@sema-agent/core 7.5.1 → 7.5.2

package/dist/core/runner/prepare-prompt-assembly.d.ts

@@ -0,0 +1,95 @@
+import type { AgentTool } from "../../internal/harness.js";
+import type { Model } from "../../internal/llm.js";
+import { assemblePrompt, type AssembledPrompt } from "../../prompt-assembly/assemble.js";
+import { type PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
+import { type EpochDeclaredSections } from "../../prompt-assembly/epoch.js";
+import { type EnvironmentFacts, type PromptProvider, type PromptTextDeclaration } from "../../prompts/default.js";
+import { type StoredSession } from "../session.js";
+import type { RunnerDeps } from "../types.js";
+import type { AnnounceOnceSink, Prepared, PrepareResume, PromptFeatureFlags, RunInternals } from "./contracts.js";
+/** The center adoption a run composes under: the artifact and, when the source stamped one, its revision. */
+export type CenterAdoption = {
+    artifact: PromptEpochArtifact;
+    sourceRevision?: string;
+};
+export interface PreparePromptAssemblyInput {
+    /** borrowed-mutable — the acquired session. Read: `getPromptEpoch` (the pin, twice — the center arm and the epoch
+     *  resolution), `getBranch` (the freshness discriminator on the pinless arms). Writer here: `appendPromptEpoch`, the
+     *  ONE pin write of this leg (only when the resolution migrated). The acquire phase and the run loop write it elsewhere. */
+    session: Pick<StoredSession, "getPromptEpoch" | "getBranch" | "appendPromptEpoch">;
+    /** borrowed-readonly — the deployment seats: `promptSource` (the center artifact store and its live candidate), `onError`
+     *  (the assembly's warn channel, the prompt-constitution line, the missing-declaration disclosure). Receiver preserved. */
+    deps: Pick<RunnerDeps, "promptSource" | "onError">;
+    /** borrowed-readonly — the trusted spawn-side channel: the parent's center closure (`parentCenterArtifactDigest`,
+     *  `parentCenterSourceRevision`), the top-level freshness facts (`parentTaskId`, `parentSessionId`) and the named-child
+     *  fact the teammate flag reads (`explicitAgentName`). */
+    internals: Pick<RunInternals, "parentCenterArtifactDigest" | "parentCenterSourceRevision" | "parentTaskId" | "parentSessionId" | "explicitAgentName"> | undefined;
+    /** borrowed-readonly — the resume leg, or undefined; PRESENCE only (a resumed leg is never truly fresh). */
+    resume: Pick<PrepareResume, "seed"> | undefined;
+    /** borrowed-readonly — the resolved prompt provider (compared against the default for `isDefaultProvider`). */
+    provider: PromptProvider;
+    /** borrowed-readonly — the caller's role-layer prompt, or undefined. */
+    userSystemPrompt: string | undefined;
+    /** borrowed-readonly — the caller's appended prompt, or undefined. */
+    userAppendSystemPrompt: string | undefined;
+    /** borrowed-readonly — the harness-context flags; the two orchestration flags are re-derived against the post-exclusion
+     *  roster at assembly. */
+    featureFlags: PromptFeatureFlags;
+    /** borrowed-readonly — the MCP instructions block, or undefined. */
+    mcpInstructionsBlock: string | undefined;
+    /** borrowed-readonly — the memory block as the assembly reads it (the recall paragraph already stripped when a
+     *  retraction ran), or undefined. */
+    memoryBlock: string | undefined;
+    /** borrowed-readonly — the environment facts; `date` is the assembly's date, the block builder re-renders on a date change. */
+    envFacts: EnvironmentFacts;
+    /** borrowed-readonly — the resolved prompt profile (a runtime fact of the assembly). */
+    promptProfile: "simple" | "classic";
+    /** borrowed-readonly — the fable mitigations switch (a runtime fact of the assembly). */
+    fableMitigations: boolean;
+    /** borrowed-readonly — the run's ONE tool roster, read only: the assembly receives DETACHED copies, the audit and the
+     *  manifest read it in place. Never mutated here. */
+    tools: AgentTool[];
+    /** borrowed-readonly — the task model; only `promptGuidance` (the model-guidance section). */
+    model: Pick<Model, "promptGuidance">;
+    /** borrowed-readonly — the acquired session id (every operator line's attribution). */
+    sessionId: string;
+    /** borrowed-readonly — the session's reminder provenance mark (the declaration the assembled prompt must render). */
+    reminderMark: string;
+    /** borrowed-readonly — the once-per-session ledger's operator sink (the collision audit's two lines). */
+    onceLedger: Pick<AnnounceOnceSink, "onError">;
+}
+export interface PreparePromptAssemblyResult {
+    /** borrowed-mutable — the LIVE system prompt (an accessor cell over this phase's closure variable). Writers: this
+     *  phase's `renderWithDate` (the date re-render, called by the listings phase's date_change seam); the turn-wiring
+     *  phase's center candidate `apply` (the compaction-boundary swap). Readers: the harness construction, the cache
+     *  fingerprint, the turn snapshot's stable text, the prompt-overhead term. */
+    systemPromptSeat: {
+        current: string;
+    };
+    /** owned — the date re-render, or undefined for a provider whose assembly cannot re-render. Returns the new prompt and
+     *  writes it into `systemPromptSeat`. */
+    renderWithDate: ((date: string) => string) | undefined;
+    /** owned — the physical block face of the assembled prompt, or undefined (the harness's systemBlocks and the turn
+     *  snapshot's layout groups). */
+    systemBlocks: AssembledPrompt["systemBlocks"];
+    /** borrowed-mutable — the composition manifest (`Prepared.promptManifest`). Writers after this phase: the tool-disclosure
+     *  phase writes `toolDisclosure` (when deferred tools exist); the turn-wiring phase backfills `snapshot` and `lowering`
+     *  once the final wire tool list exists. */
+    promptManifest: Prepared["promptManifest"];
+    /** owned — the provider-declared sections in the epoch shape (id, slot, chars, opt-in contentHash; never text). */
+    epochDeclaredSections: EpochDeclaredSections;
+    /** owned — the resolved epoch's artifact digest, the turn snapshot's identity element. */
+    epochArtifactDigestForSnapshot: string;
+    /** owned — the re-invokable assemble-inputs BUILDER: the compaction-boundary candidate re-assembles with a new
+     *  artifact's declarations through it (facts and tails identical; only the center closure differs). */
+    buildAssembleInputs: (centerDecls?: PromptTextDeclaration[]) => Parameters<typeof assemblePrompt>[0];
+    /** borrowed-mutable — the LIVE center adoption (an accessor cell over this phase's closure variable), or undefined.
+     *  Writers: this phase (the three arms; the all-shadowed drop on the fresh arm); the turn-wiring phase's center
+     *  candidate `apply` (the boundary swap / the explicit-disable rollback). Readers: the two late-bound ctx getters
+     *  (inherited-gate, caps-and-workflow), the pin write, the candidate's same-artifact test. */
+    centerAdoptionRef: {
+        current: CenterAdoption | undefined;
+    };
+}
+/** The M13 phase body — prepareTask's prompt-assembly stretch, verbatim (see the module header). */
+export declare function preparePromptAssembly(input: PreparePromptAssemblyInput): Promise<PreparePromptAssemblyResult>;

package/dist/core/runner/prepare-prompt-assembly.js

@@ -0,0 +1,162 @@
+import { createHash } from "node:crypto";
+import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
+import { assemblePrompt } from "../../prompt-assembly/assemble.js";
+import { artifactDeclarations } from "../../prompt-assembly/artifact.js";
+import { resolveEpochAgainstBundled } from "../../prompt-assembly/epoch.js";
+import { SEMA_DEFAULT_PACK } from "../../prompt-assembly/packs/sema-default.js";
+import { auditToolCollisions, projectToolManifest } from "../../prompt-assembly/tool-catalog.js";
+import { buildEnvironmentContext, defaultPromptProvider } from "../../prompts/default.js";
+import { protocolOf } from "../protocol-table.js";
+import { reminderMarkDeclaration } from "../reminder-mint.js";
+import { hasConversationContent } from "../session.js";
+import { PROMPT_HASH_SALT } from "./prompt-hash-salt.js";
+export async function preparePromptAssembly(input) {
+    const { session, deps, internals, resume, provider, userSystemPrompt, userAppendSystemPrompt, featureFlags, mcpInstructionsBlock, memoryBlock, envFacts, promptProfile, fableMitigations, tools, model, sessionId, reminderMark, onceLedger } = input;
+    let centerAdoption;
+    let centerAdoptionFresh = false;
+    {
+        const failUnavailable = (digest, via) => {
+            const e = new Error(`prompt snapshot unavailable: ${via} center prompt artifact ${digest.slice(0, 23)}… has no verified resolvable copy (artifact store miss/corrupt${deps.promptSource === undefined ? "; RunnerDeps.promptSource is not configured" : ""}) — refusing to recompose a hybrid prompt (protocol §9.2)`);
+            e.code = "prompt.snapshot_unavailable";
+            throw e;
+        };
+        const pinnedEarly = await session.getPromptEpoch();
+        if (pinnedEarly?.centerArtifactDigest !== undefined) {
+            const art = await deps.promptSource?.get(pinnedEarly.centerArtifactDigest);
+            if (art === undefined)
+                failUnavailable(pinnedEarly.centerArtifactDigest, "this session is pinned to");
+            centerAdoption = { artifact: art, ...(pinnedEarly.sourceRevision !== undefined ? { sourceRevision: pinnedEarly.sourceRevision } : {}) };
+        }
+        else if (pinnedEarly === undefined) {
+            if (internals?.parentCenterArtifactDigest !== undefined) {
+                const art = await deps.promptSource?.get(internals.parentCenterArtifactDigest);
+                if (art === undefined)
+                    failUnavailable(internals.parentCenterArtifactDigest, "the spawning parent adopted");
+                centerAdoption = {
+                    artifact: art,
+                    ...(internals.parentCenterSourceRevision !== undefined ? { sourceRevision: internals.parentCenterSourceRevision } : {}),
+                };
+            }
+            else if (resume === undefined && internals?.parentTaskId === undefined && internals?.parentSessionId === undefined) {
+                const candidate = deps.promptSource?.current();
+                if (candidate !== undefined && !hasConversationContent(await session.getBranch())) {
+                    centerAdoption = { artifact: candidate.artifact, sourceRevision: candidate.sourceRevision };
+                    centerAdoptionFresh = true;
+                }
+            }
+        }
+    }
+    const buildAssembleInputs = (centerDecls) => ({
+        provider,
+        isDefaultProvider: provider === defaultPromptProvider,
+        userSystemPrompt,
+        userAppendSystemPrompt,
+        tools: tools.map((t) => (t.aliases === undefined ? { ...t } : { ...t, aliases: [...t.aliases] })),
+        facts: {
+            supervisorEnabled: false,
+            teammateEnabled: internals?.explicitAgentName !== undefined && tools.some((t) => t.name === SEND_MESSAGE_TOOL_NAME),
+            ...featureFlags,
+            orchestrationEnabled: featureFlags.orchestrationEnabled && tools.some((t) => t.name === "Workflow"),
+            orchestrationDeferred: featureFlags.orchestrationDeferred && tools.some((t) => t.name === "Workflow"),
+            promptProfile,
+            fableMitigations,
+        },
+        mcpInstructionsBlock,
+        memoryBlock,
+        buildEnvBlock: (date) => buildEnvironmentContext({ ...envFacts, date }) || undefined,
+        date: envFacts.date,
+        ...(model.promptGuidance && model.promptGuidance.length > 0 ? { modelGuidance: model.promptGuidance.join("\n\n") } : {}),
+        onWarn: (message, phase) => deps.onError?.(new Error(message), { phase, sessionId }),
+        ...(centerDecls !== undefined ? { centerDeclarations: centerDecls } : {}),
+    });
+    const assembled = assemblePrompt(buildAssembleInputs(centerAdoption !== undefined ? artifactDeclarations(centerAdoption.artifact) : undefined));
+    if (centerAdoption !== undefined && assembled.centerMounted !== true) {
+        const ownsWholePrompt = assembled.constitution === "provider-assembled";
+        const digest = centerAdoption.artifact.artifactDigest.slice(0, 23);
+        if (ownsWholePrompt) {
+            const e = new Error(`center prompt artifact ${digest}… cannot mount: this PromptProvider owns the whole prompt (assembled-identity pass-through) — upgrade the provider to stableBlocks/stableSystem or remove RunnerDeps.promptSource for this deployment`);
+            e.code = "prompt.center_unmountable";
+            throw e;
+        }
+        deps.onError?.(new Error(centerAdoptionFresh
+            ? `prompt-constitution: center prompt artifact ${digest}… contributed NO section to this prompt — every section it declares collides with a PromptProvider stableBlocks declaration of the same id, and the deployment-local declaration wins. This session runs on the bundled prompt and is deliberately NOT pinned to the artifact (a pin claiming content the model never received would be durable and wrong). Rename the colliding section ids on either side to adopt it; the per-section collisions are reported individually on this channel.`
+            : `prompt-constitution: this session is pinned to center prompt artifact ${digest}…, but under the CURRENT PromptProvider every section that artifact declares collides with a stableBlocks declaration of the same id, so none of them compiled into this prompt. The session keeps its pin and continues on the bundled prompt — its epoch's declaredSections record what actually compiled. Rename the colliding section ids on either side to restore the artifact's content.`), { phase: "prompt-constitution", sessionId });
+        if (centerAdoptionFresh)
+            centerAdoption = undefined;
+    }
+    let systemPrompt = assembled.systemPrompt;
+    if (!systemPrompt.includes(reminderMarkDeclaration(reminderMark))) {
+        deps.onError?.(new Error("reminder-mark declaration missing from the assembled system prompt: this run's PromptProvider owns the prompt and did not render the mark declaration, so engine <system-reminder> tags carry a mark the model is never told about (the impersonation defense is inactive for this deployment). Render `reminderMarkDeclaration(ctx.reminderMark)` (exported; the value rides StablePromptContext.reminderMark) in the provider, or accept the disclosure."), { phase: "config", sessionId });
+    }
+    const renderWithDate = assembled.renderWithDate
+        ? (date) => {
+            systemPrompt = assembled.renderWithDate(date);
+            return systemPrompt;
+        }
+        : undefined;
+    const promptConstitution = assembled.constitution;
+    const promptBlocks = assembled.legacyBlocks;
+    const collisionAudit = auditToolCollisions(tools);
+    for (const y of collisionAudit.yields) {
+        onceLedger.onError(new Error(`tool mount: caller tool "${y.name}" shadows another tool with the same canonical name (deliberate last-write-wins yield — the later mount serves)`), { phase: "config", sessionId });
+    }
+    for (const c of collisionAudit.aliasCollisions) {
+        onceLedger.onError(new Error(`tool mount: alias "${c.alias}" is claimed by both "${c.owners[0]}" and "${c.owners[1]}" (design/141 warn face — name resolution serves the later mount)`), { phase: "config", sessionId });
+    }
+    const saltedHash = (text) => createHash("sha256").update(PROMPT_HASH_SALT).update(text).digest("hex").slice(0, 12);
+    const promptManifest = {
+        constitution: promptConstitution,
+        blocks: promptBlocks.map((b) => ({ id: b.id, chars: b.text.length, hash: saltedHash(b.text) })),
+        ...(assembled.sections
+            ? { sections: assembled.sections.map((s) => ({ id: s.id, slot: s.slot, carrier: s.carrier, cadence: s.cadence, cacheClass: s.cacheClass, chars: s.text.length, hash: saltedHash(s.text), ...(s.declaredContentHash !== undefined ? { contentHash: s.declaredContentHash } : {}) })) }
+            : {}),
+        tools: projectToolManifest(tools, (t) => protocolOf(t.name)?.id ?? "caller"),
+    };
+    const epochDeclaredSections = (assembled.sections ?? [])
+        .filter((s) => s.origin === "provider")
+        .map((s) => ({ id: s.id, slot: s.slot, chars: s.text.length, ...(s.declaredContentHash !== undefined ? { contentHash: s.declaredContentHash } : {}) }));
+    let epochArtifactDigestForSnapshot = "";
+    {
+        const pinned = await session.getPromptEpoch();
+        const resolved = resolveEpochAgainstBundled(pinned, SEMA_DEFAULT_PACK, epochDeclaredSections);
+        epochArtifactDigestForSnapshot = resolved.descriptor.artifactDigest;
+        if (resolved.migrated) {
+            const priorConversation = pinned === undefined ? hasConversationContent(await session.getBranch()) : true;
+            const activatedBy = pinned === undefined && !priorConversation ? "session_start" : "legacy_migration";
+            await session.appendPromptEpoch({
+                ...resolved.descriptor,
+                activatedBy,
+                ...(centerAdoption !== undefined
+                    ? {
+                        centerArtifactDigest: centerAdoption.artifact.artifactDigest,
+                        ...(centerAdoption.sourceRevision !== undefined ? { sourceRevision: centerAdoption.sourceRevision } : {}),
+                    }
+                    : {}),
+            });
+        }
+    }
+    return {
+        systemPromptSeat: {
+            get current() {
+                return systemPrompt;
+            },
+            set current(v) {
+                systemPrompt = v;
+            },
+        },
+        renderWithDate,
+        systemBlocks: assembled.systemBlocks,
+        promptManifest,
+        epochDeclaredSections,
+        epochArtifactDigestForSnapshot,
+        buildAssembleInputs,
+        centerAdoptionRef: {
+            get current() {
+                return centerAdoption;
+            },
+            set current(v) {
+                centerAdoption = v;
+            },
+        },
+    };
+}

package/dist/core/runner/prepare-prompt-inputs.d.ts

@@ -27,27 +27,8 @@ import type { LockedPreflight } from "../locked-config.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { ResolvedRole } from "../roles.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
-import type { PrepareResume, RunInternals, ToolFaceSnapshot } from "./contracts.js";
+import type { PrepareResume, PromptFeatureFlags, RunInternals, ToolFaceSnapshot } from "./contracts.js";
 import { type GitStatusLaneRef } from "./git-status-frame.js";
-/** The runtime feature flags the stable prompt's harness-context block gates its sections on
- *  (design/64 §6.3: claim only what the task has). Spread into the assembly's StablePromptContext
- *  by the driver, which re-derives the two orchestration flags against the post-exclusion roster. */
-export interface PromptFeatureFlags {
-    policyEnabled: boolean;
-    hooksEnabled: boolean;
-    isolationEnabled: boolean;
-    reminderMark: string;
-    readFaceOpen: boolean;
-    orchestrationEnabled: boolean;
-    orchestrationDeferred: boolean;
-    promptProfile: "simple" | "classic";
-    fableMitigations: boolean;
-    goalEnabled: boolean;
-    awarenessEnabled: boolean;
-    worktreeIsolated: boolean;
-    withinTaskCompactionEnabled: boolean;
-    isSubagent: boolean;
-}
 export interface PreparePromptInputsInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `promptProvider`, `hooks` (flag), `systemPrompt`
      *  / `appendSystemPrompt` (the user prompt sources), `clientContext` (zone, email), `envFacts` (the

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -75,9 +75,9 @@ export interface PrepareProtocolToolsResult {
     rebuildHarnessToolsRef: {
         current?: () => Promise<void>;
     };
-    /** borrowed-mutable — the content-origin re-classification seat. Writer: the content-origin wrap section
-     *  (installs the re-runnable pass ONCE, when an engine-memory session mounted; undefined otherwise). Read by
-     *  the rebuild closures before a swapped-in tool becomes callable. */
+    /** borrowed-mutable — the content-origin re-classification seat. Writer: the memory-engine-session phase
+     *  (installs the re-runnable pass ONCE when it arms — a mounted engine-memory session or an upstream recorder
+     *  channel; undefined otherwise). Read by the rebuild closures before a swapped-in tool becomes callable. */
     contentOriginWrapRef: {
         current?: () => void;
     };

package/dist/core/runner/prepare-protocol-tools.js

@@ -19,7 +19,6 @@ export async function prepareProtocolTools(input) {
         const callerNames = new Set((spec.tools ?? []).flatMap((t) => [t.name, ...(t.aliases ?? [])]));
         const clash = mcp.tools.find((t) => [t.name, ...(t.aliases ?? [])].some((name) => callerNames.has(name)));
         if (clash) {
-            await mcp.dispose();
             const e = new Error(`Tool name "${clash.name}" is reserved by an injected MCP tool — a caller tool of the same name would silently shadow it.`);
             e.code = "config.reserved_tool_name";
             throw e;
@@ -156,8 +155,6 @@ export async function prepareProtocolTools(input) {
         const callerNames = new Set((spec.tools ?? []).flatMap((t) => [t.name, ...(t.aliases ?? [])]));
         const clash = a2a.tools.find((t) => callerNames.has(t.name));
         if (clash) {
-            await a2a.dispose();
-            await mcp.dispose();
             const e = new Error(`Tool name "${clash.name}" is reserved by an injected A2A tool — a caller tool of the same name would silently shadow it.`);
             e.code = "config.reserved_tool_name";
             throw e;

package/dist/core/runner/prepare-question-face.d.ts

@@ -17,30 +17,12 @@
  * live read owes.
  */
 import type { AgentTool } from "../../internal/harness.js";
-import { type OnQuestion, type QuestionAnswer } from "../ask-question.js";
+import { type OnQuestion } from "../ask-question.js";
 import { type CheckpointStore } from "../checkpoint-store.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec } from "../types.js";
 import type { PrepareResume } from "./contracts.js";
-export declare const CONTENT_ASK_BINDING_CAP = 32;
-/** One gate-routed content-ask outcome, keyed by the call id it was produced for (see the table's own note). */
-export type ContentAskBinding = ({
-    kind: "answered";
-    answer: QuestionAnswer;
-} | {
-    kind: "failed";
-    error: unknown;
-}) & {
-    /** Digest of the exact question batch this outcome belongs to. The call id alone is not enough
-     *  to redeem a binding: it comes from the model/provider and can repeat, so an entry that
-     *  outlived its call (its call was allowed but never executed) could otherwise be handed to a
-     *  LATER call that happens to reuse the id. Matching on the batch as well means an outcome can
-     *  only ever be delivered for the question it was produced for. */
-    questionsHash: string;
-    /** The engine-minted per-delivery identity (see AskQuestionRequest.deliveryId) — carried so a
-     *  stranded-answer disclosure names DELIVERIES, not call ids: call ids can repeat, and a
-     *  disclosure keyed on them would collapse two lost answers into one. */
-    deliveryId: string;
-};
+import { type ContentAskBinding } from "./content-ask-bindings.js";
+export { CONTENT_ASK_BINDING_CAP, type ContentAskBinding } from "./content-ask-bindings.js";
 export interface PrepareQuestionFaceInput {
     /** borrowed-readonly — the run's frozen question seat (spec > deps), resolved once at the top of prepare;
      *  the mount predicate and the live-face derivation both read this one value. */

package/dist/core/runner/prepare-question-face.js

@@ -1,7 +1,8 @@
 import { createAskUserQuestionTool, isLiveQuestionFace } from "../ask-question.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
-export const CONTENT_ASK_BINDING_CAP = 32;
+import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
+export { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 export function prepareQuestionFace(input) {
     const { frozenOnQuestion, spec, deps, runtimeCaps, resolvedInteractionPosture, resume, sessionId, tools, inheritedUnavailableAsks } = input;
     const onQuestion = frozenOnQuestion;

package/dist/core/runner/prepare-safety-scan.d.ts

@@ -1,10 +1,5 @@
 import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
 import type { IrreversibilityTier, ReversibilityProbes } from "./contracts.js";
-/** The namespaced-name shapes the protocol table currently owns, rendered for the two messages that have
- *  to name them (the caller-name reservation and the policy audit's unprefixed-name arm). Read from the
- *  table rather than written out: a message that hard-codes ONE protocol becomes wrong — while staying
- *  green — the moment a second one is appended, and both messages tell a deployment what to write. */
-export declare const NAMESPACED_NAME_SHAPES: string;
 export interface PrepareSafetyScanInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`, the config-doors result). The scan reads
      *  `tools`, `handsReadOnly` and `enablePlanMode`; it never mutates. */

package/dist/core/runner/prepare-safety-scan.js

@@ -1,8 +1,7 @@
-import { PROTOCOL_TABLE } from "../protocol-table.js";
+import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
 import { HAND_TOOL_EFFECTS } from "../../tools/fs/index.js";
 import { OFFLOAD_TOOL_NAME } from "../tool-result-store.js";
 import { PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
-export const NAMESPACED_NAME_SHAPES = PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(", ");
 export function prepareSafetyScan(input) {
     const { spec, deps } = input;
     const toolEffects = new Map();

package/dist/core/runner/prepare-suspend-saga.d.ts

@@ -0,0 +1,170 @@
+/**
+ * design/390 §1.2 M19 (suspend saga) — prepareTask's DURABLE SETTLEMENT machinery, verbatim from the driver's
+ * gate-machinery block: the in-flight spend and repair-bundle folds, the §4.bis correctness-state serializer, the shared
+ * paused-VM compensation bound to this task's failure ledger, the put-commit + put-failure saga (the pre-put cut
+ * checkpoint, the screening-park disclosure, the rejection read-back with its three answers), the suspend-loop cap, the
+ * env capability split (suspendable / park-only / neither) and the park-only handle. The module-scope helpers only this
+ * segment called moved with it (the compensation's bound and body, the auto-mode latch reading, the placement stamp).
+ * The interface is the dependency list the segment had implicitly (design/238 R-1) — every seat below used to be
+ * captured off the driver's scope.
+ *
+ * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (every await lives inside the closures it
+ * builds, which run at park time), so the phase adds no yield between the ask lane before it and the boundary parks
+ * after it (design/390 §1.5). Read-stability of the host handles for the call: {@link RunInternals}
+ * (`@contract prepare.deps-read-stable`).
+ *
+ * The saga exists exactly when the wiring-manifest phase's `gateMachineryActive` holds (the ask lane's presence law) —
+ * the boundary parks and the park closure key off `saga`'s presence, so the orchestrator grows no branch.
+ */
+import type { AgentHarness, ExecutionEnv } from "../../internal/harness.js";
+import type { AutoModeDecider } from "../auto-mode.js";
+import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
+import type { RemoteExecutionEnv, SnapshotId } from "../remote-env.js";
+import type { CheckpointStore, SerializedCheckpointState } from "../checkpoint-store.js";
+import type { RemoteEnvFailureNote, RunnerDeps } from "../types.js";
+import type { CwdRef } from "../../tools/fs/fs-shared.js";
+import type { ReadFileState } from "../../tools/fs/safety.js";
+import type { OutputRef } from "./synthetic-tools.js";
+import type { HookInvocationIdentity } from "../hooks.js";
+import type { InheritedGate, Prepared, PrepareResume, RunInternals, SuspendSaga } from "./contracts.js";
+/**
+ * design/384 slice 2 — the ONE compensation for a paused-but-unparked VM, shared by the fence's
+ * post-pause checkpoints (③ in the park closure, ④ in the saga) and the saga's put-failure absent
+ * arm (previously inline there: same two hops, one implementation now, so the three sites cannot
+ * drift). Restores the workspace (bounded transient retry) then re-establishes consistency
+ * (`postResumeInit`), both hops under one INDEPENDENT `AbortSignal.timeout(io.boundMs)` —
+ * deliberately NOT the run/cut signal: the remote contract answers an already-aborted signal
+ * `{ok:false,"aborted"}`, so gating the restore on the very signal whose firing caused the
+ * compensation made it die instantly and strand the paused VM on exactly the run-abort arm that
+ * needs it most. The adapter signal is best-effort (a deaf adapter ignores it), so the caller's
+ * await is ALSO raced against the same bound — bounded decision, three outcomes:
+ *  · settled ok  ⇒ the VM is running again ({ok:true});
+ *  · settled not-ok / threw ⇒ recorded + disclosed, {ok:false} — the caller takes its fatal
+ *    fail-closed arm (abort the run; never continue on a paused VM);
+ *  · bound fires with the adapter still in flight ⇒ {ok:false} NOW, and the in-flight call
+ *    continues DETACHED + swallow-guarded with the late-settlement split:
+ *     – late SUCCESS: a running VM now exists with no run and no committed row to own it — the
+ *       detached continuation compensates the compensation with `destroy()` (the adapter's own
+ *       best-effort contract, swallow-guarded, disclosed);
+ *     – late FAILURE: disclosed; the VM is most likely still paused — provider-side TTL/GC
+ *       territory, and the disclosure is the end of this engine's obligation (a deaf adapter's
+ *       stranded VM is that adapter's own defect surface).
+ * Decide-then-disclose throughout: `io.disclose`/`io.noteFailure` must be swallow-guarded by the
+ * caller's binding, and nothing they do can change the returned verdict. Never throws. Exported for
+ * direct unit pinning (the bounded/deaf/late arms need a small bound; production binds the
+ * `PARK_COMPENSATION_TIMEOUT_MS` constant at the one call-site closure).
+ */
+export declare function compensateUnparkedPause(remoteEnv: RemoteExecutionEnv, snapshotId: SnapshotId, io: {
+    boundMs: number;
+    noteFailure: (note: RemoteEnvFailureNote) => void;
+    disclose: (err: unknown) => void;
+}): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+}>;
+export interface PrepareSuspendSagaInput {
+    /** borrowed-readonly — the wiring-manifest phase's ONE activation predicate; false ⇒ this phase builds nothing and
+     *  returns an absent saga. */
+    gateMachineryActive: boolean;
+    /** borrowed-mutable — prepare's abort seat. Writer here: the fail-closed arms (`abort()` when a paused VM cannot be
+     *  restored, when the put outcome is unknowable, when the loop cap trips); `.signal` is read by the mint sites. */
+    abortController: {
+        readonly signal: AbortSignal;
+        abort(): void;
+    };
+    /** borrowed-mutable — the built harness. Writer here: `abort()` on the same fail-closed arms (release the gate,
+     *  then stop the loop — the two-step every stop in this file takes). */
+    harness: Pick<AgentHarness, "abort">;
+    /** borrowed-readonly — the leg's checkpoint store, or undefined (then the saga answers `absent` and no park commits). */
+    checkpointStore: CheckpointStore | undefined;
+    /** borrowed-readonly — the deployment's error face, as a Pick over the SAME `deps` object (receiver preserved for
+     *  `deps.onError?.()`): the put-failure disclosures, the compensation's disclose binding, the cap line. */
+    deps: Pick<RunnerDeps, "onError">;
+    /** borrowed-readonly — the acquired session id (every disclosure's tag, the running-tasks owner triple, the row's
+     *  session). */
+    sessionId: string;
+    /** borrowed-readonly — the per-task identity (the running-tasks owner triple). */
+    hostTaskId: string;
+    /** borrowed-readonly — the registry scope (the running-tasks owner triple). */
+    taskScope: string;
+    /** borrowed-readonly — the loop's live spend seat (`Prepared.liveSpendRef`); `.get` is read at mint time. Not written
+     *  here (runtask sets `.get`). */
+    liveSpendRef: Prepared["liveSpendRef"];
+    /** borrowed-readonly — the resume leg, or undefined: `seed.nestedStats` (the spend delta's base), `seed.repairBundle`
+     *  (the pass-through bundle). */
+    resume: Pick<PrepareResume, "seed"> | undefined;
+    /** borrowed-readonly — the cumulative nested-usage accumulator (`Prepared.nestedStats`); read at mint time, copied
+     *  onto the row. */
+    nestedStats: Prepared["nestedStats"];
+    /** borrowed-readonly — the trusted spawn-side channel: `repairBundle` (the live bundle) and `delegationProvenance`
+     *  (the aggregate copied onto the row). */
+    internals: Pick<RunInternals, "repairBundle" | "delegationProvenance"> | undefined;
+    /** borrowed-readonly — the ToolSearch activation set (`Prepared.activeTools`); copied onto the row at mint time. */
+    activeTools: Prepared["activeTools"];
+    /** borrowed-readonly — the structured-output seat; `value`/`set` are copied onto the row at mint time. */
+    outputRef: OutputRef;
+    /** borrowed-readonly — the hand's read-file state for the checkpoint, or undefined (hands-less); its entries are
+     *  copied onto the row at mint time. */
+    readFileStateForCheckpoint: ReadFileState | undefined;
+    /** borrowed-readonly — the inherited-gate phase's read-face section builder (the row's `readFace`). */
+    faceCheckpointSection: () => SerializedCheckpointState["readFace"];
+    /** borrowed-readonly — the leg's reminder provenance mark (travels with the row). */
+    reminderMark: string;
+    /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read at mint time. Not written here. */
+    handsCwdRef: CwdRef | undefined;
+    /** borrowed-readonly — the active EnterWorktree session seat, or undefined; `current` is read at mint time. */
+    worktreeSessionRef: Prepared["worktreeSessionRef"];
+    /** borrowed-readonly — the LIVE inherited parent constraints, or undefined (the row's `requiresParentConstraint`,
+     *  count, frozen chain and the screening-park disclosure's predicate). */
+    inheritedParentConstraints: NonNullable<InheritedGate["parentConstraints"]>[number][] | undefined;
+    /** borrowed-readonly — the resume seed's inherited gate, or undefined (the carried-forward half of the same fields). */
+    seedInheritedGate: PrepareResume["seed"]["inheritedGate"];
+    /** borrowed-readonly — the inherited ancestor rules (data half), cloned onto the row. */
+    inheritedAncestorRules: InheritedGate["ancestorRules"];
+    /** borrowed-readonly — the inherited shell-gate doctrine, persisted verbatim. */
+    inheritedShellGate: InheritedGate["shellGate"];
+    /** borrowed-readonly — the auto-mode intent (seat ∨ live ∨ seed), carried while the latch is healthy. */
+    autoModeIntent: boolean;
+    /** borrowed-readonly — the auto-mode decider, or undefined (the latch-health reading only). */
+    autoModeDecider: AutoModeDecider | undefined;
+    /** borrowed-readonly — the inherited admitted org scopes, or undefined (copied onto the row). */
+    inheritedAdmittedOrgScopes: readonly string[] | undefined;
+    /** borrowed-readonly — this leg's OWN org verdict seat; `current` is read at mint time. Not written here. */
+    ownOrgVerdictRef: {
+        current: OwnOrgAdmissionVerdict | undefined;
+    };
+    /** borrowed-readonly — the monotonic org-governed provenance bit. */
+    orgGovernedProvenance: boolean;
+    /** borrowed-readonly — the listing frames' announced name-sets mirror (`Prepared.announcedListingsRef`); serialized
+     *  onto the row at mint time. */
+    announcedListingsRef: Prepared["announcedListingsRef"];
+    /** borrowed-readonly — the git frame's lane ref (`Prepared.gitStatusRef`); `announced` is copied at mint time. */
+    gitStatusRef: Prepared["gitStatusRef"];
+    /** borrowed-readonly — the leg's identity envelope; only `isDelegatedChild` is read (the row's presence-coded bit). */
+    hookIdentity: Pick<HookInvocationIdentity, "isDelegatedChild">;
+    /** borrowed-readonly — the frozen prepare-time placement resolution (the row's placement stamp). */
+    placementRootResolved: string;
+    /** borrowed-readonly — the external-content-target fold (the row's monotonic bit). */
+    externalContentTargetActive: boolean;
+    /** borrowed-mutable — the run-scoped remote-lifecycle failure log (`Prepared.remoteEnvFailures`). Writer here: the
+     *  compensation's note binding (`push`). */
+    remoteEnvFailures: Prepared["remoteEnvFailures"];
+    /** borrowed-readonly — the memory-engine session, or undefined; `harvest("checkpoint")` is called at the commit door. */
+    memoryEngineSession: Prepared["memoryEngineSession"];
+    /** borrowed-mutable — the loop-cap latch (`Prepared.suspendLoopRef`). Writer here: `hit = true` when the cap trips. */
+    suspendLoopRef: Prepared["suspendLoopRef"];
+    /** borrowed-readonly — the per-task owned env when a factory minted one, or undefined (the capability split). Never
+     *  destroyed here. */
+    ownedEnv: ExecutionEnv | undefined;
+    /** borrowed-readonly — the restore-incomplete adapter's missing members, or undefined (excluded from both targets). */
+    incompleteSuspendAdapter: readonly ("resumeVM" | "postResumeInit")[] | undefined;
+}
+export interface PrepareSuspendSagaResult {
+    /** owned — the saga, or undefined exactly when `gateMachineryActive` is false (the boundary parks and the park closure
+     *  key off this seat). */
+    saga: SuspendSaga | undefined;
+}
+/** The M19 suspend-saga phase body — prepareTask's durable settlement stretch, verbatim (see the module header). */
+export declare function prepareSuspendSaga(input: PrepareSuspendSagaInput): PrepareSuspendSagaResult;