@sema-agent/core 7.51.1 → 7.52.0

package/dist/index.js

@@ -62,7 +62,7 @@ export { WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS } from "./orchestration/workflow-siz
 export { ENGINE_AUTHORITY_ENVELOPE_TAGS } from "./core/untrusted-text.js";
 export { materializeA2aTools, A2aRpcError } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf } from "./core/protocol-table.js";
-export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, judgeSessionRulesWrite, readSessionRulesShape, } from "./core/session-policy-store.js";
+export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, judgeSessionRulesWrite, readSessionRulesShape, SESSION_RULES_GRAMMAR, compileSessionRuleBucket, unreadableDenyEntries, } from "./core/session-policy-store.js";
 export { SAFETY_MERGE_CONFORMANCE_CORPUS } from "./core/safety-merge-corpus.js";
 export { SAFETY_AXIS_VOCABULARY } from "./core/safety-axis-vocab.js";
 export { createSessionRulePolicy } from "./core/runner/session-rule-policy.js";
@@ -163,7 +163,7 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, combinePolicies, abortedSeatDeny, noApproverSeatDeny, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathRules, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, BIDI_CONTROL_CHARS, carriesBidiControls, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, combinePolicies, abortedSeatDeny, noApproverSeatDeny, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathRules, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, BIDI_CONTROL_CHARS, carriesBidiControls, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export {} from "./core/read-root-grant-screen.js";
 export { ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, ASK_FACES, askFaceOf, releasableAskClassesFor, MODE_RELEASE_REASONS, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";
@@ -203,7 +203,8 @@ export { adoptFilePermissionRuleStore } from "./stores/file/permission-rule-adop
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, } from "./stores/file/adoption/marker.js";
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
-export { HOOK_FAMILIES, HOOKS_INVALID_CODE } from "./core/hook-seats.js";
+export { KERNEL_CONTRACT_VERSION, MOD_TIERS, MOD_SEATS, MOD_EVENT_SIDES, MOD_EVENT_TABLE, MODS_INVALID_CODE, MODS_REGISTRATION_REFUSED_CODE, } from "./core/mods/kernel/index.js";
+export { admitModChain } from "./core/mods/stations.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, MEMORY_PROJECT_KEY_ABSENT_REASONS, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, CONSOLIDATION_WRITE_REFUSED_CODE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, isOrgScopeKey, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { createConsolidationWriteJudge, deliverWriteRefusal } from "./core/runner/memory-consolidation-write-judge.js";
@@ -218,14 +219,15 @@ export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDAT
 export { consolidateScope, advanceCursorAfterInline, } from "./core/consolidate-scope.js";
 export { resolveMemoryConsolidationDriver, autoRunOnRecommendationEffective, } from "./core/runner/memory-consolidation-driver.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
-export { coworkPromptProvider, COWORK_PROMPT_SECTIONS } from "./prompts/cowork.js";
-export { compose, validatePack } from "./prompt-assembly/composer.js";
-export { SEMA_DEFAULT_PACK } from "./prompt-assembly/packs/sema-default.js";
+export { OVERLAY_SOURCE_ORDER } from "./prompt-assembly/overlay.js";
+export { BANDS as PROMPT_BANDS } from "./prompt-assembly/bands.js";
+export { OVERLAY_OPS, HOST_ROLES, HOST_FORMS } from "./prompt-assembly/catalog/schema.js";
+export { SEMA_DEFAULT_CATALOG, catalogText } from "./prompt-assembly/catalog/index.js";
 export { attachToolContract, getToolContract, hasToolContract, computeShapeDigest, projectToolManifest } from "./prompt-assembly/tool-catalog.js";
-export { computeBundledArtifactDigest, normalizePromptEpoch } from "./prompt-assembly/epoch.js";
-export { ARTIFACT_LIMITS, artifactDeclarations, buildPromptArtifactEnvelope, computeArtifactDigest, computeCatalogDigest, verifyPromptArtifact, } from "./prompt-assembly/artifact.js";
+export { normalizePromptEpoch, promptIdentityOf, PROMPT_EPOCH_ACTIVATIONS, PROMPT_EPOCH_CHANGES, } from "./prompt-assembly/epoch.js";
+export { ARTIFACT_LIMITS, buildPromptArtifact, computeArtifactDigest, requiresOf, unmetRequirements, verifyPromptArtifact, } from "./prompt-assembly/artifact.js";
 export { buildTurnPromptSnapshot, loweringRecordFor, LOWERING_VERSION, PREFIX_INPUT_CLASSIFICATION, } from "./prompt-assembly/turn-snapshot.js";
 export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "./prompt-assembly/artifact-store.js";
 export { stripEngineMetadata } from "./internal/llm.js";
@@ -285,7 +287,7 @@ export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig,
 export { normalizeAgentName } from "./core/task-registry.js";
 export { DELEGATION_MAX_CONCURRENT_DEFAULT, DELEGATION_MAX_PER_SESSION_DEFAULT, SUBAGENT_TRANSCRIPT_RETENTION_DAYS_DEFAULT, } from "./config/defaults.js";
 export { COORDINATOR_ROLE_PROMPT, TEAMMATE_COMMUNICATION_ADDENDUM } from "./prompts/coordinator.js";
-export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, resolveDelegationEntryCaps, } from "./agents/subagent.js";
+export { createSubagentTool, FORK_SUBAGENT_TYPE, BUILTIN_SUBAGENT_TYPES, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, resolveDelegationEntryCaps, } from "./agents/subagent.js";
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
 export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerLaneConfig, PEER_LANE_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, } from "./agents/peer-admission.js";
@@ -320,15 +322,16 @@ export { createCircuitBreakerBrain, CIRCUIT_OPEN_MARKER, } from "./brain/circuit
 export { createDegradingBrain, readDegradation, DEGRADED_DIAGNOSTIC_TYPE, } from "./brain/degrading.js";
 export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
 export { WAITING_FIRST_TOKEN_AFTER_MS, WAITING_FIRST_TOKEN_EVERY_MS } from "./brain/stream-engine.js";
-export { adjudicateModelRoute, resolveRouteCredential, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, resolveRequestRootOf, joinRequestUrl, hasAuthCarrier, } from "./brain/route-adjudicator.js";
+export { adjudicateModelRoute, resolveRouteCredential, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, resolveRequestRootOf, joinRequestUrl, hasAuthCarrier, __resetCredentialOriginBindings, } from "./brain/route-adjudicator.js";
 export { ROUTE_CREDENTIAL_SOURCES, ROUTE_CARRIERS, ROUTE_CARRIER_BAGS, REQUEST_ROOT_ORIGINS, ROUTE_CREDENTIAL_PAIRING, requestRouteOf, routePairingRowOf, } from "./brain/request-route.js";
 export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS } from "./brain/route-conformance.js";
 export {} from "./brain/timeout.js";
 export { createAssistantMessageEventStream } from "./internal/llm.js";
 export { Type } from "typebox";
-export { explainPromptAssembly, describeDefaultPack } from "./prompt-assembly/explain.js";
+export { explainPromptAssembly, describeCatalog } from "./prompt-assembly/explain.js";
 export { APPROVAL_ROUTES, approvalRouteOf } from "./core/wiring-manifest.js";
 export { SHADOW_REASON, allowRuleShadowSentence, cardDisclosureOf } from "./core/allow-entry.js";
 export { RULE_OFFERS_ABSENCES } from "./core/ask-origin.js";
 export { BOUND_GRANT_ABSENCES } from "./core/skill-grant-binding.js";
 export { DISPOSABLE_PROMPT_SECTIONS } from "./core/prompt-section-seat.js";
+export { readMcpToolAxes } from "./core/mcp-server-spec.js";

package/dist/internal/harness.d.ts

@@ -12,7 +12,7 @@
 export * from "./harness-types.js";
 export { AgentHarness } from "../engine/harness/agent-harness.js";
 export type { HaltConsumption, PromptDeliveredCallback, SeatCutSource, StopRequestSource, TrailingToolBatchOptions } from "../engine/harness/agent-harness.js";
-export { CompactionError, ExecutionError, FileError, ok, err } from "../engine/harness/types.js";
+export { CompactionError, ExecutionError, FileError, isTimeCutCode, ok, err } from "../engine/harness/types.js";
 export { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, prepareCompaction, shouldCompact, summaryOutputBudgetTokens, } from "../engine/compaction/compaction.js";
 export { SKILL_RETENTION_PER_SKILL_MAX_CHARS, SKILL_RETENTION_TOTAL_MAX_CHARS, SKILL_RETENTION_TRUNCATION_MARKER, formatFileOperations, formatPersistedOutputRefs, readCompactionActiveTools, readRetainedInvokedSkills, renderInvokedSkillsRetention, } from "../engine/compaction/utils.js";
 export { NodeExecutionEnv } from "../engine/execution-env/node-execution-env.js";

package/dist/internal/harness.js

@@ -1,6 +1,6 @@
 export * from "./harness-types.js";
 export { AgentHarness } from "../engine/harness/agent-harness.js";
-export { CompactionError, ExecutionError, FileError, ok, err } from "../engine/harness/types.js";
+export { CompactionError, ExecutionError, FileError, isTimeCutCode, ok, err } from "../engine/harness/types.js";
 export { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, prepareCompaction, shouldCompact, summaryOutputBudgetTokens, } from "../engine/compaction/compaction.js";
 export { SKILL_RETENTION_PER_SKILL_MAX_CHARS, SKILL_RETENTION_TOTAL_MAX_CHARS, SKILL_RETENTION_TRUNCATION_MARKER, formatFileOperations, formatPersistedOutputRefs, readCompactionActiveTools, readRetainedInvokedSkills, renderInvokedSkillsRetention, } from "../engine/compaction/utils.js";
 export { NodeExecutionEnv } from "../engine/execution-env/node-execution-env.js";

package/dist/orchestration/run-spec.d.ts

@@ -8,10 +8,8 @@
  *     (green→`spec.not_red`、error→`spec.oracle_error`,均 fail-loud);捕获 baseline 计数。
  *  2. frozen deny policy 经 {@link combinePolicies} 合入部署基线(deny 短路不可被顶);绝不裸赋顶掉
  *     `taskSpec.toolPolicy`(TRAP #1)。
- *  3. Hooks 多路复用:runSpec 的 stop gate 先跑(guard-restore → oracle 判)——red ⇒ block 短路(失败
- *     尾部经 `delimitUntrusted` 围栏后置入:oracle 输出是模型可影响面);green ⇒ **链式调用**用户 stop
- *     (不吞其否决权);error ⇒ block 一次并注明 oracle 基础设施故障,**连续 2 次 error 放弃把关**走终态
- *     判定(防 oracle 自坏死循环)。其它 hook 槽原样透传。
+ *  3. stop gate = 任务座位上的一条注册(在调用方注册之前):red ⇒ block(失败尾部经 `delimitUntrusted` 围栏);green ⇒
+ *     `next(e)` 交下游;error ⇒ block 一次,**连续 2 次 error 放弃把关**走终态判定。
  *  4. 收口:终态亲跑 oracle = 最终判定;`emitTaskOutcome`(mechanical):`oracleHadRedRun` = 任一
  *     「真跑过且判 red」的观察(preflight ∨ stop-gate ∨ 终态;error 永不置位)。durable pause
  *     (suspended/needs_review)非终态,不发射(同 goal.ts 先例:无半事实、resume 不重复计数)。
@@ -34,8 +32,8 @@ import { type OracleBaseline, type OracleGateResult, type OracleVerdict, type Sp
 export interface RunSpecOptions {
     /** Workcopy root — the containment root for frozenPaths, oracle cwd, and `spec.path` resolution. */
     rootDir: string;
-    /** Per-run base spec (model/tools/toolPolicy/hooks/limits/…). `objective` is owned by runSpec (the
-     *  spec framing); `toolPolicy` and `hooks` are COMPOSED with runSpec's, never replaced. */
+    /** Per-run base spec (model/tools/toolPolicy/mods/limits/…). `objective` is owned by runSpec (the
+     *  spec framing); `toolPolicy` and `mods` are COMPOSED with runSpec's, never replaced. */
     taskSpec: Omit<TaskSpec, "objective">;
     /** Receives the oracle gates' once-per-process `config.secret_env_scrubbed` notice (`runOracle`'s `onNotice`);
      *  absent ⇒ the console line. */

package/dist/orchestration/run-spec.js

@@ -9,6 +9,8 @@ import { writeTargetPath } from "../tools/fs/safety.js";
 import { callTargetViewsOf } from "../core/effective-path-target.js";
 import { captureBaseline, resolveFrozenPaths, restoreFrozenPaths, runOracle, snapshotFrozenPaths, specError, } from "../core/spec-contract.js";
 import { isProtectedWrite } from "../core/tool-registry.js";
+const RUN_SPEC_ORACLE_GATE = "run-spec-oracle-gate";
+const RUN_SPEC_ORACLE_GATE_BUDGET_MS = 600_000;
 const CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
 const pathKey = (p) => {
     let n = p.replace(/\\/g, "/");
@@ -100,81 +102,55 @@ export async function runSpec(runner, contract, opts) {
     const frozenPolicy = frozenDenyPolicy(rootDir, frozenResolved);
     const policies = [deployBaseline?.toolPolicy, opts.taskSpec.toolPolicy, frozenPolicy].filter((p) => p !== undefined);
     const toolPolicy = policies.length === 1 ? policies[0] : combinePolicies(...policies);
-    const userHooks = opts.taskSpec.hooks && deployBaseline?.hooks
-        ? {
-            preToolUse: (opts.taskSpec.hooks.preToolUse ?? deployBaseline.hooks.preToolUse)?.bind(opts.taskSpec.hooks.preToolUse ? opts.taskSpec.hooks : deployBaseline.hooks),
-            ...((opts.taskSpec.hooks.preToolUse ? opts.taskSpec.hooks : deployBaseline.hooks).preToolUseObservational === true
-                ? { preToolUseObservational: true }
-                : {}),
-            postToolUse: (opts.taskSpec.hooks.postToolUse ?? deployBaseline.hooks.postToolUse)?.bind(opts.taskSpec.hooks.postToolUse ? opts.taskSpec.hooks : deployBaseline.hooks),
-            userPromptSubmit: (opts.taskSpec.hooks.userPromptSubmit ?? deployBaseline.hooks.userPromptSubmit)?.bind(opts.taskSpec.hooks.userPromptSubmit ? opts.taskSpec.hooks : deployBaseline.hooks),
-            stop: (opts.taskSpec.hooks.stop ?? deployBaseline.hooks.stop)?.bind(opts.taskSpec.hooks.stop ? opts.taskSpec.hooks : deployBaseline.hooks),
-            postToolUseFailure: (opts.taskSpec.hooks.postToolUseFailure ?? deployBaseline.hooks.postToolUseFailure)?.bind(opts.taskSpec.hooks.postToolUseFailure ? opts.taskSpec.hooks : deployBaseline.hooks),
-            postToolBatch: (opts.taskSpec.hooks.postToolBatch ?? deployBaseline.hooks.postToolBatch)?.bind(opts.taskSpec.hooks.postToolBatch ? opts.taskSpec.hooks : deployBaseline.hooks),
-            preCompact: (opts.taskSpec.hooks.preCompact ?? deployBaseline.hooks.preCompact)?.bind(opts.taskSpec.hooks.preCompact ? opts.taskSpec.hooks : deployBaseline.hooks),
-            postCompact: (opts.taskSpec.hooks.postCompact ?? deployBaseline.hooks.postCompact)?.bind(opts.taskSpec.hooks.postCompact ? opts.taskSpec.hooks : deployBaseline.hooks),
-            stopFailure: (opts.taskSpec.hooks.stopFailure ?? deployBaseline.hooks.stopFailure)?.bind(opts.taskSpec.hooks.stopFailure ? opts.taskSpec.hooks : deployBaseline.hooks),
-            permissionDenied: (opts.taskSpec.hooks.permissionDenied ?? deployBaseline.hooks.permissionDenied)?.bind(opts.taskSpec.hooks.permissionDenied ? opts.taskSpec.hooks : deployBaseline.hooks),
-            ...((opts.taskSpec.hooks.timeoutMs ?? deployBaseline.hooks.timeoutMs) !== undefined
-                ? { timeoutMs: opts.taskSpec.hooks.timeoutMs ?? deployBaseline.hooks.timeoutMs }
-                : {}),
-        }
-        : (opts.taskSpec.hooks ?? deployBaseline?.hooks);
     let guardRestores = 0;
     let consecutiveOracleErrors = 0;
     let gateAbandoned = false;
-    const hooks = {
-        ...(userHooks?.preToolUse && { preToolUse: userHooks.preToolUse.bind(userHooks) }),
-        ...(userHooks?.preToolUse && userHooks.preToolUseObservational === true ? { preToolUseObservational: true } : {}),
-        ...(userHooks?.postToolUse && { postToolUse: userHooks.postToolUse.bind(userHooks) }),
-        ...(userHooks?.userPromptSubmit && { userPromptSubmit: userHooks.userPromptSubmit.bind(userHooks) }),
-        ...(userHooks?.postToolUseFailure && { postToolUseFailure: userHooks.postToolUseFailure.bind(userHooks) }),
-        ...(userHooks?.postToolBatch && { postToolBatch: userHooks.postToolBatch.bind(userHooks) }),
-        ...(userHooks?.preCompact && { preCompact: userHooks.preCompact.bind(userHooks) }),
-        ...(userHooks?.postCompact && { postCompact: userHooks.postCompact.bind(userHooks) }),
-        ...(userHooks?.stopFailure && { stopFailure: userHooks.stopFailure.bind(userHooks) }),
-        ...(userHooks?.permissionDenied && { permissionDenied: userHooks.permissionDenied.bind(userHooks) }),
-        ...(userHooks?.timeoutMs !== undefined ? { timeoutMs: userHooks.timeoutMs } : {}),
-        async stop(ctx) {
-            guardRestores += restoreFrozenPaths(snapshot, rootDir);
-            if (!gateAbandoned) {
-                const gateSignal = ctx.signal !== undefined && opts.taskSpec.signal !== undefined ? AbortSignal.any([ctx.signal, opts.taskSpec.signal]) : (ctx.signal ?? opts.taskSpec.signal);
-                const report = await runOracle(contract.oracle, rootDir, { baseline, ...(gateSignal !== undefined ? { signal: gateSignal } : {}), ...noticeSeat });
-                if (ctx.signal?.aborted === true)
-                    return undefined;
-                oracleRuns++;
-                if (report.verdict === "red") {
-                    oracleHadRedRun = true;
-                    oracleRedRuns++;
-                    stopGateBlocks++;
-                    consecutiveOracleErrors = 0;
-                    return { block: redFeedback(report.gates) };
-                }
-                if (report.verdict === "error") {
-                    consecutiveOracleErrors++;
-                    if (consecutiveOracleErrors < 2) {
-                        const broken = report.gates.filter((g) => g.verdict === "error");
+    const oracleGate = {
+        name: RUN_SPEC_ORACLE_GATE,
+        uses: { events: ["classic.Stop"], calls: [] },
+        budgetMs: RUN_SPEC_ORACLE_GATE_BUDGET_MS,
+        register(on) {
+            on("classic.Stop", async (_$, e, next) => {
+                guardRestores += restoreFrozenPaths(snapshot, rootDir);
+                if (!gateAbandoned) {
+                    const gateSignal = opts.taskSpec.signal !== undefined ? AbortSignal.any([next.signal, opts.taskSpec.signal]) : next.signal;
+                    const report = await runOracle(contract.oracle, rootDir, { baseline, signal: gateSignal, ...noticeSeat });
+                    if (next.signal.aborted)
+                        return {};
+                    oracleRuns++;
+                    if (report.verdict === "red") {
+                        oracleHadRedRun = true;
+                        oracleRedRuns++;
                         stopGateBlocks++;
-                        return {
-                            block: `The verification oracle itself FAILED TO RUN (${broken.map((g) => `gate "${g.name}": ${g.reason}`).join("; ")}). ` +
-                                `This is an infrastructure error, not a test failure — you may have broken the build/test environment. ` +
-                                `Restore it so the oracle can run.`,
-                        };
+                        consecutiveOracleErrors = 0;
+                        return { block: redFeedback(report.gates) };
+                    }
+                    if (report.verdict === "error") {
+                        consecutiveOracleErrors++;
+                        if (consecutiveOracleErrors < 2) {
+                            const broken = report.gates.filter((g) => g.verdict === "error");
+                            stopGateBlocks++;
+                            return {
+                                block: `The verification oracle itself FAILED TO RUN (${broken.map((g) => `gate "${g.name}": ${g.reason}`).join("; ")}). ` +
+                                    `This is an infrastructure error, not a test failure — you may have broken the build/test environment. ` +
+                                    `Restore it so the oracle can run.`,
+                            };
+                        }
+                        gateAbandoned = true;
+                    }
+                    else {
+                        consecutiveOracleErrors = 0;
                     }
-                    gateAbandoned = true;
-                }
-                else {
-                    consecutiveOracleErrors = 0;
                 }
-            }
-            return userHooks?.stop ? userHooks.stop(ctx) : undefined;
+                return next(e);
+            });
         },
     };
     const result = await runner.runTask({
         ...opts.taskSpec,
         objective: buildObjective(specText, contract),
         toolPolicy,
-        hooks,
+        mods: [oracleGate, ...(opts.taskSpec.mods ?? [])],
     });
     guardRestores += restoreFrozenPaths(snapshot, rootDir);
     const final = await runOracle(contract.oracle, rootDir, { baseline, ...noticeSeat });

package/dist/orchestration/run-workflow-tool.js

@@ -539,9 +539,8 @@ async function mountRunWorkflowTool(d) {
                     ...((ctx.inheritedGateForChildren ?? d.inheritedGateForChildren) !== undefined
                         ? { inheritedGate: (ctx.inheritedGateForChildren ?? d.inheritedGateForChildren)() }
                         : {}),
-                    ...((ctx.toolSelector?.layers ?? d.parentToolCeiling) !== undefined ? { toolCeiling: (ctx.toolSelector?.layers ?? d.parentToolCeiling) } : {}),
                     ...(autoModeReview !== undefined ? { autoModeReview } : {}),
-                }, { workflowDepth: d.workflowDepth });
+                }, { workflowDepth: d.workflowDepth, ...((ctx.toolSelector?.layers ?? d.parentToolCeiling) !== undefined ? { toolCeiling: (ctx.toolSelector?.layers ?? d.parentToolCeiling) } : {}) });
             }
             catch (err) {
                 return structuredError(thrownText(err));

package/dist/orchestration/workflow.d.ts

@@ -153,6 +153,11 @@ export declare class WorkflowJournalAppendTimeoutError extends Error {
  */
 export interface WorkflowInternals {
     workflowDepth?: number;
+    /** The tool selector layers of the prepared run that launched this workflow (`ToolExecuteContext.toolSelector.layers`), threaded into
+     *  EVERY spawned agent as its ceiling (`RunInternals.toolCeiling`) on both spawn legs. The run that holds them judged them where it
+     *  wrote them, so they are not asked again here; a ceiling a host writes itself is {@link RunWorkflowOptions.toolCeiling}, which is.
+     *  Given both, both bound every agent (these layers first) and only the host-written one is judged. */
+    toolCeiling?: readonly import("../core/tool-face.js").ToolSelectorLayer[];
 }
 export interface WorkflowBudget {
     /** The token ceiling, or null when none was set (then `remaining()` is Infinity). */
@@ -565,9 +570,12 @@ export interface RunWorkflowOptions {
      *  `run_workflow` tool wiring; a directly-started workflow may pass its own. Absent ⇒ children run
      *  under only their own gates (pre-seam behavior). TRUSTED: never a script/model argument. */
     inheritedGate?: import("../core/runner/contracts.js").InheritedGate;
-    /** The HOST task's tool selector layers (`ToolExecuteContext.toolSelector.layers`), threaded into EVERY spawned agent's trusted
-     *  internals as its ceiling (`RunInternals.toolCeiling`) on both spawn legs: nothing a workflow agent's spec names can widen what
-     *  the host may use. Set by the `run_workflow` tool wiring; absent ⇒ the agents are bounded only by their own lists. TRUSTED. */
+    /** A tool selector ceiling the HOST writes, threaded into EVERY spawned agent's trusted internals as its ceiling
+     *  (`RunInternals.toolCeiling`) on both spawn legs: nothing a workflow agent's spec names can widen it. Nobody judged what the host
+     *  wrote, so each agent's spec is asked of it before it launches: another spelling of a tool the agent carries (a caller tool, the
+     *  catalog, a listable delegation pool) refuses that agent — `config.tool_face_control`, `detail.reason: "near_miss"`. The ceiling of the
+     *  prepared run that launched the workflow rides {@link WorkflowInternals.toolCeiling} instead; given both, both bound every agent and only
+     *  this one is judged. Absent ⇒ the agents are bounded only by their own lists. */
     toolCeiling?: readonly import("../core/tool-face.js").ToolSelectorLayer[];
     /** RB-201 FO-3 (workflow lane) — the session's auto-mode classifier, consulted BEFORE each script-spawned
      *  child starts (objective + toolset + output schema, finalized). The delegation-tool lane reviews its

package/dist/orchestration/workflow.js

@@ -20,7 +20,7 @@ import { boundInputHashOf } from "../core/canonical-json.js";
 import { boundedRedactedSummary, egressThrownText } from "../core/untrusted-egress.js";
 import { delimitUntrusted } from "../core/untrusted-text.js";
 import { OUTPUT_TOOL_NAME } from "../core/runner/synthetic-tools.js";
-import { deniedToolNamesOf } from "../core/runner/sub-agent-deny-lists.js";
+import { deniedToolNamesOf, judgeHostToolCeiling } from "../core/runner/sub-agent-deny-lists.js";
 import { compileOutputSchema } from "../core/runner/strict-output-schema.js";
 import { WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentBlockedError, WorkflowAgentParkedError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowMaxAgentsError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE } from "./workflow-types.js";
 import { WorkflowScriptError } from "./workflow-meta.js";
@@ -705,6 +705,13 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             o.close();
     };
     const sem = createSemaphore(concurrency);
+    const launchingCeiling = internals?.toolCeiling ?? undefined;
+    const hostCeiling = opts.toolCeiling ?? undefined;
+    const agentCeiling = launchingCeiling === undefined ? hostCeiling : hostCeiling === undefined ? launchingCeiling : [...launchingCeiling, ...hostCeiling];
+    const judgeHostCeiling = (spec) => {
+        if (hostCeiling !== undefined)
+            judgeHostToolCeiling(hostCeiling, spec, launchingCeiling);
+    };
     const spawnAttribution = {
         isDelegatedChild: true,
         ...(opts.questionFaceStripped === true ? { questionFaceStripped: true } : {}),
@@ -715,7 +722,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         ...(opts.parentCenterSourceRevision !== undefined ? { parentCenterSourceRevision: opts.parentCenterSourceRevision } : {}),
         ...(opts.onForwardEvent ? { onForwardEvent: opts.onForwardEvent } : {}),
         ...(opts.inheritedGate !== undefined ? { inheritedGate: opts.inheritedGate } : {}),
-        ...(opts.toolCeiling !== undefined ? { toolCeiling: opts.toolCeiling } : {}),
+        ...(agentCeiling !== undefined ? { toolCeiling: agentCeiling } : {}),
         ...((opts.rootSessionId ?? opts.originatingSessionId) !== undefined ? { rootSessionId: opts.rootSessionId ?? opts.originatingSessionId } : {}),
         ...(opts.placementRoot !== undefined ? { placementRoot: opts.placementRoot } : {}),
         ...(opts.originatingSessionId !== undefined ? { parentSessionId: opts.originatingSessionId } : {}),
@@ -1645,6 +1652,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 const preReviewSpec = agentOpts.schema
                     ? { ...seatedSpec, ...authInherit, ...parkInherit, signal: effectiveSignal, outputSchema: agentOpts.schema }
                     : { ...seatedSpec, ...authInherit, ...parkInherit, signal: effectiveSignal };
+                judgeHostCeiling(preReviewSpec);
                 const runSpec = await reviewSpawnBeforeLaunch("ctx.agent", label, callKey, preReviewSpec, effectiveSignal);
                 const enrichedForward = opts.onForwardEvent !== undefined
                     ? (e) => {
@@ -2010,6 +2018,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                     ? { ...seatedSpec, ...authInherit, ...parkInherit, signal: effectiveSignal, outputSchema: agentOpts.schema }
                     : { ...seatedSpec, ...authInherit, ...parkInherit, signal: effectiveSignal };
                 const preReviewSpec = childSessionId !== undefined ? { ...baseRunSpec, sessionId: childSessionId } : baseRunSpec;
+                judgeHostCeiling(preReviewSpec);
                 const runSpec = await reviewSpawnBeforeLaunch("ctx.agentStream", label, callKey, preReviewSpec, effectiveSignal);
                 const enrichedForwardS = opts.onForwardEvent !== undefined
                     ? (e) => {

package/dist/prompt-assembly/artifact-store.d.ts

@@ -1,28 +1,22 @@
-import { type PromptEpochArtifact, type PublishedPromptArtifactEnvelope } from "./artifact.js";
+import { type ArtifactVerifyCode, type PromptArtifact, type PublishedPromptArtifact } from "./artifact.js";
 export interface PromptArtifactStore {
-    /** Verified read by digest — undefined on miss OR on any verification failure of stored bytes. */
-    get(artifactDigest: string, opts: {
-        engineVersion: string;
-    }): Promise<PublishedPromptArtifactEnvelope | undefined>;
-    /** Idempotent immutable write (same digest ⇒ same bytes; the caller verified before putting). */
-    put(envelope: PublishedPromptArtifactEnvelope): Promise<void>;
+    /** Verified read by digest — undefined on a miss OR on any verification failure of the stored bytes. */
+    get(artifactDigest: string): Promise<PublishedPromptArtifact | undefined>;
+    /** Write by digest (the caller verified before putting). */
+    put(artifact: PublishedPromptArtifact): Promise<void>;
 }
 export declare class MemoryPromptArtifactStore implements PromptArtifactStore {
     private readonly byDigest;
-    get(artifactDigest: string, opts: {
-        engineVersion: string;
-    }): Promise<PublishedPromptArtifactEnvelope | undefined>;
-    put(envelope: PublishedPromptArtifactEnvelope): Promise<void>;
+    get(artifactDigest: string): Promise<PublishedPromptArtifact | undefined>;
+    put(artifact: PublishedPromptArtifact): Promise<void>;
 }
-/** `artifacts/<hex>.json` under a caller-owned directory; atomic tmp+rename writes (§9.2). */
+/** `artifacts/<hex>.json` under a caller-owned directory; atomic tmp+rename writes. */
 export declare class FilePromptArtifactStore implements PromptArtifactStore {
     private readonly dir;
     constructor(dir: string);
     private fileFor;
-    get(artifactDigest: string, opts: {
-        engineVersion: string;
-    }): Promise<PublishedPromptArtifactEnvelope | undefined>;
-    put(envelope: PublishedPromptArtifactEnvelope): Promise<void>;
+    get(artifactDigest: string): Promise<PublishedPromptArtifact | undefined>;
+    put(artifact: PublishedPromptArtifact): Promise<void>;
 }
 export type PromptSourceState = {
     state: "active";
@@ -49,60 +43,47 @@ export declare class FilePromptSourceStateStore implements PromptSourceStateStor
     load(): Promise<PromptSourceState | undefined>;
     save(state: PromptSourceState): Promise<void>;
 }
-/** The narrow face the Runner consumes (RunnerDeps.promptSource) — resolution only, no publish. */
+/** The narrow face the Runner consumes (`RunnerDeps.promptSource`) — resolution only, no publish. */
 export interface PromptArtifactSource {
-    /** The current validated candidate for NEW sessions, with its publish provenance
-     *  (undefined = bundled-only, today's shape). */
-    current(): {
-        artifact: PromptEpochArtifact;
-        sourceRevision: string;
-    } | undefined;
-    /** Resolve a PINNED digest (resume path). Undefined = unavailable — the caller fails loud. */
-    get(artifactDigest: string): Promise<PromptEpochArtifact | undefined>;
-    /** RB-31 — the tri-state the adoption boundary keys on: `"disabled"` = an EXPLICIT
-     *  validated revocation (applyDisabled) ⇒ pinned sessions roll back to bundled at the next
-     *  compaction; `"active"` = a validated candidate is live; `"unavailable"` = no verified state
-     *  (never-configured face, store-miss boot) ⇒ conservative restate — an outage must never strip
-     *  policy, only an explicit revocation does. Optional (older sources read as "unavailable"). */
-    sourceState?(): "active" | "disabled" | "unavailable";
+    /** The current verified candidate new sessions (and every top-level session at a compaction) adopt; undefined = none. */
+    current(): PublishedPromptArtifact | undefined;
+    /** Resolve a PINNED digest (the resume path). Undefined = unavailable — the caller fails loud. */
+    get(artifactDigest: string): Promise<PromptArtifact | undefined>;
+    /** The tri-state every adoption decision keys on: `"active"` = a verified candidate is live; `"disabled"` = an
+     *  EXPLICIT verified revocation (`applyDisabled`) — the one state that empties a pinned center layer;
+     *  `"unavailable"` = no verified state (never configured, or a store miss at boot) — an outage never strips policy,
+     *  only an explicit revocation does. */
+    sourceState(): "active" | "disabled" | "unavailable";
 }
 /**
- * The candidate state machine (§9.2 full pipeline). Publish-side entry points:
- *   - `applySnapshot(raw)` — a fetched effective-snapshot body: verify → store.put → persist
- *     active state → atomic in-memory swap. Any verification failure leaves EVERYTHING unchanged.
- *   - `applyDisabled(sourceRevision)` — an explicit, successful disable/delete response: persist
- *     disabled state + drop the candidate. (Network failure/304 = simply don't call anything.)
- *   - `restore()` — boot: re-resolve persisted active state through the verified store; a miss or
- *     verify failure boots stateless (no candidate) without touching the persisted record.
+ * The candidate state machine. Publish-side entry points:
+ *   - `applySnapshot(raw)` — a fetched published artifact: verify → store.put → persist active state → atomic
+ *     in-memory swap. Any verification failure leaves EVERYTHING unchanged.
+ *   - `applyDisabled(sourceRevision)` — an explicit, successful disable/delete response: persist disabled state +
+ *     drop the candidate. (Network failure/304 = simply don't call anything.)
+ *   - `restore()` — boot: re-resolve the persisted active state through the verified store; a miss or verify failure
+ *     boots stateless (no candidate) without touching the persisted record.
  */
 export declare class CenterPromptSource implements PromptArtifactSource {
     private readonly store;
     private readonly stateStore;
-    private readonly engineVersion;
     private candidate;
     private state;
-    /** Hardening 2026-07-31 — serialization tail for the three STATE-MUTATING entry points. Each of
-     *  them is a multi-await sequence ending in a synchronous swap of (candidate, state); with two in
-     *  flight, an interleaving where B's `stateStore.save` resolves and swaps before A's leaves the
-     *  persisted record naming B's digest while the in-memory candidate names A's — `current()` then
-     *  serves A to every new session until the next `restore()` silently switches to B. `CenterPromptSource`
-     *  is a public export driven by a caller's poll loop, so two overlapping applies are an ordinary
-     *  schedule, not an exotic race. Serializing costs nothing (these are publish-rate operations) and
-     *  makes the durable record and the in-memory candidate agree by construction. */
+    /** Serialization tail for the three STATE-MUTATING entry points. Each is a multi-await sequence ending in a
+     *  synchronous swap of (candidate, state); with two in flight, an interleaving where B's `stateStore.save`
+     *  resolves and swaps before A's would leave the persisted record naming B's digest while the in-memory candidate
+     *  names A's. `CenterPromptSource` is driven by a caller's poll loop, so overlapping applies are an ordinary
+     *  schedule. Serializing costs nothing (publish-rate operations) and makes the durable record and the in-memory
+     *  candidate agree by construction. */
     private tail;
-    /** Run `fn` after every previously-queued mutation settles (success OR failure — a failed apply
-     *  must not wedge the queue). */
+    /** Run `fn` after every previously-queued mutation settles (success OR failure — a failed apply must not wedge the queue). */
     private exclusive;
     constructor(opts: {
         store: PromptArtifactStore;
         stateStore?: PromptSourceStateStore;
-        engineVersion: string;
     });
-    current(): {
-        artifact: PromptEpochArtifact;
-        sourceRevision: string;
-    } | undefined;
-    get(artifactDigest: string): Promise<PromptEpochArtifact | undefined>;
+    current(): PublishedPromptArtifact | undefined;
+    get(artifactDigest: string): Promise<PromptArtifact | undefined>;
     restore(): Promise<void>;
     sourceState(): "active" | "disabled" | "unavailable";
     applySnapshot(raw: unknown): Promise<{
@@ -110,7 +91,7 @@ export declare class CenterPromptSource implements PromptArtifactSource {
         artifactDigest: string;
     } | {
         ok: false;
-        code: string;
+        code: ArtifactVerifyCode;
         reason: string;
     }>;
     applyDisabled(sourceRevision: string): Promise<void>;