@sema-agent/core 7.52.0 → 7.53.0

package/dist/core/runner/run-terminal-adoption.js

@@ -1,4 +1,4 @@
-import { DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact } from "../auto-compaction.js";
+import { compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact } from "../auto-compaction.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
 import { appendInterruptionMarker, reconcileInterruptedSession } from "../session-reconcile.js";
 import { emitTrace } from "../trace.js";
@@ -120,7 +120,8 @@ export async function runTerminalAdoption(input) {
         minTokens: rs.counters.compactionFloor,
         brain: compactionBrain,
         windowSafety: windowSafetyOptions(prepared.harness.getModel()),
-        onCompactionOutcome: (outcome, reason) => queue.push({ type: "compaction_outcome", outcome, trigger: "auto", reason, ...ident() }),
+        passReport: compactionPassReport(queue, ident),
+        onCompactionOutcome: (outcome, reason, end) => queue.push({ type: "compaction_outcome", outcome, trigger: "auto", reason, ...end, ...ident() }),
     }, runner, sessions);
     return await next({ threw, comp, answerSettled: settled, owedUserInput });
 }
@@ -153,7 +154,7 @@ async function finish(spec, prepared, opts, runner, sessions) {
                 ...(prepared.onCompactionApplied ? { onApplied: prepared.onCompactionApplied } : {}),
                 ...seamCCompactionOptions(runner, prepared),
                 ...compactionRestateOptions(prepared),
-                ...compactionHookOptions(runner, prepared, "auto", opts.callerStop.signal),
+                ...compactionHookOptions(runner, prepared, "auto", opts.callerStop.signal), onStarted: opts.passReport.onStarted,
             });
             recordCompactionReuse(runner, prepared, finishComp);
             if (finishComp.unevaluableWindow) {
@@ -170,7 +171,7 @@ async function finish(spec, prepared, opts, runner, sessions) {
                     reason: "cancelled",
                     ts: Date.now(),
                 }));
-                opts?.onCompactionOutcome?.("mooted", "cancelled");
+                opts?.onCompactionOutcome?.("mooted", "cancelled", opts.passReport.end);
             }
             else {
                 const failMsg = thrownText(err);
@@ -183,7 +184,7 @@ async function finish(spec, prepared, opts, runner, sessions) {
                     reason: failReason,
                     ts: Date.now(),
                 }));
-                opts?.onCompactionOutcome?.("failed", failReason);
+                opts?.onCompactionOutcome?.("failed", failReason, opts.passReport.end);
                 runner.deps.onError?.(err, { phase: "compaction", sessionId: prepared.sessionId });
             }
         }

package/dist/core/runner/run-turn-boundary.js

@@ -1,7 +1,7 @@
 import { compactionKindOf } from "../task-notification.js";
 import { mintSystemReminder } from "../reminder-mint.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
-import { DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent, nextTrimForceBackoff, recordCompactionAndCheckRapidRefill } from "../auto-compaction.js";
+import { compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent, nextTrimForceBackoff, recordCompactionAndCheckRapidRefill } from "../auto-compaction.js";
 import { emitTrace } from "../trace.js";
 import { redactThenCut } from "../../agents/subagent-steps.js";
 import { ATTACHMENT_BYTE_CAP, CHANGED_FILES_MAX, TOTAL_TOKENS_REMINDER_DEFAULT_MODE, attachmentEnvelopeTags, clipToBytes, collectDateChange, collectDueAttachments, collectInstructionsChange, commitAgentListing, commitInstructionsChange, commitSkillsListing, isIntactSource, rebaseCadenceWindows, renderAgentListingFrame, renderMcpDroppedTools, renderMcpInstructionsDelta, selectMcpDroppedBatch, renderSkillsListingFrame, renderToolsDelta } from "./turn-attachments.js";
@@ -558,6 +558,7 @@ export function createTurnBoundary(input) {
         const passTrigger = trimPressure ? "forced" : forceManual ? "manual" : "auto";
         let manualOutcome = "failed";
         const manualInstructions = claimedManual?.instructions;
+        const passReport = compactionPassReport(queue, ident);
         try {
             const comp = await maybeCompact({
                 session: prepared.session,
@@ -587,6 +588,7 @@ export function createTurnBoundary(input) {
                 ...compactionRestateOptions(prepared),
                 ...windowSafetyOptions(event.model),
                 ...compactionHookOptions(runner, prepared, passTrigger, compactionPassSignal),
+                onStarted: passReport.onStarted,
             });
             if (comp.blocked) {
                 emitTrace(rs.telemetry.tracer, () => ({
@@ -670,7 +672,7 @@ export function createTurnBoundary(input) {
         catch (err) {
             if (isCompactionManualCancel(err)) {
                 emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.mooted", version: 1, taskId: rs.telemetry.taskId, reason: "cancelled", ts: Date.now() }));
-                queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: passTrigger, reason: "cancelled", ...ident() });
+                queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: passTrigger, reason: "cancelled", ...passReport.end, ...ident() });
                 manualOutcome = "mooted";
             }
             else if (!prepared.abortController.signal.aborted) {
@@ -686,11 +688,15 @@ export function createTurnBoundary(input) {
                     reason: failReason,
                     ts: Date.now(),
                 }));
-                queue.push({ type: "compaction_outcome", outcome: "failed", trigger: passTrigger, reason: failReason, ...ident() });
+                queue.push({ type: "compaction_outcome", outcome: "failed", trigger: passTrigger, reason: failReason, ...passReport.end, ...ident() });
                 manualOutcome = "failed";
             }
             else {
                 manualOutcome = "mooted";
+                if (passReport.pass !== undefined) {
+                    emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.mooted", version: 1, taskId: rs.telemetry.taskId, reason: "task_ending", ts: Date.now() }));
+                    queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: passTrigger, reason: "task_ending", ...passReport.end, ...ident() });
+                }
             }
         }
         if (forceManual)

package/dist/core/runner/runtask.js

@@ -481,7 +481,7 @@ export class Runner {
             outcome,
             taskConfig,
             internals,
-            runner: this.depsSeat,
+            runner: this.depsSeat, sessions: this.sessions,
             parentConstraintRegistry: this.parentConstraintRegistry,
             next: (admitted) => this.resumeLadder(token, outcome, admitted),
         });

package/dist/core/runner/skills-seat.d.ts

@@ -0,0 +1,15 @@
+/**
+ * THE reading of `TaskSpec.skills` — the one place the caller's skill objects are read. The config doors call it before any
+ * resource (a resume before its claim) and hand its copy on as the leg's `skills`; the disclosure block and the `Skill` tool read
+ * that copy through `normalizeSkills` (synthetic-tools.ts), its sorted view.
+ */
+import type { SkillSpec } from "../agent-definition.js";
+/**
+ * Total, and once: a value that is not a list, an entry that is not an object, a `name` / `description` / `content` that is not a
+ * string, or `files` that is not a list of `{ path, content }` strings refuses by name (`config.invalid_argument`, `detail.field` =
+ * the member's path); `baseDir` by its own reader ({@link skillBaseDirOf}, `config.skill_base_dir_invalid`). Every entry is
+ * screened, a later duplicate of a name included. Each field is read ONCE, BY NAME (an inherited or non-enumerable list counts;
+ * a rest copy would drop it). What it returns is plain data in declaration order, first of a name: every member and attachment
+ * copied, the two tables read ({@link readSkillTable}: a non-list is one entry that reads as nothing).
+ */
+export declare function readSkillsSeat(skills: unknown): SkillSpec[];

package/dist/core/runner/skills-seat.js

@@ -0,0 +1,57 @@
+import { readSkillTable } from "../skill-grant.js";
+import { assertNoRetiredKeys, RETIRED_TASK_SPEC_KEYS } from "../retired-keys.js";
+import { skillBaseDirOf } from "./skill-base-dir.js";
+const SKILLS_SEAT = "TaskSpec.skills";
+const kindOf = (v) => (v === null ? "null" : Array.isArray(v) ? "an array" : typeof v);
+function skillsSeatRefusal(field, problem) {
+    const e = new Error(`${field} ${problem} — an entry the engine cannot read is refused rather than dropped.`);
+    e.code = "config.invalid_argument";
+    e.detail = { field };
+    return e;
+}
+function readSkillFiles(files, at) {
+    if (files === undefined)
+        return undefined;
+    if (!Array.isArray(files))
+        throw skillsSeatRefusal(at, `must be a list of { path, content } attachments (got ${kindOf(files)})`);
+    const out = [];
+    for (const [j, f] of files.entries()) {
+        if (typeof f !== "object" || f === null || Array.isArray(f))
+            throw skillsSeatRefusal(`${at}[${j}]`, `must be an attachment object { path, content } (got ${kindOf(f)})`);
+        const { path, content } = f;
+        if (typeof path !== "string")
+            throw skillsSeatRefusal(`${at}[${j}].path`, `must be a string (got ${kindOf(path)})`);
+        if (typeof content !== "string")
+            throw skillsSeatRefusal(`${at}[${j}].content`, `must be a string (got ${kindOf(content)})`);
+        out.push({ path, content });
+    }
+    return out;
+}
+export function readSkillsSeat(skills) {
+    if (skills === undefined)
+        return [];
+    if (!Array.isArray(skills))
+        throw skillsSeatRefusal(SKILLS_SEAT, `must be a list (got ${kindOf(skills)})`);
+    assertNoRetiredKeys({ skills }, RETIRED_TASK_SPEC_KEYS, "TaskSpec");
+    const seen = new Set();
+    const out = [];
+    for (const [i, raw] of skills.entries()) {
+        const at = `${SKILLS_SEAT}[${i}]`;
+        if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+            throw skillsSeatRefusal(at, `must be an object { name, description, content } (got ${kindOf(raw)})`);
+        const { name, description, content, allowedTools, disallowedTools, files: rawFiles, baseDir, ...rest } = raw;
+        void rest;
+        for (const [member, value] of [["name", name], ["description", description], ["content", content]]) {
+            if (typeof value !== "string")
+                throw skillsSeatRefusal(`${at}.${member}`, `must be a string (got ${kindOf(value)})`);
+        }
+        const files = readSkillFiles(rawFiles, `${at}.files`);
+        skillBaseDirOf(baseDir);
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        const [allowed, denied] = [readSkillTable(allowedTools), readSkillTable(disallowedTools)];
+        out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
+    }
+    return out;
+}

package/dist/core/runner/sub-agent-deny-lists.d.ts

@@ -34,8 +34,9 @@
  * another spelling of a tool of the universe) — synchronous, like the phase that calls it.
  */
 import type { AgentTool } from "../../internal/harness.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 import { type ProtocolId } from "../protocol-table.js";
-import type { ToolLegKind, ToolSelector, ToolSelectorLayer } from "../tool-face.js";
+import type { ToolLegKind, ToolSelectorLayer } from "../tool-face.js";
 import { type ConstraintChainEntry } from "../tool-policy.js";
 import type { TaskSpec } from "../types.js";
 import type { CheckpointErrorReason } from "../checkpoint-store.js";
@@ -65,14 +66,15 @@ export declare function renamedDelegationMountSentence(...rosters: unknown[]): s
  */
 export declare function refuseRenamedDelegationMounts(...rosters: unknown[]): void;
 /**
- * THE reading of what the delegation tools a run mounts hand their children, read after the run's own selector: only a delegation
- * tool the selector leaves (`selector.admits`) counts — one it takes out hands nobody anything, and neither its pool names nor an
- * unlistable pool of it belong to any universe. The tools themselves, every pool tool's name and alias (a declared `extraToolNames`
- * roster included), and whether every one of those pools can be listed: a delegation tool whose factory injects tools per spawn with no
- * declared roster has no listable pool (the static `tools` it was given included), so a name outside the listed ones may be one of its
- * own. This is the one place the pool side of both universes is defined; the list judgment below and the policy name audit ask it.
+ * THE reading of what the delegation tools a run mounts hand their children, read after the run's own tool valve: only a delegation
+ * tool the valve leaves (`leaves`, the valve's one reading — `valveLeaves`) counts — one it takes out hands nobody anything, and neither
+ * its pool names nor an unlistable pool of it belong to any universe. The tools themselves, every pool tool's name and alias (a declared
+ * `extraToolNames` roster included), and whether every one of those pools can be listed: a delegation tool whose factory injects tools
+ * per spawn with no declared roster has no listable pool (the static `tools` it was given included), so a name outside the listed ones
+ * may be one of its own. This is the one place the pool side of both universes is defined; the list judgment below and the policy name
+ * audit ask it.
  */
-export declare function delegationPoolReading(callerTools: NonNullable<TaskSpec["tools"]>, selector: Pick<ToolSelector, "admits">): DelegationPoolReading;
+export declare function delegationPoolReading(callerTools: NonNullable<TaskSpec["tools"]>, leaves: ReturnType<typeof valveLeaves>): DelegationPoolReading;
 /** The arms of this module's `config.tool_face_control` refusal that a resume carries before the claim as `detail.reason` of a `checkpoint.config_refused` — the same words
  *  ({@link CheckpointErrorReason}): a list the row recorded that is not a list / has a member that is not a string / has a spelling no tool name can have / is not in the
  *  spelling a row records, a record that is not one, a renamed delegation mount, an occupied table of declared names. */
@@ -123,8 +125,8 @@ export declare function boundOwnToolLists(record: unknown, own: {
     readonly exclude: readonly string[] | undefined;
 }): RunInternals["ownToolLists"];
 export interface RunToolListsInput {
-    /** borrowed-readonly — the REBOUND spec: `agents` (the task's definitions) and `tools` (the caller's tools and the mounted delegation tools). */
-    spec: Pick<TaskSpec, "agents" | "tools">;
+    /** borrowed-readonly — the REBOUND spec: `agents` (the task's definitions), `tools` (the caller's tools and the mounted delegation tools) and `excludeAllTools` (the valve's whole-face switch, which takes the delegation tools out too). */
+    spec: Pick<TaskSpec, "agents" | "tools" | "excludeAllTools">;
     /** borrowed-readonly — the assembled mount array BEFORE the selector's valve (names + aliases = the roster half of the universe). */
     tools: ReadonlyArray<AgentTool>;
     /** borrowed-readonly — the peers the task declares, per protocol of the protocol table (its MCP servers, its A2A peers): a namespaced
@@ -170,5 +172,5 @@ export declare function judgeRunToolLists(input: RunToolListsInput): void;
  * `detail.reason: "near_miss"`) rather than kept as a deny that hides nothing. A name no tool answers to stays kept (a tool of that
  * name may be mounted later), unannounced: the host wrote no spec this leg could name the list of.
  */
-export declare function judgeHostToolCeiling(layers: readonly ToolSelectorLayer[], agent: Pick<TaskSpec, "tools" | "allowTools" | "excludeTools">, above?: readonly ToolSelectorLayer[]): void;
+export declare function judgeHostToolCeiling(layers: readonly ToolSelectorLayer[], agent: Pick<TaskSpec, "tools" | "allowTools" | "excludeTools" | "excludeAllTools">, above?: readonly ToolSelectorLayer[]): void;
 export {};

package/dist/core/runner/sub-agent-deny-lists.js

@@ -1,4 +1,4 @@
-import { compileToolSelector, deniedProtocolTools, delegationListWhere, isCanonicalToolName, isToolSelectorLayer, listReaches, notAListSentence, toolListsDigest, notAStringSentence, readAllowedToolList, readDeniedEntry, readDeniedToolList } from "../../agents/tool-filter.js";
+import { compileToolSelector, valveLeaves, deniedProtocolTools, delegationListWhere, isCanonicalToolName, isToolSelectorLayer, listReaches, notAListSentence, toolListsDigest, notAStringSentence, readAllowedToolList, readDeniedEntry, readDeniedToolList } from "../../agents/tool-filter.js";
 import { readToolNameList, valueTypeLabel } from "../tool-name-list.js";
 import { compileAllowList, inertEntryPhrase, renderListEntry, rootFacingToolNames } from "../allow-entry.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -37,8 +37,8 @@ export function refuseRenamedDelegationMounts(...rosters) {
 function poolOf(tools) {
     return { tools, names: mountedToolNames([...tools.map((t) => ({ name: t.name })), ...tools.flatMap((t) => t.agentToolPool ?? [])]), complete: tools.every((t) => t.agentToolPool !== undefined) };
 }
-export function delegationPoolReading(callerTools, selector) {
-    return poolOf(callerTools.filter((t) => t.agentToolFaces !== undefined && selector.admits(t)));
+export function delegationPoolReading(callerTools, leaves) {
+    return poolOf(callerTools.filter((t) => t.agentToolFaces !== undefined && leaves(t)));
 }
 function peersOf(known, declaredPeers) {
     const peers = new Set(PROTOCOL_TABLE.flatMap((ns) => (declaredPeers[ns.id] ?? []).map((p) => mintNamespacePrefix(ns, p.name))));
@@ -275,7 +275,8 @@ export function judgeRunToolLists(input) {
         const by = [...deniedBy(true, ownWhere ?? "this run's own excludeTools"), ...deniedBy(false, "an inherited list (the spawning run's excludeTools, or one it inherits)")];
         throw refused(`This kind of leg (${input.legs.join(", ")}) relies on ${names.join(", ")}, but ${by.join(" and ")} — the leg cannot work without ${one ? "it" : "them"}. Remove the entry from the list that names it.`, "config.tool_face_control", "protocol_denied");
     }
-    const pool = delegationPoolReading(spec.tools ?? [], compileToolSelector(input.layers, input.legs));
+    const selector = compileToolSelector(input.layers, input.legs);
+    const pool = delegationPoolReading(spec.tools ?? [], valveLeaves(spec, selector));
     const mounted = mountedToolNames([...tools, ...(spec.tools ?? [])]);
     if (!input.judgedUpstream) {
         const root = rootFacingUniverse(input.ownBy !== undefined ? new Set([...mounted, input.ownBy.toolName]) : mounted, pool, input.declaredPeers);
@@ -310,7 +311,8 @@ export function judgeHostToolCeiling(layers, agent, above = []) {
     layers.forEach((layer, i) => readSelectorLayer(layer, where(i), () => where(i), false));
     const callerTools = agent.tools ?? [];
     const own = { ...(agent.allowTools != null ? { allow: agent.allowTools } : {}), deny: agent.excludeTools ?? [] };
-    const pool = delegationPoolReading(callerTools, compileToolSelector([...above, ...layers, own], ["delegated"]));
+    const selector = compileToolSelector([...above, ...layers, own], ["delegated"]);
+    const pool = delegationPoolReading(callerTools, valveLeaves(agent, selector));
     const universe = rootFacingUniverse(mountedToolNames(callerTools), pool, { mcp: undefined, a2a: undefined });
     const unannounced = () => undefined;
     layers.forEach((layer, i) => {

package/dist/core/runner/synthetic-tools.d.ts

@@ -110,8 +110,11 @@ export interface SkillListingEntry {
  *  and the tool, so what the prompt promises is exactly what the tool serves. Each field is READ ONCE, BY NAME, and
  *  both consumers see the copy: the gate screens this list while the invoke substitutes from it, so a `get baseDir()`
  *  answering those two reads differently passed a screen that measured a value the model never received — and a rest
- *  copy would silently drop an INHERITED or non-enumerable list. The two tables are read by {@link readSkillTable}. */
-export declare function normalizeSkills(skills: SkillLike[] | undefined): SkillLike[];
+ *  copy would silently drop an INHERITED or non-enumerable list. The two tables are read by {@link readSkillTable}.
+ *
+ *  The sorted view of {@link readSkillsSeat} (skills-seat.ts), which holds the seat's one reading — total over what a caller can
+ *  hand it, and once. */
+export declare function normalizeSkills(skills: unknown): SkillLike[];
 /** [c209-C] The skills listing's lead line — single-sourced so the run loop's durable-resume
  *  transcript probe (MED-3② skills arm, runtask) matches EXACTLY what the initial frame carries
  *  (probing the bare `<skills>` fence would be more collision-prone in model-quoted text). */

package/dist/core/runner/synthetic-tools.js

@@ -5,6 +5,7 @@ import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } fr
 import { readSkillTable, skillNamedBy } from "../skill-grant.js";
 import { toolFace } from "../tool-catalog-entries.js";
 import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
+import { readSkillsSeat } from "./skills-seat.js";
 import { foldListingWithin } from "./listing-fold.js";
 export const OUTPUT_TOOL_NAME = "StructuredOutput";
 export const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
@@ -109,18 +110,7 @@ function skillFilesSuffix(files) {
     return ` [files: ${shown.join(", ")}${more > 0 ? `, +${more} more` : ""}]`;
 }
 export function normalizeSkills(skills) {
-    const seen = new Set();
-    const out = [];
-    for (const s of skills ?? []) {
-        if (!seen.has(s.name)) {
-            seen.add(s.name);
-            const { name, description, content, allowedTools, disallowedTools, files, baseDir, ...rest } = s;
-            void rest;
-            const [allowed, denied] = [readSkillTable(allowedTools), readSkillTable(disallowedTools)];
-            out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
-        }
-    }
-    return out.toSorted((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    return readSkillsSeat(skills).toSorted((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
 }
 export const SKILLS_LISTING_PROBE_HEADER = "The following skills are available for this task.";
 export function skillListingLine(s, descMaxChars = SKILL_LISTING_DESC_MAX_CHARS_DEFAULT) {

package/dist/core/runner-deps.d.ts

@@ -159,10 +159,12 @@ export interface RunnerDeps {
      */
     rosterStore?: import("../agents/roster-store.js").RosterStore;
     /**
-     * The center prompt-artifact source (artifact v2 only — INTEGRATION-CORE §12.11). `current()` supplies the verified
+     * The center prompt-artifact source (artifact v3 only — a v2 body is refused `schema`, INTEGRATION-CORE §12.11).
+     * `current()` supplies the verified
      * candidate a top-level session adopts at session start and at a compaction; `get(digest)` resolves a PINNED center
      * layer on resume (a miss is fail-loud `prompt.snapshot_unavailable` — core never recomposes a hybrid from newer
-     * content); `sourceState()` is the tri-state every adoption decision keys on. What a source hands a run is re-checked
+     * content; a copy the engine refuses is told apart from a missing one, in the failure's sentence and on `onError`);
+     * `sourceState()` is the tri-state every adoption decision keys on. What a source hands a run is re-checked
      * before it is adopted. Core bundles `CenterPromptSource` (+ memory/file artifact & source-state stores); a server
      * feeds it published artifacts via `applySnapshot`. Omitted = no center layer.
      */
@@ -961,6 +963,19 @@ export interface RunnerDeps {
      * everywhere (mode parity, the CC default). Inert without {@link peerDirectory}.
      */
     crossSessionInbound?: import("../agents/cross-session-judge.js").CrossSessionInboundSettingLayers | (() => import("../agents/cross-session-judge.js").CrossSessionInboundSettingLayers);
+    /**
+     * WHO consumes this deployment's principal inbox (`principal.inbox`, where the
+     * organization's delivery gate appends cross-principal letters; the mailbox contract's fourth chain).
+     * Absent = no consumer, no lane (byte for byte as before); a deployment that mounts a gate DECLARES
+     * `{ assistant: "<agent handle>" }` (the scope's assistant is the only consumer; no terminal leg touches the
+     * box). `"terminals"` (each terminal drains the box as a second lane) is refused until held decisions are
+     * shared across terminals (`detail.reason: "terminals_unsupported"`). Letters are judged on the principal's
+     * `crossSessionInbound` layers (managed, user), held when unset. ANY other value fails the prepare of a leg
+     * that drains a session box with `config.principal_inbox_consumer_invalid` (`detail.reason: "malformed"`).
+     */
+    principalInboxConsumer?: "terminals" | {
+        assistant: string;
+    };
     /**
      * design/385 §4.4 (slice 4) — this deployment's `dialogExpiry` (CC settings key, verbatim vocabulary
      * `"60s" | "5m" | "10m" | "never"`, default `"5m"`): how long a HELD cross-session message whose cause
@@ -1286,18 +1301,18 @@ export interface RunnerDeps {
      *   summaries) is invisible without this and lets a session grow until it tops the window.
      * - `"prompt-cache"` — a prefix-cache hazard on the wire: a detected cache break (design/31), or a
      *   mis-declared/mismatched `promptCacheFamily`. The prefix cache will miss. Log/alert on both.
-     * - `"prompt-constitution"` — a prompt overlay did not take effect as written: a later source (or a later
-     *   declaration in the same source) superseded it on the same target, its target was not in this run's
-     *   prompt, or a mods handler's `prompt.compose` answer was skipped (it rewrote another's overlay, or wrote
-     *   what the band table does not grant its seat). Each overlay is named once per run.
-     * - `"degraded"` — the task kept running with a capability quietly reduced: a question auto-answered
-     *   with no human present, a skipped env git snapshot, a lost checkpoint-put confirmation, an
-     *   unroutable descendant notification, and similar best-effort arms. The run proceeds; the reduced
-     *   arm is what is being disclosed (`classification` names it).
-     * - `"config"` — a deployment-wiring problem detected while preparing or tearing down a task: tool
-     *   mount conflicts, refused/ignored knob values, gate-off notices, store/env teardown legs. The
-     *   broadest class by call-site count — most misconfigurations announce here rather than failing
-     *   the task.
+     * - `"prompt-constitution"` — a prompt overlay did not take effect as written: a later source (or a later declaration in the same source) superseded
+     *   it on the same target, its target was not in this run's prompt, or a mods handler's `prompt.compose` answer was skipped (it rewrote another's
+     *   overlay, or wrote what the band table does not grant its seat); each overlay is named once per run. The center prompt too: a pinned session's
+     *   stored artifact refused or unreadable (it fails `prompt.snapshot_unavailable`), a fresh session's candidate that does not verify, and a
+     *   `CenterPromptSource` boot restore with no usable copy (`sessionId: ""`, `classification: "center-source-restore"`) — that last line only when the
+     *   host passes this same sink to `CenterPromptSource` as its own `onError` (the source restores at boot, apart from any Runner; given none, it is silent).
+     * - `"degraded"` — the task kept running with a capability quietly reduced: a question auto-answered with no human
+     *   present, a skipped env git snapshot, a lost checkpoint-put confirmation, an unroutable descendant notification, and
+     *   similar best-effort arms. The run proceeds; the reduced arm is what is being disclosed (`classification` names it).
+     * - `"config"` — a deployment-wiring problem detected while preparing or tearing down a task: tool mount conflicts,
+     *   refused/ignored knob values, gate-off notices, store/env teardown legs. The broadest class by call-site count — most
+     *   misconfigurations announce here rather than failing the task.
      * - `"memory"` — a post-task memory-consolidation pass failed or skipped a malformed reconcile
      *   decision (design/41). Best-effort: the notes the model saved are kept; the task still succeeds.
      * - `"mcp"` — an MCP server failed to connect / list its tools and was skipped (fail-open, design/29);

package/dist/core/session-policy-store.d.ts

@@ -27,6 +27,7 @@
  *   chain); the real isolation boundary is the executionEnv, never these rules.
  */
 import { compileAllowList, type AllowEntryInert, type AllowEntryInertDetail, type AllowEntryInertReason } from "./allow-entry.js";
+import type { EngineNotice } from "./engine-notice.js";
 /** The per-session rules. All optional; an absent bucket imposes no constraint of that kind. */
 export interface SessionPermissionRules {
     /** If set, ONLY the calls these entries admit are allowed — a narrowing allowlist: a call no entry admits is refused.
@@ -244,6 +245,24 @@ export declare function compileSessionRuleBucket(rules: SessionRulesInGrammar, f
  * to make a parenthesized one the rule it now spells, or (`*`, which is no allow rule in any grammar) to leave it out.
  */
 export declare function earlierGrammarAdvisory(sessionId: string, entries: readonly string[], field: SessionRuleEntryField, grammar: number): string;
+/** The reader's word for one entry an earlier grammar reads as nothing: `no_rule` — this engine's rule grammar reads it as no
+ *  rule; `named_no_tool` — a grammar-0 allow entry the bare-name comparison of its day read as naming no tool. */
+export type EarlierGrammarReader = "no_rule" | "named_no_tool";
+/**
+ * The notice for the entries of one bucket a stored row's earlier grammar reads as nothing (`config.session_rules_earlier_grammar`,
+ * audience `user` — the session's rules are what the person's calls are judged by): the message is {@link earlierGrammarAdvisory}
+ * verbatim, and `detail` carries the same facts for a machine — `bucket` (the field), `storedGrammar` (the row's), `entries` (every
+ * entry, each as `noticeRuleText` hands rule text to a notice, with its reader's word), `rewrite` (the way out: an operator write of
+ * a new value without the stored row's rev, which stamps `stampsGrammar`), `rulesSessionId` (whose rules — an ancestor's on a
+ * delegated child's inherited layer) and `sessionId` (the run that read them).
+ */
+export declare function earlierGrammarNotice(input: {
+    rulesSessionId: string;
+    sessionId: string;
+    entries: readonly string[];
+    field: SessionRuleEntryField;
+    grammar: number;
+}): EngineNotice;
 /** The clause a run-time refusal carries when the allowlist it judged by holds entries its earlier grammar reads as nothing
  *  ({@link compileSessionRuleBucket}; `grammar` = the row's): the grammar the rules are stored in, then which entries name no tool
  *  there (grammar 0: `*` by its spelling, the parenthesized ones counted) and how many this engine's grammar reads as no rule —

package/dist/core/session-policy-store.js

@@ -4,6 +4,7 @@ import { NAMESPACED_NAME_SHAPES } from "./protocol-table.js";
 import { callerToolNameProblem } from "./caller-tool-name.js";
 import { compileAllowList, compiledEntryName, inertEntryPhrase, readRuleEntry, renderListEntry, rootFacingToolNames } from "./allow-entry.js";
 import { valueTypeLabel } from "./tool-name-list.js";
+import { noticeRuleText } from "./permission-rule-model.js";
 const SESSION_RULE_BUCKETS = { toolAllow: "allow", toolDeny: "deny", allowDirs: "dirs" };
 const BUCKETS = Object.keys(SESSION_RULE_BUCKETS);
 const ENTRY_FIELDS = BUCKETS.filter((f) => SESSION_RULE_BUCKETS[f] !== "dirs");
@@ -162,11 +163,30 @@ function shownEntries(entries, render) {
 }
 const REWRITE_THROUGH = `through this engine (an operator write of a new value without the stored row's rev; the write stamps grammar ${SESSION_RULES_GRAMMAR})`;
 export function earlierGrammarAdvisory(sessionId, entries, field, grammar) {
-    const noRule = entries.filter((e) => readsAsNoRule(e, field));
-    const namedNoTool = entries.filter((e) => !readsAsNoRule(e, field));
+    const read = earlierGrammarReadings(entries, field);
+    const noRule = read.filter((r) => r.reader === "no_rule").map((r) => r.entry);
+    const namedNoTool = read.filter((r) => r.reader === "named_no_tool").map((r) => r.entry);
     const sentences = [...(namedNoTool.length > 0 ? [namedNoToolInGrammar0(namedNoTool)] : []), ...(noRule.length > 0 ? [noRuleInThisGrammar(noRule, field, grammar)] : [])];
     return `session permission rules of session ${JSON.stringify(sessionId)}: ${sentences.join(" ")}`;
 }
+function earlierGrammarReadings(entries, field) {
+    return entries.map((entry) => ({ entry, reader: readsAsNoRule(entry, field) ? "no_rule" : "named_no_tool" }));
+}
+export function earlierGrammarNotice(input) {
+    const { rulesSessionId, sessionId, entries, field, grammar } = input;
+    return {
+        code: "config.session_rules_earlier_grammar",
+        message: earlierGrammarAdvisory(rulesSessionId, entries, field, grammar),
+        detail: {
+            bucket: field,
+            storedGrammar: grammar,
+            entries: earlierGrammarReadings(entries, field).map((r) => ({ entry: noticeRuleText(r.entry), reader: r.reader })),
+            rewrite: { by: "operator_write_without_rev", stampsGrammar: SESSION_RULES_GRAMMAR },
+            rulesSessionId,
+            sessionId,
+        },
+    };
+}
 function namedNoToolInGrammar0(entries) {
     const one = entries.length === 1;
     const wildcard = entries.some(readsAsWildcard);

package/dist/core/store-contracts/mailbox-store-contract.js

@@ -1,6 +1,8 @@
 import { strict as assert } from "node:assert";
 import { MAILBOX_INVALID_PEER_META_CODE, MAILBOX_TOMBSTONED_RECIPIENT_CODE } from "../mailbox-store.js";
 import { beginContract } from "./contract-harness.js";
+import { PRINCIPAL_INBOX_HANDLE } from "../../agents/cross-session-ref.js";
+import { mintCrossPrincipalRecord } from "../../agents/org-delivery-gate.js";
 export const MAILBOX_CONTRACT_SCOPE = "default";
 const msg = (content, sentAt = 1000) => ({ content, sentAt });
 async function withStores(mk, fn) {
@@ -259,6 +261,17 @@ export async function mailboxBundledOnlyContract(mk, runAssertion) {
         await s.drop("tenant-b", "shared-handle");
         assert.equal(await s.peekCount("tenant-b", "shared-handle"), 0);
     });
+    run("第四条消费链(principal 收件箱):投递门铸的信落收件人 scope 的 principal.inbox,两只信任锚逐字节回读,发信方 scope 零残留", async (make) => {
+        const s = make();
+        const letter = mintCrossPrincipalRecord({ from: { scope: "principal-a", name: "alice" }, body: { content: "letter" }, receiptId: "gr-1", sentAt: 10_000, consumer: { kind: "terminals" } });
+        assert.equal(await s.append("principal-b", PRINCIPAL_INBOX_HANDLE, letter), 1);
+        assert.equal(await s.peekCount("principal-a", PRINCIPAL_INBOX_HANDLE), 0, "发信方 scope 的同名箱不得出现这封信");
+        const lease = await s.claimLease("principal-b", PRINCIPAL_INBOX_HANDLE, "drain:r1", 60_000, 10_000);
+        assert.deepEqual(lease.messages.map((m) => m.peerMeta), [{ kind: "peer_message", fromScope: "principal-a", gateReceiptId: "gr-1" }]);
+        assert.equal(lease.messages[0].from, "alice");
+        assert.deepEqual(await s.ack("principal-b", PRINCIPAL_INBOX_HANDLE, "drain:r1", lease.maxSeq), { acked: true });
+        assert.equal(await s.peekCount("principal-b", PRINCIPAL_INBOX_HANDLE), 0);
+    });
     await settle();
 }
 export async function mailboxCrossProcessContract(hooks) {

package/dist/core/task-event.d.ts

@@ -677,6 +677,10 @@ export type TaskEvent = ({
      *  pre-compaction context size. CC parity = `SDKCompactBoundary{trigger, pre_tokens, preserved_segment}`. */
     type: "compacted";
     trigger: "auto" | "manual" | "forced";
+    /** The pass this frame CONCLUDES — the value the pass's `compaction_started` frame carried. A landing is
+     *  always preceded by its start, so the engine sets it on every `compacted` frame; it is optional in the
+     *  type only so a literal a host builds by hand stays valid. */
+    pass?: string;
     tokensBefore: number;
     /** How much context this compaction FREED, as the engine measured it: one structural sum over
      *  the pre-messages minus the same sum over the post-messages, inside the pass. **The only
@@ -763,8 +767,9 @@ export type TaskEvent = ({
      * - `"mooted"` — the pass did not run to its end: a manual request no boundary could serve
      *   (`trigger:"manual"`, `reason:"task_ending"`), or a request withdrawn / a pass cut in flight by its
      *   caller — a `compact({ signal })` withdrawal, `halt()`, `interrupt()`, `destroy()` or the task's own
-     *   `signal` (`reason:"cancelled"`), on any trigger: `"auto"`, `"manual"` or `"forced"`. Read
-     *   `"mooted"` with its `trigger` — it is not a manual-only outcome.
+     *   `signal` (`reason:"cancelled"`), on any trigger: `"auto"`, `"manual"` or `"forced"`, or a turn-boundary
+     *   pass in flight that the task's own end cut — a limit, a timeout (`reason:"task_ending"`, with the
+     *   `pass` the start announced). Read `"mooted"` with its `trigger` — it is not a manual-only outcome.
      */
     type: "compaction_outcome";
     outcome: Exclude<CompactOutcome, "compacted"> | "suppressed";
@@ -772,6 +777,37 @@ export type TaskEvent = ({
     trigger: "auto" | "manual" | "forced";
     /** Optional human-readable detail (mirrors the trace frame's reason where one exists). */
     reason?: string;
+    /** The pass this frame CONCLUDES — the value its `compaction_started` frame carried. Present exactly when a
+     *  start was announced for the pass this frame ends, which makes it `failed` or `mooted` (a pass that ran its
+     *  summary call and did not land, or was cut while it ran). Absent on every outcome of a pass that never
+     *  started — `blocked`, `suppressed`, `disabled`, `noop`, a `mooted` request no boundary served — and on the
+     *  rapid-refill `disabled` frame, which reports a state the landing before it caused, not that pass's end. */
+    pass?: string;
+} & TaskEventIdentity) | ({
+    /**
+     * A compaction pass is under way: the engine has committed to it and is about to produce its summary.
+     * Until now compaction was announced only when it ended (`compacted`, or `compaction_outcome` for a pass
+     * that did not land), so a consumer watching a summary call wait out a provider's retries had nothing to
+     * show for the minutes in between.
+     *
+     * Minted at the one place a pass commits — after the trigger gate, a valid cut point and the
+     * `preCompact` hook (a blocking hook ends the pass before it starts), before the summary provider is
+     * consulted or the model is called — by every lane that compacts: the turn boundary (`"auto"`, `"manual"`,
+     * and `"forced"` under trim pressure), the prompt-too-long recovery and guard-chain arm B (`"forced"`), and
+     * the end-of-task summary (`"auto"`). Retries inside the pass's model call never mint a second one.
+     *
+     * Pairing: exactly one frame concludes each started pass, carrying the same `pass` — `compacted` when it
+     * lands, `compaction_outcome{failed | mooted}` when it does not. A pass that never reaches this point
+     * (`blocked`, `suppressed`, `disabled`, `noop`) announces nothing here and its outcome carries no `pass`.
+     * `pass` is unique across runs, so a consumer multiplexing several tasks on one stream pairs on `pass` alone.
+     */
+    type: "compaction_started";
+    /** Same three-state vocabulary (and the same value) the pass hands the `preCompact` hook and its concluding frame. */
+    trigger: "auto" | "manual" | "forced";
+    /** The pass's identity: an opaque engine-minted id (uuidv7), carried by the frame that concludes the pass. */
+    pass: string;
+    /** The engine clock (epoch ms) at the moment the pass committed. */
+    startedAt: number;
 } & TaskEventIdentity) | ({
     /**
      * TB telemetry B3: the engine injected a SYSTEM steering message (a deadline nudge

package/dist/core/task-notification.js

@@ -2,7 +2,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { escapeEnvelopeTag, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { egressText } from "./untrusted-egress.js";
 import { PEER_MESSAGE_NOTICE } from "../agents/peer-admission.js";
-import { buildCrossSessionEnvelope, CROSS_SESSION_MESSAGE_NOTICE, neutralizePeerBody } from "../agents/cross-session-envelope.js";
+import { buildCrossSessionEnvelope, CROSS_PRINCIPAL_MESSAGE_NOTICE, CROSS_SESSION_MESSAGE_NOTICE, neutralizePeerBody } from "../agents/cross-session-envelope.js";
 export const TASK_NOTIFICATION_TERMINAL_STATUSES = Object.freeze(["completed", "failed", "killed", "cancelled"]);
 export const NOTIFICATION_INJECTION_OUTCOMES = Object.freeze(["queued", "parked", "parked_durably", "dropped_duplicate"]);
 export function isNotificationInjectionOutcome(value) {
@@ -88,7 +88,7 @@ export function renderAgentMessageFrame(frame) {
 }
 export function renderCrossSessionMessageFrame(frame) {
     const { body, ...fields } = frame;
-    return `${buildCrossSessionEnvelope(fields, body)}\n\n${CROSS_SESSION_MESSAGE_NOTICE}`;
+    return `${buildCrossSessionEnvelope(fields, body)}\n\n${fields.fromScope !== undefined ? CROSS_PRINCIPAL_MESSAGE_NOTICE : CROSS_SESSION_MESSAGE_NOTICE}`;
 }
 export function renderCrossSessionNoticeLine(notice) {
     return sanitizeUntrustedText(notice.text);

package/dist/core/task-spec.d.ts

@@ -307,7 +307,7 @@ export interface TaskSpec {
      *  `appendSystemPrompt` stay. Absent ⇒ standard. Rides the parent spec seat to every engine-built child (a clamp-table
      *  row: no child authors the standard form back). A value outside the closed set is refused at prepare. */
     promptForm?: "minimal";
-    /** The deployment's center binding (a scenario name): selects the adopted center artifact's `scope.binding` overlays; rides the parent spec seat; out of grammar (non-blank, ≤ 128) ⇒ `config.prompt_selector_invalid`. */
+    /** The deployment's binding (a scenario name): a prompt selector value, read by every overlay's `when.binding` (center, deploy and task alike); rides the parent spec seat; out of grammar (non-blank, ≤ 128 Unicode code points — `PROMPT_BINDING_MAX_CHARS`, counted `[...s].length`, not UTF-16 units) ⇒ `config.prompt_selector_invalid`. */
     promptBinding?: string;
     /**
      * APPEND a caller block to the assembled system prompt, keeping the engine's base + harness/safety blocks

package/dist/core/tool-policy.d.ts

@@ -1879,6 +1879,9 @@ export declare function ownArgs<T>(v: T, root?: string): {
     reason: string;
     cause?: unknown;
 };
+/** A call's argument reading (the loop's: the tool's preparation, the schema's coercions) whose every value is engine-owned
+ *  like a pass's args ({@link ownArgs}) — the gate's face seat and the resumed call's belt seat read through this one. */
+export declare function ownedReading(read: (args: unknown) => unknown): (args: unknown) => unknown;
 /**
  * A label for a value that was THROWN at us, safe to put in a fail-closed refusal. Never coerces: `String(x)`
  * throws on a null-prototype object or a untrusted `toString`/`Symbol.toPrimitive`, and the thrower here is