@sema-agent/core 7.5.2 → 7.6.1

package/CHANGELOG.md

@@ -1,5 +1,72 @@
 # Changelog
 
+## 7.6.1 — 2026-09-07
+
+Patch: three bug fixes from the 7.6.0 field and black-box rounds (#608 P1, #609, #610) and the first refactor wave (design/393 S0, #594, #598), all byte-invariant on the runtime except where named. One public d.ts narrowing is called out below.
+
+### Fixed
+- **#608 (P1)** — the file store's single-writer directory lock judged its owner by pid number alone, so a dead holder's pid recycled to an unrelated process kept the lock "in use" and every engine start failed with `store.dir_in_use` until an operator deleted the lock by hand (the cli production shape: two LOCK files reading `79814`, no trailing newline). The lock record now carries a process fingerprint `{pid, startedAtMs, startedSinceBootMs, host, v: 2}`; liveness is "pid alive AND not falsified by BOTH clocks" (a wall-clock start and an uptime-relative start — each unreliable exactly where the other is sound); a record from another host, or one without a comparable measure, keeps the pre-fingerprint verdict (a false "dead" reclaims a working writer's directory; a false "live" costs one refusal an operator can act on); a reboot the host has outlived is the uptime measure's second way of saying gone. Bare-pid locks are read by pid and rewritten on reclaim. What the guards cannot see (a same-boot backward clock correction hiding a genuine reuse; a reboot the machine has since outlived with no comparable measure) falls back to the pre-existing refusal, never a wrong reclaim — a boot-scoped kernel start token is the design-level fix (#612).
+- **#609** — a resume of a parked policy ask that still spells the retired decision facts (`settledBy` / `approver` as top-level keys) is refused before the CAS with a coded error naming the `hostDecision` shape, instead of having the keys silently ignored (found by the 7.6.0 black-box round, G2.b).
+- **#610** — every connect-phase MCP failure reports `delivered: "no"` — the dial has dispatched nothing of the caller's, so the verdict is a fact, not the in-flight guess; the two kinds a server itself answered (`protocol`, `http_status`) keep the table verdict. One verdict table (`DELIVERED_BY_KIND`, fenced over the closed set) replaces the per-row spellings. A stdio child that exits before the handshake is now `connection_closed / no` (was `unknown`); a 401 endpoint stays `http_status / unknown`; the request phase is unchanged. The dial's `no` promises that no call of the caller's was dispatched — it does not promise that no user data crossed the line during the handshake's elicitation (#611).
+- **#594-b** — the #594 station relocation had put one microtask between the fold and the lanes (and one more inside the screening wrapper), so an org rule cleared on that tick was read as absent and a call 7.6.0 denied was let through; the three station-group seams (screening→fold, fold→lanes, lanes→exit) are back to the one-body form's await boundaries — the next group runs inside the previous group's continuation via a `GatePass.afterFold` seat. Five boundary pins record the microtask counts against the 7.6.0 tree.
+- 7.6.0 carry-over disclosure: the D-8 refusal text `Resume it via checkpointToken` became `Resume it via the pause's token` (wording only).
+
+### BREAKING (d.ts face only — runtime unchanged)
+- Option types and orchestration entry points that used to name the `Runner` CLASS for their `runner` member / parameter (`TaskServerOptions`, `SubagentToolOptions`, `SendMessageToolOptions`, `RunWorkflowToolDeps`, `warmResume`, `runGoal`, `runCascade`, `runRepairLoop`, `verify*`, `runWithTeacher`, `startWorkflow`, `runWorkflow`) now name **`RunnerSelfSeat`** — the one seat the Runner implements and every consumer names (`sessions`, `runTask`, `runTaskStream`, `resume`, `resumeStream`, `agentCatalog`, `emitTaskOutcome`, `gateBaseline`). A host that read `opts.runner.swapModels` or `opts.runner.sideQuery` THROUGH an option type no longer type-checks; call them on the Runner instance it constructed. No shipped consumer does (server calls `swapModels` on its own instances). Passing a `Runner` where a seat is expected still compiles.
+
+### Changed (refactor wave 1 — byte-invariant on the runtime)
+- **design/393 S0** — the run loop's seven contract declarations move down to `contracts.ts`; runtask.ts takes its contracts from their declaring modules (orchestrator contract edges 2→0; G2 exemptions 3→1); the G5 phase-api gate is driven by a `PHASE_FAMILIES` table; LAYERING gains the "run lanes" stratum. runtask.ts 12 215 → 11 946 lines. dist `runtask.js` differs only in import lines.
+- **#594** — the 23 gate stations (+4 exits) leave hooks.ts for the three-layer shape: `gate-fold.ts` (L1, the policy fold), `gate-lanes.ts` (L1, the org + ask-resolution lanes), `runner/gate-exit.ts` (L0, the exits + the one mint); hooks.ts keeps only the hook machinery and a six-call dispatch; `GatePass` is the one record the three read and write. hooks.ts 4 047 → 2 291 lines. Station-file closed-set pin + wiring pin. Words, order, deny layers, settlement kinds: unchanged and pinned.
+- **#598** — the 7 721-line public type hub `types.ts` becomes a 54-line re-export hub over fourteen layer-0 domain modules (`model-seat`, `task-spec`, `tool-spec`, `hands-band`, `agent-definition`, `mcp-server-spec`, `task-limits`, `task-result`, `task-event`, `task-stream`, `runtime-caps`, `delegation-frames`, `runner-deps`, `engine-notice`); every import path and the public export surface are byte-identical; a re-export closed-set pin refuses a declaration re-appearing in the hub.
+
+### Added
+- `processFingerprint(pid?)`, `isProcessLive(record)`, `type ProcessFingerprint` — the file store's process-identity pair, exported for a host's own liveness arm.
+- `type RunnerSelfSeat`.
+
+### Unchanged and pinned
+- Public export surface: 7.6.0's 2 098 names plus the four above, zero removed. Wire frames, the durable park row, the 23 gate stations, `TaskResult.terminal`, the MCP failure record's kinds: unchanged.
+
+## 7.6.0 — 2026-09-07
+
+**BREAKING.** design/390 S6 (three slices, merged): the tool gate's settlement/origin words become ONE `GateOutcome` record, `TaskResult` becomes ONE terminal record, MCP failures become ONE structural record with a delivery verdict, and the durable off switch becomes a word. Every consumer that read the retired keys must migrate (server 7.64.0, cli/client-core, web-admin, desktop — the criteria post lists the frames old→new).
+
+### BREAKING — exports removed (10)
+- `APPROVAL_SETTLED_BY_VALUES`, `ASK_DENY_RESOLUTION_VALUES`, `isApprovalSettledBy`, `isAskDenyResolution`, `type ApprovalSettledBy`, `type AskDenyResolution`, `type PermissionDeniedSource` (S6-A — replaced by `GateOutcome` / `Settlement` / `DeniedBy`).
+- `MCP_FAILURE_CODES`, `mcpFailureCodeOf`, `type McpFailureCode` (S6-B — replaced by `McpFailure` / `MCP_FAILURE_KINDS` / `classifyMcpFailure`).
+
+### BREAKING — same-name shape changes
+- `TaskResult`: the eight plane fields `status` / `errorCode` / `errorMessage` / `blockedReason` / `checkpointToken` / `checkpointId` / `checkpointGate` / `workspaceRestoreMode` are deleted; the run's end is ONE required `terminal: TerminalCause` (`completed` | `failed{code?, message?, nestedPause?}` | `blocked{reason}` | `paused{gate, token, checkpointId?, restoreMode?}`). `terminalProjection(terminal)` is the explicit projection for a face that keeps the old shape. The `done` frame, the HTTP task body and SSE `done.result` are the result itself, so they lose the eight keys and carry `terminal`; a nested boundary's pause is `failed` + `nestedPause` (its token no longer rides `checkpointToken`).
+- `TaskSpec.checkpointStore`: the per-run durable off switch is the word `"disabled"`; the retired `null` is refused at the first prepare with `config.invalid_checkpoint_store` (also through a worktree baseline overlay). `engine_notice` cause `task_store_null` → `task_store_disabled`.
+- `Checkpoint` is a type (`CheckpointRow & CheckpointPause`) whose gate × pendingAction pairing is fixed by `PAUSE_REGISTRY`; hand-built rows go through `checkpointFrom` / `pauseOf`. A dry-run `needs_review` row carries its own `pendingAction.kind: "review"`.
+- `ResumeOutcome.policy_ask.hostDecision` is required: a host resolving a park supplies decision FACTS (`{decision, decidedBy: "person" | "sla_timeout", …}`) and core mints every settlement word — a host never spells a kind.
+- `RealApprovalGateBit.origin` is the full `AskOrigin` set (was a five-word subset) and gains the org FACT member `org?: "rule" | "unavailable"`; read governance through `realApprovalOrgFact(bit)`, never through the routing word. `AskOrigin` gains `safety_tighten` and `shell_gate_tighten`.
+- `TeacherRunResult` and `VerificationResult` (they extend `TaskResult`) lose the same eight plane keys; `ResumeOutcome` loses `settledBy` / `approver` (the host supplies `hostDecision` facts instead).
+- `ResolvedAsk` loses its four settlement keys; `RepairResult.terminal` → `repairTerminal`; `McpErrorMarks.errorKind` is replaced by `McpFailure{kind, delivered, httpStatus?}`; `SubagentErrorKind` drops `overloaded` and gains `unknown`.
+
+### BREAKING — wire frames
+- `tool_end`: `settledBy` / `resolution` / `autoDenied` / `approver` deleted → `gate?: GateOutcome` (`disposition: {kind:"allowed"} | {kind:"denied", deniedBy}`, `settlement?: Settlement` (12 kinds, `who` fixed by `kind`), `origin?: AskOrigin`); `errorCode` speaks `McpFailureKind` (`connection_failed` / `connection_closed` / `timeout` / `protocol` / `http_status` / …; `network` and `http_<n>` retired) or a result code (`mcp.task_required`, `mcp.tool_error`, `mcp.server_revoked`); new `delivered?: "yes" | "no" | "unknown"`.
+- `permissionDenied` observer payload: `source` / `resolution` / `autoDenied` deleted → `gate: GateOutcome` (frozen). `DeniedBy` = policy / hook / org / classifier / plan_mode / compliance / write_protection / ask_resolution.
+- `wiring_manifest.mcp[]`: `errorCode` in the new words, plus `delivered` and `httpStatus`.
+- Checkpoint rows: `realApproval.origin` full set + `org`; resolved rows record `resolvedOutcome.gateOutcome`; a `review` pending kind exists.
+- Agent card `error_kind`: `overloaded` → gone, `unknown` added (no structured code ⇒ `unknown`, not retryable).
+
+### Changed (narrowings, named)
+- An approval-factory approver's bare refusal on the parent thread halts the batch like a live approver's; a person's yes vetoed by a later layer is recorded as `human_allowed` beside the vetoing `deniedBy`; the post-CAS belt's refusal carries the veto record.
+- The HTTP MCP transport no longer follows redirects (3xx ⇒ `http_status`, delivered `unknown`); a listing requiring task support is refused before any send (`mcp.task_required`, delivered `no`); a server's `isError:true` reply is `mcp.tool_error` with delivered `yes`; same-raw-name listings mount from one accepted view; a bare `TypeError` classifies as `unknown`, never `connection_failed`.
+- A resume journal entry whose result carries no closed-set terminal cause (a journal written before `TaskResult.terminal`, or a malformed entry) refuses the resume with `WorkflowJournalIncompatibleError` (`workflow.journal_incompatible`) before any agent is dispatched — it no longer diverges into a live re-run of completed work. `TERMINAL_CAUSE_IS_REPLAYABLE` is the one table behind admission and replay.
+- A background child's "durable pause without a token" arm is retired (unconstructible).
+
+### Added
+- `GateOutcome` / `Settlement` / `DeniedBy` (+ `SETTLEMENT_KINDS`, `DENIED_BY_VALUES`, `SETTLEMENT_IS_REFUSAL`, `DENIED_BY_MAY_VETO`, `isSettlementKind`, `isDeniedBy`, `screenGateOutcome`), minted once at the gate exit (`mintGateOutcome`) and projected onto three faces; invariants I1–I4 screened at the wire entry; `ORIGIN_IMPLIES_REAL_APPROVAL`.
+- `PAUSE_REGISTRY` (+ `GateKind`, `PendingKind`, `ResumeGate`, `isGateKind`, `resumeGateMatches`, `checkpointFrom`, `pauseOf`, `CheckpointFields`, `CheckpointPause`, `CheckpointRow`).
+- `TerminalCause`, `PausedCause`, `terminalProjection`, `realApprovalOrgFact`, `resolveCheckpointStore`.
+- `McpFailure`, `MCP_FAILURE_KINDS`, `MCP_DELIVERY_VERDICTS`, `McpDelivered`, `classifyMcpFailure` (ordered structural classifier, no text regex).
+- `WorkflowJournalIncompatibleError`.
+- Gates: `gate:closed-sets` (`docs/CLOSED-SETS.md` registry + `AssertAllKeysHandled` fences + switch exhaustiveness) and `gate:contract-sentences` (`@contract` ids, `docs/CONTRACT-SENTENCES.md`, duplicate-sentence baseline); invariant pins `test/gate-outcome-invariants.test.ts`; `test/design390-d8-terminal-only.test.ts`.
+
+### Unchanged and pinned
+- The suspendAsk 13-parameter `AskCarry`; the 23 gate stations (words, order); delegation lifecycle frames, `task.end` trace, agent cards, reports and workflow records keep their shape through the explicit projection; `engine_notice` codes other than the renamed cause; `wiring_manifest` keys other than `mcp[]`.
+
 ## 7.5.2 — 2026-09-06
 
 Maintenance release: design/390 slices S3–S4 complete the `prepareTask` decomposition (4 756 → 1 666 driver lines, 34 phase modules), one settlement-path narrowing (#587), and the wire-manifest tooling that the 7.5.1 review asked for (#588 / #589). **No BREAKING change**: the export surface is byte-identical to 7.5.1; the only behaviour delta is that a reserved-tool-name collision now disposes an acquired protocol handle once instead of twice (below).

package/dist/agents/agent-transcript-tool.d.ts

@@ -1,10 +1,10 @@
 import { Type } from "typebox";
-import type { Runner } from "../core/runner/runtask.js";
+import type { RunnerSelfSeat } from "../core/runner/contracts.js";
 /** Model-facing name of the child-transcript read tool (residual lane C). */
 export declare const AGENT_TRANSCRIPT_TOOL_NAME = "AgentTranscript";
 export interface AgentTranscriptToolOptions {
     /** Runner whose `sessions` store holds the child's persisted history. */
-    runner: Runner;
+    runner: RunnerSelfSeat;
     /** The unified registry the background Agent lane registered its a* handles in (scopes reads to lineage). */
     registry: import("../core/task-registry.js").TaskRegistry;
     /** design/151 S1b: the durable ledger — when the live row/retain entry is gone (restart, terminal GC,

package/dist/agents/cascade.d.ts

@@ -1,6 +1,5 @@
-import type { Runner } from "../core/runner/runtask.js";
-import type { RunInternals } from "../core/runner/prepare-task.js";
-import type { ModelRef, TaskResult, TaskSpec } from "../core/types.js";
+import type { RunInternals, RunnerSelfSeat } from "../core/runner/contracts.js";
+import type { ModelRef, TaskResult, TaskSpec, TaskStatus } from "../core/types.js";
 /**
  * Quality-gate cascade (design/27). Run the SAME task across a ladder of models (cheapest → strongest);
  * after each rung a caller-supplied **decidable gate** judges "good enough" — pass = keep it, fail =
@@ -109,7 +108,7 @@ export interface CascadeAttempt {
      *  F4) — a fabricated 0 here both misreported the attempt and let escalation ride under a finite
      *  ceiling the engine could not actually enforce. */
     costMicroUsd?: number;
-    status: TaskResult["status"];
+    status: TaskStatus;
     /** The rung's own failure code (e.g. "auth") if its `runTask` failed — distinct from "gate rejected it". */
     errorCode?: string;
     /** Set when the gate THREW (vs returned false) — surfaces a broken verifier-gate (expired key, etc.). */
@@ -154,7 +153,7 @@ export interface CascadeRunResult extends TaskResult {
  * (`effect: "write"`), those execute once PER rung — ensure idempotency, or gate before the side effect
  * (e.g. a structured-output gate). `TaskSpec` never guaranteed idempotency; cascade makes it explicit.
  */
-export declare function runCascade(runner: Runner, spec: TaskSpec, config: CascadeConfig, 
+export declare function runCascade(runner: RunnerSelfSeat, spec: TaskSpec, config: CascadeConfig, 
 /**
  * The TRUSTED, run-scoped internals channel — the same object `Runner.runTask` takes as its second
  * argument — forwarded to EVERY rung under the composition forward contract (identity, with the one

package/dist/agents/cascade.js

@@ -1,3 +1,4 @@
+import { terminalProjection } from "../core/runner/terminal-projection.js";
 import { releaseSession } from "./session-util.js";
 import { mapNestedSuspend, isDurablePause } from "./suspend-guard.js";
 import { buildCumulativeStats } from "./cumulative-stats.js";
@@ -10,9 +11,13 @@ function cascadeConfigError(message) {
     e.code = CASCADE_CONFIG_ERROR_CODE;
     return e;
 }
+function attemptTerminal(result) {
+    const face = terminalProjection(result.terminal);
+    return { status: face.status, errorCode: face.errorCode };
+}
 function createDefaultGate(spec) {
     const requiresStructured = spec.outputSchema != null;
-    return (result) => result.status === "completed" && (!requiresStructured || result.structuredOutput !== undefined);
+    return (result) => result.terminal.kind === "completed" && (!requiresStructured || result.structuredOutput !== undefined);
 }
 export async function runCascade(runner, spec, config, internals) {
     const ladder = config.ladder;
@@ -126,9 +131,9 @@ export async function runCascade(runner, spec, config, internals) {
             nestedTasks += s.nested.tasks;
             nestedCostMicro += s.nested.costMicroUsd ?? 0;
         }
-        if (isDurablePause(result.status)) {
+        if (isDurablePause(result.terminal)) {
             const mapped = mapNestedSuspend(result);
-            attempts.push({ index: i, model: rung.model, passed: false, costMicroUsd: rungCost, status: result.status, errorCode: mapped.errorCode });
+            attempts.push({ index: i, model: rung.model, passed: false, costMicroUsd: rungCost, status: attemptTerminal(result).status, errorCode: attemptTerminal(mapped).errorCode });
             return {
                 ...mapped,
                 stats: cumulativeStats(result.stats),
@@ -145,8 +150,7 @@ export async function runCascade(runner, spec, config, internals) {
                 model: rung.model,
                 passed: false,
                 costMicroUsd: rungCost,
-                status: result.status,
-                errorCode: result.errorCode,
+                ...attemptTerminal(result),
                 ...(deadlineFired ? { timedOut: true } : { cancelled: true }),
             });
             notifier.notify(() => config.onRung?.({ index: i, model: rung.model, passed: false, result }), CASCADE_ON_RUNG_SITE);
@@ -170,7 +174,7 @@ export async function runCascade(runner, spec, config, internals) {
                 passed = false;
                 gateError = e instanceof Error ? e.message : String(e);
             }
-            const statusRejected = passed && config.acceptPartial !== true && result.status !== "completed";
+            const statusRejected = passed && config.acceptPartial !== true && result.terminal.kind !== "completed";
             if (statusRejected)
                 passed = false;
             attempts.push({
@@ -178,8 +182,7 @@ export async function runCascade(runner, spec, config, internals) {
                 model: rung.model,
                 passed,
                 costMicroUsd: rungCost,
-                status: result.status,
-                errorCode: result.errorCode,
+                ...attemptTerminal(result),
                 gateError,
                 diagnostics,
                 ...(statusRejected ? { statusRejected: true } : {}),
@@ -198,9 +201,8 @@ export async function runCascade(runner, spec, config, internals) {
         return {
             taskId: spec.taskId ?? "",
             sessionId: "",
-            status: "failed",
             result: `runCascade: the overall wall-clock budget (totalTimeoutMs ${config.totalTimeoutMs}ms) was already spent when the ladder was entered — no rung dispatched`,
-            errorCode: CASCADE_NO_DISPATCH_ERROR_CODE,
+            terminal: { kind: "failed", code: CASCADE_NO_DISPATCH_ERROR_CODE },
             stats: { tokens: 0, turns: 0, costMicroUsd: 0 },
             cascadeOutcome: "exhausted",
             escalated: false,

package/dist/agents/repair-loop.d.ts

@@ -1,4 +1,4 @@
-import type { Runner } from "../core/runner/runtask.js";
+import type { RunnerSelfSeat } from "../core/runner/contracts.js";
 import type { TaskSpec } from "../core/types.js";
 import type { ExecutionEnv } from "../internal/harness-types.js";
 import type { VerificationResult } from "./verify.js";
@@ -179,7 +179,7 @@ export interface RepairLoopConfig {
     /** Per-attempt callback (observability). */
     onAttempt?: (info: {
         attempt: number;
-        terminal?: RepairTerminal;
+        repairTerminal?: RepairTerminal;
         oracle: OracleResult;
     }) => void;
     /**
@@ -191,8 +191,10 @@ export interface RepairLoopConfig {
     onWarn?: (warning: Error) => void;
 }
 export interface RepairResult extends VerificationResult {
-    /** The projected terminal (§2). SAFE-tier never returns `fixed`. */
-    terminal: RepairTerminal;
+    /** The projected REPAIR terminal (§2) — the loop's own word (fixed / candidate_only / gave_up / …), distinct
+     *  from the inherited run terminal `terminal` (a {@link import("../core/types.js").TerminalCause}, WHY the
+     *  worker's last leg ended). SAFE-tier never returns `fixed`. */
+    repairTerminal: RepairTerminal;
     /** The final repair state (in-memory unless an orthogonal suspend serialized it — §4). */
     bundle: RepairBundle;
     /**
@@ -276,4 +278,4 @@ export declare function terminalForTier(oracle: OracleResult): RepairTerminal |
  * SAFE-tier: the projection caps every PASS at `candidate_only` — this NEVER auto-accepts. `runRepairLoop` is a
  * SIBLING of {@link verifyCompleted}: it composes over `runner.runTask` and never touches the Runner core.
  */
-export declare function runRepairLoop(runner: Runner, implSpec: TaskSpec, config: RepairLoopConfig): Promise<RepairResult>;
+export declare function runRepairLoop(runner: RunnerSelfSeat, implSpec: TaskSpec, config: RepairLoopConfig): Promise<RepairResult>;

package/dist/agents/repair-loop.js

@@ -1,4 +1,4 @@
-import { isDurablePause } from "./suspend-guard.js";
+import { isDurablePause, pauseFamily } from "./suspend-guard.js";
 import { delimitUntrusted, sanitizeUntrustedText } from "../core/untrusted-text.js";
 import { assertOracleIsolation } from "../core/oracle-isolation.js";
 import { buildCumulativeStats } from "./cumulative-stats.js";
@@ -48,12 +48,11 @@ export async function runRepairLoop(runner, implSpec, config) {
         const oracle = { tier: "none", passed: false, flaky: false, retries: 0 };
         return {
             taskId: implSpec.taskId ?? "",
-            status: "failed",
             result: `oracle isolation check failed: ${reason}`,
-            errorCode: "oracle.unprotected",
+            terminal: { kind: "failed", code: "oracle.unprotected", message: `oracle isolation check failed: ${reason}` },
             sessionId: "",
             stats: { tokens: 0, turns: 0, costMicroUsd: 0 },
-            terminal: "oracle.unprotected",
+            repairTerminal: "oracle.unprotected",
             ...(isolationClass ? { isolationClass } : {}),
             bundle: { ...freshBundle(), attemptCount: config.resumeBundle?.attemptCount ?? 0 },
             oracleCostMicroUsd: 0,
@@ -157,12 +156,11 @@ export async function runRepairLoop(runner, implSpec, config) {
     };
     const exhaustedBeforeDispatch = (message, errorCode) => ({
         taskId: implSpec.taskId ?? "",
-        status: "failed",
         result: message ?? `repair loop: attempt budget already spent (attemptCount ${bundle.attemptCount} >= maxAttempts ${maxAttempts}) — no attempt dispatched`,
-        errorCode: errorCode ?? "repair.attempts_exhausted",
+        terminal: { kind: "failed", code: errorCode ?? "repair.attempts_exhausted", message: message ?? `repair loop: attempt budget already spent (attemptCount ${bundle.attemptCount} >= maxAttempts ${maxAttempts}) — no attempt dispatched` },
         sessionId: implSpec.sessionId ?? "",
         stats: { tokens: 0, turns: 0, costMicroUsd: 0 },
-        terminal: "gave_up",
+        repairTerminal: "gave_up",
         bundle,
         ...(isolationClass ? { isolationClass } : {}),
         oracleCostMicroUsd,
@@ -208,22 +206,22 @@ export async function runRepairLoop(runner, implSpec, config) {
         accumulate(result.stats);
         lastResult = result;
         bundle.attemptCount += 1;
-        if (isDurablePause(result.status)) {
+        if (isDurablePause(result.terminal)) {
             return {
                 ...result,
                 stats: cumulativeStats(result.stats),
-                terminal: "gave_up",
+                repairTerminal: "gave_up",
                 bundle,
                 ...(isolationClass ? { isolationClass } : {}),
                 oracleCostMicroUsd,
-                verification: { verdict: "unverified", unverifiedReason: result.status === "needs_review" ? "needs_review" : "suspended", rounds: bundle.attemptCount, findings: [] },
+                verification: { verdict: "unverified", unverifiedReason: pauseFamily(result.terminal), rounds: bundle.attemptCount, findings: [] },
             };
         }
-        if (result.status !== "completed") {
+        if (result.terminal.kind !== "completed") {
             return {
                 ...result,
                 stats: cumulativeStats(result.stats),
-                terminal: "gave_up",
+                repairTerminal: "gave_up",
                 bundle,
                 ...(isolationClass ? { isolationClass } : {}),
                 oracleCostMicroUsd,
@@ -237,12 +235,12 @@ export async function runRepairLoop(runner, implSpec, config) {
         lastOracle = oracle;
         bundle.oracleTier = oracle.tier;
         const projected = terminalForTier(oracle);
-        config.onAttempt?.({ attempt: bundle.attemptCount, terminal: projected, oracle });
+        config.onAttempt?.({ attempt: bundle.attemptCount, repairTerminal: projected, oracle });
         if (projected !== undefined) {
             return {
                 ...result,
                 stats: cumulativeStats(result.stats),
-                terminal: projected,
+                repairTerminal: projected,
                 bundle,
                 ...(isolationClass ? { isolationClass } : {}),
                 oracleCostMicroUsd,
@@ -266,7 +264,7 @@ export async function runRepairLoop(runner, implSpec, config) {
             return {
                 ...lastResult,
                 stats: cumulativeStats(lastResult.stats),
-                terminal,
+                repairTerminal: terminal,
                 bundle,
                 ...(isolationClass ? { isolationClass } : {}),
                 oracleCostMicroUsd,

package/dist/agents/retain-ledger.d.ts

@@ -1,6 +1,5 @@
-import type { Runner } from "../core/runner/runtask.js";
+import type { RunInternals, RunnerSelfSeat } from "../core/runner/contracts.js";
 import type { TaskSpec } from "../core/types.js";
-import type { RunInternals } from "../core/runner/prepare-task.js";
 /** design/122 D2 — per-child resume cap (default 8): a child can be revived at most this many times. */
 export declare const SUBAGENT_RESUME_CAP = 8;
 /**
@@ -25,7 +24,7 @@ export interface SubagentRetainEntry {
      * resume.evicted, the 1.283 ruling). Lifetime: the entry's `release` closure already captures the same
      * runner, so this adds no new retention class.
      */
-    runner?: Runner;
+    runner?: RunnerSelfSeat;
     agentName?: string;
     /** fix-C5: PER-ENTRY retain TTL override (ms). A SESSION-scoped ledger is shared by two purposes with
      *  different windows (failure-evidence retain = FAILED_SESSION_RETAIN_TTL_MS vs a session-scoped bg

package/dist/agents/send-message-tool.d.ts

@@ -1,5 +1,5 @@
 import { Type } from "typebox";
-import type { Runner } from "../core/runner/runtask.js";
+import type { RunnerSelfSeat } from "../core/runner/contracts.js";
 import type { TaskNotificationPayload } from "../core/task-notification.js";
 import { type ToolCtxEnricher } from "../core/tools.js";
 import { type TaskAccess } from "../core/task-registry.js";
@@ -12,7 +12,7 @@ import { type PeerAdmissionConfig, type PeerInboundChainRef, type PeerSelfRef }
 export declare const SEND_MESSAGE_TOOL_NAME = "SendMessage";
 export interface SendMessageToolOptions {
     /** Runner used to execute the resumed child run (the design/122 resume face's delegation runner). */
-    runner: Runner;
+    runner: RunnerSelfSeat;
     /** The unified task registry the background Agent lane registered its a* handles in. */
     registry: import("../core/task-registry.js").TaskRegistry;
     /** design/122 D1 — the parent run's retain ledger (present only when `TaskSpec.retainSubagentSessions`

package/dist/agents/session-util.d.ts

@@ -1,7 +1,7 @@
-import type { Runner } from "../core/runner/runtask.js";
+import type { RunnerSelfSeat } from "../core/runner/contracts.js";
 /**
  * Release a throwaway session, swallowing errors — best-effort cleanup for the verifier/cascade-rung
  * sessions that agents spin up and discard. Always call this in a `finally` so a throwing `runTask`
  * result handler or caller hook (`onRung`/`onRound`) can't leak the session.
  */
-export declare function releaseSession(runner: Runner, sessionId: string): Promise<void>;
+export declare function releaseSession(runner: RunnerSelfSeat, sessionId: string): Promise<void>;

package/dist/agents/subagent.d.ts

@@ -1,7 +1,6 @@
-import type { Runner } from "../core/runner/runtask.js";
-import type { AgentDefinition, Model, ModelRef, TaskLimits, ToolSpec } from "../core/types.js";
+import type { RunInternals, RunnerSelfSeat } from "../core/runner/contracts.js";
+import type { AgentDefinition, Model, ModelRef, TaskLimits, TerminalCause, ToolSpec } from "../core/types.js";
 import { type ExecutionEnv } from "../internal/harness.js";
-import type { RunInternals } from "../core/runner/prepare-task.js";
 import type { TaskNotificationPayload } from "../core/task-notification.js";
 import { RETAIN_DEFAULT_TTL_MS, RETAIN_DEFAULT_MAX } from "../config/defaults.js";
 /**
@@ -215,45 +214,28 @@ export declare function createSubagentWorktreeHelper(baseEnv: ExecutionEnv, repo
 /** Cap for the inline-defused worker-controlled report metadata lines (blocked_reason / error). Matches the
  *  ask-question.ts inline-value convention (300) — a one-line operator-facing reason, not a bulk payload. */
 export declare const REPORT_FIELD_MAX = 300;
-/** The machine-readable failure class stamped on a FAILED sub-agent report (sema form — see below). */
-export type SubagentErrorKind = "rate_limit" | "overloaded" | "timeout" | "network" | "logic" | "governance";
 /**
- * RB-302 — ATTRIBUTION CORRECTED (taxonomy and behavior unchanged; this is a SEMA form, not CC
- * parity). The old header called this "CC 2.1.201 parity (追平批 α 项5)". Re-verified against the CC
- * 2.1.220 corpus, three things are true and none of them support that claim:
- *  • CC's `errorKind` lives on an ERROR CLASS (`AgentApiErrorTerminationError` @409103-409110), not
- *    on the delegation's report card — the Agent result schema (@409040-409090: usage / toolStats /
- *    modelsUsed / resolvedModel) has no `error_kind` field at all;
- *  • its DOMAIN is three values, `{rate_limit, overloaded, server_error}` (`G2_` @409113) — no
- *    `timeout`, no `network`, no `logic`;
- *  • its USE is not a retry signal. It gates PARTIAL-OUTPUT HANDBACK (`V2_` @408558-408570): when the
- *    kind is in that set and the child produced text before dying, CC returns the salvaged history
- *    with the cutoff note "Everything below is PARTIAL output recovered from the agent before it was
- *    cut off. The agent did NOT finish its task — treat these results as incomplete."
- * sema's pair is a different mechanism answering a different question (re-delegate or not), derived
- * from sema's OWN errorCode taxonomy. It is kept as-is: it serves a real parent-side decision, and
- * changing the domain now would break every consumer for a parity that was never there.
- *
- * Residual (registered, not done here): CC's partial-output handback has no sema equivalent on this
- * lane — sema's `salvagedOutput` covers two other terminals only. And `authentication_failed`-style
- * auth faults still fold into `logic`, which is correct for "don't retry" but coarse for a caller
- * that wants to re-auth and retry.
- *
- * Classification (unchanged) — a FAILED child run into a coarse `error_kind` +
- * `retryable` pair so the PARENT model (and an orchestrating deployment) can react correctly without
- * string-matching the report: a `rate_limit`/`overloaded`/`timeout`/`network` failure is transient
- * (re-delegating the same subtask may succeed); a `logic` failure is not (auth/invalid_request/budget/
- * output.* — re-delegating unchanged just burns tokens). Derived from the EXISTING taxonomy: the
- * child's `TaskResult.errorCode` (assemble-result's priority chain — brain `[code]` prefixes lifted
- * via `extractErrorCode`, `limits.max_walltime_exceeded`, `budget.*`, …) plus a message sniff for the two classes our
- * BrainError codes fold together ("server" covers overloaded_error/529 AND plain 5xx; "network"
- * covers both timeouts and resets). Returns undefined for a non-failed child (no error to classify).
+ * The machine-readable failure class stamped on a FAILED sub-agent report (the Agent card's `error_kind`
+ * beside `retryable`). A sema form, not a CC one: CC's kind lives on an error class and gates
+ * partial-output handback, not retry; sema's pair answers the parent's one question — re-delegate or not.
+ *  · `rate_limit` / `network` / `timeout` — transient (re-delegating the same subtask may succeed);
+ *  · `governance`                            — a registered policy-plane refusal; retryability is the
+ *                                              governance table's transient/terminal split;
+ *  · `logic`                                 — a coded failure re-delegating unchanged cannot fix
+ *                                              (auth / invalid_request / http / output.* / budget axes);
+ *  · `unknown`                               — the child reported NO code: nothing structural to classify,
+ *                                              and the class is not guessed from the message (not retried).
+ */
+export declare const SUBAGENT_ERROR_KINDS: readonly ["rate_limit", "timeout", "network", "logic", "governance", "unknown"];
+export type SubagentErrorKind = (typeof SUBAGENT_ERROR_KINDS)[number];
+/**
+ * Classify a FAILED child run into its `error_kind` + `retryable` pair from the child's STRUCTURED
+ * terminal code alone (the `TerminalCause.failed.code` taxonomy: brain codes, `limits.*`, `budget.*`,
+ * governance codes). The message is never read: a class read out of prose moved when the prose moved,
+ * and a remote's own error text could steer it. A child with no code is `unknown`. Returns undefined
+ * for a non-failed child (no error to classify).
  */
-export declare function classifySubagentError(child: {
-    status: string;
-    errorCode?: string;
-    errorMessage?: string;
-}): {
+export declare function classifySubagentError(terminal: TerminalCause): {
     errorKind: SubagentErrorKind;
     retryable: boolean;
 } | undefined;
@@ -315,13 +297,12 @@ export declare function classifySubagentError(child: {
 export declare function completedAgentCard(child: {
     taskId: string;
     sessionId: string;
-    status: string;
+    /** The child's terminal cause. The card speaks its projection (`status` + the failure-attribution keys), never the
+     *  cause's own members: a paused token, or the pause a nested boundary wrapped on `nestedPause`, is the resume CAPABILITY. */
+    terminal: TerminalCause;
     model?: string;
     result: string;
     salvagedOutput?: string;
-    blockedReason?: string;
-    errorMessage?: string;
-    errorCode?: string;
     /** The child run's provider-boundary fault assertion, verbatim from its `TaskResult.apiFailure`.
      *  PRESENCE is the claim ("this child's terminal failure came from the transport/provider, not from
      *  this deployment refusing to send, a limit, or unusable model output"); the members are whatever
@@ -451,7 +432,7 @@ export declare function markerFragment(): string;
 export declare function createSubagentResume(deps: {
     ledger: SubagentRetainLedger | undefined;
     parentToolCallId: string;
-    runner: Runner;
+    runner: RunnerSelfSeat;
     notify?: (n: TaskNotificationPayload, opts?: {
         priority?: "now" | "next" | "later";
     }) => void;
@@ -634,7 +615,7 @@ export interface SubagentToolOptions {
      * .jsonl` + a `.meta.json` sidecar), so "the child conversation is readable afterwards" is a
      * property CC never makes conditional on a store tier.
      */
-    runner: Runner;
+    runner: RunnerSelfSeat;
     /**
      * design/115 P3 — background sub-agents (CC `run_in_background`). When set, the tool exposes the
      * `run_in_background` parameter: the call returns an `a*` task_id immediately, the child runs