@sema-agent/core 7.51.2 → 7.53.0

package/dist/agents/tool-filter.d.ts

@@ -9,30 +9,36 @@ import { type ToolNameListReading } from "../core/tool-name-list.js";
  * root run (`TaskSpec.allowTools` / `TaskSpec.excludeTools`) and every child (its definition's lists, under the ceiling of the
  * run that spawned it), so there is no spawn-time filter and no complement anywhere.
  *
- *  - an allowed list absent, or holding `"*"`, sets no allowlist on its layer; otherwise the layer keeps only what it names
+ *  - an allowed list absent, or holding `"*"` (any spelling the rule syntax reads as it: `*()`, `*(*)`), sets no allowlist on
+ *    its layer; otherwise the layer keeps only what it names
  *    (`[]` keeps nothing — intentional, not a mistake);
  *  - a denied list removes what it names from whatever remains (a denied tool always loses);
  *  - a layer above a run (its ceiling) bounds it: a child's `"*"` never widens what its parent could use.
  *
- * An entry is read as the reference reads a rule string ({@link readDeniedEntry}: `Tool(content)` names `Tool`, the content is
- * not read, the whole tool is hidden); a protocol spelling (`mcp__srv`, `mcp__srv__*`, a glob over the tool segment) reaches the
+ * An entry is read by the rule syntax ({@link readDeniedEntry}: `Tool(content)` names `Tool`, the content is not read, the
+ * whole tool is hidden; an entry the syntax cannot read names no tool); a protocol spelling (`mcp__srv`, `mcp__srv__*`, a glob over the tool segment) reaches the
  * tools of that peer, including ones it lists later; an entry no tool answers to is kept by name and reaches one mounted later.
  * Judged at the prepare that receives it: a spelling no tool name can have is refused, an unknown name told (`sub-agent-deny-lists.ts`).
  *
- * Note: `"*"` in an allowed list is the "allow all" sentinel, so a tool literally NAMED `"*"` cannot be
- * the sole allowed tool via this path (tool names are conventionally identifiers, so this is moot).
+ * `"*"` in an allowed list is the "allow all" sentinel and never a name: no tool is named `*` (the caller tool name
+ * contract, `caller-tool-name.ts`, refuses it at the mount; engine and protocol-minted names never are).
  */
 /**
- * How ONE denied-tools entry is read — the reference reads each as a rule string, without trimming: `Tool(content)` names
- * `Tool` (the content is dropped, so the whole tool is hidden), `Tool()` and `Tool(*)` are the bare name, and anything else
- * — a malformed paren form, an entry with surrounding whitespace — is the whole string, which names no tool. A value that is
- * not a string (a list a host read from a file can hold anything) names no tool either: it reads as `not_a_string` with a
- * fixed label of its TYPE, and nothing about the value is read, converted or printed — `typeof` and the array test only.
+ * How ONE denied-tools entry is read — by the rule syntax's own test of a rule spelling (`ruleSpellingOf`, the one every entry
+ * list's reader asks), exactly as written: `Tool(content)` names `Tool` (the content is not read here, so the whole tool is
+ * hidden), `Tool()` and `Tool(*)` are the bare name. An entry the syntax cannot read — surrounding whitespace, a tool name
+ * outside its spelling (a blank or an invisible character before the `(`, a leading `-`), a parenthesis that does not close
+ * the entry — names no tool: `unreadable`, the entry as written. A value that is not a string (a list a host read from a file
+ * can hold anything) names no tool either: it reads as `not_a_string` with a fixed label of its TYPE, and nothing about the
+ * value is read, converted or printed — `typeof` and the array test only.
  */
 export type DeniedEntryReading = {
     readonly kind: "name";
     readonly name: string;
     readonly content: boolean;
+} | {
+    readonly kind: "unreadable";
+    readonly entry: string;
 } | {
     readonly kind: "not_a_string";
     readonly type: string;
@@ -79,13 +85,31 @@ export interface ToolNameListReach {
     readonly covering: readonly string[];
     readonly wholeProtocols: ReadonlySet<ProtocolId>;
 }
+/**
+ * The tool ONE entry of a list on `side` reaches ({@link readDeniedEntry}) — the one per-entry reading every list reader takes:
+ * `Tool()` / `Tool(*)` are the bare `Tool` (`*()` / `*(*)` the wildcard `*`); a denied `Tool(content)` hides the whole `Tool`;
+ * an allowed one, an unreadable entry or a non-string reaches nothing (`undefined`).
+ */
+export declare function toolNameOfEntry(entry: unknown, side: ToolNameListSide): string | undefined;
+/**
+ * Is this entry a bare tool name as the rule syntax reads it, written as such (`Read`, `mcp__srv__*`, `*`; never `Read()`,
+ * `Read(*)`, `Read(x)`, an unreadable spelling or a non-string)? The one form a checkpoint row records and is read back in.
+ */
+export declare function isCanonicalToolName(entry: unknown): boolean;
+/**
+ * A tool-name list as a checkpoint row records it: each entry as {@link toolNameOfEntry} reads it, in canonical spelling, an
+ * allowed entry that admits nothing left out — the copy reaches what the list reached, in the spelling a reader accepts
+ * ({@link isCanonicalToolName}). An unreadable entry stays as written: prepare refuses it before the park, the reader again.
+ */
+export declare function persistedToolNameList(entries: readonly string[], side: ToolNameListSide): string[];
 /**
  * What an allowed-tools value admits, or `undefined` when it names no allowlist: absent, `null`, or a list holding the
- * wildcard. A list admits its string entries (an entry that is not a string admits nothing); a value that is not a list admits
- * NOTHING — the judge before the run refuses it, and a reader that meets it first fails closed.
+ * wildcard — an entry {@link toolNameOfEntry} reads as `*` (`*`, `*()`, `*(*)`). A list admits its string entries (an entry that
+ * is not a string admits nothing); a value that is not a list admits NOTHING — the judge before the run refuses it, and a
+ * reader that meets it first fails closed.
  */
 export declare function readAllowedToolList(allowTools: unknown): ToolNameListReach | undefined;
-/** What a denied value hides: its string entries read as {@link readDeniedEntry} reads them (an entry that is not a string, or a value that is not a list, hides nothing). */
+/** What a denied value hides: its string entries read as {@link readDeniedEntry} reads them (an entry it reads as `unreadable` or not a string, or a value that is not a list, hides nothing here — the judgment before the run refuses each). */
 export declare function readDeniedToolList(denyTools: unknown): ToolNameListReach;
 /** Does the list reach this tool — through its wire name, any alias it declares, or a protocol spelling that covers it? The one matcher. */
 export declare function listReaches(reach: ToolNameListReach, tool: {
@@ -99,6 +123,9 @@ type UniverseTool = {
 };
 /** The wire names a leg of these kinds relies on (the catalog's protocol column). */
 export declare function protocolToolNames(legs: readonly ToolLegKind[]): string[];
+/** Is this value a layer — an object (not a list) with the two lists `allow` / `deny`? One that is not admits NOTHING here;
+ *  the judge before the run (`judgeRunToolLists`) refuses it, and a reader that meets it first fails closed. */
+export declare function isToolSelectorLayer(layer: unknown): layer is ToolSelectorLayer;
 /**
  * Compile ONE run's tool selector from its layers (the ceiling it was spawned under, then its own lists — the LAST layer is its own)
  * and the kinds of leg it is. Each list is read by the one reading ({@link readAllowedToolList} / {@link readDeniedToolList}) and
@@ -108,6 +135,24 @@ export declare function protocolToolNames(legs: readonly ToolLegKind[]): string[
  * producer passes frozen copies of the lists it read.
  */
 export declare function compileToolSelector(layers: readonly ToolSelectorLayer[], legs?: readonly ToolLegKind[]): ToolSelector;
+/**
+ * What a leg's tool valve leaves mounted — its one reading: nothing under the run's whole-face switch (`excludeAllTools`: every
+ * tool unmounts, protocol tools included), else what the compiled selector admits. The valve unmounts by it, and every question
+ * prepare asks about the post-valve roster before the valve runs (the full shell's reachability, the memory write channel, the
+ * persistence verdict, the two memory pairs' planning) asks it too.
+ */
+export declare function valveLeaves(spec: {
+    readonly excludeAllTools?: true;
+}, selector: Pick<ToolSelector, "admits">): (tool: UniverseTool) => boolean;
+/**
+ * The valve's reading at the SERVER level — {@link valveLeaves} asked of a whole peer before any of its tools is known: can the valve
+ * leave a tool of the peer `prefix` (`mcp__srv__`) at all? Nothing under the run's whole-face switch; else what the compiled selector's
+ * lists can reach of the peer ({@link ToolSelector.admitsPeer} — read off the lists, never off what the server lists). A peer this
+ * answers `false` for leaves no tool on the roster whatever it lists, so a run has no reason to dial it or to teach its instructions.
+ */
+export declare function valveLeavesPeer(spec: {
+    readonly excludeAllTools?: true;
+}, selector: Pick<ToolSelector, "admitsPeer">): (prefix: string) => boolean;
 /** One protocol tool a denylist reaches, and whose list it is: the leg's own (the last layer) or one it inherits (a ceiling layer). */
 export interface DeniedProtocolTool {
     readonly name: string;

package/dist/agents/tool-filter.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { canonicalize, UNCANONICALIZABLE } from "../core/canonical-json.js";
-import { parsePermissionRule } from "../core/permission-rule-syntax.js";
+import { ruleSpellingOf } from "../core/permission-rule-syntax.js";
 import { TOOL_CATALOG_ENTRIES } from "../core/tool-catalog-entries.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../core/namespaced-rule-name.js";
 import { protocolOf } from "../core/protocol-table.js";
@@ -9,9 +9,9 @@ import { readToolNameList, snapshotToolNameList, valueTypeLabel } from "../core/
 export function readDeniedEntry(entry) {
     if (typeof entry !== "string")
         return { kind: "not_a_string", type: valueTypeLabel(entry) };
-    if (entry !== entry.trim())
-        return { kind: "name", name: entry, content: false };
-    const parsed = parsePermissionRule(entry);
+    const parsed = ruleSpellingOf(entry);
+    if (parsed === undefined)
+        return { kind: "unreadable", entry };
     return { kind: "name", name: parsed.toolName, content: parsed.ruleContent !== undefined };
 }
 const LIST_NOUN = { allowed: "allowed tools", denied: "denied tools" };
@@ -52,18 +52,28 @@ export function snapshotDefinitionLists(def) {
         copy.denyTools = snapshotToolNameList(copy.denyTools);
     return copy;
 }
+export function toolNameOfEntry(entry, side) {
+    const read = readDeniedEntry(entry);
+    return read.kind === "name" && (side === "denied" || !read.content) ? read.name : undefined;
+}
+export function isCanonicalToolName(entry) {
+    const read = readDeniedEntry(entry);
+    return read.kind === "name" && !read.content && read.name === entry;
+}
+export function persistedToolNameList(entries, side) {
+    return entries.flatMap((entry) => {
+        const name = toolNameOfEntry(entry, side);
+        if (name !== undefined)
+            return [name];
+        return readDeniedEntry(entry).kind === "name" ? [] : [entry];
+    });
+}
 function reachOf(entries, side) {
     const names = new Set();
     const covering = [];
     const wholeProtocols = new Set();
     for (const entry of entries) {
-        let name;
-        if (side === "denied") {
-            const read = readDeniedEntry(entry);
-            name = read.kind === "name" ? read.name : undefined;
-        }
-        else
-            name = typeof entry === "string" ? entry : undefined;
+        const name = toolNameOfEntry(entry, side);
         if (name === undefined)
             continue;
         const split = splitNamespacedName(name);
@@ -85,7 +95,7 @@ export function readAllowedToolList(allowTools) {
     const list = readToolNameList(allowTools);
     if (list.kind !== "entries")
         return reachOf([], "allowed");
-    if (list.entries.includes("*"))
+    if (list.entries.some((entry) => toolNameOfEntry(entry, "allowed") === "*"))
         return undefined;
     return reachOf(list.entries, "allowed");
 }
@@ -129,9 +139,13 @@ function reachCoversPeer(reach, peer) {
         return split !== undefined && split.ns.id === peer.ns && split.peer === peer.peer && (split.tool === undefined || split.tool === "*");
     });
 }
+export function isToolSelectorLayer(layer) {
+    return typeof layer === "object" && layer !== null && !Array.isArray(layer);
+}
+const NO_TOOL_LAYER = Object.freeze({ allow: reachOf([], "allowed"), deny: reachOf([], "denied") });
 export function compileToolSelector(layers, legs = []) {
     const kept = Object.freeze([...layers]);
-    const compiled = kept.map((l) => ({ allow: readAllowedToolList(l.allow), deny: readDeniedToolList(l.deny) }));
+    const compiled = kept.map((l) => (isToolSelectorLayer(l) ? { allow: readAllowedToolList(l.allow), deny: readDeniedToolList(l.deny) } : NO_TOOL_LAYER));
     const admittedBy = (ls, tool) => ls.every((l) => (l.allow === undefined || listReaches(l.allow, tool)) && !listReaches(l.deny, tool));
     const protocol = new Map(PROTOCOL_ROWS.filter((r) => r.legs.some((l) => legs.includes(l))).map((r) => [r.name, r.underCeiling]));
     return Object.freeze({
@@ -153,8 +167,14 @@ export function compileToolSelector(layers, legs = []) {
         },
     });
 }
+export function valveLeaves(spec, selector) {
+    return spec.excludeAllTools === true ? () => false : (tool) => selector.admits(tool);
+}
+export function valveLeavesPeer(spec, selector) {
+    return spec.excludeAllTools === true ? () => false : (prefix) => selector.admitsPeer(prefix);
+}
 export function deniedProtocolTools(layers, legs) {
-    const denies = layers.map((l) => readDeniedToolList(l.deny));
+    const denies = layers.map((l) => readDeniedToolList(isToolSelectorLayer(l) ? l.deny : undefined));
     const own = denies.slice(-1);
     const inherited = denies.slice(0, -1);
     const hits = new Map();

package/dist/bench/metrics.d.ts

@@ -158,6 +158,7 @@ export interface CoreStatsSubset {
         nestedSubagentMicroUsd: number;
         memoryConsolidationMicroUsd: number;
         compactionMicroUsd: number;
+        sideCallMicroUsd?: number;
     };
     nested?: {
         costMicroUsd?: number;

package/dist/brain/anthropic.d.ts

@@ -1,7 +1,7 @@
 import type { Brain } from "../core/types.js";
 import { type StreamEngineConfig } from "./stream-engine.js";
 export interface AnthropicBrainConfig extends StreamEngineConfig {
-    /** Base URL of the Anthropic(-compatible) API. Default `https://api.anthropic.com`. Overridden by model.baseUrl. */
+    /** Base URL of the Anthropic(-compatible) API. Default {@link ANTHROPIC_DEFAULT_BASE_URL}. Overridden by model.baseUrl. */
     baseUrl?: string;
     /** API key (`x-api-key`). Overridden by per-call options.apiKey / getApiKeyAndHeaders. */
     apiKey?: string;
@@ -35,6 +35,11 @@ export interface AnthropicBrainConfig extends StreamEngineConfig {
      */
     thinkingBudgetTokens?: number;
 }
+/** This lane's own default endpoint: where a request goes when neither the entry nor the config names a root,
+ *  and so the root a key on the config is paired with when the config declares none. Exported so that every place that
+ *  names the Anthropic API's own root — the {@link fable5Model} preset, a host's disclosure of where a default request
+ *  lands — reads this one spelling. */
+export declare const ANTHROPIC_DEFAULT_BASE_URL = "https://api.anthropic.com";
 /**
  * Create a Brain for the Anthropic Messages API (`/v1/messages`) with **prompt caching** and
  * **extended-thinking replay**. Translates the unified Context into an Anthropic request and the

package/dist/brain/anthropic.js

@@ -6,8 +6,8 @@ import { STREAM_TORN_WARNING, createRepetitionPoll, createStreamEndLedger, model
 import { admitToolCallId, providerResultIds, providerToolCallId, responseToolCallIds } from "./tool-call-id.js";
 import { emitBrainTelemetry, reportReasoningWireFacts } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, modelSupportsVision, sendableImages } from "./media-degrade.js";
-import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders, takeHeaderCasefold } from "./request-params.js";
-import { adjudicateModelRoute, applyRouteCredentialHeaders, assertServableRequestRoot, brainConfigSnapshot, createBrainRouteJudge, joinRequestUrl, resolveRequestRootOf, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
+import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, headerBagOnce, lockHeader, mergeHeaders, takeHeaderCasefold } from "./request-params.js";
+import { admitRouteRequest, applyRouteCredentialHeaders, assertServableRequestRoot, brainConfigSnapshot, createBrainRouteJudge, joinRequestUrl, resolveRequestRootOf, resolveRouteCredential } from "./route-adjudicator.js";
 import { requestRouteOf } from "./request-route.js";
 import { MIN_THINKING_TOKENS, budgetCapSkipsThinking, declaredEffortLevels, reasoningBudgetShare, reasoningRequestCarried, resolveEffort } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
@@ -226,7 +226,8 @@ function closeToolUseBlock(acc, responseIds, closed) {
     acc.closedTc = { type: "toolCall", id: engineId, ...(wireId !== engineId ? { wireId } : {}), name: acc.toolName, arguments: args };
     return acc.closedTc;
 }
-const ANTHROPIC_LANE_DEFAULT = "https://api.anthropic.com";
+export const ANTHROPIC_DEFAULT_BASE_URL = "https://api.anthropic.com";
+const ANTHROPIC_KEY_HEADER = "x-api-key";
 export function createAnthropicBrain(given = {}) {
     const config = brainConfigSnapshot(given, "createAnthropicBrain config");
     assertServableRequestRoot(config.baseUrl, "config.baseUrl");
@@ -246,17 +247,19 @@ export function createAnthropicBrain(given = {}) {
             maxRetries: options?.maxRetries,
             stallTimeouts: options?.stallTimeouts,
             buildRequest: (overrides) => {
-                const { root, origin: rootOrigin } = resolveRequestRootOf(model.baseUrl, config.baseUrl, ANTHROPIC_LANE_DEFAULT);
+                const routed = { id: model.id, baseUrl: model.baseUrl };
+                const { root, origin: rootOrigin } = resolveRequestRootOf(routed.baseUrl, config.baseUrl, ANTHROPIC_DEFAULT_BASE_URL);
+                const modelHeaders = headerBagOnce(model.headers);
+                const optionsHeaders = headerBagOnce(options?.headers);
                 const routeCredential = resolveRouteCredential({
                     optionsApiKey: options?.apiKey,
-                    optionsHeaders: options?.headers,
-                    modelHeaders: model.headers,
+                    optionsHeaders,
+                    modelHeaders,
                     configApiKey: config.apiKey,
                     configHeaders: config.headers,
+                    keyHeader: ANTHROPIC_KEY_HEADER,
                 });
-                const routeVerdict = adjudicateModelRoute(model, routeCredential, { baseUrl: config.baseUrl, laneDefault: ANTHROPIC_LANE_DEFAULT });
-                if (!routeVerdict.ok)
-                    throw new BrainError("invalid_request", routeRefusalText(routeVerdict));
+                const routeAdmission = admitRouteRequest(routed, routeCredential, { baseUrl: config.baseUrl, laneDefault: ANTHROPIC_DEFAULT_BASE_URL });
                 const apiKey = routeCredential.apiKey;
                 const nonEmptyBlocks = context.systemBlocks?.filter((b) => b.text.length > 0);
                 const system = nonEmptyBlocks?.length
@@ -329,8 +332,8 @@ export function createAnthropicBrain(given = {}) {
                 if (anthCompat.interleavedThinking) {
                     betas.push("interleaved-thinking-2025-05-14");
                 }
-                const headers = mergeHeaders(model.headers, config.headers, options?.headers);
-                applyRouteCredentialHeaders(headers, routeCredential, { model: model.headers, options: options?.headers });
+                const headers = mergeHeaders(modelHeaders, config.headers, optionsHeaders);
+                applyRouteCredentialHeaders(headers, routeCredential);
                 if (betas.length > 0) {
                     const existing = (takeHeaderCasefold(headers, "anthropic-beta") ?? "").split(",").map((b) => b.trim()).filter(Boolean);
                     for (const beta of betas) {
@@ -342,7 +345,7 @@ export function createAnthropicBrain(given = {}) {
                 lockHeader(headers, "content-type", "application/json");
                 lockHeader(headers, "anthropic-version", config.version ?? "2023-06-01");
                 if (apiKey)
-                    headers["x-api-key"] = apiKey;
+                    lockHeader(headers, ANTHROPIC_KEY_HEADER, apiKey);
                 const builtThinkingRequested = body.thinking !== undefined;
                 const builtMaxTokens = body.max_tokens;
                 const builtMaxTokensLane = overrides?.maxOutputTokens !== undefined
@@ -362,6 +365,7 @@ export function createAnthropicBrain(given = {}) {
                     outputCapTokens: effectiveOutputCap(wire, OUTPUT_CAP_KEYS.anthropic),
                     capDerivedPaths: [...OUTPUT_CAP_KEYS.anthropic, "thinking.budget_tokens"],
                     onCommitted: () => {
+                        routeAdmission();
                         thinkingRequested = builtThinkingRequested;
                         sentMaxTokens = builtMaxTokens;
                         sentMaxTokensLane = builtMaxTokensLane;
@@ -768,5 +772,5 @@ export function createAnthropicBrain(given = {}) {
             },
         });
     };
-    return { stream, adjudicateRoute: createBrainRouteJudge({ ...config, laneDefault: ANTHROPIC_LANE_DEFAULT }) };
+    return { stream, adjudicateRoute: createBrainRouteJudge({ ...config, laneDefault: ANTHROPIC_DEFAULT_BASE_URL, keyHeader: ANTHROPIC_KEY_HEADER }) };
 }

package/dist/brain/model-presets.d.ts

@@ -20,12 +20,11 @@ import type { AnthropicMessagesCompat, Model } from "../internal/llm.js";
  */
 export declare const FABLE_5_COMPAT: AnthropicMessagesCompat;
 /**
- * Fable-5 behavioral guidance (CC 2.1.198 `fable_5_mitigations` — Anthropic's own runtime patches
- * for this model class's known behavior pitfalls, adapted; design/119 S3). Carried on the Model as
- * `promptGuidance` DATA — the injection mechanism (`Model.promptGuidance` → system-prompt tail) is
- * generic and model-name-free.
+ * The fable lines the classic prompt shape serves. They are prompt text, so they live with the prompt
+ * text; this name stays exported for hosts that read them. The preset below no longer carries them as
+ * `promptGuidance`: the prompt composes them itself, once, where they are the only fable text.
  */
-export declare const FABLE_5_PROMPT_GUIDANCE: string[];
+export declare const FABLE_5_PROMPT_GUIDANCE: readonly string[];
 /**
  * A ready-to-use `claude-fable-5` {@link Model} (CC 2.1.198 registry facts: 1M-token native context
  * window, 64k default max output — the 128k tier is opt-in via `maxTokens` override, knowledge

package/dist/brain/model-presets.js

@@ -1,12 +1,14 @@
+import { catalogText } from "../prompt-assembly/catalog/index.js";
+import { ANTHROPIC_DEFAULT_BASE_URL } from "./anthropic.js";
 export const FABLE_5_COMPAT = {
     thinkingMode: "adaptive",
     effortLevels: ["low", "medium", "high", "xhigh", "max"],
     supportsTemperature: false,
 };
 export const FABLE_5_PROMPT_GUIDANCE = [
-    "Your final message of a turn is the only text the caller is guaranteed to read. Put every conclusion, answer, and deliverable in it — lead with the outcome, then supporting detail. Never leave a result only in an intermediate message or in your reasoning.",
-    "When operating autonomously: before ending your turn, check that the task is actually complete (not just planned); before any state-changing action, re-verify that the evidence supports that specific action rather than pattern-matching a familiar case.",
-    "When calling tools, provide exactly ONE complete JSON value per parameter — never concatenate multiple values, never truncate, never wrap a value in commentary.",
+    catalogText("core/behavior.fable-classic.final-message"),
+    catalogText("core/behavior.fable-classic.autonomy"),
+    catalogText("core/behavior.fable-classic.tool-json"),
 ];
 export function fable5Model(overrides = {}) {
     return {
@@ -14,7 +16,7 @@ export function fable5Model(overrides = {}) {
         name: "Claude Fable 5",
         api: "anthropic-messages",
         provider: "anthropic",
-        baseUrl: "https://api.anthropic.com",
+        baseUrl: ANTHROPIC_DEFAULT_BASE_URL,
         reasoning: true,
         defaultThinking: "high",
         input: ["text", "image"],
@@ -23,7 +25,6 @@ export function fable5Model(overrides = {}) {
         maxTokens: 64_000,
         charsPerToken: 3,
         compat: { ...FABLE_5_COMPAT },
-        promptGuidance: [...FABLE_5_PROMPT_GUIDANCE],
         ...overrides,
     };
 }

package/dist/brain/open-responses.js

@@ -5,13 +5,14 @@ import { STREAM_TORN_WARNING, createRepetitionPoll, modelOutputInvalidOf, noteRe
 import { admitToolCallId, providerResultIds, providerToolCallId, responseToolCallIds } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
-import { OUTPUT_CAP_KEYS, RESPONSES_RESERVED, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders } from "./request-params.js";
-import { adjudicateModelRoute, applyRouteCredentialHeaders, assertServableRequestRoot, brainConfigSnapshot, createBrainRouteJudge, joinRequestUrl, resolveRequestRootOf, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
+import { OUTPUT_CAP_KEYS, RESPONSES_RESERVED, applyExtraBody, effectiveOutputCap, headerBagOnce, lockHeader, mergeHeaders } from "./request-params.js";
+import { admitRouteRequest, applyRouteCredentialHeaders, assertServableRequestRoot, brainConfigSnapshot, createBrainRouteJudge, joinRequestUrl, resolveRequestRootOf, resolveRouteCredential } from "./route-adjudicator.js";
 import { requestRouteOf } from "./request-route.js";
 import { declaredOffSpelling, mintEffortWireValue, reasoningRequestCarried } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
 import { refuseRetiredTimeoutKnobs } from "./timeout.js";
 import { resolveFetch } from "./transport.js";
+const OPEN_RESPONSES_KEY_HEADER = "authorization";
 const DEGENERATE_POLL_CHARS = 64;
 const MALFORMED_SAMPLE_CHARS = 160;
 const MALFORMED_ARGS_CHARS = 200;
@@ -239,20 +240,22 @@ export function createOpenResponsesBrain(given = {}) {
             maxRetries: options?.maxRetries,
             stallTimeouts: options?.stallTimeouts,
             buildRequest: (overrides) => {
-                const { root, origin: rootOrigin } = resolveRequestRootOf(model.baseUrl, config.baseUrl);
+                const routed = { id: model.id, baseUrl: model.baseUrl };
+                const { root, origin: rootOrigin } = resolveRequestRootOf(routed.baseUrl, config.baseUrl);
                 if (!root) {
                     throw new Error("createOpenResponsesBrain: no baseUrl configured (set config.baseUrl or model.baseUrl)");
                 }
+                const modelHeaders = headerBagOnce(model.headers);
+                const optionsHeaders = headerBagOnce(options?.headers);
                 const routeCredential = resolveRouteCredential({
                     optionsApiKey: options?.apiKey,
-                    optionsHeaders: options?.headers,
-                    modelHeaders: model.headers,
+                    optionsHeaders,
+                    modelHeaders,
                     configApiKey: config.apiKey,
                     configHeaders: config.headers,
+                    keyHeader: OPEN_RESPONSES_KEY_HEADER,
                 });
-                const routeVerdict = adjudicateModelRoute(model, routeCredential, { baseUrl: config.baseUrl });
-                if (!routeVerdict.ok)
-                    throw new BrainError("invalid_request", routeRefusalText(routeVerdict));
+                const routeAdmission = admitRouteRequest(routed, routeCredential, { baseUrl: config.baseUrl });
                 const apiKey = routeCredential.apiKey;
                 if (options?.stop !== undefined && options.stop.length > 0) {
                     throw new Error("createOpenResponsesBrain: options.stop is not expressible in the Open Responses request (the wire form has no stop-sequence field); " +
@@ -285,11 +288,11 @@ export function createOpenResponsesBrain(given = {}) {
                 }
                 if (effort !== undefined)
                     body.reasoning = { effort };
-                const headers = mergeHeaders(model.headers, config.headers, options?.headers);
-                applyRouteCredentialHeaders(headers, routeCredential, { model: model.headers, options: options?.headers });
+                const headers = mergeHeaders(modelHeaders, config.headers, optionsHeaders);
+                applyRouteCredentialHeaders(headers, routeCredential);
                 lockHeader(headers, "content-type", "application/json");
                 if (apiKey)
-                    headers["authorization"] = `Bearer ${apiKey}`;
+                    lockHeader(headers, OPEN_RESPONSES_KEY_HEADER, `Bearer ${apiKey}`);
                 const { body: wire, dropped: extraBodyDropped } = applyExtraBody(body, model.extraBody, RESPONSES_RESERVED);
                 return {
                     url: joinRequestUrl(root, "/responses"),
@@ -300,6 +303,7 @@ export function createOpenResponsesBrain(given = {}) {
                     outputCapTokens: effectiveOutputCap(wire, OUTPUT_CAP_KEYS.responses),
                     capDerivedPaths: OUTPUT_CAP_KEYS.responses,
                     onCommitted: () => {
+                        routeAdmission();
                         sentMaxTokens = builtMaxTokens;
                         sentMaxTokensLane = builtMaxTokensLane;
                         sentEffort = effort;
@@ -773,5 +777,5 @@ export function createOpenResponsesBrain(given = {}) {
             },
         });
     };
-    return { stream, adjudicateRoute: createBrainRouteJudge(config) };
+    return { stream, adjudicateRoute: createBrainRouteJudge({ ...config, keyHeader: OPEN_RESPONSES_KEY_HEADER }) };
 }

package/dist/brain/openai.js

@@ -5,15 +5,16 @@ import { STREAM_TORN_WARNING, createRepetitionPoll, createStreamEndLedger, echoF
 import { admitToolCallId, providerResultIds, providerToolCallId, responseToolCallIds } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
-import { OPENAI_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders } from "./request-params.js";
+import { OPENAI_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, headerBagOnce, lockHeader, mergeHeaders } from "./request-params.js";
 import { BrainError, providerErrorWord } from "./errors.js";
 import { inBandProviderError } from "./provider-dialect.js";
-import { adjudicateModelRoute, applyRouteCredentialHeaders, assertServableRequestRoot, brainConfigSnapshot, createBrainRouteJudge, joinRequestUrl, resolveRequestRootOf, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
+import { admitRouteRequest, applyRouteCredentialHeaders, assertServableRequestRoot, brainConfigSnapshot, createBrainRouteJudge, joinRequestUrl, resolveRequestRootOf, resolveRouteCredential } from "./route-adjudicator.js";
 import { requestRouteOf } from "./request-route.js";
 import { declaredOffSpelling, mintEffortWireValue, reasoningRequestCarried } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
 import { refuseRetiredTimeoutKnobs } from "./timeout.js";
 import { resolveFetch } from "./transport.js";
+const OPENAI_KEY_HEADER = "authorization";
 function closeToolCallAccum(acc, responseIds, closed) {
     if (acc.closedTc)
         return acc.closedTc;
@@ -342,20 +343,22 @@ export function createOpenAIBrain(given = {}) {
             maxRetries: options?.maxRetries,
             stallTimeouts: options?.stallTimeouts,
             buildRequest: (overrides) => {
-                const { root, origin: rootOrigin } = resolveRequestRootOf(model.baseUrl, config.baseUrl);
+                const routed = { id: model.id, baseUrl: model.baseUrl };
+                const { root, origin: rootOrigin } = resolveRequestRootOf(routed.baseUrl, config.baseUrl);
                 if (!root) {
                     throw new Error("createOpenAIBrain: no baseUrl configured (set config.baseUrl or model.baseUrl)");
                 }
+                const modelHeaders = headerBagOnce(model.headers);
+                const optionsHeaders = headerBagOnce(options?.headers);
                 const routeCredential = resolveRouteCredential({
                     optionsApiKey: options?.apiKey,
-                    optionsHeaders: options?.headers,
-                    modelHeaders: model.headers,
+                    optionsHeaders,
+                    modelHeaders,
                     configApiKey: config.apiKey,
                     configHeaders: config.headers,
+                    keyHeader: OPENAI_KEY_HEADER,
                 });
-                const routeVerdict = adjudicateModelRoute(model, routeCredential, { baseUrl: config.baseUrl });
-                if (!routeVerdict.ok)
-                    throw new BrainError("invalid_request", routeRefusalText(routeVerdict));
+                const routeAdmission = admitRouteRequest(routed, routeCredential, { baseUrl: config.baseUrl });
                 const apiKey = routeCredential.apiKey;
                 const body = {
                     model: model.id,
@@ -385,11 +388,11 @@ export function createOpenAIBrain(given = {}) {
                 if (options?.stop)
                     body.stop = options.stop;
                 applyThinking(body, model, options?.reasoning);
-                const headers = mergeHeaders(model.headers, config.headers, options?.headers);
-                applyRouteCredentialHeaders(headers, routeCredential, { model: model.headers, options: options?.headers });
+                const headers = mergeHeaders(modelHeaders, config.headers, optionsHeaders);
+                applyRouteCredentialHeaders(headers, routeCredential);
                 lockHeader(headers, "content-type", "application/json");
                 if (apiKey)
-                    headers["authorization"] = `Bearer ${apiKey}`;
+                    lockHeader(headers, OPENAI_KEY_HEADER, `Bearer ${apiKey}`);
                 const { body: wire, dropped: extraBodyDropped } = applyExtraBody(body, model.extraBody, OPENAI_RESERVED);
                 return {
                     url: joinRequestUrl(root, "/chat/completions"),
@@ -400,6 +403,7 @@ export function createOpenAIBrain(given = {}) {
                     outputCapTokens: effectiveOutputCap(wire, OUTPUT_CAP_KEYS.openai),
                     capDerivedPaths: [mtField],
                     onCommitted: () => {
+                        routeAdmission();
                         sentMaxTokens = builtMaxTokens;
                         sentMaxTokensLane = builtMaxTokensLane;
                     },
@@ -749,5 +753,5 @@ export function createOpenAIBrain(given = {}) {
             },
         });
     };
-    return { stream, adjudicateRoute: createBrainRouteJudge(config) };
+    return { stream, adjudicateRoute: createBrainRouteJudge({ ...config, keyHeader: OPENAI_KEY_HEADER }) };
 }

package/dist/brain/request-params.d.ts

@@ -1,19 +1,3 @@
-/**
- * Request-parameter passthrough (design/40). A deployment can set official provider params it wants but
- * core doesn't model as first-class fields (OpenAI `frequency_penalty`/`presence_penalty`/`top_p`/`seed`/
- * `logit_bias`; Anthropic `top_k`/`top_p`/`stop_sequences`; …) via `Model.extraBody`, and core merges them
- * into the brain's request body. Anchored at the **Model** level (not per-turn) so the serialized body
- * stays byte-stable across turns → the prefix cache holds (design/9/31).
- *
- * Symmetric: each brain owns its structural + tuning keys (`reserved`) and ALWAYS wins — `extraBody` can
- * only supply the long tail, never clobber `messages`/`tools`/`temperature`/etc. Stripping is the safety
- * enforcement (the brains are standalone-usable), and a strip is never silent: {@link applyExtraBody}
- * RETURNS the keys it stripped, the brain reports them on the request it built
- * (`SSERequest.extraBodyDropped`), the stream engine reports them to the run's sink when it commits that
- * request (`reportExtraBodyDropped`), and the Runner announces them (`route.extra_body_reserved_dropped`).
- * One reading, at the one place the strip happens — so an `extraBody` a host brain swapped in for a single
- * request, or one on the compaction model, is said the same way the task's own model spec is.
- */
 /** OpenAI request-body keys core owns; `extraBody` cannot override these. */
 export declare const OPENAI_RESERVED: ReadonlySet<string>;
 /** Anthropic request-body keys core owns; `extraBody` cannot override these. (Note the asymmetry vs
@@ -43,16 +27,6 @@ export declare function applyExtraBody(body: Record<string, unknown>, extraBody:
     body: Record<string, unknown>;
     dropped: readonly string[];
 };
-/** The auth-bearing header names (case-fold), single-sourced for the credential enforcement
- *  (`applyRouteCredentialHeaders`, route-adjudicator.ts — the ONE authority over auth spelling: a
- *  per-model winner strips every carrier, any case, and re-asserts the winning bag's own),
- *  {@link mergeHeaders} (which EXEMPTS them — see there), and the route credential resolver (which
- *  reads carrier PRESENCE per bag to classify a headers-borne credential). The former per-call
- *  strip helper that lived here (`stripAuthHeaders` — "per-call auth replaces construction-time
- *  auth", triggered on `options.apiKey` presence) is retired: the three brains now run the
- *  route-credential resolution instead, whose per-model arm strips a strict superset of what the
- *  helper did. */
-export declare const AUTH_CARRIER_NAMES: ReadonlySet<string>;
 /**
  * #343 — the shared USER-HEADER merge layer (`model.headers` → construction `config.headers` →
  * per-call `options.headers`, later bag wins), CASE-FOLD deduplicated: HTTP header field names are
@@ -62,10 +36,11 @@ export declare const AUTH_CARRIER_NAMES: ReadonlySet<string>;
  * override silently defeated. A later bag's entry replaces an earlier case-variant instead; the
  * WINNER'S spelling and value survive (a single-spelling config is byte-identical on the wire).
  *
- * EXEMPT: the auth carriers (`authorization` / `x-api-key`, any case) pass through with plain
- * spread semantics (same-spelling override only, no case-fold dedup), so that the credential
- * enforcement (`applyRouteCredentialHeaders`, route-adjudicator.ts) stays the ONE authority over
- * auth spelling and this layer never becomes a second, subtly different one.
+ * EXEMPT: the credential headers ({@link isCredentialHeaderName}, the engine's one reading of which
+ * header carries a credential: `authorization`, `x-api-key`, `api-key`, `cookie`, …, any case) pass
+ * through with plain spread semantics (same-spelling override only, no case-fold dedup), so that the
+ * credential enforcement (`applyRouteCredentialHeaders`, route-adjudicator.ts) stays the ONE authority
+ * over credential spelling and this layer never becomes a second, subtly different one.
  *
  * The exemption is NOT what keeps a header-only `ANTHROPIC_AUTH_TOKEN` alive: dedup keeps the
  * winner's spelling, a lone `Authorization` has nothing to dedup against, and the credential
@@ -90,9 +65,9 @@ export declare const AUTH_CARRIER_NAMES: ReadonlySet<string>;
  * user-bag merge precisely so they "can NEVER be overridden" (council design/40) — and without the
  * delete a user bag carrying `Content-Type: text/plain` survives BESIDE the lowercase lock, the
  * platform `Headers` fold turning the pair into `text/plain, application/json` on the wire: a lock
- * that decides nothing. Auth carriers are deliberately NOT routed through here (credential replacement + the
- * header-only boot flow are the pinned jurisdiction of `applyRouteCredentialHeaders`,
- * route-adjudicator.ts).
+ * that decides nothing. WHICH credential headers ride is the jurisdiction of `applyRouteCredentialHeaders`
+ * (route-adjudicator.ts); the key header a brain writes after it (`authorization` / `x-api-key`, from the
+ * apiKey knob) is a lock like any other — one value per name, whatever spelling a bag carried.
  */
 export declare function lockHeader(headers: Record<string, string>, lowerName: string, value: string): void;
 /**
@@ -103,6 +78,10 @@ export declare function lockHeader(headers: Record<string, string>, lowerName: s
  * losing the user's betas from the merge AND double-sending the header).
  */
 export declare function takeHeaderCasefold(headers: Record<string, string>, lowerName: string): string | undefined;
+/** A caller's header bag read ONCE, into a plain copy of its own enumerable entries — what a request build hands both
+ *  the route law (which credential rides, and its identity) and the merge (what goes on the wire), so a bag whose getters
+ *  or keys answer differently on a second read cannot be judged as one bag and sent as another. */
+export declare function headerBagOnce(bag: Readonly<Record<string, string>> | undefined): Record<string, string> | undefined;
 export declare function mergeHeaders(...bags: Array<Record<string, string> | undefined>): Record<string, string>;
 /**
  * The output-cap key(s) each lane's wire form uses. A lane's set is exactly the keys THAT lane's