@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/locked-config.d.ts

@@ -1,4 +1,5 @@
-import type { McpServerSpec, RunnerDeps, TaskSpec } from "./types.js";
+import type { A2aServerSpec, McpServerSpec, RunnerDeps, TaskSpec } from "./types.js";
+import { type ToolAxesSurface } from "./mcp-server-spec.js";
 import type { ToolPolicy } from "./tool-policy.js";
 /** The closed set of administratively lockable configuration keys. Adding a member is a deliberate
  *  edit HERE (tsc forces the registry row), never a free-form string. */
@@ -34,7 +35,7 @@ export interface LockedConfig {
     keys: readonly LockedKey[];
 }
 /** The preflight's resolved snapshot — the ONLY thing downstream task assembly reads for the
- *  guarded slots (never the raw `spec.mcp` / `spec.toolPolicy` fields). */
+ *  guarded slots (never the raw `spec.mcp` / `spec.a2a` / `spec.toolPolicy` fields). */
 export interface LockedPreflight {
     /** The validated lock set (empty when the deployment declares none). */
     lockedKeys: ReadonlySet<LockedKey>;
@@ -45,6 +46,10 @@ export interface LockedPreflight {
      *  `undefined` (core has no deployment-level MCP seat — a locked deployment mounts no
      *  task-supplied servers). */
     mcp: TaskSpec["mcp"];
+    /** The task's A2A peers: a frozen SNAPSHOT of `spec.a2a` whose `toolAxes` were judged here by the same reader and with the same
+     *  disposition as an MCP server's (a declaration that does not fit refused the whole prepare), each peer carrying the reader's plain
+     *  copy; `undefined` when the spec declares no peer (absent or empty). Read once, here: the peers dialed are the peers judged. */
+    a2a: TaskSpec["a2a"];
     /** Effective caller tool policy: the same `spec.toolPolicy ?? deps.toolPolicy` slot the gate has
      *  always enforced, resolved ONCE here. With `toolPolicy` locked, the deployment's own
      *  `deps.toolPolicy` is the whole answer (a spec-supplied policy has already been refused). */
@@ -56,12 +61,27 @@ export interface LockedPreflight {
      *  site). Unlocked: `spec.basePolicyForResumeEdit ?? deps.basePolicyForResumeEdit`. */
     basePolicyForResumeEdit: ToolPolicy | undefined;
 }
+/**
+ * How one configuration door is entered: `seat` names the input that carries the value the door judges — the task's configuration or the
+ * deployment's deps. A prepare enters each door as it stands ({@link ENTER_AS_IS}: the door's own coded throw); a resume's screen before the
+ * claim enters the same door through the resume's refusal channel, which names the seat (`asResumeConfigRefusal`). One door, one function,
+ * two entrances: the seat is written once, where the door is called.
+ */
+export type ConfigDoorEntry = <T>(seat: "taskConfig" | "deps", door: () => T) => T;
+export declare const ENTER_AS_IS: ConfigDoorEntry;
 /**
  * Validate a deployment's lock declaration against the closed registry. Fail-loud on any unknown
  * key (`config.locked_registry`): a security control that doesn't parse must refuse to arm, not
  * degrade to "that key silently unlocked". Exported for deployments that want the check at their
  * own startup; the task-preparation preflight runs it on every leg regardless (a mis-declared lock
- * then fails the first prepare instead of silently guarding nothing).
+ * then fails the first prepare instead of silently guarding nothing — and, on a resume, the screen before
+ * the claim, which calls the same preflight).
+ *
+ * Total over the declaration: anything but `undefined` (no locks) or plain data whose `keys` is a list of registry names — `null`, a
+ * list, a primitive, a `keys` that is absent or not a list, a declaration that is not plain data (a Proxy, a `Set` of keys, a class
+ * instance, a getter that throws), an element that is not a string, a string that is not a registry name — is the same coded refusal
+ * naming `RunnerDeps.lockedConfig` and the member (an element by its index), never a TypeError and never "no locks". The declaration is
+ * read once, by the one declaration reading.
  */
 export declare function resolveLockedKeys(config: LockedConfig | undefined): ReadonlySet<LockedKey>;
 /**
@@ -74,23 +94,33 @@ export declare function resolveLockedKeys(config: LockedConfig | undefined): Rea
  * read off a LIVE object is only true for as long as the object holds still, and the fail-open
  * direction is the reachable one — so both boundaries consume data instead.
  *
- * The read discipline is the load-bearing part, and it is why this is a spread rather than
- * "read the property, then copy the object": a getter answering ALTERNATING LEGAL values would
+ * The read discipline is the load-bearing part, and it is why the copy is made in the pass that reads
+ * rather than "read the property, then copy the object": a getter answering ALTERNATING LEGAL values would
  * satisfy any number of re-reads (`"external"` to a validator, `"local"` to a mint site), and no
- * vocabulary guard anywhere has purchase on a legal value. One spread evaluates every own property
- * EXACTLY ONCE and materializes the result as plain data; every later reader — validator, connect,
- * refresh — then sees the same byte. Frozen so nothing downstream rewrites it.
+ * vocabulary guard anywhere has purchase on a legal value. One pass evaluates every member EXACTLY ONCE
+ * and materializes the result as plain data; every later reader — validator, connect, refresh — then sees
+ * the same byte. Frozen so nothing downstream rewrites it.
+ *
+ * Plain data, stated: an entry IS plain data, to its whole depth, or it is refused whole. The entry is read
+ * by the one declaration reading ({@link receiveDeclaration} — the engine's one receipt of a caller's object,
+ * in its declaration mode): every own member read once off its captured descriptor, every level copied, every
+ * copied container frozen; an object the entry reaches through two members is read once, and both hold the one
+ * copy. So a server's `transport` with its `args` / `env` / `headers`, `allowTools`, `toolFaces`, `toolAxes`
+ * and a peer's `headers` and `allowSkills` are the copy's own, and a host that edits its own nested object after
+ * the door (a header value, an `allowSkills.push`) reaches nothing the engine holds: the dial, a refresh and a
+ * re-dial all work from this copy, on both surfaces. The axes are then judged on that copy by their own reader
+ * ({@link judgeEntryToolAxes}), and an MCP server's faces by theirs ({@link judgeEntryToolFaces}).
  *
- * Boundary, stated: the copy is one level deep — nested option objects (transport, headers, env,
- * toolAxes) stay shared with the caller's entry exactly as before, because the axis this owns is the
- * content class; readers of the nested shapes normalize their own values (the transport DISCRIMINATOR
- * is derived, never echoed raw). `toolAxes` is the one nested shape both entrances replace with its
- * reader's plain copy ({@link judgeEntryToolAxes}), and the one member this snapshot reads BY NAME rather
- * than by spread, once: a declaration an entry carries as a non-enumerable or inherited property would
- * otherwise vanish before any reader sees it, and an absent caller axis is a tightening lost, not a
- * fail-closed absence. Every other member is taken as own ENUMERABLE properties only: an entry whose
- * fields live on a prototype was never the plain configuration record this type describes, and its
- * absent class reads fail-closed like any other absence.
+ * There is no third outcome between "copied whole" and "refused": a value the copy cannot carry whole is a
+ * declaration the engine cannot read — a Proxy at any level, an object whose prototype is neither
+ * `Object.prototype` nor null (a class instance, a map, `process.env`, a record built on a prototype or in another
+ * realm, whose members a copy would drop or could not tell from its own), a function, a structure that contains
+ * itself, a getter that throws (whatever it throws), a nesting too deep to read, a list element that is not a
+ * string, a member named `__proto__`, an entry that is not an object. Each is refused as `config.invalid_argument`
+ * naming the declarer and the member where reading stopped (`toolFaces.write_file`, `allowTools[2]`), never as the
+ * raw error the host's code threw, and never by handing the host's object on: a member some of whose getters have
+ * already run would be read again downstream, and could answer differently. The door refuses the whole prepare and
+ * a library entrance the whole call, with this one sentence either way.
  *
  * Exported because the SECOND boundary needs the identical guarantee: `materializeMcpTools` is public
  * and a library caller reaches it without passing any door, so it snapshots its own input through
@@ -98,14 +128,64 @@ export declare function resolveLockedKeys(config: LockedConfig | undefined): Rea
  */
 export declare function snapshotMcpEntries(entries: readonly McpServerSpec[]): McpServerSpec[];
 /**
- * The `toolAxes` question for ONE snapshot entry — asked by the preparation door (a refusal ends the prepare) and by the materialization
- * entrance (a refusal fails that server's dial), so there is one reading, one copy and one sentence whichever time it is asked.
- * `ok: true` carries the entry with the reader's PLAIN COPY of the axes in place of the caller's object: what was judged is the very value
- * the connect and every refresh read, not a live object that could answer differently later. The copy is frozen with the entry — a tool
- * that shallow-copies a server (`mountedMcp()`) to customise its axes must not rewrite what the parent reads. `ok: false` carries the
- * coded refusal (`config.invalid_argument`) naming the server, the tool and the member, never a value.
+ * The refusal of a declaration the engine cannot read (`config.invalid_argument`). `declarer` is the entry's own name as the engine captured
+ * it ({@link capturedName}) — absent when there was none to capture — so a consumer that holds the refused entry by a name (the A2A
+ * entrance's warning, its collision check) takes it from here and never reads the caller's object again.
+ */
+export type DeclarationRefusal = Error & {
+    code: "config.invalid_argument";
+    declarer?: string;
+};
+/**
+ * The name a refused entry is held under by a consumer that holds it by a name (the A2A entrance): the refusal's own `declarer`, read as
+ * own data — never through anything the refusal's prototype carries — or `undefined` (the consumer names the entry by its place).
+ */
+export declare function refusedDeclarer(refusal: unknown): string | undefined;
+/**
+ * One entry of EITHER surface that declares `toolAxes` (an MCP server, an A2A peer) as frozen plain data, read by the discipline
+ * {@link snapshotMcpEntries} states: the entry and everything in it read once by the one declaration reading and copied to its whole
+ * depth, or the entry refused ({@link DeclarationRefusal}), naming the member where reading stopped. The A2A peer's door and its
+ * materialization snapshot through this same function, so the two surfaces' declarations reach the one judge ({@link judgeEntryToolAxes})
+ * read the same way; `at` is the surface the entry sits on, which only decides what the refusal calls the declarer.
+ */
+export declare function snapshotDeclaredEntry<E extends McpServerSpec | A2aServerSpec>(entry: E, at: ToolAxesSurface): E;
+/**
+ * The `toolAxes` question for ONE snapshot entry of either surface (`at`: an MCP server, an A2A peer) — asked by the preparation door (a
+ * refusal ends the prepare) and by each materialization entrance (a refusal fails that server's or that peer's dial), so there is one
+ * reading, one copy and one sentence whichever surface and whichever time it is asked. `ok: true` carries the entry with the reader's
+ * PLAIN COPY of the axes in place of the caller's object: what was judged is the very value the connect and every refresh read, not a
+ * live object that could answer differently later. The copy is frozen with the entry — a tool that shallow-copies a server
+ * (`mountedMcp()`) to customise its axes must not rewrite what the parent reads. `ok: false` carries the coded refusal
+ * (`config.invalid_argument`) naming the declarer, the tool (or skill) and the member, never a value.
+ */
+export declare function judgeEntryToolAxes<E extends McpServerSpec | A2aServerSpec>(copy: E, at: ToolAxesSurface): {
+    ok: true;
+    entry: E;
+} | {
+    ok: false;
+    error: Error & {
+        code: string;
+    };
+};
+/**
+ * The `toolFaces` question for ONE snapshot entry of an MCP server — asked by the preparation door and by the materialization entrance exactly
+ * as {@link judgeEntryToolAxes} asks its own, so the engine reads a face declaration one way (`readToolFaces`) and the mount consumes the copy
+ * that way gave it, never the caller's object: a mistyped member, an axis word written as a face member, a member of the wrong kind or an empty
+ * tool name is a refusal here, not a protection dropped in silence or a throw at the listing. `ok: true` carries the entry with the reader's
+ * frozen copy in place of the declaration (an empty record declares nothing and leaves no key); `ok: false` carries the coded refusal
+ * (`config.tool_face_invalid`) naming the server, the tool and the member.
  */
-export declare function judgeEntryToolAxes(copy: McpServerSpec): {
+export declare function judgeEntryToolFaces(copy: McpServerSpec): {
+    ok: true;
+    entry: McpServerSpec;
+} | {
+    ok: false;
+    error: Error & {
+        code: string;
+    };
+};
+/** Everything a snapshot MCP entry declares per tool, judged: its `toolAxes` ({@link judgeEntryToolAxes}), then its `toolFaces` ({@link judgeEntryToolFaces}). */
+export declare function judgeMcpEntryDeclarations(copy: McpServerSpec): {
     ok: true;
     entry: McpServerSpec;
 } | {
@@ -118,14 +198,13 @@ export declare function judgeEntryToolAxes(copy: McpServerSpec): {
  * The single preflight resolver: validate the lock declaration, refuse a spec that tries to occupy
  * a locked slot (`config.locked_key`, two-state — the whole prepare is rejected, nothing is
  * silently dropped or merged), and produce the resolved snapshot downstream assembly consumes.
- * Runs BEFORE any side effect of task preparation.
+ * Runs BEFORE any side effect of task preparation — and, on a resume, before the claim: the resume's
+ * screen calls this same function (`enter` naming each refusal's seat) and hands the leg the frozen
+ * entries it judged, so the leg's prepare judges engine-owned plain data and dials what was judged.
  */
-export declare function preflightLockedConfig(spec: TaskSpec, deps: RunnerDeps): LockedPreflight;
+export declare function preflightLockedConfig(spec: Pick<TaskSpec, "mcp" | "a2a" | "toolPolicy" | "basePolicyForResumeEdit">, deps: RunnerDeps, enter?: ConfigDoorEntry): LockedPreflight;
 /**
  * The two caller policies a prepare resolves to: the task's own seat over the deployment's, or the deployment's alone
- * under a `toolPolicy` lock. One resolution for the preflight above and for the resume ladder's pre-claim door.
+ * under a `toolPolicy` lock — one resolution, read by the preflight above (which a resume enters before its claim).
  */
 export declare function callerPolicySeats(spec: Pick<TaskSpec, "toolPolicy" | "basePolicyForResumeEdit">, deps: Pick<RunnerDeps, "toolPolicy" | "basePolicyForResumeEdit">, toolPolicyLocked: boolean): Pick<LockedPreflight, "toolPolicy" | "basePolicyForResumeEdit">;
-/** The retired-member door over the resolved caller policies: a member the engine no longer reads is refused by name
- *  (`config.deps_retired_key`), never dropped in silence. */
-export declare function assertCallerPoliciesCurrent(policies: Pick<LockedPreflight, "toolPolicy" | "basePolicyForResumeEdit">): void;

package/dist/core/locked-config.js

@@ -1,4 +1,8 @@
-import { readMcpToolAxes } from "./mcp-server-spec.js";
+import { types } from "node:util";
+import { DECLARATION_PATH_RULES, NO_DECLARATION_PATH_RULES, declarationFaultOf, declarerWord, readToolAxes, receiveDeclaration, toolAxesRefusal } from "./mcp-server-spec.js";
+import { isPlainRecord, receive } from "./mods/kernel/receive.js";
+import { readToolFaces } from "./tool-face-reader.js";
+import { CONFIG_RECEIPT_MODE } from "./own-property-receipt.js";
 import { isToolContentOrigin, TOOL_CONTENT_ORIGINS } from "./memory-engine/content-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { assertNoRetiredToolPolicyKeys } from "./retired-keys.js";
@@ -8,6 +12,7 @@ export const LOCKED_KEY_REGISTRY = {
     compliancePosture: { specFields: [] },
     retentionPolicy: { specFields: [] },
 };
+export const ENTER_AS_IS = (_seat, door) => door();
 function codedError(code, message) {
     const e = new Error(message);
     e.code = code;
@@ -17,21 +22,74 @@ export function resolveLockedKeys(config) {
     if (config === undefined)
         return new Set();
     const keys = new Set();
-    for (const key of config.keys) {
-        if (!Object.prototype.hasOwnProperty.call(LOCKED_KEY_REGISTRY, key)) {
-            throw codedError("config.locked_registry", `lockedConfig.keys contains "${String(key)}", which is not a member of the locked-key registry ` +
-                `(${Object.keys(LOCKED_KEY_REGISTRY).join(", ")}). A lock that does not parse must not half-arm — ` +
-                `fix the deployment's lock declaration.`);
+    const listed = declaredLockKeys(config);
+    for (let index = 0; index < listed.length; index++) {
+        const key = listed[index];
+        if (!Object.hasOwn(LOCKED_KEY_REGISTRY, key)) {
+            throw lockDeclarationRefusal(`RunnerDeps.lockedConfig.keys[${index}]`, `is ${inlineUntrusted(JSON.stringify(key), 80)}, which is not a member of the locked-key registry (${Object.keys(LOCKED_KEY_REGISTRY).join(", ")})`);
         }
         keys.add(key);
     }
     return keys;
 }
+function declaredLockKeys(config) {
+    const received = receiveDeclaration(config, NO_DECLARATION_PATH_RULES);
+    if (!received.ok)
+        throw lockDeclarationRefusal(memberPath(received.fault.path, "RunnerDeps.lockedConfig"), `cannot be read: ${received.fault.problem}`);
+    const copy = received.value;
+    if (!isPlainRecord(copy))
+        throw lockDeclarationRefusal("RunnerDeps.lockedConfig", `is ${inlineUntrusted(describeDeclared(copy), 80)}, not an object with a \`keys\` list`);
+    const keys = Object.hasOwn(copy, "keys") ? copy["keys"] : undefined;
+    if (!Array.isArray(keys))
+        throw lockDeclarationRefusal("RunnerDeps.lockedConfig.keys", `is ${inlineUntrusted(describeDeclared(keys), 80)}, not a list of locked keys`);
+    return keys;
+}
+function lockDeclarationRefusal(member, problem) {
+    return codedError("config.locked_registry", `${member} ${problem}. A lock that does not parse must not half-arm — fix the deployment's lock declaration.`);
+}
 export function snapshotMcpEntries(entries) {
-    return entries.map((entry) => {
-        const { toolAxes, ...rest } = entry;
-        return Object.freeze((toolAxes === undefined ? rest : { ...rest, toolAxes }));
-    });
+    return entries.map((entry) => snapshotDeclaredEntry(entry, "mcp"));
+}
+function memberPath(path, base = "") {
+    let rendered = base;
+    for (const key of path) {
+        const name = typeof key === "string" && /^\d+$/.test(key) ? JSON.stringify(key) : String(key);
+        rendered += typeof key === "number" ? `[${key}]` : rendered === "" ? name : `.${name}`;
+        if (rendered.length > 120 + base.length)
+            break;
+    }
+    return rendered;
+}
+function unreadableDeclaration(at, declarer, member, problem) {
+    const refusal = codedError("config.invalid_argument", `${declarerWord(at)}${declarer === undefined ? "" : ` ${declarerNameOf(declarer)}`} declares ${inlineUntrusted(member, 80)} the engine cannot read: ${problem}. A declaration the engine cannot read is refused ` +
+        `rather than partly applied — what the caller wrote and what the engine runs on would otherwise differ without anyone being told.`);
+    if (declarer !== undefined)
+        Object.defineProperty(refusal, "declarer", { value: declarer, enumerable: true, writable: false, configurable: false });
+    return refusal;
+}
+function ownDataString(holder, key) {
+    const slot = Object.getOwnPropertyDescriptor(holder, key);
+    const value = slot !== undefined && Object.hasOwn(slot, "value") ? slot.value : undefined;
+    return typeof value === "string" ? value : undefined;
+}
+export function refusedDeclarer(refusal) {
+    return typeof refusal === "object" && refusal !== null && !types.isProxy(refusal) ? ownDataString(refusal, "declarer") : undefined;
+}
+function capturedName(entry) {
+    return typeof entry === "object" && entry !== null && !types.isProxy(entry) ? ownDataString(entry, "name") : undefined;
+}
+function entryFaultRefusal(at, declarer, path, problem) {
+    return unreadableDeclaration(at, declarer, path.length === 0 ? "an entry" : memberPath(path), problem);
+}
+export function snapshotDeclaredEntry(entry, at) {
+    const declared = entry;
+    const declarer = capturedName(declared);
+    const received = receiveDeclaration(declared, DECLARATION_PATH_RULES[at]);
+    if (!received.ok)
+        throw entryFaultRefusal(at, declarer, received.fault.path, received.fault.problem);
+    if (!isPlainRecord(received.value))
+        throw unreadableDeclaration(at, declarer, "an entry", `it is ${inlineUntrusted(describeDeclared(received.value), 80)}, not an object`);
+    return received.value;
 }
 function describeDeclared(value) {
     try {
@@ -46,58 +104,117 @@ function describeDeclared(value) {
         }
     }
 }
-const serverNameOf = (copy) => inlineUntrusted(typeof copy.name === "string" ? JSON.stringify(copy.name) : describeDeclared(copy.name), 80);
-export function judgeEntryToolAxes(copy) {
+const declarerNameOf = (name) => inlineUntrusted(typeof name === "string" ? JSON.stringify(name) : describeDeclared(name), 80);
+export function judgeEntryToolAxes(copy, at) {
     const { toolAxes: declaredAxes, ...rest } = copy;
-    const axes = readMcpToolAxes(declaredAxes);
-    if (!axes.ok) {
-        return {
-            ok: false,
-            error: codedError("config.invalid_argument", `MCP server ${serverNameOf(copy)} declares toolAxes the engine cannot read: ${inlineUntrusted(axes.problem, 240)}. A per-tool safety-axis declaration is the ` +
-                `caller's trust root for the approval gate, so it is refused rather than partly applied — dropping one key or defaulting one word ` +
-                `would leave a declaration that reads as in force while it is not.`),
-        };
-    }
+    const axes = readToolAxes(declaredAxes, at);
+    if (!axes.ok)
+        return { ok: false, error: toolAxesRefusal(at, declarerNameOf(copy.name), axes.problem) };
     if (axes.toolAxes !== undefined) {
         for (const perTool of Object.values(axes.toolAxes))
             Object.freeze(perTool);
         Object.freeze(axes.toolAxes);
     }
-    return { ok: true, entry: Object.freeze(axes.toolAxes === undefined ? rest : { ...rest, toolAxes: axes.toolAxes }) };
+    return { ok: true, entry: Object.freeze((axes.toolAxes === undefined ? rest : { ...rest, toolAxes: axes.toolAxes })) };
+}
+function deepFrozen(value) {
+    if (typeof value === "object" && value !== null && !Object.isFrozen(value)) {
+        Object.freeze(value);
+        for (const member of Object.values(value))
+            deepFrozen(member);
+    }
+    return value;
 }
-function snapshotAndValidateMcpEntries(entries) {
-    return snapshotMcpEntries(entries).map((copy) => {
+function toolFacesRefusal(name, problem) {
+    return codedError("config.tool_face_invalid", `${declarerWord("mcp")} ${name} declares toolFaces the engine cannot read: ${inlineUntrusted(problem, 240)}. A per-tool face declaration is the deployment's own ` +
+        `narrowing (which argument names a tool's path, how a write is confined, which approval card and rule vocabulary the tool wears), so it is refused ` +
+        `rather than partly applied — a member dropped or a word defaulted would mount the tool without the protection its operator declared.`);
+}
+export function judgeEntryToolFaces(copy) {
+    const { toolFaces: declared, ...rest } = copy;
+    if (declared === undefined)
+        return { ok: true, entry: copy };
+    const faces = readToolFaces(declared);
+    if (!faces.ok)
+        return { ok: false, error: toolFacesRefusal(declarerNameOf(copy.name), faces.problem) };
+    return { ok: true, entry: Object.freeze((faces.faces === undefined ? rest : { ...rest, toolFaces: deepFrozen(faces.faces) })) };
+}
+export function judgeMcpEntryDeclarations(copy) {
+    const axes = judgeEntryToolAxes(copy, "mcp");
+    return axes.ok ? judgeEntryToolFaces(axes.entry) : axes;
+}
+function declaredEntriesOf(declared, at) {
+    const field = at;
+    const received = receive(declared, CONFIG_RECEIPT_MODE);
+    let problem;
+    if (received.ok) {
+        const list = received.value;
+        if (Array.isArray(list) && list !== declared)
+            return Array.from({ length: list.length }, (_, index) => list[index]);
+        problem = typeof list === "object" && list !== null ? "it is not an array" : `it is ${inlineUntrusted(describeDeclared(list), 80)}`;
+    }
+    else {
+        const fault = declarationFaultOf(received.fault);
+        if (fault.path.length > 0)
+            throw unreadableDeclaration(at, undefined, "an entry", fault.problem);
+        problem = fault.problem;
+    }
+    throw codedError("config.invalid_argument", `TaskSpec.${field} must be a readable array of ${declarerWord(at)} declarations; ${problem}. A list the engine cannot read ` +
+        `is refused rather than read as "no entries" — the declared ${declarerWord(at)}s would otherwise be dropped without anyone being told.`);
+}
+function snapshotAndValidateA2aEntries(declared) {
+    const entries = declaredEntriesOf(declared, "a2a");
+    if (entries.length === 0)
+        return undefined;
+    return entries.map((entry) => {
+        const judged = judgeEntryToolAxes(snapshotDeclaredEntry(entry, "a2a"), "a2a");
+        if (!judged.ok)
+            throw judged.error;
+        return judged.entry;
+    });
+}
+function snapshotAndValidateMcpEntries(declared) {
+    return snapshotMcpEntries(declaredEntriesOf(declared, "mcp")).map((copy) => {
         const declared = copy.contentOrigin;
         if (declared !== undefined && !isToolContentOrigin(declared)) {
-            throw codedError("config.mcp_content_class", `MCP server ${serverNameOf(copy)} declares contentOrigin ` +
+            throw codedError("config.mcp_content_class", `MCP server ${declarerNameOf(copy.name)} declares contentOrigin ` +
                 `${inlineUntrusted(describeDeclared(declared), 80)}, which is not one of ` +
                 `${TOOL_CONTENT_ORIGINS.map((v) => `"${v}"`).join(" | ")}. The declaration decides whether this server's tools ` +
                 `mark the session's memory externally exposed — a value this engine cannot read is refused at the door rather ` +
                 `than folded to a class, because folding it would let a deployment believe a declaration is in force while every ` +
                 `call keeps writing a one-way durable mark.`);
         }
-        const judged = judgeEntryToolAxes(copy);
+        const judged = judgeMcpEntryDeclarations(copy);
         if (!judged.ok)
             throw judged.error;
         return judged.entry;
     });
 }
-export function preflightLockedConfig(spec, deps) {
-    const lockedKeys = resolveLockedKeys(deps.lockedConfig);
-    for (const key of lockedKeys) {
-        for (const field of LOCKED_KEY_REGISTRY[key].specFields) {
-            if (spec[field] !== undefined) {
-                throw codedError("config.locked_key", `TaskSpec.${field} is administratively locked by this deployment (locked key "${key}") — ` +
-                    `the task-supplied value is refused wholesale (locks are config-time; there is no request-time ` +
-                    `unlock). Remove the field from the task, or change the deployment's lock configuration.`);
+export function preflightLockedConfig(spec, deps, enter = ENTER_AS_IS) {
+    const lockedKeys = enter("deps", () => resolveLockedKeys(deps.lockedConfig));
+    enter("taskConfig", () => {
+        for (const key of lockedKeys) {
+            for (const field of LOCKED_KEY_REGISTRY[key].specFields) {
+                if (spec[field] !== undefined) {
+                    throw codedError("config.locked_key", `TaskSpec.${field} is administratively locked by this deployment (locked key "${key}") — ` +
+                        `the task-supplied value is refused wholesale (locks are config-time; there is no request-time ` +
+                        `unlock). Remove the field from the task, or change the deployment's lock configuration.`);
+                }
             }
         }
-    }
-    const policies = callerPolicySeats(spec, deps, lockedKeys.has("toolPolicy"));
-    assertCallerPoliciesCurrent(policies);
+    });
+    const toolPolicyLocked = lockedKeys.has("toolPolicy");
+    const task = toolPolicyLocked ? {} : { toolPolicy: spec.toolPolicy, basePolicyForResumeEdit: spec.basePolicyForResumeEdit };
+    const policies = callerPolicySeats(task, deps, toolPolicyLocked);
+    enter(!toolPolicyLocked && task.toolPolicy != null ? "taskConfig" : "deps", () => assertNoRetiredToolPolicyKeys(policies.toolPolicy));
+    enter(!toolPolicyLocked && task.basePolicyForResumeEdit != null ? "taskConfig" : "deps", () => assertNoRetiredToolPolicyKeys(policies.basePolicyForResumeEdit));
+    const declaredServers = lockedKeys.has("mcp") ? undefined : spec.mcp;
+    const mcp = declaredServers === undefined ? undefined : enter("taskConfig", () => snapshotAndValidateMcpEntries(declaredServers));
+    const declaredPeers = spec.a2a;
     return {
         lockedKeys,
-        mcp: lockedKeys.has("mcp") || spec.mcp === undefined ? undefined : snapshotAndValidateMcpEntries(spec.mcp),
+        mcp,
+        a2a: declaredPeers === undefined ? undefined : enter("taskConfig", () => snapshotAndValidateA2aEntries(declaredPeers)),
         ...policies,
     };
 }
@@ -107,7 +224,3 @@ export function callerPolicySeats(spec, deps, toolPolicyLocked) {
         basePolicyForResumeEdit: toolPolicyLocked ? deps.basePolicyForResumeEdit : (spec.basePolicyForResumeEdit ?? deps.basePolicyForResumeEdit),
     };
 }
-export function assertCallerPoliciesCurrent(policies) {
-    assertNoRetiredToolPolicyKeys(policies.toolPolicy);
-    assertNoRetiredToolPolicyKeys(policies.basePolicyForResumeEdit);
-}

package/dist/core/lsp.d.ts

@@ -260,7 +260,7 @@ export interface LspServerManager {
      * ExecutionEnv (the SAME sandbox the agent runs in) — core passes it because a real in-env language
      * server must run inside that sandbox, and core already holds the per-task env at mount time. Supplying
      * it here means a manager can be **stateless** (it doesn't need a sessionId→env registry). It is
-     * optional/last for back-compat: a manager that resolves the env another way (e.g. a sessionId registry
+     * optional/last by contract: a manager that resolves the env another way (e.g. a sessionId registry
      * keyed off `executionEnvFactory`) may ignore it.
      */
     sessionFor(filePath: string, signal?: AbortSignal, env?: ExecutionEnv): Promise<LspSession | undefined>;

package/dist/core/mcp-probe.js

@@ -128,5 +128,5 @@ export async function probeMcpServers(specs, opts = {}) {
         fatal = { cause: abortCause(signal) };
     if (fatal !== undefined)
         throw fatal.cause;
-    return { entries: mcpManifestEntries(declared, statuses), servers };
+    return { entries: mcpManifestEntries(declared, statuses, servers.flatMap((s) => s?.tools ?? [])), servers };
 }