@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/child-clamp-seats.d.ts

@@ -11,7 +11,8 @@
  *    source by hand cannot drop a row;
  *  · the SCAN — the gate reads this table literally, requires each registered constructor to go through the carrier,
  *    requires the published carriers (`ToolExecuteContext`, `ParentSpecSeat`) to declare exactly the rows they carry,
- *    and names any hand-written restricting projection outside the carriers.
+ *    and names any hand-written restricting projection outside the carriers (a field row's: the clamped member at its
+ *    restricting value on an object, `memory: { enabled: false }`).
  *
  * "Tighten-only" here: the value that travels is the RESTRICTING one and only that one, so a parent that clamped nothing
  * changes nothing about its children, and nothing a child can author lifts a clamp its parent ran under.
@@ -136,6 +137,13 @@ export declare const CLAMP_SET: Readonly<{
         readonly script: false;
         readonly carrier: "specSeat";
     }>;
+    memory: Readonly<{
+        readonly law: "restricting";
+        readonly field: "enabled";
+        readonly value: false;
+        readonly script: false;
+        readonly carrier: "specSeat";
+    }>;
 }>;
 /** One row's seat name. */
 export type ClampSeat = keyof typeof CLAMP_SET;
@@ -155,11 +163,19 @@ export type ClampSource = {
 };
 /** The clamp source a construction site hands the carrier: EVERY clamp-carrier row as a PRESENT key. */
 export type ChildClampSource = Pick<ClampSource, ChildClampSeat>;
+/** What one row hands on: its restricting value; an add-only row's list; a field row's restricting MEMBER as a partial
+ *  declaration of the seat (`{ enabled: false }`) — never the whole declaration, which is the caller's own. */
+type SeatTravels<K extends ClampSeat> = (typeof CLAMP_SET)[K] extends {
+    readonly field: infer F extends string;
+    readonly value: infer V;
+} ? {
+    readonly [P in F]: V;
+} : (typeof CLAMP_SET)[K] extends {
+    readonly value: infer V;
+} ? V : NonNullable<TaskSpec[K]>;
 /** Only the restricting values (add-only rows: a non-empty list) — the shape a waker's clamp seat and a projection take. */
 export type ClampValues = {
-    readonly [K in ClampSeat]?: (typeof CLAMP_SET)[K] extends {
-        readonly value: infer V;
-    } ? V : NonNullable<TaskSpec[K]>;
+    readonly [K in ClampSeat]?: SeatTravels<K>;
 };
 /** Every row's seat name, in table order. */
 export declare const CLAMP_SEATS: readonly ClampSeat[];
@@ -170,7 +186,9 @@ export type ScriptSeat = {
 /** {@link ScriptSeat}, in table order — the script whitelist's tighten-only half. */
 export declare const SCRIPT_SEATS: readonly ScriptSeat[];
 /** Two declarations of one seat under its row's law (`b` is the later one): the restricting value if either carries it,
- *  else what was authored (`b` over `a`); an add-only list is the union of both, in order, by the row's identity. */
+ *  else what was authored (`b` over `a`); an add-only list is the union of both, in order, by the row's identity. A field
+ *  row's seat is a declaration the later author writes whole — what is composed is the one member the row clamps: the
+ *  restricting value stands on the authored declaration if either side carries it, every other member is the author's. */
 export declare function composeClampSeat(seat: ClampSeat, a: unknown, b: unknown): unknown;
 /**
  * THE union of an add-only seat's lists — the ONE merge every add-only row reads, wherever two of its lists meet: two
@@ -188,8 +206,13 @@ export declare function unionAddOnly<S extends AddOnlySeat>(seat: S, ...lists: R
  * list is folded or compiled, so a task-layer value is judged as the caller wrote it. Absent ⇒ nothing to judge.
  */
 export declare function assertAddOnlySeats(spec: object): void;
+/** The name a refusal gives a seat's clamped cell: the seat, or (field row) `seat.member`. */
+export declare function clampCellPath(seat: ClampSeat): string;
+/** What a declaration of the seat states for the cell its row clamps (the value itself for a whole-value row). */
+export declare function clampCellOf(seat: ClampSeat, declaration: unknown): unknown;
 /** Would `override` LOOSEN `base` on this seat? Only a restricting row can be loosened: a base carrying the restricting
- *  value meeting an override that states a different one. */
+ *  value meeting an override that states a different one (a field row reads the one member it clamps, so an override that
+ *  declares the seat without stating that member loosens nothing). */
 export declare function loosensClampSeat(seat: ClampSeat, base: unknown, override: unknown): boolean;
 /** Read every row (`carrier`: that carrier's rows only) off a record that carries the seats under their own names (a spec, a ctx, a seat). */
 export declare function clampSourceOf(record: object | undefined): ClampSource;
@@ -201,6 +224,22 @@ export declare function foldClampSources(...records: ReadonlyArray<object | unde
 /** The restricting values of every row (`carrier` narrows it to one carrier's rows): a row with nothing restricting adds
  *  NO KEY, so the result spreads onto a spec without ever writing a loosening value. */
 export declare function clampSeatsOf(source: Partial<Record<ClampSeat, unknown>>, carrier?: ClampCarrier): ClampValues;
+/** The field rows' seats (object-valued seats, one member of each clamped). */
+export type FieldSeat = {
+    [K in ClampSeat]: (typeof CLAMP_SET)[K] extends {
+        readonly field: string;
+    } ? K : never;
+}[ClampSeat];
+/** {@link clampSeatsOf} for the FIELD rows alone: what a field row hands on is a partial declaration, so it is written onto a
+ *  spec by {@link applyClampSeats}, never spread over it. */
+export declare function clampFieldSeatsOf(source: Partial<Record<ClampSeat, unknown>>): Pick<ClampValues, FieldSeat>;
+/**
+ * Write clamp values onto a spec — the ONE way a projection lands on a record. A whole-value row lands as the value; a field
+ * row REWRITES the one member it clamps on the spec's own declaration and keeps every other member (a declaration that was
+ * deleted instead would leave the next mint nothing to read, and the clamp would end one level down). Returns a new object;
+ * `spec` is not mutated; a seat the values do not carry is left as the spec has it.
+ */
+export declare function applyClampSeats<S extends object>(spec: S, values: ClampValues): S;
 /** The coded refusal of a clamp record a caller handed in (`config.invalid_argument`). */
 export declare function clampRecordError(message: string): Error & {
     code: "config.invalid_argument";

package/dist/core/child-clamp-seats.js

@@ -102,14 +102,31 @@ export const CLAMP_SET = Object.freeze({
     memoryPersistenceCapable: Object.freeze({ law: "restricting", value: false, script: true, carrier: "specSeat" }),
     fileHistory: Object.freeze({ law: "restricting", value: "disabled", script: false, carrier: "specSeat" }),
     promptForm: Object.freeze({ law: "restricting", value: "minimal", script: false, carrier: "specSeat" }),
+    memory: Object.freeze({ law: "restricting", field: "enabled", value: false, script: false, carrier: "specSeat" }),
 });
+function fieldOf(row) {
+    return "field" in row ? row.field : undefined;
+}
+function cellOf(row, declaration) {
+    const field = fieldOf(row);
+    if (field === undefined)
+        return declaration;
+    return typeof declaration === "object" && declaration !== null && !Array.isArray(declaration) ? declaration[field] : undefined;
+}
+function withCell(row, declaration, cell) {
+    const field = fieldOf(row);
+    if (field === undefined)
+        return cell;
+    const own = typeof declaration === "object" && declaration !== null && !Array.isArray(declaration) ? declaration : {};
+    return { ...own, [field]: cell };
+}
 const ROWS = Object.freeze(Object.entries(CLAMP_SET));
 export const CLAMP_SEATS = Object.freeze(ROWS.map(([seat]) => seat));
 export const SCRIPT_SEATS = Object.freeze(ROWS.filter(([, row]) => row.script !== false).map(([seat]) => seat));
 export function composeClampSeat(seat, a, b) {
     const row = CLAMP_SET[seat];
     if (row.law === "restricting")
-        return a === row.value || b === row.value ? row.value : (b ?? a);
+        return cellOf(row, a) === row.value || cellOf(row, b) === row.value ? withCell(row, b ?? a, row.value) : (b ?? a);
     const lists = [a, b];
     return unionAddOnly(seat, ...lists);
 }
@@ -156,14 +173,28 @@ export function assertAddOnlySeats(spec) {
         }
     }
 }
+export function clampCellPath(seat) {
+    const field = fieldOf(CLAMP_SET[seat]);
+    return field === undefined ? seat : `${seat}.${field}`;
+}
+export function clampCellOf(seat, declaration) {
+    return cellOf(CLAMP_SET[seat], declaration);
+}
 export function loosensClampSeat(seat, base, override) {
     const row = CLAMP_SET[seat];
-    return row.law === "restricting" && base === row.value && override !== undefined && override !== row.value;
+    if (row.law !== "restricting")
+        return false;
+    const stated = cellOf(row, override);
+    return cellOf(row, base) === row.value && stated !== undefined && stated !== row.value;
 }
 function projected(seat, v) {
     const row = CLAMP_SET[seat];
-    if (row.law === "restricting")
-        return v === row.value ? row.value : undefined;
+    if (row.law === "restricting") {
+        if (cellOf(row, v) !== row.value)
+            return undefined;
+        const travels = withCell(row, undefined, row.value);
+        return fieldOf(row) === undefined ? travels : Object.freeze(travels);
+    }
     return Array.isArray(v) && v.length > 0 ? Object.freeze(v.map((e) => (typeof e === "object" && e !== null ? { ...e } : e))) : undefined;
 }
 export function clampSourceOf(record, carrier) {
@@ -184,6 +215,27 @@ export function clampSeatsOf(source, carrier) {
     }
     return out;
 }
+export function clampFieldSeatsOf(source) {
+    const out = {};
+    for (const [seat, row] of ROWS) {
+        if (fieldOf(row) === undefined)
+            continue;
+        const v = projected(seat, source[seat]);
+        if (v !== undefined)
+            out[seat] = v;
+    }
+    return out;
+}
+export function applyClampSeats(spec, values) {
+    const out = { ...spec };
+    for (const [seat, row] of ROWS) {
+        const v = values[seat];
+        if (v === undefined)
+            continue;
+        out[seat] = fieldOf(row) === undefined ? v : withCell(row, out[seat], cellOf(row, v));
+    }
+    return out;
+}
 export function clampRecordError(message) {
     const e = new Error(message);
     e.code = "config.invalid_argument";

package/dist/core/compliance.js

@@ -1,3 +1,4 @@
+import { describeRejectedValue } from "./tool-search-setting.js";
 export const COMPLIANCE_CAPABILITIES = Object.freeze(["mcp_servers", "workflows", "web_fetch", "org_memory_mount"]);
 export const BUILTIN_COMPLIANCE_DENIES = {
     hipaa: ["web_fetch", "org_memory_mount"],
@@ -26,7 +27,8 @@ export function resolveComplianceDenies(posture) {
 export function complianceCapabilityProblem(cap, owner) {
     if (COMPLIANCE_CAPABILITIES.some((member) => member === cap))
         return undefined;
-    return (`${owner} contains "${String(cap)}", not a member of the closed capability set ` +
+    const shown = (typeof cap === "object" && cap !== null) || typeof cap === "function" ? describeRejectedValue(cap) : `"${String(cap)}"`;
+    return (`${owner} contains ${shown}, not a member of the closed capability set ` +
         `(${COMPLIANCE_CAPABILITIES.join(", ")}) — a misspelled deny must never silently not-enforce.`);
 }
 export const WEB_FETCH_TOOL_NAME = "WebFetch";

package/dist/core/consolidate-scope.d.ts

@@ -86,7 +86,7 @@ export declare function consolidateScope(scope: string, deps: ConsolidateScopeDe
  * plain max) would lose `id > cursor` and be exiled from consolidation forever. Pass the pass's
  * `stats.consolidatedIds` (processed), `stats.addedIds`, and `stats.failedIds`.
  *
- * No-op when the store lacks the cursor pair (back-compat: an old store keeps the pure-inline behavior).
+ * No-op when the store lacks the cursor pair (back-compat, RL-1654-consolidate-scope: an old store keeps the pure-inline behavior).
  * Never throws — a cursor-advance failure routes to `onWarn` (the inline notes are already durable; the
  * worst case is the next periodic pass re-sees them, which `runMemoryConsolidation` handles idempotently).
  */

package/dist/core/cross-boundary-taint.d.ts

@@ -0,0 +1,213 @@
+/**
+ * The device lane's CROSS-BOUNDARY vocabulary: the run tree's two taint bits and its posture fact, the legs one call
+ * travels, the one table those answer a call's obligation from, and the session record that carries a tree's state from
+ * one leg of a session to the next. Pure data and pure functions — no I/O, no clock, no engine state.
+ *
+ * THE RULE. A call's cross-boundary obligation is decided by three things and nothing else: the legs THIS call travels
+ * (declared by the code that dispatches it — a constant on most definitions, given per call by the two that route by
+ * their arguments), whether the environment a leg reaches declares itself the target device right now, and the tree's
+ * three bits. Two outcomes, independent of each other: `mandate` — a person confirms this call; `record` — once this
+ * call is allowed, the tree's off-target-read bit is set. {@link crossBoundaryObligation} is the one function that
+ * answers it; every place that asks calls it and none restates a cell.
+ */
+import type { AssertAllKeysHandled } from "./ask-origin.js";
+import type { EngineNotice } from "./engine-notice.js";
+import type { HostDecider } from "./gate-outcome.js";
+/** The run tree's two TAINT bits: the tree executes on a target device (`targetExecutionArmed`), and an off-target read
+ *  was allowed into it since (`offTargetReadObserved`). Presence-coded on every carrier: `true` or absent, never `false`. */
+export declare const CROSS_BOUNDARY_TAINT_BITS: readonly ["targetExecutionArmed", "offTargetReadObserved"];
+export type CrossBoundaryTaintBit = (typeof CROSS_BOUNDARY_TAINT_BITS)[number];
+/**
+ * The tree's state: the two taint bits and `governed` — the tree has run under the `multi_tenant` posture since it was
+ * first armed. `governed` is a posture fact, not a taint bit; it rides the same carriers and joins the same way. Each
+ * member is `true` or absent. The state only grows ({@link joinCrossBoundaryTree}).
+ */
+export interface CrossBoundaryTree {
+    readonly targetExecutionArmed?: true;
+    readonly offTargetReadObserved?: true;
+    readonly governed?: true;
+}
+/** The deployment's posture words (`RunnerDeps.crossBoundaryPosture`): who is hurt when a tree that executes on a device
+ *  reaches past it — the device's own user (`single_user`), or an organization's other tenants (`multi_tenant`). */
+export declare const CROSS_BOUNDARY_POSTURES: readonly ["single_user", "multi_tenant"];
+export type CrossBoundaryPosture = (typeof CROSS_BOUNDARY_POSTURES)[number];
+/**
+ * The legs one call can travel: `env` — into or out of an execution environment (the call's arguments reach it, or its
+ * content comes back from it); `outside_read` — content fetched from beyond the boundary; `outside_write` — an effect
+ * produced beyond the boundary. An empty set is a call whose effect stays inside the engine (its process or its session
+ * store).
+ */
+export declare const BOUNDARY_LEGS: readonly ["env", "outside_read", "outside_write"];
+export type BoundaryLeg = (typeof BOUNDARY_LEGS)[number];
+/** A definition's declaration of its legs: the legs every call travels, or `"per_call"` — the code that dispatches the call
+ *  gives them per call (the destination is chosen by the call's own arguments). */
+export type BoundaryLegsDeclaration = BoundaryLegList | "per_call";
+/** A list of legs, in any order, each at most once on a roster row. */
+export type BoundaryLegList = readonly BoundaryLeg[];
+/** What one call owes: a person's confirmation (`mandate`), the off-target-read bit once allowed (`record`), both, or neither. */
+export interface CrossBoundaryObligation {
+    readonly mandate: boolean;
+    readonly record: boolean;
+}
+/** What a `"per_call"` definition's dispatch gives for one call: the legs it travels and, when its `env` leg reaches an
+ *  environment other than the calling leg's own (a background shell's), that environment — its declaration is read as the call
+ *  is judged. */
+export interface BoundaryLegsGiven {
+    readonly legs: readonly BoundaryLeg[];
+    readonly env?: {
+        readonly externalContentTarget?: boolean;
+    };
+}
+declare const CROSS_BOUNDARY_TREE_TOKEN: unique symbol;
+/** A run tree's cross-boundary IDENTITY — opaque and frozen, minted by the engine alone: a tool is handed it so a delegation or
+ *  workflow lane can join its children to the same tree and a registry handle can name the tree that spawned it, compared by
+ *  identity. Nothing reads or writes the tree's state through it; the state stays the engine's. */
+export interface CrossBoundaryTreeToken {
+    readonly [CROSS_BOUNDARY_TREE_TOKEN]: true;
+}
+/** A `"per_call"` definition's resolver, written beside the code that dispatches the call: handed the call's arguments as the
+ *  tool reads them and the calling tree's {@link CrossBoundaryTreeToken} (a handle that recorded one compares it by identity). No I/O. */
+export type BoundaryLegsFor = (args: unknown, at: {
+    readonly tree: CrossBoundaryTreeToken;
+}) => BoundaryLegsGiven;
+/** Why an exit refused a call its decision allowed: the call needs a person's confirmation under the tree's state NOW and the
+ *  decision was not a person's (`unconfirmed`), or the session record the call owes could not be written before it ran
+ *  (`unrecorded`). */
+export interface CrossBoundaryExitRefusal {
+    readonly kind: "unconfirmed" | "unrecorded";
+    readonly message: string;
+}
+/** One call as the cross-boundary seat reads it: its wire name, its arguments as they would run, and its id (the trace names it). */
+export interface CrossBoundaryCall {
+    readonly toolName: string;
+    readonly args: unknown;
+    readonly toolCallId?: string;
+}
+/** The gate's cross-boundary seat — ENGINE-BUILT per leg (`runner/cross-boundary-lane.ts`), never a deployment callback. */
+export interface CrossBoundaryCheck {
+    /** This call's obligation under the tree's state at this moment (the station reads it on the final arguments). */
+    obligation(call: CrossBoundaryCall): CrossBoundaryObligation;
+    /** The allow exit's rule, on the bytes that run and the party that decided: re-reads the obligation; a mandate the decider cannot
+     *  answer refuses; otherwise the off-target-read bit the call owes is joined and the session record is written before it runs. */
+    exit(call: CrossBoundaryCall, decidedBy: HostDecider): Promise<CrossBoundaryExitRefusal | undefined>;
+}
+/** The gate input's seat for {@link CrossBoundaryCheck}: present on a leg whose station is ENGAGED (a posture is declared, the leg runs
+ *  on a target, or its tree is governed); absent ⇒ the decision path is byte-identical. */
+export interface CrossBoundaryGateSeat {
+    crossBoundaryCheck?: CrossBoundaryCheck;
+}
+/** The table's rows. An `env` leg is judged by where it lands: a target environment is its own row, any other environment
+ *  reads as both outside rows ({@link ENV_LEG_ROWS}). */
+type LegRow = "env_to_target" | "outside_read" | "outside_write";
+/** THE table. The host-lane column is empty, so a tree that never armed decides exactly as it would without this table. */
+declare const OBLIGATION_TABLE: {
+    readonly env_to_target: {
+        readonly host_lane: "none";
+        readonly armed: "none";
+        readonly armed_observed: "mandate_if_governed";
+    };
+    readonly outside_read: {
+        readonly host_lane: "none";
+        readonly armed: "record";
+        readonly armed_observed: "none";
+    };
+    readonly outside_write: {
+        readonly host_lane: "none";
+        readonly armed: "mandate_if_governed";
+        readonly armed_observed: "mandate_if_governed";
+    };
+};
+export type ObligationTableCoversEveryRow = AssertAllKeysHandled<Exclude<LegRow, keyof typeof OBLIGATION_TABLE>>;
+/** The obligation of one call — the union of its legs' cells under the tree's current state. `legs` are the legs this call
+ *  travels (a definition's constant, or what its dispatch gave for this call); `reachedEnvIsTarget` — the environment its
+ *  `env` leg reaches declares itself the target right now (read off that environment, never off the tree's history; unread
+ *  when the call has no `env` leg). A leg outside {@link BOUNDARY_LEGS}, a non-boolean target fact or a malformed tree throws. */
+export declare function crossBoundaryObligation(legs: readonly BoundaryLeg[], reachedEnvIsTarget: boolean, tree: CrossBoundaryTree): CrossBoundaryObligation;
+/** The tree is GOVERNED — what the table's `mandate_if_governed` cells read, and so what makes the session record a carrier some
+ *  judgment reads (a record that cannot be written refuses its call on a governed tree only). */
+export declare function crossBoundaryTreeGoverned(tree: CrossBoundaryTree): boolean;
+/** The join of two tree states: every bit either holds. Monotone — it never clears a bit — and returns a fresh frozen
+ *  state, never one of its operands. */
+export declare function joinCrossBoundaryTree(a: CrossBoundaryTree, b: CrossBoundaryTree): CrossBoundaryTree;
+/** Whether `covering` holds every bit `tree` holds — a record that covers a tree's state need not be written again. */
+export declare function crossBoundaryTreeCovers(covering: CrossBoundaryTree, tree: CrossBoundaryTree): boolean;
+/** The strictest state: what a record that cannot be read stands for. */
+export declare const STRICTEST_CROSS_BOUNDARY_TREE: CrossBoundaryTree;
+/** The `customType` of the session entry that records a tree's state: a custom entry, persisted with the transcript and
+ *  never replayed into model context — the state lives where the content it describes lives. */
+export declare const CROSS_BOUNDARY_RECORD_TYPE = "engine:cross_boundary";
+/** The record's `data`: written only for an armed tree, so `targetExecutionArmed` is always present. */
+export interface CrossBoundaryRecordData {
+    readonly targetExecutionArmed: true;
+    readonly offTargetReadObserved?: true;
+    readonly governed?: true;
+}
+/** The one spelling of a record's `data` for a tree state. A tree that is not armed has no record: refused. */
+export declare function crossBoundaryRecordData(tree: CrossBoundaryTree): CrossBoundaryRecordData;
+/** What a branch says about its tree: no record on it; the join of its records (`entryId` = the newest one's); or a record — or an
+ *  entry — that cannot be read, which reads as the strictest state, with the sentence a disclosure names. A record covers the content
+ *  before it: `uncoveredContent` — conversation content (the session layer's `hasConversationContent`: a message, a custom message, a
+ *  compaction) follows the newest record, or with no record is on the branch at all — is content produced under a state no record says. */
+export type CrossBoundaryRecordRead = {
+    readonly kind: "absent";
+    readonly uncoveredContent: boolean;
+} | {
+    readonly kind: "recorded";
+    readonly entryId?: string;
+    readonly tree: CrossBoundaryTree;
+    readonly uncoveredContent: boolean;
+} | {
+    readonly kind: "malformed";
+    readonly entryId?: string;
+    readonly tree: CrossBoundaryTree;
+    readonly why: string;
+};
+/** The members a session entry is read by. */
+export interface CrossBoundaryRecordEntry {
+    readonly type: string;
+    readonly id?: string;
+    readonly customType?: unknown;
+    readonly data?: unknown;
+}
+/**
+ * Read a branch's tree state: the JOIN of every cross-boundary record on `branch` (entries in path order) — the state only grows, so
+ * a later record holding fewer bits never lowers it. Any record whose shape is not a record's, and any entry that cannot be read
+ * (one of its members throws), makes the read {@link STRICTEST_CROSS_BOUNDARY_TREE}, never a looser state. No record reads `absent`.
+ */
+export declare function readCrossBoundaryRecord(branch: readonly CrossBoundaryRecordEntry[]): CrossBoundaryRecordRead;
+/** The one mint of `config.cross_boundary_posture_undeclared`: an armed tree on a deployment that configured no posture, so
+ *  the permissive `single_user` reading is in force. `detail.taint` lists the tree's taint bits. */
+export declare function crossBoundaryPostureUndeclaredNotice(at: {
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly tree: CrossBoundaryTree;
+}): EngineNotice;
+/** Where a session record's write was owed: a leg's prepare, an exit before its call runs, a suspend before its row, a settle. */
+export type CrossBoundaryRecordPhase = "prepare" | "exit" | "suspend" | "settle"; /** The one mint of `config.cross_boundary_record_unwritten`: a session record that could not be written and refused nothing — on a tree
+ *  that is not governed (no judgment reads the record), or at a governed leg's prepare / settle (no call to refuse; the next leg then
+ *  reads the content after the newest record as off-target). A governed exit refuses its call and a governed suspend its row instead. */
+export declare function crossBoundaryRecordUnwrittenNotice(at: {
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly phase: CrossBoundaryRecordPhase;
+    readonly governed: boolean;
+    readonly cause: string;
+}): EngineNotice;
+/** The face a protocol tool (an MCP tool, an A2A skill) carries for its JUDGED `toolAxes` entry (`readToolAxes`' copy): the empty leg
+ *  set when the entry declares `boundaryFlow: "engine"`, nothing otherwise (its roster row then states the legs its effect implies).
+ *  The one translation of that declaration onto a mounted instance; the MCP intake and the A2A peer mint both call it. */
+export declare function boundaryFlowFace(entry: {
+    readonly boundaryFlow?: "engine";
+} | undefined): {
+    boundaryLegs?: readonly BoundaryLeg[];
+};
+/**
+ * The legs a ROSTER ROW states, from where the instance came from, what it declares and its resolved effect. The engine's
+ * own definitions (`builtin` / `synthetic` rows) and the protocol tools the engine materialized (`mcp` / `a2a`) are read by
+ * their declaration; any other row — and a row of those sources that declares nothing — by its effect: `read` reaches beyond
+ * the boundary to read, anything else to write. A declaration that is neither `"per_call"` nor a list of legs is refused on EVERY
+ * row, whoever declared it (`undefined` back, the caller refuses the row loudly): a row that does not read a declaration still does
+ * not let a bad one pass silently. The returned list is a fresh array in {@link BOUNDARY_LEGS} order.
+ */
+export declare function rosterBoundaryLegs(source: string, declared: unknown, effect: "read" | "write" | "idempotent"): BoundaryLegsDeclaration | undefined;
+export {};

package/dist/core/cross-boundary-taint.js

@@ -0,0 +1,196 @@
+import { hasConversationContent } from "./session.js";
+export const CROSS_BOUNDARY_TAINT_BITS = Object.freeze(["targetExecutionArmed", "offTargetReadObserved"]);
+export const CROSS_BOUNDARY_POSTURES = Object.freeze(["single_user", "multi_tenant"]);
+const postureSeatIsTheSet = true;
+void postureSeatIsTheSet;
+export const BOUNDARY_LEGS = Object.freeze(["env", "outside_read", "outside_write"]);
+const LEG_SET = new Set(BOUNDARY_LEGS);
+const OBLIGATION_TABLE = {
+    env_to_target: { host_lane: "none", armed: "none", armed_observed: "mandate_if_governed" },
+    outside_read: { host_lane: "none", armed: "record", armed_observed: "none" },
+    outside_write: { host_lane: "none", armed: "mandate_if_governed", armed_observed: "mandate_if_governed" },
+};
+const ENV_LEG_ROWS = { target: ["env_to_target"], off_target: ["outside_read", "outside_write"] };
+const TREE_MEMBERS = [...CROSS_BOUNDARY_TAINT_BITS, "governed"];
+function assertTree(tree, at) {
+    if (typeof tree !== "object" || tree === null || Array.isArray(tree))
+        throw new TypeError(`${at}: a cross-boundary tree is a record of presence bits (got ${tree === null ? "null" : Array.isArray(tree) ? "an array" : typeof tree})`);
+    for (const member of TREE_MEMBERS) {
+        const v = tree[member];
+        if (v !== undefined && v !== true)
+            throw new TypeError(`${at}: tree member "${member}" is presence-coded (true or absent), got ${typeof v}`);
+    }
+}
+export function crossBoundaryObligation(legs, reachedEnvIsTarget, tree) {
+    if (!Array.isArray(legs))
+        throw new TypeError(`crossBoundaryObligation: legs is a list of ${BOUNDARY_LEGS.join(" | ")}`);
+    if (typeof reachedEnvIsTarget !== "boolean")
+        throw new TypeError("crossBoundaryObligation: reachedEnvIsTarget is a boolean");
+    assertTree(tree, "crossBoundaryObligation");
+    const column = tree.targetExecutionArmed !== true ? "host_lane" : tree.offTargetReadObserved === true ? "armed_observed" : "armed";
+    let mandate = false;
+    let record = false;
+    for (const leg of legs) {
+        if (!LEG_SET.has(leg))
+            throw new TypeError(`crossBoundaryObligation: ${JSON.stringify(leg)} is not a boundary leg (${BOUNDARY_LEGS.join(", ")})`);
+        const rows = leg === "env" ? ENV_LEG_ROWS[reachedEnvIsTarget ? "target" : "off_target"] : [leg];
+        for (const row of rows) {
+            const cell = OBLIGATION_TABLE[row][column];
+            if (cell === "record")
+                record = true;
+            else if (cell === "mandate_if_governed" && crossBoundaryTreeGoverned(tree))
+                mandate = true;
+        }
+    }
+    return Object.freeze({ mandate, record });
+}
+export function crossBoundaryTreeGoverned(tree) {
+    return tree.governed === true;
+}
+export function joinCrossBoundaryTree(a, b) {
+    assertTree(a, "joinCrossBoundaryTree");
+    assertTree(b, "joinCrossBoundaryTree");
+    const out = {};
+    if (a.targetExecutionArmed === true || b.targetExecutionArmed === true)
+        out.targetExecutionArmed = true;
+    if (a.offTargetReadObserved === true || b.offTargetReadObserved === true)
+        out.offTargetReadObserved = true;
+    if (a.governed === true || b.governed === true)
+        out.governed = true;
+    return Object.freeze(out);
+}
+export function crossBoundaryTreeCovers(covering, tree) {
+    assertTree(covering, "crossBoundaryTreeCovers");
+    assertTree(tree, "crossBoundaryTreeCovers");
+    return TREE_MEMBERS.every((m) => tree[m] !== true || covering[m] === true);
+}
+export const STRICTEST_CROSS_BOUNDARY_TREE = Object.freeze({ targetExecutionArmed: true, offTargetReadObserved: true, governed: true });
+export const CROSS_BOUNDARY_RECORD_TYPE = "engine:cross_boundary";
+export function crossBoundaryRecordData(tree) {
+    assertTree(tree, "crossBoundaryRecordData");
+    if (tree.targetExecutionArmed !== true)
+        throw new TypeError("crossBoundaryRecordData: only an armed tree is recorded");
+    return Object.freeze({ targetExecutionArmed: true, ...(tree.offTargetReadObserved === true ? { offTargetReadObserved: true } : {}), ...(tree.governed === true ? { governed: true } : {}) });
+}
+const RECORD_MEMBERS = TREE_MEMBERS;
+function ownedRecordTree(data) {
+    if (typeof data !== "object" || data === null || Array.isArray(data) || Object.getPrototypeOf(data) !== Object.prototype)
+        return { why: `its data is ${data === null ? "null" : Array.isArray(data) ? "an array" : typeof data === "object" ? "not a plain record" : typeof data}` };
+    const owned = new Map();
+    for (const key of Reflect.ownKeys(data)) {
+        if (typeof key !== "string" || !RECORD_MEMBERS.includes(key))
+            return { why: `its data carries ${typeof key === "string" ? JSON.stringify(key.slice(0, 40)) : "a symbol key"}, which is not a member` };
+        const d = Object.getOwnPropertyDescriptor(data, key);
+        if (d === undefined || !("value" in d))
+            return { why: `"${key}" is not a data member` };
+        owned.set(key, d.value);
+    }
+    if (owned.get("targetExecutionArmed") !== true)
+        return { why: `"targetExecutionArmed" is not true` };
+    for (const m of ["offTargetReadObserved", "governed"])
+        if (owned.get(m) !== undefined && owned.get(m) !== true)
+            return { why: `"${m}" is neither true nor absent` };
+    return { tree: Object.freeze({ targetExecutionArmed: true, ...(owned.get("offTargetReadObserved") === true ? { offTargetReadObserved: true } : {}), ...(owned.get("governed") === true ? { governed: true } : {}) }) };
+}
+function readBranchEntry(branch, i) {
+    let id;
+    try {
+        const e = branch[i];
+        if (typeof e !== "object" || e === null)
+            return { kind: "other", content: false };
+        const { type, customType } = e;
+        if (type !== "custom" || customType !== CROSS_BOUNDARY_RECORD_TYPE)
+            return { kind: "other", content: typeof type === "string" && hasConversationContent([{ type }]) };
+        const rawId = e.id;
+        id = typeof rawId === "string" ? rawId : undefined;
+        const read = ownedRecordTree(e.data);
+        return "why" in read ? { kind: "unreadable", ...(id !== undefined ? { id } : {}), why: read.why } : { kind: "record", ...(id !== undefined ? { id } : {}), tree: read.tree };
+    }
+    catch {
+        return { kind: "unreadable", ...(id !== undefined ? { id } : {}), why: "an entry on the branch could not be read" };
+    }
+}
+export function readCrossBoundaryRecord(branch) {
+    const strictest = (id, why) => Object.freeze({ kind: "malformed", ...(id !== undefined ? { entryId: id } : {}), tree: STRICTEST_CROSS_BOUNDARY_TREE, why: `the cross-boundary record on this branch cannot be read: ${why}` });
+    let isList;
+    let length;
+    try {
+        isList = Array.isArray(branch);
+        length = isList ? branch.length : undefined;
+    }
+    catch {
+        return strictest(undefined, "the branch could not be read");
+    }
+    if (!isList)
+        throw new TypeError("readCrossBoundaryRecord: the branch is a list of session entries");
+    if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0)
+        return strictest(undefined, "the branch could not be read");
+    let joined;
+    let newest;
+    let uncoveredContent = false;
+    for (let i = 0; i < length; i++) {
+        const entry = readBranchEntry(branch, i);
+        if (entry.kind === "other") {
+            uncoveredContent ||= entry.content;
+            continue;
+        }
+        if (entry.kind === "unreadable")
+            return strictest(entry.id, entry.why);
+        joined = joinCrossBoundaryTree(joined ?? {}, entry.tree);
+        newest = entry.id;
+        uncoveredContent = false;
+    }
+    return joined === undefined ? Object.freeze({ kind: "absent", uncoveredContent }) : Object.freeze({ kind: "recorded", ...(newest !== undefined ? { entryId: newest } : {}), tree: joined, uncoveredContent });
+}
+export function crossBoundaryPostureUndeclaredNotice(at) {
+    assertTree(at.tree, "crossBoundaryPostureUndeclaredNotice");
+    return {
+        code: "config.cross_boundary_posture_undeclared",
+        message: 'This run executes on an external-content target (the device lane) and no RunnerDeps.crossBoundaryPosture is configured — the engine reads the permissive "single_user" posture. ' +
+            'On a multi-tenant deployment declare "multi_tenant", so an org-side write from a tainted run is put to a person; on a single-user deployment declare "single_user" to silence this line.',
+        detail: { sessionId: at.sessionId, runId: at.runId, taint: CROSS_BOUNDARY_TAINT_BITS.filter((b) => at.tree[b] === true) },
+    };
+}
+export function crossBoundaryRecordUnwrittenNotice(at) {
+    return {
+        code: "config.cross_boundary_record_unwritten",
+        message: `The session's cross-boundary record could not be written at ${at.phase} (${at.cause.slice(0, 300)}) — ` +
+            (at.governed
+                ? "the tree is governed: the next leg on this session reads the content after its newest record as off-target, so its device calls are put to a person."
+                : "the tree is not governed: no judgment reads the record, so its failure refused nothing; the tree's growth, or the leg's end, writes next."),
+        detail: { sessionId: at.sessionId, runId: at.runId, phase: at.phase, governed: at.governed, cause: at.cause.slice(0, 300) },
+    };
+}
+const NO_LEGS = Object.freeze([]);
+export function boundaryFlowFace(entry) {
+    return entry?.boundaryFlow === "engine" ? { boundaryLegs: NO_LEGS } : {};
+}
+function ownedLegList(v) {
+    try {
+        if (!Array.isArray(v))
+            return undefined;
+        const length = v.length;
+        if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0)
+            return undefined;
+        const held = new Set();
+        for (let i = 0; i < length; i++) {
+            const leg = v[i];
+            if (!LEG_SET.has(leg))
+                return undefined;
+            held.add(leg);
+        }
+        return BOUNDARY_LEGS.filter((l) => held.has(l));
+    }
+    catch {
+        return undefined;
+    }
+}
+export function rosterBoundaryLegs(source, declared, effect) {
+    const list = declared === undefined || declared === "per_call" ? undefined : ownedLegList(declared);
+    if (declared !== undefined && declared !== "per_call" && list === undefined)
+        return undefined;
+    const reads = source === "builtin" || source === "synthetic" || source === "mcp" || source === "a2a";
+    if (!reads || declared === undefined)
+        return effect === "read" ? ["outside_read"] : ["outside_write"];
+    return declared === "per_call" ? "per_call" : list;
+}