@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/runner/caller-stop-gate.js

@@ -0,0 +1,7 @@
+export function mintCallerStopGate(callerSignal) {
+    const verbs = new AbortController();
+    return {
+        stop: () => verbs.abort(),
+        signal: callerSignal !== undefined ? AbortSignal.any([verbs.signal, callerSignal]) : verbs.signal,
+    };
+}

package/dist/core/runner/compaction-seams.d.ts

@@ -1,5 +1,4 @@
 import type { MaybeCompactOptions } from "../auto-compaction.js";
-import type { TaskSpec } from "../types.js";
 import type { Prepared, RunnerDepsSeat } from "./contracts.js";
 /**
  * The cost-optimization compaction options threaded into BOTH `maybeCompact` call
@@ -13,27 +12,14 @@ import type { Prepared, RunnerDepsSeat } from "./contracts.js";
  * function itself always returns an object.
  */
 export declare function seamCCompactionOptions(runner: RunnerDepsSeat, prepared: Prepared): Pick<MaybeCompactOptions, "summaryProvider" | "onCompaction" | "maxConsecutiveProviderReuse" | "consecutiveProviderReuse" | "onCommitted">;
-/** Resolve the pre/postCompact lifecycle callbacks (whole-slot `spec.hooks ??
- *  deps.hooks`, same resolution as the stop hook) and wrap each in a SWALLOW+TRACE shell before
- *  threading them into maybeCompact. The wrapper owns the observability half of the R3 MED contract
- *  (maybeCompact swallows defensively too, but has no sink): a throwing callback is reported via
- *  `onError(phase:"hook")` and treated as absent; a `block` returned under a "forced" trigger is
- *  reported as ignored (maybeCompact enforces the ignore — blocking a compaction the provider/trim
- *  layer already demanded would kill the run). */
-export declare function compactionHookOptions(runner: RunnerDepsSeat, spec: TaskSpec, sessionId: string, trigger: "auto" | "manual" | "forced", 
-/** The leg's identity envelope, spread onto both compaction contexts by the wrappers
- *  below (the compaction module builds its contexts below the runner and cannot know the leg;
- *  the wrapper is the runner's seam). Every runner call site supplies `prepared.hookIdentity`;
- *  optional only so a context built without a leg stays honestly identity-less. */
-identity?: import("../hooks.js").HookInvocationIdentity, 
-/** The leg's already-validated seat bound (`Prepared.hookTimeoutMs`) and its abort signal. Optional
- *  for the same reason `identity` is — a wrapper built without a prepared leg still works, on the
- *  default bound and with no signal. The signal is what keeps a hung compaction hook from holding a
- *  CANCELLED run's turn boundary for the whole deadline (the seat's post-abort grace). */
-seatBound?: {
-    timeoutMs: number;
-    signal?: AbortSignal;
-}): Pick<MaybeCompactOptions, "trigger" | "preCompact" | "postCompact">;
+/** The pre/postCompact stations threaded into maybeCompact: `classic.PreCompact` and `classic.PostCompact` raised on the
+ *  leg's bus (a station is wired only when a handler hangs on its event). Their failure and abort columns are the
+ *  bus's — a handler that throws or runs past its budget is skipped and reported, so a failed gate is "no block, no
+ *  instructions" and the compaction that was already deemed necessary proceeds. A `block` answered under a "forced"
+ *  trigger is reported as ignored (maybeCompact enforces the ignore — blocking a compaction the provider/trim layer
+ *  already demanded would kill the run). `signal` is the pass's abort (absent ⇒ each handler's own budget is the
+ *  whole bound). */
+export declare function compactionHookOptions(runner: RunnerDepsSeat, prepared: Pick<Prepared, "modBus" | "hookIdentity" | "sessionId">, trigger: "auto" | "manual" | "forced", signal: AbortSignal | undefined): Pick<MaybeCompactOptions, "trigger" | "preCompact" | "postCompact">;
 /** Fold a finished compaction's `reused` flag into the run-scoped consecutive-reuse
  *  counter: a reused (provider) summary increments it, a real (LLM) summary resets it to 0. A no-op
  *  compaction (`compacted:false`) leaves the counter untouched. No-op when no provider is wired. */

package/dist/core/runner/compaction-seams.js

@@ -1,5 +1,4 @@
-import { hookSeatExpiredError, resolveHookTimeoutMs, runHookSeat } from "../hooks.js";
-import { asThrownError } from "../thrown-value.js";
+import { classicEventBase, dispatchClassic, observeClassic, stringMembersAnswer, stringMembersOf } from "../mods/stations.js";
 export function seamCCompactionOptions(runner, prepared) {
     return {
         ...(runner.deps.summaryProvider
@@ -17,66 +16,42 @@ export function seamCCompactionOptions(runner, prepared) {
         },
     };
 }
-export function compactionHookOptions(runner, spec, sessionId, trigger, identity, seatBound) {
-    const hooks = spec.hooks ?? runner.deps.hooks;
-    const pre = hooks?.preCompact;
-    const post = hooks?.postCompact;
-    const seatMs = seatBound?.timeoutMs ?? resolveHookTimeoutMs(hooks?.timeoutMs);
-    const seatSignal = seatBound?.signal;
-    const withIdentity = (ctx) => identity !== undefined ? { ...ctx, identity } : ctx;
+export function compactionHookOptions(runner, prepared, trigger, signal) {
+    const bus = prepared.modBus;
+    const base = classicEventBase(prepared.hookIdentity);
+    const report = (err) => {
+        try {
+            runner.deps.onError?.(err, { phase: "hook", sessionId: prepared.sessionId });
+        }
+        catch {
+        }
+    };
     return {
         trigger,
-        ...(pre
+        ...(bus.hasHandlers("classic.PreCompact")
             ? {
-                preCompact: async (rawCtx) => {
-                    const ctx = withIdentity(rawCtx);
-                    const report = (err) => {
-                        try {
-                            runner.deps.onError?.(err, { phase: "hook", sessionId });
-                        }
-                        catch {
-                        }
-                    };
-                    try {
-                        const seat = await runHookSeat("preCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => pre.call(hooks, { ...ctx, signal: sig }));
-                        if (seat.expired) {
-                            report(hookSeatExpiredError("preCompact", seatMs, seat.cause, `the "${ctx.trigger}" compaction PROCEEDED unblocked and with no additional instructions`));
-                            return undefined;
-                        }
-                        const r = seat.value;
-                        if (r?.block && ctx.trigger === "forced") {
-                            report(new Error(`a preCompact callback blocked a "forced" compaction — ignored (PTL/trim-pressure compaction is not optional): ${r.block}`));
-                        }
-                        return r;
-                    }
-                    catch (err) {
-                        report(asThrownError(err));
+                preCompact: async (ctx) => {
+                    const outcome = await dispatchClassic(bus, "classic.PreCompact", { ...base, trigger: ctx.trigger, ...(ctx.customInstructions !== undefined ? { customInstructions: ctx.customInstructions } : {}) }, { ...(signal !== undefined ? { signal } : {}), checkAnswer: stringMembersAnswer("classic.PreCompact", ["block", "additionalInstructions"]) });
+                    if (outcome?.kind !== "answered")
                         return undefined;
+                    const r = stringMembersOf(outcome.answer, ["block", "additionalInstructions"]);
+                    if (r.block && ctx.trigger === "forced") {
+                        report(new Error(`a preCompact handler blocked a "forced" compaction — ignored (PTL/trim-pressure compaction is not optional): ${r.block}`));
                     }
+                    return r;
                 },
             }
             : {}),
-        ...(post
+        ...(bus.hasHandlers("classic.PostCompact")
             ? {
-                postCompact: async (rawCtx) => {
-                    try {
-                        const seat = await runHookSeat("postCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => post.call(hooks, { ...withIdentity(rawCtx), signal: sig }));
-                        if (seat.expired) {
-                            try {
-                                runner.deps.onError?.(hookSeatExpiredError("postCompact", seatMs, seat.cause, "the observation was abandoned; the compaction that already landed is unchanged"), { phase: "hook", sessionId });
-                            }
-                            catch {
-                            }
-                        }
-                    }
-                    catch (err) {
-                        try {
-                            runner.deps.onError?.(asThrownError(err), { phase: "hook", sessionId });
-                        }
-                        catch {
-                        }
-                    }
-                },
+                postCompact: (ctx) => observeClassic(bus, "classic.PostCompact", {
+                    ...base,
+                    trigger: ctx.trigger,
+                    summary: ctx.summary,
+                    ...(ctx.tokensBefore !== undefined ? { tokensBefore: ctx.tokensBefore } : {}),
+                    ...(ctx.tokensAfter !== undefined ? { tokensAfter: ctx.tokensAfter } : {}),
+                    ...(ctx.freedTokens !== undefined ? { freedTokens: ctx.freedTokens } : {}),
+                }, signal),
             }
             : {}),
     };

package/dist/core/runner/construction-doors.js

@@ -1,8 +1,9 @@
 import { checkedAgentConfigDir } from "../agent-config-dir.js";
 import { checkedMediaByteCap } from "../media-byte-cap.js";
-import { receiveOwnProperties, refuseProxy } from "../own-property-receipt.js";
+import { receiptRefusal, receiveOwnProperties, refuseProxy } from "../own-property-receipt.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { copyReadDenySeat, READ_DENY_DEPLOYMENT_SEATS } from "../read-face-seats.js";
+import { holdOwnCredentialValues } from "../secret-env.js";
 export function retainRunnerDeps(deps) {
     const words = { subject: "RunnerDeps", unit: "seat", moment: "at new Runner" };
     refuseProxy(deps, words);
@@ -14,5 +15,14 @@ export function retainRunnerDeps(deps) {
         if (Object.hasOwn(retained, seat))
             Object.defineProperty(retained, seat, { value: copyReadDenySeat(Reflect.get(retained, seat)), enumerable: true, writable: true, configurable: true });
     }
+    let consolidationKey;
+    try {
+        const chat = retained.memoryConsolidationDriver?.chat;
+        consolidationKey = typeof chat === "object" && chat !== null ? Reflect.get(chat, "apiKey") : undefined;
+    }
+    catch {
+        throw receiptRefusal("RunnerDeps.memoryConsolidationDriver.chat threw while its apiKey was read at new Runner — refused (the thrown value is not repeated)");
+    }
+    holdOwnCredentialValues([typeof consolidationKey === "string" ? consolidationKey : undefined], retained.onNotice);
     return retained;
 }

package/dist/core/runner/contracts.d.ts

@@ -36,7 +36,9 @@ import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-de
 import type { Checkpoint, CheckpointState, CheckpointStore, CheckpointToken, PendingSteerEntry, PlatformLimitReason, ReopenReason, ResourceLedger, ResourceLimitReason, ResumeOutcome, SerializedCheckpointState } from "../checkpoint-store.js";
 import type { ExecutionOutcomeRecordWord } from "../checkpoint-execution-record.js";
 import type { ClearedProjectionLedger, MicroCompactMachine, OccurrenceIndex } from "../context-edit.js";
-import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, PostToolBatchResult, ToolGateInput } from "../hooks.js";
+import type { ModBus } from "../mods/kernel/index.js";
+import type { LegModBus, LegMods, ModChainLink } from "../mods/stations.js";
+import type { HookInvocationIdentity, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, ToolGateInput } from "../hooks.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { MemoryEngine } from "../memory-engine/engine.js";
 import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
@@ -62,6 +64,7 @@ import type { SessionReadFileStates } from "./session-read-file-states.js";
 import type { LegModeCeiling, SessionModeSeats } from "./session-mode-seats.js";
 import type { BlockedRef, OutputRef, SkillListingEntry } from "./synthetic-tools.js";
 import type { createAttachmentState, WriteFamily } from "./turn-attachments.js";
+import type { SideCallBook } from "./side-call-account.js";
 import type { cacheFamilyOf } from "./usage-accounting.js";
 /**
  * The frozen task-start copies of the caller's tool-face control arrays, as the config-doors phase takes them (synchronously,
@@ -99,6 +102,14 @@ export interface ToolFaceSnapshot {
  */
 export interface AnnounceOnceSink {
     onError: NonNullable<RunnerDeps["onError"]>;
+    /**
+     * The same operator sink for a fact about the DEPLOYMENT rather than the conversation (a built-in tool pair that
+     * declines to mount because of the deployment's own selector or roster): deduplicated per RUNNER by
+     * `(code, text)` instead of per session, because a serving layer that opens a fresh session per request would
+     * otherwise repeat a standing configuration fact on every request. Independent of the session record — it
+     * writes nothing to the transcript. Same signature as `RunnerDeps.onError`.
+     */
+    onErrorOncePerRunner: NonNullable<RunnerDeps["onError"]>;
 }
 /** Static per-tool irreversibility tier, resolved at prepare time by the safety scan. */
 export type IrreversibilityTier = Map<string, "never" | "maybe" | "always">;
@@ -524,6 +535,8 @@ export interface Prepared {
      * leg always knows its identity.
      */
     hookIdentity: HookInvocationIdentity;
+    /** The leg's mods bus: one per leg, admitted at this leg's prepare (both seats, `plugin.register` run once for this leg). Every classic station raises its event on it; its `records` are the manifest's `mods[]`. */
+    modBus: ModBus;
     /**
      * This session's DURABLE box, present iff this leg mounted the session-box drain (a top-level leg
      * over a cross-process-safe mailbox with a grammatical session id). The notification lane binds it
@@ -566,38 +579,18 @@ export interface Prepared {
     peerBoundaryRound?: (o: {
         continues: boolean;
     }) => Promise<void>;
-    /**
-     * The per-invocation TIME BOUND every hook seat of this leg runs under (`Hooks.timeoutMs`, already
-     * validated — a garbage value was refused to the default and disclosed ONCE, here, rather than on
-     * every tool call). Published for the same reason `hookIdentity` is: the seats live in two files, and
-     * a number each station re-derived would be two answers to one wiring question — including two
-     * chances to re-refuse the same bad value.
-     */
-    hookTimeoutMs: number;
+    /** The composition manifest (v3) the `prompt.assembled` frame reports (`trace.ts`, the same member types). */
     promptManifest: {
-        constitution: "core" | "replaced" | "provider-assembled";
+        identity: import("../trace.js").PromptManifestIdentity;
+        selectors: import("../trace.js").PromptManifestSelectors;
         blocks: Array<{
             id: string;
             chars: number;
             hash: string;
         }>;
-        /** Manifest v2 (stage S1, additive): the compiled-IR section view (slot/carrier/cadence/
-         *  cacheClass per section). `contentHash` is the
-         *  digest-tiering face: present ONLY on operator-declared sections (the typed
-         *  `stableBlocks` lane, owner "deployment") as an UNSALTED full sha256 of the section text —
-         *  the center-publish ↔ manifest end-to-end reconciliation anchor. Core-native sections (env
-         *  facts, memory tail, user role text) stay salted-only: a plain hash of a short guessable
-         *  block is a dictionary-preimage surface for trace readers ([E]). */
-        sections?: Array<{
-            id: string;
-            slot: string;
-            carrier: string;
-            cadence: string;
-            cacheClass: string;
-            chars: number;
-            hash: string;
-            contentHash?: string;
-        }>;
+        sections: import("../trace.js").PromptManifestSection[];
+        /** Each overlay the composition superseded; absent when none was. */
+        superseded?: import("../../prompt-assembly/overlay.js").SupersededOverlay[];
         /** S2 (additive): the mounted tools plane — contract identity, durable-replay aliases,
          *  presentation-invariant shape digest and full wire digest per tool (initial mount face). */
         tools?: ToolManifestRow[];
@@ -615,26 +608,18 @@ export interface Prepared {
          *  seat chose it. Absent when nothing is deferred (there is no disclosure to describe). */
         toolDisclosure?: ToolDisclosureManifest;
     };
-    /** This run's provider-declared prompt sections (epoch declaration axis),
-     *  threaded to every compaction-boundary epoch selection so boundary re-pins hash the same
-     *  artifact identity as the prepare-time pin. Empty on declaration-free runs. */
-    epochDeclaredSections: import("../../prompt-assembly/epoch.js").EpochDeclaredSections;
+    /** This run's prompt identity inputs and its pinned center layer's provenance, threaded to every compaction-boundary
+     *  epoch selection so a boundary restates the same identity the prepare-time record names. Replaced by a committed
+     *  compaction-boundary center change. */
+    promptIdentity: import("../../prompt-assembly/epoch.js").RunPromptIdentity;
     /** The LIVE nine-element identity face (refreshed by deferred materialization and
      *  the deferred-materialization adoption swap); the manifest holds the prepare-time initial copy. */
     turnSnapshot?: import("../../prompt-assembly/turn-snapshot.js").TurnPromptSnapshot;
-    /** The compaction-boundary center-adoption seam (undefined = no source
-     *  wired or session not center-pinned). Returns the maybeCompact `centerAdoption` fragment or
-     *  undefined; `apply` runs post-CAS only (auto-compaction owns the ordering). Both
-     *  `epochDeclaredSections` and `promptOverheadTokens` on THIS object are mutated by a successful
-     *  adoption (read them at call time, never capture early). */
-    centerCompactionCandidate?: () => {
-        centerArtifactDigest?: string;
-        sourceRevision?: string;
-        clear?: true;
-        declaredSections: import("../../prompt-assembly/epoch.js").EpochDeclaredSections;
-        overheadTokensAfter: number;
-        apply: (committedArtifactDigest?: string) => void;
-    } | undefined;
+    /** The compaction-boundary center-layer seam (undefined = no source wired, or a child run — a child composes its
+     *  parent's layer). Returns the maybeCompact `centerAdoption` fragment or undefined; `apply` runs post-CAS only
+     *  (auto-compaction owns the ordering). Both `promptIdentity` and `promptOverheadTokens` on THIS object are mutated by
+     *  a successful change (read them at call time, never capture early). */
+    centerCompactionCandidate?: () => NonNullable<import("../auto-compaction.js").MaybeCompactOptions["centerAdoption"]> | undefined;
     /** Deferred-tool disclosure: the monotonic set of activated deferred-tool names. Empty
      *  (and no `tool_search` injected) when nothing is deferred. Mutated by BOTH disclosure lanes across
      *  the run — the injected `tool_search` and the direct-call placeholder lane (default ON) —
@@ -924,6 +909,12 @@ export interface Prepared {
             walltimeMs: number;
         };
     };
+    /** The cell the run body binds with the leg's side-call door once `stats` exists; a lane built at prepare (the
+     *  permission classifier) books its replies through it. A lane that books before the run body bound it is an
+     *  engine defect and throws. */
+    sideCallBookRef: {
+        book?: SideCallBook;
+    };
     /** The per-task human-review accumulator (synchronous `resolveAsk` waits this leg + the carried
      *  prior-leg burden seeded from the resumed checkpoint). The run loop ADDS the durable-resume latency
      *  (`now() − cp.suspendedAt`) on a resume, then surfaces it as `stats.humanReview` at assembly (omitted when
@@ -1323,6 +1314,9 @@ export interface PrepareResume {
     /** The decision this resume carries (the gate word and, for a review, approve / edit / reject) — read by the mode seed
      *  (`modeRequestAfterResume`: an approved or edited `plan_review` exits a recorded plan to its pre-plan word). Absent on a prepare that resumes nothing. */
     outcome?: ResumeRun["outcome"];
+    /** The leg's mods bus, when the resume entrance already admitted it (a wake message's screen raises
+     *  `classic.UserPromptSubmit` before this leg prepares): prepare adopts it instead of admitting a second time. */
+    legMods?: LegMods;
     /** How many times this task already suspended (the resumed checkpoint's
      *  `suspendCount`). The next suspend mints `priorSuspendCount + 1`; past `maxSuspends` it fails
      *  (`suspend.loop`) instead of re-suspending. Absent/0 ⇒ no prior suspends. */
@@ -1544,24 +1538,23 @@ export interface InheritedGate extends InheritedAutoModeFace {
             };
         };
         /**
-         * Set ONLY on an entry whose `policy` is the folded form of an ancestor's PreToolUse screening face
-         * (issue #33 — the face used to stop at the task that installed it, so a call the ancestor had
-         * refused executed one level down). It carries the raw callback for ONE purpose: identity. A
-         * deployment-level face (`RunnerDeps.hooks`) is resolved by every task in the tree on its own, so
-         * each descendant's gate already runs it in phase 1 — folding it AGAIN as an inherited constraint
-         * would consult the same callback twice per call at depth 1 and once more per level below. Two
-         * identity tests keep that at exactly one consultation per call: chain assembly does not re-append a
-         * face already on the chain, and a descendant substitutes a pass-through for the entry naming the
-         * very callback its own gate will run. A per-task face (`TaskSpec.hooks`) is a different function in
-         * the descendant (or absent), so it folds and travels.
+         * Set by the constraint mint's caller on an entry whose `policy` is the folded form of an ancestor's
+         * `classic.PreToolUse` chain (`createPreToolUseConstraintPolicy`): the chain that leg's admission MOUNTED, as the
+         * entry declares it. It is read for ONE thing — a declaration that this entry carries a chain: beside a policy the
+         * mint did not make, a declared judging `tool.check` handler is refused (`config.mods_invalid`; the guard has no bus to
+         * be raised on), and such an entry is never treated as a caller policy (it licenses no ask grant). It is NEVER the
+         * entry's identity: the chain an entry stands for is read off the bus its policy was minted over (that bus's admission
+         * recorded it), so a host may hand any list here (`[]` included, or none) without moving what is judged.
          *
-         * Identity is the only sound test here, and it is deliberately the CONSERVATIVE one: an assembly that
-         * hands each task a freshly bound wrapper over one underlying callback (the `runSpec` mux does this)
-         * produces two distinct function objects, so the descendant both folds the ancestor's entry and runs
-         * its own — the callback is consulted twice rather than skipped. Erring toward a second screening,
-         * never toward a missed one, is what makes an identity miss a cost rather than a hole.
+         * The identity (`sameInstallation`) is that chain plus the context the entry's questions are settled in — the frozen
+         * approver, the two durable mandates, the environment, the classifier instance — and it is the CONSERVATIVE test:
+         * two chains over the same registrations in a different order, or a re-built registration object, compare unequal,
+         * and a bus no engine admission mounted is no leg's installation. Chain assembly does not re-append a leg already on
+         * the chain; a descendant's own gate stands in for an entry only when that identity holds under no mandate (the
+         * pass-through of its `classic.PreToolUse`, the skip of its `tool.check`); any other entry is judged on both events
+         * under its own context — judged twice rather than skipped, never toward a missed one.
          */
-        preToolUse?: Hooks["preToolUse"];
+        mods?: readonly ModChainLink[];
         /**
          * The environment this screening face was installed against — the source of the `HookEnvCapabilities`
          * handed to it, compared BY REFERENCE, `undefined` when the installation had no env face. Part of the
@@ -1646,14 +1639,21 @@ export interface RunInternals {
      */
     toolCeiling?: readonly import("../tool-face.js").ToolSelectorLayer[];
     /** Set by the delegation lane when the spawning run's prepare judged this leg's own tool lists (its spec's `allowTools` /
-     *  `excludeTools` — a definition's or the delegation tool's) where they were mounted: their digest (`toolListsDigest`), the evidence
-     *  bound to exactly those lists. A prepare whose own lists digest to it does not judge them again against its own, narrower universe,
-     *  and its rows record it (`CheckpointState.toolListsJudged`) so a resume that hands no internals keeps the judgment. Absent (a
-     *  workflow agent, a team member, a host's direct `runTask`), or lists that digest differently ⇒ the leg judges its own lists. */
+     *  `excludeTools` — a definition's or the delegation tool's) against a pool it could list: their digest (`toolListsDigest`), the
+     *  evidence bound to exactly those lists. A prepare whose own lists digest to it does not judge them again, and its rows record it
+     *  (`CheckpointState.toolListsJudged`) so a resume that hands no internals keeps the judgment. Absent (a delegation tool whose pool
+     *  cannot be listed, a workflow agent, a team member, a host's direct `runTask`), or lists that digest differently ⇒ the leg judges its own lists. */
     toolListsJudged?: string;
-    /** Set by the delegation lane: whose lists this leg's own are (`delegationListWhere` — the agent definition it was spawned as, or the
-     *  delegation tool's tool-level list), so a refusal at the leg's prepare names the list to fix. Absent ⇒ the leg's own `TaskSpec` seats. */
-    ownToolListsWhere?: string;
+    /** Set by the delegation lane: whose lists this leg's own are — the delegation tool that spawned it (its declared name, its mounted one), the
+     *  agent definition it was spawned as (absent ⇒ the tool's tool-level list) and `lists`, the digest of exactly the lists it wrote. A refusal
+     *  at the leg's prepare names that list (`delegationListWhere`), and the tool's name is a name of this leg's lineage: its own lists are
+     *  asked of a universe that carries it. Held only for the lists it wrote ({@link boundOwnToolLists}): other lists are the host's own
+     *  `TaskSpec` seats. Absent ⇒ no delegation tool behind the leg's own `TaskSpec` seats. */
+    ownToolLists?: {
+        readonly toolName: string;
+        readonly definition?: string;
+        readonly lists: string;
+    };
     /** Set only on an observer sidecar's legs: the leg kind whose protocol is the observer's report tool. */
     observerLeg?: true;
     /** The live repair bundle from a `runRepairLoop` attempt in flight (attemptCount>0). Serialized onto a
@@ -2647,6 +2647,8 @@ export interface ResumeRun {
      *  §4.3-3 reserves for the cross-process parked leg). Present only when a wake message passed a
      *  screen that supplied context. */
     wakeMessageHookContext?: string;
+    /** The resumed leg's bus when the wake-message screen admitted it before the claim — prepare adopts it. */
+    legMods?: LegMods;
     /** Compensation hook: called iff the resumed run fails with `resume.env_failed` (post-CAS
      *  workspace `resumeVM` failed) OR `resume.tool_unavailable` (P-7: the approved tool vanished) — in both
      *  the CAS already consumed the checkpoint but the pending action never ran. `resumeStream` supplies a
@@ -2695,11 +2697,12 @@ export interface SuspendReap {
 export interface TurnBoundaryDeps {
     spec: TaskSpec;
     queue: PushQueue<TaskEvent>;
-    /** The run loop's own latch — read for `userHalted` (the public `TaskStream.halt()` verb, which sets
-     *  the harness stop latch directly, not through the ctx primitive `Prepared.stopRequestedRef`
-     *  mirrors): a halted boundary has no next request either, so the bundle is not collected there. */
+    /** The run loop's own latch — read for `userHalted` (the `TaskStream.halt()` verb sets the harness stop latch directly,
+     *  not through the ctx primitive `Prepared.stopRequestedRef` mirrors: a halted boundary has no next request either, so
+     *  the bundle is not collected there) and for `callerStop`, the gate the boundary's compaction pass admits on and carries. */
     loopLatch: {
         readonly userHalted: boolean;
+        readonly callerStop: import("./caller-stop-gate.js").CallerStopGate;
     };
     manualCompactRef: {
         requested: boolean;
@@ -2722,9 +2725,8 @@ export interface TurnBoundaryDeps {
         parentToolCallId?: string;
         sourceTaskId?: string;
     };
-    postToolBatchHook: ((batch: PostToolBatchCall[], meta?: {
-        injectedThisTurn: "final_verification" | "finalize";
-    }, ctx?: import("../hooks.js").PostToolBatchContext) => PostToolBatchResult | undefined | Promise<PostToolBatchResult | undefined>) | undefined;
+    /** Whether a handler hangs on `classic.PostToolBatch` (the batch is collected only then). */
+    postToolBatchArmed: boolean;
     batchArgs: Map<string, unknown> | undefined;
     compactionBrain: Brain;
     withinTaskCompaction: () => boolean;
@@ -2784,9 +2786,8 @@ export interface HarnessHandlersDeps {
     toolProgress: ToolProgressLane;
     writeFamilyOf: (name: string) => WriteFamily | undefined;
     toolLabels: Map<string, string>;
-    postToolBatchHook: ((batch: PostToolBatchCall[], meta?: {
-        injectedThisTurn: "final_verification" | "finalize";
-    }, ctx?: import("../hooks.js").PostToolBatchContext) => PostToolBatchResult | undefined | Promise<PostToolBatchResult | undefined>) | undefined;
+    /** Whether a handler hangs on `classic.PostToolBatch` (the batch is collected only then). */
+    postToolBatchArmed: boolean;
     batchArgs: Map<string, unknown> | undefined;
     runnerHooks: {
         onError: RunnerDeps["onError"];
@@ -2841,10 +2842,9 @@ export interface RunnerSelfSeat {
      *  against the catalog in force): prepare hands its leg a call-time reader over it, because this is the one seat a
      *  running leg re-reads (geometry, not route — see `context-settings.ts`). */
     contextOverlayOf?(ref: import("../model-seat.js").ModelRef | undefined): import("../context-settings.js").ContextWindowOverlay | undefined;
-    /** The deployment-level gating baseline (deps toolPolicy / hooks) as delegate wrappers — for assemblers that compose with it. */
+    /** The deployment-level gating baseline (deps toolPolicy) as a delegate wrapper — for assemblers that compose with it. */
     readonly gateBaseline: {
         toolPolicy?: RunnerDeps["toolPolicy"];
-        hooks?: RunnerDeps["hooks"];
     };
     /** Whether a child task THIS runner runs can be placed in a tree other than the caller's (an explicit cwd, a worktree):
      *  true only when its deps carry an `executionEnvFactory` (live read — `swapDeps` replaces the deps). The delegation tool asks
@@ -2883,10 +2883,10 @@ export type PrepareTaskFn = (spec: TaskSpec, deps: RunnerDeps, sessions: Session
  */
 export interface InstallingPhaseResult {
 }
-/** The live-task handle `runLocked` publishes once the harness exists: the harness + abort
- *  controller, the loop-liveness latch (`ended` flips when the single `harness.prompt` settles; `userInterrupted`
- *  / `userHalted` are the interrupt and halt verbs' attribution seats), the run's reminder mark, its session and
- *  engine-minted run id, and the hook bound + identity envelope the steer entrance screen runs under. */
+/** The live-task handle `runLocked` publishes once the harness exists: the harness + abort controller, the loop latch
+ *  (`ended` flips when the single `harness.prompt` settles; `userInterrupted` / `userHalted` are the interrupt and halt
+ *  verbs' attribution seats; `callerStop` is the run's caller-stop gate the three stop verbs trip), the run's reminder
+ *  mark, its session and engine-minted run id, and the bus + identity envelope the steer entrance screen runs on. */
 export interface LiveHandle {
     harness: AgentHarness;
     abortController: AbortController;
@@ -2894,13 +2894,15 @@ export interface LiveHandle {
         ended: boolean;
         userInterrupted: boolean;
         userHalted: boolean;
+        callerStop: import("./caller-stop-gate.js").CallerStopGate;
     };
     reminderMark: string;
     sessionId: string;
     /** The run body's engine-minted run id, so the stream-layer verbs can name the run their disclosures are about. */
     runId: string;
-    hookTimeoutMs: number;
     hookIdentity: HookInvocationIdentity;
+    /** The leg's mods bus (the steer entrance raises `classic.UserPromptSubmit` on it). */
+    modBus: LegModBus;
     /** The leg's live permission-mode seat (`TaskStream.setPermissionMode` steers it). */
     permissionMode: PermissionModeController;
 }
@@ -2936,6 +2938,7 @@ export interface ManualCompactRef {
  */
 export type EndOfTaskCompaction = {
     compacted: boolean;
+    pass?: string;
     tokensBefore?: number;
     freedTokens?: number;
     triggerTokens?: number;

package/dist/core/runner/credential-origin-seat.d.ts

@@ -0,0 +1,2 @@
+import type { NoticeSeatInput } from "./notice-seat-input.js";
+export declare function createCredentialOriginRefusalScope({ onNotice, sessionId, runId }: NoticeSeatInput): <T>(fn: () => Promise<T>) => Promise<T>;

package/dist/core/runner/credential-origin-seat.js

@@ -0,0 +1,19 @@
+import { runWithCredentialOriginRefusals } from "../../brain/status-sink.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+export function createCredentialOriginRefusalScope({ onNotice, sessionId, runId }) {
+    const announced = new Set();
+    return (fn) => runWithCredentialOriginRefusals(({ modelId, boundOrigin, requestOrigin }) => {
+        const key = `${modelId}\u0000${boundOrigin}\u0000${requestOrigin}`;
+        if (announced.has(key))
+            return;
+        announced.add(key);
+        deliverEngineNotice(onNotice, {
+            code: "route.credential_origin_mismatch",
+            message: `A request for model "${modelId}" was not sent: the model's own credential belongs to ${boundOrigin}, the host it was ` +
+                `first sent to, and this request was going to ${requestOrigin}. A credential does not follow its model to another host — ` +
+                `the deployment has to give the model a credential for ${requestOrigin} (or point it back at ${boundOrigin}). ` +
+                `Said once per run for this model and these two hosts.`,
+            detail: { modelId, boundOrigin, requestOrigin, sessionId, runId },
+        });
+    }, fn);
+}

package/dist/core/runner/extra-body-dropped-seat.d.ts

@@ -1,8 +1,4 @@
-import type { EngineNotice } from "../engine-notice.js";
+import type { NoticeSeatInput } from "./notice-seat-input.js";
 /** Where the announcement goes and whom it is attributed to — the same triple as the sibling `route.*` seats. */
-export interface ExtraBodyDroppedSeatInput {
-    onNotice: ((notice: EngineNotice) => void) | undefined;
-    sessionId: string;
-    runId: string;
-}
+export type ExtraBodyDroppedSeatInput = NoticeSeatInput;
 export declare function createExtraBodyDroppedScope({ onNotice, sessionId, runId }: ExtraBodyDroppedSeatInput): <T>(fn: () => Promise<T>) => Promise<T>;