersActive = runtimeCaps?.allowObservers === true;
+    let autoModeDecider;
+    let autoModeDenialTracking;
+    let autoModeArming;
+    const autoModeArmReason = autoModeArmReasonOf(autoModeIntent, deps.autoMode !== undefined, runtimeCaps?.autoMode, runtimeCapsFaulted);
+    if (autoModeIntent && deps.autoMode !== undefined && runtimeCaps?.autoMode !== false) {
+        const am = deps.autoMode;
+        let classifierModel;
+        try {
+            classifierModel = resolveTaskModel({ modelRole: "classifier" }, deps).model;
+        }
+        catch {
+            classifierModel = model;
+        }
+        if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId, runId })) {
+            classifierModel = model;
+        }
+        const classifierLaneRule = peerLaneActive && peerSendMessageBuiltIn;
+        const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
+        const classifierRuntime = brainToRuntime(deps.brain);
+        autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
+        autoModeDecider = createAutoModeDecider({
+            ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
+            ...(am.failureThreshold !== undefined ? { failureThreshold: am.failureThreshold } : {}),
+            ...(am.onBreakerOpen !== undefined ? { onBreakerOpen: am.onBreakerOpen } : {}),
+            classify: async (input, signal) => {
+                const ctx = await session.buildContext();
+                const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) &&
+                    (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
+                const userPrompt = renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
+                const classifierAuth = await spec.getApiKeyAndHeaders?.(classifierModel);
+                const response = await classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
+                    signal,
+                    ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
+                    ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
+                });
+                return response.content
+                    .filter((c) => c.type === "text")
+                    .map((c) => c.text)
+                    .join("");
+            },
+        });
+        if (am.persistArming === true)
+            autoModeArming = mintPersistedArming(am, classifierLaneRule, classifierSystemPrompt, deps.onError, sessionId);
+    }
+    const deploymentWorkflowReady = runnerSelf !== undefined && isSelfOrchestrationActive(spec, deps);
+    const selfOrchestrationActive = deploymentWorkflowReady && runtimeCaps?.allowWorkflows !== false;
+    if (deploymentWorkflowReady && runtimeCaps?.allowWorkflows === false) {
+        deps.onError?.(new Error(`self-orchestration DENIED for principal "${spec.principal ?? ""}" by runtimeCaps.allowWorkflows=false ` +
+            `(per-principal entitlement governance, not a misconfiguration — the run_workflow tool is not mounted)`), { phase: "config", sessionId });
+    }
+    let workflowToolsActive = false;
+    let workflowSizeGuideline;
+    if (selfOrchestrationActive && runnerSelf && deps.workflowScriptRunner && deps.workflowGovernanceBaseline) {
+        workflowToolsActive = true;
+        const currentSizeGuideline = () => resolveWorkflowSizeGuideline(deps.workflowLimits?.sizeGuideline).size;
+        workflowSizeGuideline = { legGuideline: currentSizeGuideline(), current: currentSizeGuideline };
+        toolEffects.set(RUN_WORKFLOW_TOOL_NAME, "write");
+        tools.push(await createRunWorkflowTool({
+            runner: runnerSelf,
+            scriptRunner: deps.workflowScriptRunner,
+            governanceBaseline: deps.workflowGovernanceBaseline,
+            parentExcludeTools: toolFaceSnapshot.exclude,
+            parentDeferTools: toolFaceSnapshot.defer,
+            parentAlwaysLoadTools: toolFaceSnapshot.alwaysLoad,
+            ...(toolFaceSnapshot.restoreGated !== undefined ? { parentRestoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
+            parentPromptProfile: promptProfile,
+            models: deps.models,
+            agents: deps.agents,
+            builtinAgents: deps.builtinAgents,
+            store: deps.workflowRunStore,
+            journalStore: deps.workflowJournalStore,
+            ...(deps.onBackgroundChildEvent ? { onBackgroundChildEvent: deps.onBackgroundChildEvent } : {}),
+            scriptStore: deps.workflowScriptStore,
+            builtinWorkflows: deps.builtinWorkflows,
+            onAgentSpawn: deps.onWorkflowAgentSpawn,
+            scope: taskScope,
+            notifier: deps.workflowCompletionNotifier,
+            originatingSessionId: sessionId,
+            rootSessionId: internals?.rootSessionId ?? sessionId, ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}),
+            taskRegistry: defaultTaskRegistry,
+            taskNotification: internals?.onTaskNotification,
+            taskOwner: hostTaskId,
+            limits: deps.workflowLimits,
+            sourceTaskId: hostTaskId,
+            parentModel: () => harnessRef.current?.getModel(),
+            ...(spec.getApiKeyAndHeaders !== undefined ? { parentGetApiKeyAndHeaders: spec.getApiKeyAndHeaders } : {}),
+            ...(frozenOnAsk !== undefined ? { parentOnAsk: frozenOnAsk } : {}),
+            principal: spec.principal,
+            oneShot: spec.oneShot,
+            ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
+            parentMemoryCaptureState: () => {
+                const memoryEngineSession = input.memoryEngineSession();
+                const ctl = memoryEngineSession?.engine.controlPlaneDir;
+                const co = memoryEngineSession?.captureOptOut;
+                return assembleParentCaptureState(co?.optedOut() ?? false, co?.indeterminate() ?? false, ctl, [...(internals?.memoryCaptureAncestors ?? []), { sessionId, ...(ctl !== undefined ? { controlDir: ctl } : {}) }]);
+            },
+            autoModeReview: () => (autoModeDecider !== undefined ? { decider: autoModeDecider } : undefined),
+            workflowDepth: internals?.workflowDepth,
+            parentCwd: taskRootFinal,
+            parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
+            parentReadFace: () => carrierReadFace(),
+            parentReadDenyPatterns: () => {
+                const readDenyAdditionsNormalized = input.readDenyAdditionsNormalized();
+                return readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized : undefined;
+            },
+            ...(spec.handsReadOnly === true ? { parentHandsReadOnly: true } : {}), ...(spec.interactiveTools === false ? { parentInteractiveTools: false } : {}),
+            onNotice: deps.onNotice,
+            parentCheckpointStoreDisabled: spec.checkpointStore === null,
+            parentCenterArtifactDigest: () => input.centerAdoption()?.artifact.artifactDigest,
+            parentCenterSourceRevision: () => input.centerAdoption()?.sourceRevision,
+            ...(forwardEvent ? { forwardEvent } : {}),
+            inheritedGateForChildren,
+        }));
+    }
+    return { tools, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline };
+}

package/dist/core/runner/prepare-config-doors.d.ts

@@ -28,7 +28,7 @@ import { type ResolvedRole } from "../roles.js";
 import type { SessionStore } from "../session.js";
 import type { RunnerDeps, TaskLimits, TaskSpec } from "../types.js";
 import { type UsageWindow } from "../usage-window-store.js";
-import type { PrepareResume, RunInternals } from "./prepare-task.js";
+import type { PrepareResume, RunInternals, ToolFaceSnapshot } from "./contracts.js";
 export declare function limitConfigError(code: string, message: string): Error & {
     code?: string;
 };
@@ -138,15 +138,7 @@ export interface PrepareConfigDoorsResult {
     /** owned — the frozen task-start snapshot of the caller's tool-face control arrays; the ONLY thing
      *  later face reads consult (own-task filter, defer classify, delegation ctx). Frozen-immutable ⇒
      *  shared by reference into tool execution ctxs. */
-    toolFaceSnapshot: {
-        exclude: readonly string[] | undefined;
-        defer: readonly string[] | undefined;
-        alwaysLoad: readonly string[] | undefined;
-        /** design/277 — the model-gate restore selector ({@link TaskSpec.restoreGatedTools}), fourth
-         *  seat of the same frozen task-start snapshot: the gate decision and the delegation carrier
-         *  read THIS, never the live spec. */
-        restoreGated: readonly string[] | true | undefined;
-    };
+    toolFaceSnapshot: ToolFaceSnapshot;
     /** owned — the profile half of the RB-50 single decision point (model-independent by contract). */
     promptProfile: "simple" | "classic";
     /** owned — the administrator lock snapshot; the rest of prepare reads guarded slots through it. */

package/dist/core/runner/prepare-defer-classify.d.ts

@@ -0,0 +1,86 @@
+/**
+ * design/390 M11 — prepareTask's TOOL-FACE FOLD + DEFERRED CLASSIFICATION phase: the exclusion valve's
+ * true unmount (in place, on the shared mount array), the full-shell anti-drift invariant, the classic-
+ * profile description swap, `classifyDeferredOverFace` (the one classifier both counterfactual passes
+ * run), the built-in memory pairs' support-name pre-check (sole-cause counterfactual, whole-group
+ * retraction, the engine pair's recall paragraph stripped back out of the memory block) and the final
+ * `deferred` set. The body is the driver's stretch moved verbatim (one exception, named below); the
+ * interface is the dependency list it had implicitly (design/238 R-1).
+ *
+ * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between
+ * the git-status probe before it and the content-origin wrap after it (design/390 §1.5 S1: a stretch
+ * with no await is extracted as a sync function — an `async` wrapper would open a microtask window).
+ *
+ * The one non-move: the stretch used to write `sharedMemoryPairMounted = false` /
+ * `memoryEnginePairMounted = false` on the retraction arm. Nothing reads either flag after this stretch
+ * (the driver's next reader was this stretch's own pair derivation, which runs first), so the two dead
+ * writes are not carried into the Result — the flags arrive as borrowed-readonly inputs.
+ *
+ * Throws pass through unchanged: `internal.full_shell_reachable_mismatch` (an engine invariant, never a
+ * configuration error). The reserved-name refusal for a standing ToolSearch collision is NOT here — it
+ * belongs to the disclosure mount downstream, which reads the `deferred` set this phase returns.
+ */
+import type { AgentTool } from "../../internal/harness.js";
+import type { Model } from "../../internal/llm.js";
+import type { MaterializedA2a } from "../a2a.js";
+import type { MaterializedMcp } from "../mcp.js";
+import type { RunnerDeps, TaskSpec } from "../types.js";
+import type { AnnounceOnceSink, ToolFaceSnapshot } from "./contracts.js";
+export interface PrepareDeferClassifyInput {
+    /** borrowed-readonly — the REBOUND spec (`spec′`); only `tools` is read (the caller roster the
+     *  classifier judges: names for the full-schema filter, specs for the `defer` declarations). */
+    spec: Pick<TaskSpec, "tools">;
+    /** borrowed-readonly — deployment deps; only `deferMode` is read (the classifier's mode knob). */
+    deps: Pick<RunnerDeps, "deferMode">;
+    /** borrowed-mutable — the shared mount array (later refs alias it; in-place contract, never
+     *  re-created). Mutated here, in order: `splice` of every excluded name; element REPLACEMENT with a
+     *  shallow copy for the classic-profile description swap (the caller's ToolSpec object is never
+     *  mutated); `splice` of a retracted memory group. After this phase: the content-origin wrap
+     *  (element replacement with the wrapped object), the disclosure mount, the MCP refresh re-splice. */
+    tools: AgentTool[];
+    /** borrowed-readonly — the frozen task-start tool face: `exclude` (the valve), `defer` (operator
+     *  defers, exact wire names), `alwaysLoad` (the inline pins). */
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "exclude" | "defer" | "alwaysLoad">;
+    /** borrowed-readonly — whether a real execution env is mounted (the full-shell invariant runs only
+     *  where a shell could be on the roster). */
+    handsEnabled: boolean;
+    /** borrowed-readonly — the spec-time precomputation the invariant checks the post-exclusion roster
+     *  against (design/199 D-6): a mismatch is an engine bug, thrown. */
+    fullShellReachable: boolean;
+    /** borrowed-readonly — the resolved prompt profile (`classic` swaps in `descriptionClassic`). */
+    promptProfile: "simple" | "classic";
+    /** borrowed-readonly — the resolved model (the classifier's constant-defer arm reads its shape). */
+    model: Model;
+    /** borrowed-readonly — the materialized MCP roster; only `tools` is read (protocol names for the
+     *  remote-roster arm; `mcpAlwaysLoad` self-declarations, losing to an explicit operator defer). */
+    mcp: Pick<MaterializedMcp, "tools">;
+    /** borrowed-readonly — the materialized A2A roster; only `tools` is read (protocol names). */
+    a2a: Pick<MaterializedA2a, "tools">;
+    /** borrowed-readonly — whether the shared-memory pair mounted (project-context phase). */
+    sharedMemoryPairMounted: boolean;
+    /** borrowed-readonly — whether the engine-memory pair mounted (project-context phase). */
+    memoryEnginePairMounted: boolean;
+    /** borrowed-readonly — the memory block as the project-context phase left it. The engine pair's
+     *  retraction strips the recall paragraph from it and the stripped value returns as
+     *  {@link PrepareDeferClassifyResult.memoryBlock}; the input value itself is never mutated. */
+    memoryBlock: string | undefined;
+    /** borrowed-readonly — the exact recall-discipline segment the memory phase composed (the strip
+     *  removes THIS string, never a re-composition). */
+    memoryRecallSegment: string | undefined;
+    /** borrowed-readonly — the once-per-session ledger's deduplicated operator sink (a retraction is a
+     *  session-level fact, announced once). */
+    onceLedger: AnnounceOnceSink;
+    /** borrowed-readonly — the acquired session's id (operator-line context). */
+    sessionId: string;
+}
+export interface PrepareDeferClassifyResult {
+    /** owned — the FINAL deferred set over the post-exclusion, post-retraction roster: the disclosure
+     *  mount, the deferred registry and `Prepared.deferredToolNames` all read this one set (there is
+     *  deliberately no second classification). Empty ⇒ nothing is deferred. */
+    deferred: Set<string>;
+    /** owned — the memory block after the engine pair's retraction strip (unchanged when no retraction
+     *  ran). The driver binds it under the name the prompt assembly reads. */
+    memoryBlock: string | undefined;
+}
+/** The M11 phase body — prepareTask's tool-face fold + deferred classification, verbatim (module header). */
+export declare function prepareDeferClassify(input: PrepareDeferClassifyInput): PrepareDeferClassifyResult;