@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/auto-compaction.d.ts

@@ -1,7 +1,7 @@
 import { type AgentMessage, type CompactionSettings, type Session, type ThinkingLevel } from "../internal/harness.js";
 import type { Message, Model, Tool } from "../internal/llm.js";
 import type { ContextWindowOverlay } from "./context-settings.js";
-import type { Hooks } from "./hooks.js";
+import type { PostCompactContext, PreCompactContext, PreCompactResult } from "./hooks.js";
 import type { TraceEvent } from "./trace.js";
 import type { Brain } from "./types.js";
 import type { TaskEvent, TaskEventIdentity } from "./task-event.js";
@@ -101,6 +101,18 @@ export interface CompactionForkContext {
      *  eligibility gate refuses a snapshot from a different model (see the engine-side twin's doc). */
     modelId?: string;
 }
+/**
+ * What a compaction pass reports at the moment it commits ({@link MaybeCompactOptions.onStarted}) — and the
+ * whole content of its `compaction_started` wire frame. `pass` is minted HERE, by the one function every lane
+ * runs, so no lane can number its own passes; the frame that ends the pass carries the same value.
+ */
+export interface CompactionPassStart {
+    readonly pass: string;
+    /** The trigger this pass runs under — the value it hands the `preCompact` hook. */
+    readonly trigger: "auto" | "manual" | "forced";
+    /** Engine clock, epoch ms, at the commit. */
+    readonly startedAt: number;
+}
 export interface MaybeCompactOptions {
     /** Disclosure channel for CONTAINED host-callback failures in this scope (the RB-463
      *  isolation primitive's bounded first-failure per site). Absent ⇒ failures are counted only. */
@@ -108,25 +120,27 @@ export interface MaybeCompactOptions {
     /** The session to compact. Typed on the INTERFACE face (typecheck 车 2026-07-24): every member this
      *  module touches lives on `Session` (the optional `getPromptEpoch` degrades honestly via `?.()`). */
     session: Session;
-    /** This run's provider-declared prompt sections (the epoch declaration axis):
-     *  the compaction-boundary epoch restatement/advance must hash the SAME artifact identity as the
-     *  prepare-time pin, or every compaction under a declaration-carrying run would flap the pin. */
-    epochDeclaredSections?: import("../prompt-assembly/epoch.js").EpochDeclaredSections;
-    /** A compaction-boundary CENTER CANDIDATE ADOPTION, pre-assembled by the
-     *  caller (prepare's seam): the descriptor advances with the candidate's declarations + provenance
-     *  in the SAME CAS append as the new baseline, and `apply()` (the live prefix/fingerprint swap)
-     *  runs ONLY after that append succeeded — a failed/blocked compaction must swap nothing. */
+    /** This run's prompt identity inputs (and the pinned center layer's provenance): the compaction restates the
+     *  session's epoch when the identity is unchanged and advances it otherwise — the same identity the prepare-time
+     *  record names, so a compaction never flaps the record. Absent ⇒ no restatement (a host compacting outside a run). */
+    promptIdentity?: {
+        readonly layers: import("../prompt-assembly/epoch.js").PromptIdentityLayers;
+        readonly sourceRevision?: string;
+    };
+    /** A compaction-boundary CENTER LAYER CHANGE, pre-assembled by the caller (prepare's seam): an adopted candidate,
+     *  or an emptied center layer after an explicit revocation. The epoch advances to the identity after the change in
+     *  the SAME CAS append as the new baseline, and `apply()` (the live prefix / fingerprint swap) runs ONLY after that
+     *  append succeeded — a failed or blocked compaction swaps nothing. */
     centerAdoption?: {
-        /** Absent together with `clear` ⇒ never happens; adoption carries the new digest, ROLLBACK
-         *  (explicit center disable) carries `clear:true` and no digest. */
-        centerArtifactDigest?: string;
-        sourceRevision?: string;
-        clear?: true;
-        declaredSections: import("../prompt-assembly/epoch.js").EpochDeclaredSections;
+        /** The run's identity inputs after the change (`layers.center` absent ⇒ the center layer is emptied). */
+        promptIdentity: {
+            readonly layers: import("../prompt-assembly/epoch.js").PromptIdentityLayers;
+            readonly sourceRevision?: string;
+        };
         /** the post-swap prompt overhead in the trigger estimate's coordinate: used for THIS
          *  compaction's post-measurement so PTL recovery/anti-thrash see the swapped prefix size. */
         overheadTokensAfter: number;
-        apply: (committedArtifactDigest?: string) => void;
+        apply: (committedIdentity: string) => void;
     };
     /** Model whose context window bounds the budget (the model that runs the next turn). */
     model: Model;
@@ -196,8 +210,9 @@ export interface MaybeCompactOptions {
     contextInstructionFiles?: string;
     signal?: AbortSignal;
     /**
-     * Manual compact() withdrawal signal — the composed cancel signals of the manual callers THIS
-     * pass claimed (a strict SUBSET of `signal`, which additionally carries the task's own abort).
+     * The pass's WITHDRAWAL signal — the run's caller-stop gate (the stop verbs and the task's own
+     * `signal`), composed with the cancel signals of the manual callers THIS pass claimed (a SUBSET
+     * of `signal`, which may additionally carry the leg's own abort).
      * Used only for failure ATTRIBUTION: when the summary call's failure is its abort outcome and
      * this signal has fired, the thrown error is stamped so {@link isCompactionManualCancel} holds —
      * the caller then treats the pass as withdrawn ("mooted") instead of summarizer evidence. It
@@ -479,6 +494,17 @@ export interface MaybeCompactOptions {
      * not optional there, so a preCompact `block` is IGNORED on "forced").
      */
     trigger?: "auto" | "manual" | "forced";
+    /**
+     * The pass has COMMITTED: the trigger gate passed, a valid cut point exists and no `preCompact` handler
+     * blocked it, and nothing has yet consulted the summary provider or called the model. Fired exactly once per
+     * pass — a retry inside the summary call is the same pass — and never for a pass that ends before this point
+     * (under threshold, held under the floor, disabled, nothing to compact, blocked, or cut by its own signal while
+     * the `preCompact` hook ran). A pass that fired it ends
+     * in `compacted: true` or a throw, so the caller that put a frame on the wire here owes the matching end.
+     * Observe-only: a throw — or the rejection of an `async` callback, which this seat does not await — is
+     * contained and never reaches the pass.
+     */
+    onStarted?: (start: CompactionPassStart) => void;
     /**
      * design/134 (CC PreCompact parity) — fired AFTER the trigger gate and a CONFIRMED valid cut point
      * (so every invocation corresponds to a compaction that would actually happen), BEFORE the
@@ -488,13 +514,13 @@ export interface MaybeCompactOptions {
      * no-block/no-instructions (the caller's wrapper owns tracing; an observer bug must never feed the
      * caller's breaker or kill PTL recovery).
      */
-    preCompact?: Hooks["preCompact"];
+    preCompact?: (ctx: PreCompactContext) => PreCompactResult | undefined | Promise<PreCompactResult | undefined>;
     /**
      * design/134 (CC PostCompact parity) — observe-only, fired after the compaction LANDED
      * (appendCompaction done, post measurement taken). A throw is swallowed (same isolation contract
      * as {@link onCompaction}: the compaction already succeeded).
      */
-    postCompact?: Hooks["postCompact"];
+    postCompact?: (ctx: PostCompactContext) => void | Promise<void>;
     /**
      * MF-18 修② — observe-only: fired when a summary call's serialized conversation INPUT was
      * truncated to fit the compaction model's context window (the ~300K-session shape that previously
@@ -550,6 +576,10 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
      *  nothing to do looked identical to one that never wanted to run; the caller's outcome event
      *  (`compaction_outcome{outcome:"noop"}`) reads this flag. */
     noop?: true;
+    /** The id of the pass this result concludes — the value {@link MaybeCompactOptions.onStarted} was handed.
+     *  Set exactly when `compacted` is true: every other return of this function ends before the pass commits,
+     *  and a pass that commits and does not land THROWS (the caller learned the id from the start callback). */
+    pass?: string;
     tokensBefore?: number;
     /** The §25.2 STRUCTURAL pre/post delta in ONE coordinate — the only subtractable quantity here.
      *  Absent ⇒ the post measurement failed and no delta was taken. */
@@ -666,6 +696,8 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
 /** What a landed compaction hands the wire frame. Structural, so both the full `maybeCompact` result
  *  and the settle lane's narrower `EndOfTaskCompaction` satisfy it without either importing the other. */
 export interface CompactedFrameSource {
+    /** The pass this landing concludes (see {@link MaybeCompactOptions.onStarted}). */
+    pass?: string;
     tokensBefore?: number;
     freedTokens?: number;
     postTriggerTokens?: number;
@@ -700,6 +732,34 @@ export interface CompactedFrameSource {
 export declare function mintCompactedEvent(comp: CompactedFrameSource, trigger: "auto" | "manual" | "forced", identity: TaskEventIdentity): Extract<TaskEvent, {
     type: "compacted";
 }>;
+/**
+ * THE mint of the `compaction_started` wire frame — the opening half of the pair whose closing half is the
+ * `compacted` frame above (or a `compaction_outcome` that carries the same `pass`). One function, three
+ * lanes, as the landing's: the frame is the start report itself plus the identity envelope, so a lane that
+ * wants to announce a pass can only announce the one `maybeCompact` committed.
+ */
+export declare function mintCompactionStartedEvent(start: CompactionPassStart, identity: TaskEventIdentity): Extract<TaskEvent, {
+    type: "compaction_started";
+}>;
+/**
+ * One compaction pass's account on the wire: the `onStarted` seat to hand `maybeCompact`, and the id the frame
+ * that ENDS the pass must carry. A lane makes one per pass, hands `onStarted` to the pass, and spreads
+ * {@link CompactionPassReport.end} into every `compaction_outcome` the pass can end with after it committed — a
+ * pass that threw before it committed leaves it empty, which is exactly "no start was announced, so no `pass`
+ * names it". The landing needs no spread: `maybeCompact` returns the id and `mintCompactedEvent` reads it.
+ */
+export interface CompactionPassReport {
+    readonly onStarted: (start: CompactionPassStart) => void;
+    /** The announced pass's id; `undefined` until a start went on the wire. */
+    readonly pass: string | undefined;
+    /** `{ pass }` once a start was announced, `{}` before — for the frame that ends the pass. */
+    readonly end: {
+        pass?: string;
+    };
+}
+export declare function compactionPassReport(sink: {
+    push(event: TaskEvent): void;
+}, ident: () => TaskEventIdentity): CompactionPassReport;
 /**
  * How many cross-session message frames the summarized prefix held: the engine-note user messages
  * whose text is the drain's `<cross-session-message …>` envelope, before the kept tail begins. The

package/dist/core/auto-compaction.js

@@ -1,12 +1,11 @@
 import { CROSS_SESSION_MESSAGE_TAG } from "../agents/cross-session-envelope.js";
-import { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, CompactionError, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, formatFileOperations, formatPersistedOutputRefs, prepareCompaction, shouldCompact, } from "../internal/harness.js";
-import { fileArgPath } from "../tools/fs/safety.js";
+import { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, CompactionError, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, formatFileOperations, formatPersistedOutputRefs, prepareCompaction, shouldCompact, uuidv7, } from "../internal/harness.js";
+import { fileArgPath } from "./tool-registry.js";
 import { contextEditFrontier, resolveTriggerWindow } from "./context-edit.js";
 import { selectCompactionEpoch } from "../prompt-assembly/epoch.js";
-import { SEMA_DEFAULT_PACK } from "../prompt-assembly/packs/sema-default.js";
 import { brainToRuntime } from "./runtime.js";
 import { defuseFenceMarkers, sanitizeUntrustedText } from "./untrusted-text.js";
-import { createSafeNotifier } from "./safe-notify.js";
+import { createSafeNotifier, observeThenableRejection } from "./safe-notify.js";
 export const DEFAULT_COMPACTION_INSTRUCTIONS = "Preserve verbatim every code, identifier, name, number, file path, error message, credential " +
     "reference, and explicit user instruction or decision mentioned anywhere in the conversation. " +
     "When in doubt, keep the specific detail rather than generalizing it.";
@@ -153,24 +152,53 @@ export async function maybeCompact(opts) {
             ? `${specInstructions}\n\n${hookSanitized}`
             : hookSanitized
         : specInstructions;
+    const signalAtCommit = opts.signal;
+    if (signalAtCommit?.aborted === true) {
+        throw Object.assign(new CompactionError("aborted", "compaction cancelled before the pass committed — nothing was summarized or persisted"), opts.manualCancelSignal?.aborted === true ? { [COMPACTION_MANUAL_CANCEL_FLAG]: true } : {});
+    }
+    const pass = uuidv7();
+    notifier.notify(() => observeThenableRejection(opts.onStarted?.({ pass, trigger, startedAt: Date.now() }), notifier, "compaction.onStarted"), "compaction.onStarted");
     const maxReuse = opts.maxConsecutiveProviderReuse ?? 3;
     const forceRealSummary = maxReuse > 0 && (opts.consecutiveProviderReuse ?? 0) >= maxReuse;
     let providerSummary;
     if (opts.summaryProvider && !forceRealSummary && !prep.value.isSplitTurn) {
         const providerModifiedFiles = computeFileLists(prep.value.fileOps).modifiedFilesByRecency;
+        const signal = opts.signal;
+        const cut = Symbol("cut");
+        let release = () => undefined;
+        const cutByAbort = new Promise((resolve) => {
+            if (signal === undefined || signal.aborted)
+                return;
+            const onAbort = () => resolve(cut);
+            signal.addEventListener("abort", onAbort, { once: true });
+            release = () => signal.removeEventListener("abort", onAbort);
+        });
+        let consulted;
         try {
-            const raw = await opts.summaryProvider({
-                messagesToSummarize: prep.value.messagesToSummarize,
-                previousSummary: prep.value.previousSummary,
-                modifiedFiles: providerModifiedFiles,
-            });
-            const trimmed = typeof raw === "string" ? raw.trim() : "";
+            consulted =
+                signal?.aborted === true
+                    ? cut
+                    : await Promise.race([
+                        Promise.resolve(opts.summaryProvider({
+                            messagesToSummarize: prep.value.messagesToSummarize,
+                            previousSummary: prep.value.previousSummary,
+                            modifiedFiles: providerModifiedFiles,
+                        })),
+                        cutByAbort,
+                    ]);
+            const trimmed = typeof consulted === "string" ? consulted.trim() : "";
             if (trimmed) {
                 providerSummary = trimmed;
             }
         }
         catch {
         }
+        finally {
+            release();
+        }
+        if (consulted === cut) {
+            throw Object.assign(new CompactionError("aborted", "compaction cancelled while the summary provider was answering — nothing was persisted"), opts.manualCancelSignal?.aborted === true ? { [COMPACTION_MANUAL_CANCEL_FLAG]: true } : {});
+        }
     }
     let summary;
     let firstKeptEntryId;
@@ -448,18 +476,17 @@ export async function maybeCompact(opts) {
     for (const m of ctx.messages)
         preChars += estimateTokens(m, cpt);
     const ca = opts.centerAdoption;
-    const restatedEpoch = selectCompactionEpoch((await opts.session.getPromptEpoch?.()) ?? undefined, SEMA_DEFAULT_PACK, ca?.declaredSections ?? opts.epochDeclaredSections, ca !== undefined
-        ? ca.clear === true
-            ? { clear: true }
-            : { centerArtifactDigest: ca.centerArtifactDigest, ...(ca.sourceRevision !== undefined ? { sourceRevision: ca.sourceRevision } : {}) }
-        : undefined);
+    const stored = await opts.session.getPromptEpoch?.();
+    const current = stored?.kind === "pin" ? stored.descriptor : undefined;
+    const identityNow = ca?.promptIdentity ?? opts.promptIdentity ?? (current !== undefined ? { layers: current.layers, ...(current.sourceRevision !== undefined ? { sourceRevision: current.sourceRevision } : {}) } : undefined);
+    const restatedEpoch = identityNow !== undefined ? selectCompactionEpoch(current, identityNow.layers, identityNow.sourceRevision) : undefined;
     const restatedListings = await opts.session.getAnnouncedListing().catch(() => undefined);
     if (opts.signal?.aborted === true) {
         throw Object.assign(new Error("compaction cancelled before commit — the abort signal fired during the summary call; nothing was persisted"), opts.manualCancelSignal?.aborted === true ? { [COMPACTION_MANUAL_CANCEL_FLAG]: true } : {});
     }
     await opts.session.appendCompaction(summaryWithAttachments, firstKeptEntryId, summaryTokensBefore, {
         ...(details ?? {}),
-        promptEpoch: restatedEpoch,
+        ...(restatedEpoch !== undefined ? { promptEpoch: restatedEpoch } : {}),
         ...(restatedListings !== undefined ? { announcedListings: restatedListings } : {}),
         ...(opts.activeTools !== undefined && opts.activeTools.length > 0 ? { activeTools: [...opts.activeTools] } : {}),
         ...(opts.gitRestate !== undefined ? { gitAnnouncement: { kind: opts.gitRestate.pending.kind, hash: opts.gitRestate.pending.hash, pending: true } } : {}),
@@ -494,9 +521,9 @@ export async function maybeCompact(opts) {
     }
     catch {
     }
-    if (ca !== undefined) {
+    if (ca !== undefined && restatedEpoch !== undefined) {
         try {
-            ca.apply(restatedEpoch.artifactDigest);
+            ca.apply(restatedEpoch.identity);
         }
         catch {
         }
@@ -534,6 +561,7 @@ export async function maybeCompact(opts) {
     return {
         contextUsage,
         compacted: true,
+        pass,
         tokensBefore: summaryTokensBefore,
         freedTokens,
         triggerTokens: tokens,
@@ -564,6 +592,7 @@ export function mintCompactedEvent(comp, trigger, identity) {
     return {
         type: "compacted",
         trigger,
+        ...(comp.pass !== undefined ? { pass: comp.pass } : {}),
         tokensBefore: comp.tokensBefore ?? 0,
         ...(comp.freedTokens !== undefined ? { freedTokens: comp.freedTokens } : {}),
         ...(comp.postTriggerTokens !== undefined ? { tokensAfter: comp.postTriggerTokens } : {}),
@@ -580,6 +609,24 @@ export function mintCompactedEvent(comp, trigger, identity) {
         ...identity,
     };
 }
+export function mintCompactionStartedEvent(start, identity) {
+    return { type: "compaction_started", trigger: start.trigger, pass: start.pass, startedAt: start.startedAt, ...identity };
+}
+export function compactionPassReport(sink, ident) {
+    let pass;
+    return {
+        onStarted: (start) => {
+            sink.push(mintCompactionStartedEvent(start, ident()));
+            pass = start.pass;
+        },
+        get pass() {
+            return pass;
+        },
+        get end() {
+            return pass !== undefined ? { pass } : {};
+        },
+    };
+}
 export function countSummarizedCrossSessionMessages(branch, firstKeptEntryId) {
     const firstKeptIdx = branch.findIndex((e) => e.id === firstKeptEntryId);
     const summarized = firstKeptIdx >= 0 ? branch.slice(0, firstKeptIdx) : branch;

package/dist/core/auto-promote.d.ts

@@ -106,7 +106,8 @@ export declare const FROZEN_DENYLIST_FLOOR: ReadonlySet<string>;
  *
  * @param artifactText the artifact's raw text (markdown body included).
  * @param declared the artifact's declared tool list (the `SkillSpec` member the loader copies) — its `allowedTools`
- *   entries, each read as a permission rule for the tool it names, are the symbol-drift baseline.
+ *   entries, read by the list reader as a rule for the tool each names (one it reads as nothing names none), are the
+ *   symbol-drift baseline.
  * @param profileTokens optional ADD-ONLY extra denylist tokens (UNIONed onto the frozen floor; cannot remove).
  */
 export declare function deriveTripwire(artifactText: string, declared: Pick<SkillSpec, "allowedTools">, profileTokens?: ReadonlySet<string>): TripwireResult;

package/dist/core/auto-promote.js

@@ -1,5 +1,5 @@
 import { extractSymbols } from "../tools/fs/repo-map.js";
-import { parsePermissionRule } from "./permission-rules.js";
+import { compileAllowList, compiledEntryName } from "./allow-entry.js";
 import { thrownText } from "./thrown-value.js";
 export function decideAutoPromote(i) {
     if (i.tripwire.escalate)
@@ -60,7 +60,7 @@ export function deriveTripwire(artifactText, declared, profileTokens) {
     const reasons = [];
     let escalate = false;
     try {
-        const allow = new Set((declared.allowedTools ?? []).map((entry) => parsePermissionRule(entry).toolName));
+        const allow = new Set(compileAllowList(declared.allowedTools ?? [], "allow").rows.map((r) => compiledEntryName(r.compiled)));
         const symbols = extractSymbols(artifactText);
         for (const sym of symbols) {
             if (!allow.has(sym)) {

package/dist/core/caller-tool-name.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Why `name` cannot be a caller tool's name or alias — or `undefined` when it can. Two clauses, in this order:
+ *  - the name must be one a rule can name ({@link isNameableToolName}; a value that is not a string is none): a tool mounted
+ *    under a name no list can write could be neither granted nor refused by name;
+ *  - `__` is reserved for the protocol namespaces: a caller name carrying it is read as a peer's tool everywhere names are
+ *    parsed (routing, policy, telemetry), and an alias carrying it would sit inside a peer's prefix domain (a refresh would
+ *    classify or clear it as remote, and a remote tool minted under the same name would shadow the local one).
+ */
+export declare function callerToolNameProblem(name: string): string | undefined;

package/dist/core/caller-tool-name.js

@@ -0,0 +1,13 @@
+import { NAMESPACED_NAME_SHAPES, carriesNamespaceSeparator } from "./protocol-table.js";
+import { isNameableToolName } from "./permission-rule-syntax.js";
+export function callerToolNameProblem(name) {
+    if (!isNameableToolName(name)) {
+        return (`a caller tool name or alias must be a name a rule can name — ASCII letters, digits and "_" "-" "." ":" "*", ` +
+            `starting with a letter, a digit or "_", not ending with "." or ":", and not the lone wildcard "*" — ` +
+            `or no allow or deny list could name the tool; rename it`);
+    }
+    if (carriesNamespaceSeparator(name)) {
+        return `"__" is reserved for the engine's protocol tool namespaces (${NAMESPACED_NAME_SHAPES}) and no caller tool name or alias may carry it`;
+    }
+    return undefined;
+}

package/dist/core/checkpoint-requirements.d.ts

@@ -6,7 +6,7 @@ import { type StoreFidelity, type Checkpoint, type CheckpointFeature, type Check
  * had carried beside the one its word now names, and the members added after the table, each a capability a reader
  * must have. Downstream reads them for display only (`CheckpointError.detail.requires`).
  */
-export declare const REQUIREMENT_WORDS: readonly ["resource", "binding", "token", "orgAdmission", "f012", "realApproval", "face", "requirements_digest", "org_admission_inherited", "org_write_grant", "org_governed", "delegation_provenance", "skill_grants", "skill_card_binding", "hands_coordinates", "hands_home", "path_rule_anchors", "path_rule_installations", "permission_mode", "plan_mode_restore", "persisted_rule_mandate", "deployment_authored", "call_names", "write_face", "denial_limit_fallback", "leg_scope", "tool_ceiling", "tool_lists_judged"];
+export declare const REQUIREMENT_WORDS: readonly ["resource", "binding", "token", "orgAdmission", "f012", "realApproval", "face", "requirements_digest", "org_admission_inherited", "org_write_grant", "org_governed", "delegation_provenance", "skill_grants", "skill_card_binding", "hands_coordinates", "hands_home", "path_rule_anchors", "path_rule_installations", "permission_mode", "plan_mode_restore", "persisted_rule_mandate", "deployment_authored", "call_names", "write_face", "denial_limit_fallback", "leg_scope", "tool_ceiling", "tool_lists_judged", "own_tool_lists"];
 export type RequirementWord = (typeof REQUIREMENT_WORDS)[number];
 /** Runtime twin of {@link RequirementWord}. */
 export declare function isRequirementWord(word: unknown): word is RequirementWord;
@@ -224,6 +224,9 @@ export declare const CHECKPOINT_STATE_REQUIREMENTS: {
     readonly toolListsJudged: {
         readonly word: "tool_lists_judged";
     };
+    readonly ownToolLists: {
+        readonly word: "own_tool_lists";
+    };
 };
 export declare const PENDING_ACTION_REQUIREMENTS: {
     readonly tool_approval: {
@@ -576,6 +579,9 @@ export declare const CHECKPOINT_REQUIREMENTS: {
             readonly toolListsJudged: {
                 readonly word: "tool_lists_judged";
             };
+            readonly ownToolLists: {
+                readonly word: "own_tool_lists";
+            };
         };
     };
     readonly resourceLedger: {

package/dist/core/checkpoint-requirements.js

@@ -30,6 +30,7 @@ export const REQUIREMENT_WORDS = Object.freeze([
     "leg_scope",
     "tool_ceiling",
     "tool_lists_judged",
+    "own_tool_lists",
 ]);
 export function isRequirementWord(word) {
     return typeof word === "string" && REQUIREMENT_WORDS.includes(word);
@@ -90,6 +91,7 @@ export const CHECKPOINT_STATE_REQUIREMENTS = {
     legScope: { word: "leg_scope" },
     toolCeiling: { word: "tool_ceiling" },
     toolListsJudged: { word: "tool_lists_judged" },
+    ownToolLists: { word: "own_tool_lists" },
 };
 export const PENDING_ACTION_REQUIREMENTS = {
     tool_approval: {

package/dist/core/checkpoint-store.d.ts

@@ -1338,7 +1338,9 @@ export interface CheckpointState {
     legScope?: string;
     /** The tool-selector layers this LEG was spawned under (`RunInternals.toolCeiling`), stamped at every mint: a resume that hands
      *  no live ceiling restores it, so a resumed child can never use a tool its spawning run could not. Absent ⇒ the leg had no
-     *  ceiling (a root run) or the row was minted before the member. A reader that lacks the word would run the leg unbounded. */
+     *  ceiling (a root run) or the row was minted before the member. A reader that lacks the word would run the leg unbounded.
+     *  Each entry is a tool name in its canonical spelling (`persistedToolNameList`, `src/agents/tool-filter.ts`): a row restored with
+     *  any other entry is refused before the claim (`checkpoint.config_refused`, `detail.code: config.tool_face_control`, `detail.field: inheritedGate`, the row pending). */
     toolCeiling?: ReadonlyArray<{
         readonly allow?: readonly string[];
         readonly deny: readonly string[];
@@ -1348,6 +1350,18 @@ export interface CheckpointState {
      *  that hands different lists is judged again. Absent ⇒ the leg judged its own lists (or the row was minted before the member). A
      *  reader that lacks the word would judge again a list judged against a wider universe, and refuse a leg that was valid. */
     toolListsJudged?: string;
+    /** Whose lists this LEG's own are (`RunInternals.ownToolLists`: the delegation tool that spawned it, by its declared name, the
+     *  agent definition it was spawned as — absent ⇒ the tool's tool-level list — and `lists`, the digest of exactly the lists it wrote),
+     *  stamped at every mint while it holds: a resume that hands no internals restores it while its own lists digest to `lists`, so the
+     *  resumed leg asks its own lists of the same universe (which carries that tool's name — a name of its lineage, mounted or not at its
+     *  depth) and a refusal names the same list; a resume that hands another table reads it as the host's own `TaskSpec` seats. Absent ⇒ the
+     *  leg's lists were not written by a delegation tool (or the row was minted before the member): the leg judges them against its own
+     *  roster as before. A reader that lacks the word would refuse a list the leg's lineage wrote, and refuse a leg that was valid. */
+    ownToolLists?: {
+        readonly toolName: string;
+        readonly definition?: string;
+        readonly lists: string;
+    };
 }
 /**
  * {@link CheckpointState} with **every** field made required-PRESENT, while each value keeps its original
@@ -2082,19 +2096,36 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
 /** On `resume.parent_constraint_mismatch`: a re-supplied chain entry whose path rules depend on the leg that installed it has
  *  no installation record (a chain written before the record existed) / a record that does not cover the chain entry for
  *  entry / a record member naming no absolute root. */
- | "installation_record_absent" | "installation_record_misaligned" | "installation_record_invalid";
+ | "installation_record_absent" | "installation_record_misaligned" | "installation_record_invalid"
+/** On `checkpoint.config_refused` with `detail.code` `config.tool_face_control` — the arm prepare's own refusal carries as its `detail.reason`:
+ *  a tool-name list the row recorded is not a list / has a member that is not a string / has a spelling no tool name can have / is not in
+ *  the one spelling a row records (`"not_a_list"`, `"not_a_string"`, `"unknown_name"`, `"unsupported_pattern"`; the re-supplied config's own four lists —
+ *  `allowTools`, `excludeTools`, `deferTools`, `alwaysLoadTools` — are refused as `"not_a_list"` / `"not_a_string"`); the record of the delegation tool that
+ *  wrote the leg's lists is not one (`"invalid_record"`); the roster the resume hands mounts a delegation tool under another name than it declares
+ *  (`"renamed_mount"`); the process-wide table of declared names is occupied by a value that is not the engine's (`"registry_occupied"`). */
+ | "not_a_list" | "not_a_string" | "unknown_name" | "unsupported_pattern" | "invalid_record" | "renamed_mount" | "registry_occupied"
+/** On `checkpoint.config_refused` with `detail.code` `config.unknown_role` — a role seat or a tier binding the deployment wrote that the engine cannot read:
+ *  a word the model catalog does not hold (`"unknown_model_ref"`), or a value that is no model reference at all — a number, a boolean, a list
+ *  (`"not_a_model_ref"`). The sentence names the seat (`roles.consolidate`, `tiers.pro`). */
+ | "unknown_model_ref" | "not_a_model_ref";
 /**
- * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the eight
- * words prepare's mode, output-style, approval-reach, invoked-skill, attachment and recorded-mode doors throw, held unchanged so one refusal
- * reads the same on a fresh run (`TaskResult.errorCode`) and on a resume. `config.spec_retired_key`: a retired spec key;
- * `config.output_style_invalid`: a malformed output-style seat; `config.permission_mode_invalid`: a mode word outside the closed
- * set (the config's `permissionMode`, or one the row recorded); `config.shell_gate_value_retired`: a retired shell-floor word;
- * `config.approval_reach_invalid`: an `approvalReach` outside its set; `config.user_invoked_skill_unknown` / `skill_deny_unreadable`:
- * `userInvokedSkills` names a skill the config does not carry / one whose `disallowed-tools` entry the grammar reads as nothing;
- * `config.user_attachment_invalid`: the config declares `userAttachments` (a resume sends no new human message) or a malformed
- * value there.
+ * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the words prepare's
+ * doors throw, held unchanged so one refusal reads the same on a fresh run (`TaskResult.errorCode`) and on a resume: the mode, output-style,
+ * approval-reach, invoked-skill, attachment, recorded-mode and tool-face doors (`config.spec_retired_key` … `config.tool_face_control`, the first
+ * nine — `detail.reason` names the tool-face arm: {@link CheckpointErrorReason}), and every value door of the config-door phase over the
+ * re-supplied config and the deployment's deps (`configValueDoors`, the rest): the retired deps seats and caller-policy members
+ * (`config.deps_retired_key`), the peer presence, the restore selector, the microCompact knob, the prompt selectors, `resumeAt` on a resume
+ * (`resume_at.conflicts_resume`, `resume_at.mode_without_target` — a resume carrying `resumeAt` is refused as a conflict before its mode is
+ * read, so `resume_at.invalid_mode` is a fresh run's word only), the containment faces, the add-only seats and the MCP / A2A `toolAxes` (`config.invalid_argument`), the three memory seats,
+ * the auto-consolidation arming (its role key too, and the role seats and tier bindings it reads: `config.unknown_role`, `detail.reason` naming the arm), the materialize strategy and persistence flag, the lock layer (`config.locked_registry`,
+ * `config.locked_key`), an MCP server's content class, the skills-listing seats (`config.skill_listing_budget_invalid`), the limits and the
+ * resource-suspend knobs, the attachment modes, the governance windows, the brain-call guardrail and the retention declaration over the stores the leg
+ * would run on (`config.retention_policy`, `config.retention_capability`), and the checkpoint store seat itself (`config.invalid_checkpoint_store`: the
+ * retired `null` spelling, a store that declares no execution outcome), and the skills seat and the hands band (`config.invalid_argument`;
+ * a skill's `baseDir` by its own reader, `config.skill_base_dir_invalid`). A door not entered here (the leg's model, its rebuilt
+ * roster, its answer face, the approval seat's value) still refuses after the claim, each for a stated reason (INTEGRATION-CORE, "A resume's two doors").
  */
-export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid"];
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"];
 export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
 export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
@@ -2204,9 +2235,10 @@ export declare class CheckpointError extends Error {
     /** Parent effective-policy inheritance (shape check): the resume DID re-supply
      *  `internals.inheritedGate.parentConstraints`, but its length differs from the checkpoint's recorded
      *  `parentConstraintCount` — or (F-012 L1) its projection CONTENT digests differently from the
-     *  recorded `constraintDigest` — a partial/mismatched re-supply would silently run the child under a
-     *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
-     *  stays `pending`); re-resume with the full original chain. */
+     *  recorded `constraintDigest` — or a screening entry names a `tool.check` guard beside a policy the
+     *  constraint mint did not make (no chain to raise it on) — a partial/mismatched re-supply would silently run
+     *  the child under a thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the
+     *  checkpoint stays `pending`); re-resume with the full original chain. */
      | "resume.parent_constraint_mismatch"
     /** #449 G1 (codex r2, pre-CAS entrance): a deployment usage-governance window for this resume's
      *  ledger key (the config's principal, else the row's recorded one, else the shared bucket) is
@@ -2272,13 +2304,13 @@ export declare class CheckpointError extends Error {
      *  resolve, or try to supply the minted record), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
      *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
-     *  (the re-supplied config: correct it and resume the same token) or `"inheritedGate"` (the mode the row
-     *  recorded: no config reaches it; expire the row). The throw
+     *  (the re-supplied config: correct it and resume the same token), `"deps"` (the deployment's own seat — and the policies the
+     *  caller re-supplies as inherited constraints: correct them and resume the same token) or `"inheritedGate"` (the row's record: no config reaches it; expire the row). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     readonly detail?: {
-        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "inheritedGate";
+        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "deps" | "inheritedGate";
         /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
          *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
         code?: CheckpointConfigRefusalCode;
@@ -2406,9 +2438,10 @@ export declare class CheckpointError extends Error {
     /** Parent effective-policy inheritance (shape check): the resume DID re-supply
      *  `internals.inheritedGate.parentConstraints`, but its length differs from the checkpoint's recorded
      *  `parentConstraintCount` — or (F-012 L1) its projection CONTENT digests differently from the
-     *  recorded `constraintDigest` — a partial/mismatched re-supply would silently run the child under a
-     *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
-     *  stays `pending`); re-resume with the full original chain. */
+     *  recorded `constraintDigest` — or a screening entry names a `tool.check` guard beside a policy the
+     *  constraint mint did not make (no chain to raise it on) — a partial/mismatched re-supply would silently run
+     *  the child under a thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the
+     *  checkpoint stays `pending`); re-resume with the full original chain. */
      | "resume.parent_constraint_mismatch"
     /** #449 G1 (codex r2, pre-CAS entrance): a deployment usage-governance window for this resume's
      *  ledger key (the config's principal, else the row's recorded one, else the shared bucket) is
@@ -2474,13 +2507,13 @@ export declare class CheckpointError extends Error {
      *  resolve, or try to supply the minted record), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
      *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
-     *  (the re-supplied config: correct it and resume the same token) or `"inheritedGate"` (the mode the row
-     *  recorded: no config reaches it; expire the row). The throw
+     *  (the re-supplied config: correct it and resume the same token), `"deps"` (the deployment's own seat — and the policies the
+     *  caller re-supplies as inherited constraints: correct them and resume the same token) or `"inheritedGate"` (the row's record: no config reaches it; expire the row). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     detail?: {
-        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "inheritedGate";
+        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "deps" | "inheritedGate";
         /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
          *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
         code?: CheckpointConfigRefusalCode;

package/dist/core/checkpoint-store.js

@@ -305,7 +305,7 @@ export function summarizeCheckpoint(cp) {
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;
@@ -399,13 +399,13 @@ export function resolveCheckpointStore(spec, deps) {
             throw checkpointStoreExecutionUndeclared("TaskSpec.checkpointStore", spec.checkpointStore);
         return spec.checkpointStore;
     }
-    if (deps.checkpointStore !== undefined && deps.checkpointStore.execution?.outcome !== true) {
+    if (deps.checkpointStore !== undefined && deps.checkpointStore?.execution?.outcome !== true) {
         throw checkpointStoreExecutionUndeclared("RunnerDeps.checkpointStore", deps.checkpointStore);
     }
     return deps.checkpointStore;
 }
 export function checkpointStoreExecutionUndeclared(seat, store) {
-    const ctor = store.constructor?.name;
+    const ctor = store?.constructor?.name;
     const name = typeof ctor === "string" && ctor.length > 0 && ctor !== "Object" ? ` (${ctor})` : "";
     const e = new Error(`${seat}: the wired CheckpointStore${name} does not declare \`execution = { outcome: true }\` — the execution-outcome ` +
         "record (recordExecutionOutcome, and reopen refusing a recorded row) is a required member of the store contract; " +