@sema-agent/core 7.50.1 → 7.50.2

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 7.50.2 — 2026-10-14
+
+**Hard-breaking changes:** none. **Closed sets:** none. **Exports:** +0 / −0 (`releasePolicyDefects` is module-level, not on the package root).
+
+### The gate-outcome screen reads the shape of a mode release, not today's release policy (#1730; fix; truthfulness of persisted records; hard-breaking: none) (@server @test)
+
+- **Before (v7.50.0 / v7.50.1).** `screenGateOutcome` I7 asked whether `released.askClass` is releasable under TODAY's table (`releasableAskClassesFor`). Release policy moves between versions (7.50.0 made `rule_unreadable` bypass-immune), so a record a 7.49.5 engine minted lawfully — a `rule_unreadable` ask released under `bypassPermissions` — screened as `I7: released.askClass "rule_unreadable" is not a releasable class` on 7.50.x, and a reader of persisted records (server's event-ledger replay, S-1546) recorded lawful history as a defective producer.
+- **Now.** I7 is a shape invariant: the class word is a member of the closed set (`isAskClass`), the release carries no settlement, the mode is `bypassPermissions`, `classes` is a non-empty list of ask classes, `origin` / `reason` are members of their sets. Whether a class MAY be released is the producer's law at mint time: `releasePolicyDefects` (module-level) is read beside the shape screen at the gate's exit (`gate-exit.ts`) and at the station screen (`prepare-gate-stations.ts`), so this engine still refuses to mint a release of an immune class today, while a reader of persisted records asks only the shape.
+- **Who is hurt.** A consumer that used `screenGateOutcome` as a producer check on records it mints itself (none known; the engine's two producer sites now read both halves) no longer gets the policy defect from the screen alone. Nobody else: a record this engine minted screens exactly as before; a lawful historical release stops reading as defective.
+- **Compensation.** None needed for readers of persisted records. A host that mints gate records and wants today's policy judged calls both functions, or waits for 7.51.0's `screenGateOutcome(g, { reading: "producer" | "archive" })` with the engine's retired-vocabulary table (so 7.50.x records naming `governance_unavailable` read clean after its 7.51.0 retirement).
+- **Pins.** `test/backlog1730-gate-screen-shape-not-policy.test.ts` P1–P5 (P1 red on v7.50.1); `test/backlog1423-wpu-by-face.test.ts` re-pinned: the policy defect is the producer's, the shape screen accepts the record.
+
 ## 7.50.1 — 2026-10-14
 
 **Hard-breaking changes:** none. **Closed sets:** none — the read station's details code stays `read_unestablished` on both faces (whether a write finding gets its own code is a closed-set question, left to 7.51.0). **Package exports:** +0 / −0 names (`npm run handoff:diff v7.50.0 HEAD`); no type, signature or closed-set change (`wire-changes` preview: 0 / 0 / 0). **Behavior:** a tool policy that throws is denied in its own words with one redacted line and reported once on `onError`, never as a timeout; a write the read station could not place is carded as a write. Both defects were present in 7.49.5 and 7.50.0.

package/dist/core/gate-outcome.d.ts

@@ -401,9 +401,11 @@ export interface ModeRefusal {
  *      {@link import("./auto-mode.js").AUTO_MODE_FALLBACK_CAUSES} — a record whose `to` and `modelUsed`
  *      disagree would let a reader answer "which model decided this call?" two ways;
  *  I7  `disposition.released` present ⇒ `kind === "allowed"`, no settlement, `mode` is `bypassPermissions`,
- *      `askClass` is a releasable class, every member of `classes` is an ask class, `origin` / `reason`, when
+ *      `askClass` is an ask class (a member of the closed set — SHAPE; whether the class was releasable is the mint's
+ *      law at mint time, read by the gate's mode-release arm, never re-judged here against today's table: a persisted
+ *      record outlives the policy of its day), every member of `classes` is an ask class, `origin` / `reason`, when
  *      present, are members of their closed sets, and `reason` names a member of `classes` (the mint takes it from
- *      that set) — a mode releases nothing a person answered and nothing the table calls immune;
+ *      that set) — a mode releases nothing a person answered;
  *  I8  `deniedBy === "mode"` ⇔ `mode` present (`bypassPermissions` | `dontAsk`) with `askClass` and `classes`.
  * Nothing here is read out of an ABSENCE: an ordinary allow with no ask is `{ disposition: { kind: "allowed" } }`,
  * a direct policy deny is `{ disposition: { kind: "denied", deniedBy: "policy" } }`, and neither carries a
@@ -422,4 +424,12 @@ export interface GateOutcome {
  * clean record); the caller decides the fail-loud form (report + withhold, or refuse), never silently
  * repairs the record.
  */
+/**
+ * The PRODUCER's half of I7, read beside {@link screenGateOutcome} wherever this engine composes or screens a record it is
+ * minting today: a mode release names a class this engine's table lets a mode release (`releasableAskClassesFor` on some
+ * face). Policy, not shape — it moves between versions (7.50.0 made `rule_unreadable` immune), so a reader of PERSISTED
+ * records (a replay, an archive) does not read it: a release lawful when minted is not a defect under a later table.
+ * Module-level only; not part of the package root.
+ */
+export declare function releasePolicyDefects(g: GateOutcome): string[];
 export declare function screenGateOutcome(g: GateOutcome): string[];

package/dist/core/gate-outcome.js

@@ -108,6 +108,15 @@ export const DENIED_BY_MAY_CARRY_CAUSE = {
     read_boundary: false,
     mode: false,
 };
+export function releasePolicyDefects(g) {
+    const d = g.disposition;
+    if (d.kind !== "allowed" || d.released === undefined)
+        return [];
+    const askClass = d.released.askClass;
+    if (!isAskClass(askClass))
+        return [];
+    return ASK_FACES.some((face) => releasableAskClassesFor(face).includes(askClass)) ? [] : [`I7: released.askClass "${askClass}" is not a releasable class under this engine's table`];
+}
 export function screenGateOutcome(g) {
     const defects = [];
     const d = g.disposition;
@@ -144,8 +153,8 @@ export function screenGateOutcome(g) {
             defects.push("I7: a mode release carries no settlement — nobody answered the ask it released");
         if (r.mode !== "bypassPermissions")
             defects.push(`I7: a mode release names mode "${String(r.mode)}" — only bypassPermissions releases`);
-        if (!isAskClass(r.askClass) || !ASK_FACES.some((face) => releasableAskClassesFor(face).includes(r.askClass)))
-            defects.push(`I7: released.askClass "${String(r.askClass)}" is not a releasable class`);
+        if (!isAskClass(r.askClass))
+            defects.push(`I7: released.askClass "${String(r.askClass)}" is outside the closed set`);
         if (!Array.isArray(r.classes) || r.classes.length === 0 || !r.classes.every((c) => isAskClass(c)))
             defects.push("I7: released.classes must be a non-empty list of ask classes");
         if (r.origin !== undefined && !isAskOrigin(r.origin))

package/dist/core/runner/gate-exit.js

@@ -1,4 +1,4 @@
-import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
+import { screenGateOutcome, SETTLEMENT_IS_REFUSAL, releasePolicyDefects } from "../gate-outcome.js";
 import { askFaceOf, classifyAsk, headlessApprovalRemedy } from "../ask-origin.js";
 import { wireOf } from "../tool-name-readings.js";
 import { isProtectedWrite } from "../tool-registry.js";
@@ -23,7 +23,7 @@ export function mintGateOutcome(facts) {
             : { kind: "allowed", ...(attribution !== undefined ? { classifier: attribution } : {}), ...(facts.released !== undefined ? { released: Object.freeze({ ...facts.released, classes: Object.freeze([...facts.released.classes]) }) } : {}) }),
         ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
     });
-    const defects = screenGateOutcome(outcome);
+    const defects = [...screenGateOutcome(outcome), ...releasePolicyDefects(outcome)];
     if (defects.length > 0)
         throw new Error(`the tool gate composed an outcome that violates its own record: ${defects.join("; ")}`);
     return outcome;

package/dist/core/runner/prepare-gate-stations.js

@@ -2,7 +2,7 @@ import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { mountedToolRequiresUserInteraction } from "../mode-policy.js";
 import { complianceCallDenial } from "../compliance.js";
 import { cloneObserverInput, formatHookFeedback, runToolGate } from "../hooks.js";
-import { screenGateOutcome } from "../gate-outcome.js";
+import { screenGateOutcome, releasePolicyDefects } from "../gate-outcome.js";
 import { directDeny, frozenInputSnapshot } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../engine-notice.js";
@@ -20,7 +20,7 @@ function screenGateResult(result) {
     const gate = result.gate;
     if (gate === undefined)
         return { defects: ["a tool-gate result carried no outcome record on a terminal exit — every terminal exit mints one; the frame carries none"] };
-    const defects = screenGateOutcome(gate);
+    const defects = [...screenGateOutcome(gate), ...releasePolicyDefects(gate)];
     const blocked = result.block === true;
     if ((gate.disposition.kind === "denied") !== blocked) {
         defects.push(`a tool-gate result's outcome reads "${gate.disposition.kind}" on ${blocked ? "a blocked" : "an executing"} call — the two faces of one verdict disagree; the frame carries no outcome`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.50.1",
+  "version": "7.50.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.50.2.json

@@ -0,0 +1,42 @@
+{
+  "repo": "core",
+  "version": "7.50.2",
+  "from": "c9b91932c9c442efbedc38a9fd43629d6da3b64c",
+  "to": "6420369270dad7ad426f39d338defa4eeee9594b",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 229,
+  "signatures": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.gate",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "GateOutcome.disposition",
+      "assertions": [
+        "G1.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@37f37540 server@9ce3abaf sdk@fe943ec — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}