@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/runner/stream-steer-verb.js

@@ -6,7 +6,7 @@ import { classicEventBase, failedHandlerClause, screenUserPrompt } from "../mods
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
 import { injectionLaneOf, isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 import { deliverEngineNotice } from "../types.js";
-import { inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { inlineUntrusted, sanitizeUntrustedText, sentinelTagRefusal } from "../untrusted-text.js";
 import { announceAcceptance, armAcceptance, nextHumanInputSeq } from "./steer-admission.js";
 import { steerReplayRefusal } from "../steer-replay.js";
 export function streamSteerVerb(input) {
@@ -18,7 +18,7 @@ export function streamSteerVerb(input) {
         }
         const trusted = options?.trusted ? true : false;
         if (trusted && sanitizeUntrustedText(text) !== text) {
-            throw steeringError("trusted steering text must not contain a </system-reminder> tag", "steering.invalid_content");
+            throw steeringError(sentinelTagRefusal("trusted steering text"), "steering.invalid_content");
         }
         const inputId = options?.inputId;
         if (inputId !== undefined) {

package/dist/core/runner/sub-agent-deny-lists.d.ts

@@ -34,8 +34,9 @@
  * another spelling of a tool of the universe) — synchronous, like the phase that calls it.
  */
 import type { AgentTool } from "../../internal/harness.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 import { type ProtocolId } from "../protocol-table.js";
-import type { ToolLegKind, ToolSelector, ToolSelectorLayer } from "../tool-face.js";
+import type { ToolLegKind, ToolSelectorLayer } from "../tool-face.js";
 import { type ConstraintChainEntry } from "../tool-policy.js";
 import type { TaskSpec } from "../types.js";
 import type { CheckpointErrorReason } from "../checkpoint-store.js";
@@ -65,14 +66,15 @@ export declare function renamedDelegationMountSentence(...rosters: unknown[]): s
  */
 export declare function refuseRenamedDelegationMounts(...rosters: unknown[]): void;
 /**
- * THE reading of what the delegation tools a run mounts hand their children, read after the run's own selector: only a delegation
- * tool the selector leaves (`selector.admits`) counts — one it takes out hands nobody anything, and neither its pool names nor an
- * unlistable pool of it belong to any universe. The tools themselves, every pool tool's name and alias (a declared `extraToolNames`
- * roster included), and whether every one of those pools can be listed: a delegation tool whose factory injects tools per spawn with no
- * declared roster has no listable pool (the static `tools` it was given included), so a name outside the listed ones may be one of its
- * own. This is the one place the pool side of both universes is defined; the list judgment below and the policy name audit ask it.
+ * THE reading of what the delegation tools a run mounts hand their children, read after the run's own tool valve: only a delegation
+ * tool the valve leaves (`leaves`, the valve's one reading — `valveLeaves`) counts — one it takes out hands nobody anything, and neither
+ * its pool names nor an unlistable pool of it belong to any universe. The tools themselves, every pool tool's name and alias (a declared
+ * `extraToolNames` roster included), and whether every one of those pools can be listed: a delegation tool whose factory injects tools
+ * per spawn with no declared roster has no listable pool (the static `tools` it was given included), so a name outside the listed ones
+ * may be one of its own. This is the one place the pool side of both universes is defined; the list judgment below and the policy name
+ * audit ask it.
  */
-export declare function delegationPoolReading(callerTools: NonNullable<TaskSpec["tools"]>, selector: Pick<ToolSelector, "admits">): DelegationPoolReading;
+export declare function delegationPoolReading(callerTools: NonNullable<TaskSpec["tools"]>, leaves: ReturnType<typeof valveLeaves>): DelegationPoolReading;
 /** The arms of this module's `config.tool_face_control` refusal that a resume carries before the claim as `detail.reason` of a `checkpoint.config_refused` — the same words
  *  ({@link CheckpointErrorReason}): a list the row recorded that is not a list / has a member that is not a string / has a spelling no tool name can have / is not in the
  *  spelling a row records, a record that is not one, a renamed delegation mount, an occupied table of declared names. */
@@ -123,8 +125,8 @@ export declare function boundOwnToolLists(record: unknown, own: {
     readonly exclude: readonly string[] | undefined;
 }): RunInternals["ownToolLists"];
 export interface RunToolListsInput {
-    /** borrowed-readonly — the REBOUND spec: `agents` (the task's definitions) and `tools` (the caller's tools and the mounted delegation tools). */
-    spec: Pick<TaskSpec, "agents" | "tools">;
+    /** borrowed-readonly — the REBOUND spec: `agents` (the task's definitions), `tools` (the caller's tools and the mounted delegation tools) and `excludeAllTools` (the valve's whole-face switch, which takes the delegation tools out too). */
+    spec: Pick<TaskSpec, "agents" | "tools" | "excludeAllTools">;
     /** borrowed-readonly — the assembled mount array BEFORE the selector's valve (names + aliases = the roster half of the universe). */
     tools: ReadonlyArray<AgentTool>;
     /** borrowed-readonly — the peers the task declares, per protocol of the protocol table (its MCP servers, its A2A peers): a namespaced
@@ -170,5 +172,5 @@ export declare function judgeRunToolLists(input: RunToolListsInput): void;
  * `detail.reason: "near_miss"`) rather than kept as a deny that hides nothing. A name no tool answers to stays kept (a tool of that
  * name may be mounted later), unannounced: the host wrote no spec this leg could name the list of.
  */
-export declare function judgeHostToolCeiling(layers: readonly ToolSelectorLayer[], agent: Pick<TaskSpec, "tools" | "allowTools" | "excludeTools">, above?: readonly ToolSelectorLayer[]): void;
+export declare function judgeHostToolCeiling(layers: readonly ToolSelectorLayer[], agent: Pick<TaskSpec, "tools" | "allowTools" | "excludeTools" | "excludeAllTools">, above?: readonly ToolSelectorLayer[]): void;
 export {};

package/dist/core/runner/sub-agent-deny-lists.js

@@ -1,4 +1,4 @@
-import { compileToolSelector, deniedProtocolTools, delegationListWhere, isCanonicalToolName, isToolSelectorLayer, listReaches, notAListSentence, toolListsDigest, notAStringSentence, readAllowedToolList, readDeniedEntry, readDeniedToolList } from "../../agents/tool-filter.js";
+import { compileToolSelector, valveLeaves, deniedProtocolTools, delegationListWhere, isCanonicalToolName, isToolSelectorLayer, listReaches, notAListSentence, toolListsDigest, notAStringSentence, readAllowedToolList, readDeniedEntry, readDeniedToolList } from "../../agents/tool-filter.js";
 import { readToolNameList, valueTypeLabel } from "../tool-name-list.js";
 import { compileAllowList, inertEntryPhrase, renderListEntry, rootFacingToolNames } from "../allow-entry.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -37,8 +37,8 @@ export function refuseRenamedDelegationMounts(...rosters) {
 function poolOf(tools) {
     return { tools, names: mountedToolNames([...tools.map((t) => ({ name: t.name })), ...tools.flatMap((t) => t.agentToolPool ?? [])]), complete: tools.every((t) => t.agentToolPool !== undefined) };
 }
-export function delegationPoolReading(callerTools, selector) {
-    return poolOf(callerTools.filter((t) => t.agentToolFaces !== undefined && selector.admits(t)));
+export function delegationPoolReading(callerTools, leaves) {
+    return poolOf(callerTools.filter((t) => t.agentToolFaces !== undefined && leaves(t)));
 }
 function peersOf(known, declaredPeers) {
     const peers = new Set(PROTOCOL_TABLE.flatMap((ns) => (declaredPeers[ns.id] ?? []).map((p) => mintNamespacePrefix(ns, p.name))));
@@ -275,7 +275,8 @@ export function judgeRunToolLists(input) {
         const by = [...deniedBy(true, ownWhere ?? "this run's own excludeTools"), ...deniedBy(false, "an inherited list (the spawning run's excludeTools, or one it inherits)")];
         throw refused(`This kind of leg (${input.legs.join(", ")}) relies on ${names.join(", ")}, but ${by.join(" and ")} — the leg cannot work without ${one ? "it" : "them"}. Remove the entry from the list that names it.`, "config.tool_face_control", "protocol_denied");
     }
-    const pool = delegationPoolReading(spec.tools ?? [], compileToolSelector(input.layers, input.legs));
+    const selector = compileToolSelector(input.layers, input.legs);
+    const pool = delegationPoolReading(spec.tools ?? [], valveLeaves(spec, selector));
     const mounted = mountedToolNames([...tools, ...(spec.tools ?? [])]);
     if (!input.judgedUpstream) {
         const root = rootFacingUniverse(input.ownBy !== undefined ? new Set([...mounted, input.ownBy.toolName]) : mounted, pool, input.declaredPeers);
@@ -310,7 +311,8 @@ export function judgeHostToolCeiling(layers, agent, above = []) {
     layers.forEach((layer, i) => readSelectorLayer(layer, where(i), () => where(i), false));
     const callerTools = agent.tools ?? [];
     const own = { ...(agent.allowTools != null ? { allow: agent.allowTools } : {}), deny: agent.excludeTools ?? [] };
-    const pool = delegationPoolReading(callerTools, compileToolSelector([...above, ...layers, own], ["delegated"]));
+    const selector = compileToolSelector([...above, ...layers, own], ["delegated"]);
+    const pool = delegationPoolReading(callerTools, valveLeaves(agent, selector));
     const universe = rootFacingUniverse(mountedToolNames(callerTools), pool, { mcp: undefined, a2a: undefined });
     const unannounced = () => undefined;
     layers.forEach((layer, i) => {

package/dist/core/runner/synthetic-tools.d.ts

@@ -110,8 +110,11 @@ export interface SkillListingEntry {
  *  and the tool, so what the prompt promises is exactly what the tool serves. Each field is READ ONCE, BY NAME, and
  *  both consumers see the copy: the gate screens this list while the invoke substitutes from it, so a `get baseDir()`
  *  answering those two reads differently passed a screen that measured a value the model never received — and a rest
- *  copy would silently drop an INHERITED or non-enumerable list. The two tables are read by {@link readSkillTable}. */
-export declare function normalizeSkills(skills: SkillLike[] | undefined): SkillLike[];
+ *  copy would silently drop an INHERITED or non-enumerable list. The two tables are read by {@link readSkillTable}.
+ *
+ *  The sorted view of {@link readSkillsSeat} (skills-seat.ts), which holds the seat's one reading — total over what a caller can
+ *  hand it, and once. */
+export declare function normalizeSkills(skills: unknown): SkillLike[];
 /** [c209-C] The skills listing's lead line — single-sourced so the run loop's durable-resume
  *  transcript probe (MED-3② skills arm, runtask) matches EXACTLY what the initial frame carries
  *  (probing the bare `<skills>` fence would be more collision-prone in model-quoted text). */

package/dist/core/runner/synthetic-tools.js

@@ -5,6 +5,7 @@ import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } fr
 import { readSkillTable, skillNamedBy } from "../skill-grant.js";
 import { toolFace } from "../tool-catalog-entries.js";
 import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
+import { readSkillsSeat } from "./skills-seat.js";
 import { foldListingWithin } from "./listing-fold.js";
 export const OUTPUT_TOOL_NAME = "StructuredOutput";
 export const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
@@ -109,18 +110,7 @@ function skillFilesSuffix(files) {
     return ` [files: ${shown.join(", ")}${more > 0 ? `, +${more} more` : ""}]`;
 }
 export function normalizeSkills(skills) {
-    const seen = new Set();
-    const out = [];
-    for (const s of skills ?? []) {
-        if (!seen.has(s.name)) {
-            seen.add(s.name);
-            const { name, description, content, allowedTools, disallowedTools, files, baseDir, ...rest } = s;
-            void rest;
-            const [allowed, denied] = [readSkillTable(allowedTools), readSkillTable(disallowedTools)];
-            out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
-        }
-    }
-    return out.toSorted((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    return readSkillsSeat(skills).toSorted((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
 }
 export const SKILLS_LISTING_PROBE_HEADER = "The following skills are available for this task.";
 export function skillListingLine(s, descMaxChars = SKILL_LISTING_DESC_MAX_CHARS_DEFAULT) {

package/dist/core/runner/tool-face-overlay.d.ts

@@ -4,13 +4,15 @@
  * tool name like `allowTools` / `toolAxes`). Validated against the MATERIALIZED schema at every listing
  * (the first mount and every RefreshMcpTools): `pathTarget.param` must be a top-level property; an
  * `approvalCard` must find the keys the card needs; a `ruleFace` may only name scalar keys; `family`
- * must be a member of the closed set. A failing overlay does NOT mount — the tool mounts BARE (no
+ * must be a member of the closed set; every `resultCards` entry must live under the tool's own card namespace.
+ * A failing overlay does NOT mount — the tool mounts BARE (no
  * face) and the leg announces `config.tool_face_invalid` once per tool; a `toolFaces` key naming a
  * tool the listing does not carry announces `config.tool_face_undeclared` once per name. Never a
  * silent partial application: an overlay is one declaration, applied whole or not at all.
  *
  * Prepare-path machinery (layer 1): pure over the tool objects and the server specs; the notice sink
- * is a parameter.
+ * is a parameter. The declaration itself is read once, by `readToolFaces` (`core/tool-face-reader.ts`), at the preparation door and at the
+ * materialization entrance; the specs this file consumes carry that reader's copy, never the caller's object.
  */
 import type { AgentTool } from "../../internal/harness-types.js";
 import type { McpServerSpec } from "../mcp-server-spec.js";
@@ -20,10 +22,24 @@ import { type EngineNotice } from "../engine-notice.js";
  *  card's full schema; this is the pre-filter the overlay is validated against). */
 export declare const APPROVAL_CARD_REQUIRED_KEYS: Readonly<Record<ToolApprovalCard, readonly string[]>>;
 export type McpToolFace = NonNullable<McpServerSpec["toolFaces"]>[string];
-/** Why an overlay is refused — a closed reason list, each a distinct declaration mistake. */
-export declare function toolFaceProblem(face: McpToolFace, schema: AgentTool["parameters"], tool?: {
+/** The tool a face rides on, as far as the judge needs to know it: its name (a reserved approval card belongs to the engine's own tool of that
+ *  name) and, when the caller holds the tool's card namespace, the `cardId` its `resultCards` must live under (`<cardId>/<card>`). */
+export interface FaceTool {
     readonly toolName: string;
-}): string | undefined;
+    readonly cardId?: string;
+}
+/** Why an overlay is refused — a closed reason list, each a distinct declaration mistake. */
+export declare function toolFaceProblem(face: McpToolFace, schema: AgentTool["parameters"], tool?: FaceTool): string | undefined;
+/**
+ * The one judge of a face. With the tool's materialized `schema` it is {@link toolFaceProblem}: the declaration against the
+ * schema it rides on. With no schema it is the same judge over the DECLARATION ALONE (`readToolFaces`, `core/tool-face-reader.ts`): every
+ * check that needs the schema's keys (a path target's `param` / `patternParam`, an approval card's required keys, the names a summary or a
+ * rule face lists) waits for the listing; the closed words, the bounds and the cross-member rules do not need it and are the same
+ * checks, in the same order, with the same sentences. A face this judges is a well-typed one (the reader types it first). A tool that
+ * holds its card namespace (`tool.cardId`) has its `resultCards` held to it here too, so a caller's face and a server's face are
+ * judged by this one function, not by a rule beside it.
+ */
+export declare function faceProblem(face: McpToolFace, schema: AgentTool["parameters"] | undefined, tool?: FaceTool): string | undefined;
 export interface ApplyToolFacesInput {
     /** The materialized tools of ONE server (namespaced names). */
     tools: readonly AgentTool[];
@@ -38,5 +54,7 @@ export interface ApplyToolFacesInput {
  *  untyped carry `defineTool` uses, so the roster reads it off the instance). A face that does NOT fit the materialized
  *  schema is a bad declaration: the tool is NOT mounted on this leg (announced once, `config.tool_face_invalid`) —
  *  mounting it bare would silently drop the write protection the operator declared for it (an MCP name has no catalog
- *  floor), and a schema refresh that invalidates only a display hint must fail loud, never open. */
+ *  floor), and a schema refresh that invalidates only a display hint must fail loud, never open. The faces it reads are the
+ *  server entry's own: the reader's copy of the declaration (`readToolFaces`), put there by the preparation door or the
+ *  materialization entrance, never a caller's object. */
 export declare function applyMcpToolFaces(input: ApplyToolFacesInput): AgentTool[];

package/dist/core/runner/tool-face-overlay.js

@@ -1,7 +1,8 @@
 import { MCP_NAMESPACE } from "../protocol-table.js";
 import { mintNamespacePrefix } from "../protocol-naming.js";
 import { RESERVED_APPROVAL_CARDS, TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_PATH_ABSENCES, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_KEY_MAX_CHARS, } from "../tool-face.js";
-import { engineCardOf, inputKeysOf } from "../tool-roster.js";
+import { engineCardOf, inputKeysOf, offendingResultCard, protocolToolOf, rosterCardId } from "../tool-roster.js";
+import { engineCardTypes } from "../tool-registry.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 export const APPROVAL_CARD_REQUIRED_KEYS = Object.freeze({
     "file-edit": ["file_path"],
@@ -14,17 +15,20 @@ export const APPROVAL_CARD_REQUIRED_KEYS = Object.freeze({
     generic: [],
 });
 export function toolFaceProblem(face, schema, tool) {
-    const { keys, scalar } = inputKeysOf(schema);
-    const top = new Set(keys.map((k) => k.name));
+    return faceProblem(face, schema, tool);
+}
+export function faceProblem(face, schema, tool) {
+    const bound = schema === undefined ? undefined : inputKeysOf(schema);
+    const top = bound === undefined ? undefined : new Set(bound.keys.map((k) => k.name));
     if (face.family !== undefined && !TOOL_FAMILIES.includes(face.family))
         return `family ${JSON.stringify(face.family)} is outside the closed set`;
     const overlong = (label, values) => {
         const k = values.find((v) => v.length > TOOL_KEY_MAX_CHARS);
         return k === undefined ? undefined : `${label} ${JSON.stringify(k.slice(0, 40) + "…")} is ${k.length} characters; a roster key is at most ${TOOL_KEY_MAX_CHARS}`;
     };
-    const vocabulary = new Set(scalar);
+    const vocabulary = new Set(bound?.scalar);
     if (face.pathTarget !== undefined) {
-        if (typeof face.pathTarget.param !== "string" || !top.has(face.pathTarget.param))
+        if (top !== undefined && (typeof face.pathTarget.param !== "string" || !top.has(face.pathTarget.param)))
             return `pathTarget.param ${JSON.stringify(face.pathTarget.param)} is not a top-level property of the tool's schema`;
         if (!TOOL_PATH_ACCESSES.includes(face.pathTarget.access))
             return `pathTarget.access ${JSON.stringify(face.pathTarget.access)} is outside the closed set`;
@@ -40,7 +44,7 @@ export function toolFaceProblem(face, schema, tool) {
             return `pathTarget.absent "base" needs pathTarget.access "read" — it says the call is about the whole base directory when the slot is empty, which is a search SCOPE; a write with no path names no file, and the containment fences judge a write on its own target`;
         const patternParam = face.pathTarget.patternParam;
         if (patternParam !== undefined) {
-            if (typeof patternParam !== "string" || !top.has(patternParam))
+            if (top !== undefined && (typeof patternParam !== "string" || !top.has(patternParam)))
                 return `pathTarget.patternParam ${JSON.stringify(patternParam)} is not a top-level property of the tool's schema`;
             if (absent !== "base")
                 return `pathTarget.patternParam ${JSON.stringify(patternParam)} is declared but pathTarget.absent is ${JSON.stringify(absent ?? "none")} — the pattern base is only ever read for an absent slot, so this declaration would be inert`;
@@ -62,7 +66,7 @@ export function toolFaceProblem(face, schema, tool) {
                 return `renderHints.approvalCard ${JSON.stringify(card)} is outside the closed set`;
             if (RESERVED_APPROVAL_CARDS.includes(card) && (tool === undefined || engineCardOf(tool) !== card))
                 return `renderHints.approvalCard ${JSON.stringify(card)} is reserved for the engine's own tool that owns it; a declared tool takes another card or none`;
-            const missing = APPROVAL_CARD_REQUIRED_KEYS[card].filter((k) => !top.has(k));
+            const missing = top === undefined ? [] : APPROVAL_CARD_REQUIRED_KEYS[card].filter((k) => !top.has(k));
             if (missing.length > 0)
                 return `renderHints.approvalCard ${JSON.stringify(card)} needs ${missing.join(", ")} on the tool's schema`;
         }
@@ -77,16 +81,21 @@ export function toolFaceProblem(face, schema, tool) {
         const long = overlong("renderHints.summaryParams", hints.summaryParams ?? []) ?? overlong("renderHints.resultCards", hints.resultCards ?? []);
         if (long !== undefined)
             return long;
-        const stray = (hints.summaryParams ?? []).find((p) => !top.has(p));
+        const foreignCard = tool?.cardId === undefined ? undefined : offendingResultCard(hints, tool.cardId, engineCardTypes());
+        if (foreignCard !== undefined)
+            return `renderHints.resultCards names ${JSON.stringify(foreignCard.slice(0, 80))}, outside the tool's own card namespace "${tool.cardId}/<card>" (engine cards and other contracts' namespaces are reserved)`;
+        const stray = top === undefined ? undefined : (hints.summaryParams ?? []).find((p) => !top.has(p));
         if (stray !== undefined)
             return `renderHints.summaryParams names ${JSON.stringify(stray)}, which is not a top-level property`;
     }
-    for (const p of face.ruleFace?.params ?? [])
-        if (!vocabulary.has(p))
-            return `ruleFace.params names ${JSON.stringify(p)}, which is neither a scalar top-level property nor the declared path target`;
-    for (const p of face.ruleFace?.primaryParams ?? [])
-        if (!vocabulary.has(p))
-            return `ruleFace.primaryParams names ${JSON.stringify(p)}, which is neither a top-level property nor the declared path target`;
+    if (top !== undefined) {
+        for (const p of face.ruleFace?.params ?? [])
+            if (!vocabulary.has(p))
+                return `ruleFace.params names ${JSON.stringify(p)}, which is neither a scalar top-level property nor the declared path target`;
+        for (const p of face.ruleFace?.primaryParams ?? [])
+            if (!vocabulary.has(p))
+                return `ruleFace.primaryParams names ${JSON.stringify(p)}, which is neither a top-level property nor the declared path target`;
+    }
     const long = overlong("ruleFace.params", face.ruleFace?.params ?? []) ?? overlong("ruleFace.primaryParams", face.ruleFace?.primaryParams ?? []);
     if (long !== undefined)
         return long;
@@ -121,7 +130,7 @@ export function applyMcpToolFaces(input) {
         if (raw === undefined || face === undefined)
             return t;
         const hit = { raw, face };
-        const problem = toolFaceProblem(hit.face, t.parameters, { toolName: t.name });
+        const problem = toolFaceProblem(hit.face, t.parameters, { toolName: t.name, cardId: rosterCardId("mcp", t.name, input.server.name, protocolToolOf(t.name), "") });
         if (problem !== undefined) {
             const key = `invalid:${t.name}`;
             if (!input.announced.has(key)) {

package/dist/core/runner-deps.d.ts

@@ -14,7 +14,7 @@ import type { OnElicit } from "./mcp-server-spec.js";
 import type { Brain, ModelRef, ModelRoles } from "./model-seat.js";
 import type { RuntimeCaps, WorkflowGovernanceBaseline } from "./runtime-caps.js";
 /**
- * parity-204 — structured `RunnerDeps.loadProjectMemory` return (backward-compatible: a bare
+ * parity-204 — structured `RunnerDeps.loadProjectMemory` return (backward-compatible, RL-1336-project-memory-bare: a bare
  * `string | null` keeps its exact historical meaning). Adds the CC 2.1.204 `seededFromContext`
  * seam (cc204-bundle @17917159: CC preloads readFileState for CLAUDE.md/nested-memory files it
  * placed in context, and a DEFAULT whole-file Read of an unchanged seeded file answers with the
@@ -73,8 +73,8 @@ export interface ResumePreflightInfo {
      *  the resume entry's identity-continuity rung already refused a contradicting supplied principal
      *  before this hook runs, so a present value IS the resumed leg's identity. */
     principal?: string;
-    /** provider / deviceId / mountPath — the placement facts. */
-    workspaceHandle?: import("./remote-env.js").WorkspaceHandle;
+    /** provider / deviceId / mountPath — the placement facts: the row handle's one frozen copy (as `resumeWorkspace`, `priorHandle`). */
+    workspaceHandle?: Readonly<import("./remote-env.js").WorkspaceHandle>;
     gateKind: import("./checkpoint-store.js").CheckpointGate["kind"];
 }
 /** design/380 O2 — a {@link RunnerDeps.resumePreflight} answer. */
@@ -141,10 +141,8 @@ export interface RunnerDeps {
      * probe must not brick every MCP call) with a once-per-MATERIALIZATION `mcp.revocation_probe_failed`
      * notice (a resume re-materializes and may announce again — the standing condition is re-news at
      * each fresh mount, never per-call). The notice is a deployment wiring fact: `detail: { message }`
-     * only, no session attribution, `"operator"` audience by its explicit {@link NOTICE_AUDIENCE}
-     * row (#433 made the registry total over the catalog — no engine-minted code is
-     * audience-defaulted any more) — a
-     * wire projector forwards it operator-tier and needs no per-session de-duplication of its own.
+     * only, no session attribution, `"operator"` audience by its explicit {@link NOTICE_AUDIENCE} row — a wire projector
+     * forwards it operator-tier and needs no per-session de-duplication of its own.
      * The probe's second argument, `{ fingerprint }`, is passed exactly when the server's declaration carries one.
      */
     mcpRevocations?: import("./mcp-server-spec.js").McpRevocationLedger;
@@ -159,10 +157,11 @@ export interface RunnerDeps {
      */
     rosterStore?: import("../agents/roster-store.js").RosterStore;
     /**
-     * The center prompt-artifact source (artifact v2 only — INTEGRATION-CORE §12.11). `current()` supplies the verified
-     * candidate a top-level session adopts at session start and at a compaction; `get(digest)` resolves a PINNED center
+     * The center prompt-artifact source (artifact v3 only — a v2 body is refused `schema`, INTEGRATION-CORE §12.11).
+     * `current()` supplies the verified candidate a top-level session adopts at session start and at a compaction; `get(digest)` resolves a PINNED center
      * layer on resume (a miss is fail-loud `prompt.snapshot_unavailable` — core never recomposes a hybrid from newer
-     * content); `sourceState()` is the tri-state every adoption decision keys on. What a source hands a run is re-checked
+     * content; a copy the engine refuses is told apart from a missing one, in the failure's sentence and on `onError`);
+     * `sourceState()` is the tri-state every adoption decision keys on. What a source hands a run is re-checked
      * before it is adopted. Core bundles `CenterPromptSource` (+ memory/file artifact & source-state stores); a server
      * feeds it published artifacts via `applySnapshot`. Omitted = no center layer.
      */
@@ -341,6 +340,9 @@ export interface RunnerDeps {
      * to CONTINUE instead — zero capture and zero out-of-policy running, availability paid).
      */
     memoryCapturePolicy?: "open" | "governed" | "capture-required";
+    /** The deployment's cross-boundary posture, one of {@link import("./cross-boundary-taint.js").CROSS_BOUNDARY_POSTURES} (who is hurt when a tree that
+     *  executes on a target device reaches past it). Absent reads `"single_user"`; any other value refuses the prepare, and a resume before its claim (`config.cross_boundary_posture`). */
+    crossBoundaryPosture?: "single_user" | "multi_tenant";
     /**
      * design/383 §2.1b — an optional host-supplied carrier for the session capture opt-out record
      * (per memory plane, keyed by that plane's control dir). Absent = the control-plane file trio
@@ -961,6 +963,19 @@ export interface RunnerDeps {
      * everywhere (mode parity, the CC default). Inert without {@link peerDirectory}.
      */
     crossSessionInbound?: import("../agents/cross-session-judge.js").CrossSessionInboundSettingLayers | (() => import("../agents/cross-session-judge.js").CrossSessionInboundSettingLayers);
+    /**
+     * WHO consumes this deployment's principal inbox (`principal.inbox`, where the
+     * organization's delivery gate appends cross-principal letters; the mailbox contract's fourth chain).
+     * Absent = no consumer, no lane (byte for byte as before); a deployment that mounts a gate DECLARES
+     * `{ assistant: "<agent handle>" }` (the scope's assistant is the only consumer; no terminal leg touches the
+     * box). `"terminals"` (each terminal drains the box as a second lane) is refused until held decisions are
+     * shared across terminals (`detail.reason: "terminals_unsupported"`). Letters are judged on the principal's
+     * `crossSessionInbound` layers (managed, user), held when unset. ANY other value fails the prepare of a leg
+     * that drains a session box with `config.principal_inbox_consumer_invalid` (`detail.reason: "malformed"`).
+     */
+    principalInboxConsumer?: "terminals" | {
+        assistant: string;
+    };
     /**
      * design/385 §4.4 (slice 4) — this deployment's `dialogExpiry` (CC settings key, verbatim vocabulary
      * `"60s" | "5m" | "10m" | "never"`, default `"5m"`): how long a HELD cross-session message whose cause
@@ -1286,18 +1301,18 @@ export interface RunnerDeps {
      *   summaries) is invisible without this and lets a session grow until it tops the window.
      * - `"prompt-cache"` — a prefix-cache hazard on the wire: a detected cache break (design/31), or a
      *   mis-declared/mismatched `promptCacheFamily`. The prefix cache will miss. Log/alert on both.
-     * - `"prompt-constitution"` — a prompt overlay did not take effect as written: a later source (or a later
-     *   declaration in the same source) superseded it on the same target, its target was not in this run's
-     *   prompt, or a mods handler's `prompt.compose` answer was skipped (it rewrote another's overlay, or wrote
-     *   what the band table does not grant its seat). Each overlay is named once per run.
-     * - `"degraded"` — the task kept running with a capability quietly reduced: a question auto-answered
-     *   with no human present, a skipped env git snapshot, a lost checkpoint-put confirmation, an
-     *   unroutable descendant notification, and similar best-effort arms. The run proceeds; the reduced
-     *   arm is what is being disclosed (`classification` names it).
-     * - `"config"` — a deployment-wiring problem detected while preparing or tearing down a task: tool
-     *   mount conflicts, refused/ignored knob values, gate-off notices, store/env teardown legs. The
-     *   broadest class by call-site count — most misconfigurations announce here rather than failing
-     *   the task.
+     * - `"prompt-constitution"` — a prompt overlay did not take effect as written: a later source (or a later declaration in the same source) superseded
+     *   it on the same target, its target was not in this run's prompt, or a mods handler's `prompt.compose` answer was skipped (it rewrote another's
+     *   overlay, or wrote what the band table does not grant its seat); each overlay is named once per run. The center prompt too: a pinned session's
+     *   stored artifact refused or unreadable (it fails `prompt.snapshot_unavailable`), a fresh session's candidate that does not verify, and a
+     *   `CenterPromptSource` boot restore with no usable copy (`sessionId: ""`, `classification: "center-source-restore"`) — that last line only when the
+     *   host passes this same sink to `CenterPromptSource` as its own `onError` (the source restores at boot, apart from any Runner; given none, it is silent).
+     * - `"degraded"` — the task kept running with a capability quietly reduced: a question auto-answered with no human
+     *   present, a skipped env git snapshot, a lost checkpoint-put confirmation, an unroutable descendant notification, and
+     *   similar best-effort arms. The run proceeds; the reduced arm is what is being disclosed (`classification` names it).
+     * - `"config"` — a deployment-wiring problem detected while preparing or tearing down a task: tool mount conflicts,
+     *   refused/ignored knob values, gate-off notices, store/env teardown legs. The broadest class by call-site count — most
+     *   misconfigurations announce here rather than failing the task.
      * - `"memory"` — a post-task memory-consolidation pass failed or skipped a malformed reconcile
      *   decision (design/41). Best-effort: the notes the model saved are kept; the task still succeeds.
      * - `"mcp"` — an MCP server failed to connect / list its tools and was skipped (fail-open, design/29);

package/dist/core/session-policy-store.d.ts

@@ -27,6 +27,7 @@
  *   chain); the real isolation boundary is the executionEnv, never these rules.
  */
 import { compileAllowList, type AllowEntryInert, type AllowEntryInertDetail, type AllowEntryInertReason } from "./allow-entry.js";
+import type { EngineNotice } from "./engine-notice.js";
 /** The per-session rules. All optional; an absent bucket imposes no constraint of that kind. */
 export interface SessionPermissionRules {
     /** If set, ONLY the calls these entries admit are allowed — a narrowing allowlist: a call no entry admits is refused.
@@ -244,6 +245,24 @@ export declare function compileSessionRuleBucket(rules: SessionRulesInGrammar, f
  * to make a parenthesized one the rule it now spells, or (`*`, which is no allow rule in any grammar) to leave it out.
  */
 export declare function earlierGrammarAdvisory(sessionId: string, entries: readonly string[], field: SessionRuleEntryField, grammar: number): string;
+/** The reader's word for one entry an earlier grammar reads as nothing: `no_rule` — this engine's rule grammar reads it as no
+ *  rule; `named_no_tool` — a grammar-0 allow entry the bare-name comparison of its day read as naming no tool. */
+export type EarlierGrammarReader = "no_rule" | "named_no_tool";
+/**
+ * The notice for the entries of one bucket a stored row's earlier grammar reads as nothing (`config.session_rules_earlier_grammar`,
+ * audience `user` — the session's rules are what the person's calls are judged by): the message is {@link earlierGrammarAdvisory}
+ * verbatim, and `detail` carries the same facts for a machine — `bucket` (the field), `storedGrammar` (the row's), `entries` (every
+ * entry, each as `noticeRuleText` hands rule text to a notice, with its reader's word), `rewrite` (the way out: an operator write of
+ * a new value without the stored row's rev, which stamps `stampsGrammar`), `rulesSessionId` (whose rules — an ancestor's on a
+ * delegated child's inherited layer) and `sessionId` (the run that read them).
+ */
+export declare function earlierGrammarNotice(input: {
+    rulesSessionId: string;
+    sessionId: string;
+    entries: readonly string[];
+    field: SessionRuleEntryField;
+    grammar: number;
+}): EngineNotice;
 /** The clause a run-time refusal carries when the allowlist it judged by holds entries its earlier grammar reads as nothing
  *  ({@link compileSessionRuleBucket}; `grammar` = the row's): the grammar the rules are stored in, then which entries name no tool
  *  there (grammar 0: `*` by its spelling, the parenthesized ones counted) and how many this engine's grammar reads as no rule —

package/dist/core/session-policy-store.js

@@ -4,6 +4,7 @@ import { NAMESPACED_NAME_SHAPES } from "./protocol-table.js";
 import { callerToolNameProblem } from "./caller-tool-name.js";
 import { compileAllowList, compiledEntryName, inertEntryPhrase, readRuleEntry, renderListEntry, rootFacingToolNames } from "./allow-entry.js";
 import { valueTypeLabel } from "./tool-name-list.js";
+import { noticeRuleText } from "./permission-rule-model.js";
 const SESSION_RULE_BUCKETS = { toolAllow: "allow", toolDeny: "deny", allowDirs: "dirs" };
 const BUCKETS = Object.keys(SESSION_RULE_BUCKETS);
 const ENTRY_FIELDS = BUCKETS.filter((f) => SESSION_RULE_BUCKETS[f] !== "dirs");
@@ -162,11 +163,30 @@ function shownEntries(entries, render) {
 }
 const REWRITE_THROUGH = `through this engine (an operator write of a new value without the stored row's rev; the write stamps grammar ${SESSION_RULES_GRAMMAR})`;
 export function earlierGrammarAdvisory(sessionId, entries, field, grammar) {
-    const noRule = entries.filter((e) => readsAsNoRule(e, field));
-    const namedNoTool = entries.filter((e) => !readsAsNoRule(e, field));
+    const read = earlierGrammarReadings(entries, field);
+    const noRule = read.filter((r) => r.reader === "no_rule").map((r) => r.entry);
+    const namedNoTool = read.filter((r) => r.reader === "named_no_tool").map((r) => r.entry);
     const sentences = [...(namedNoTool.length > 0 ? [namedNoToolInGrammar0(namedNoTool)] : []), ...(noRule.length > 0 ? [noRuleInThisGrammar(noRule, field, grammar)] : [])];
     return `session permission rules of session ${JSON.stringify(sessionId)}: ${sentences.join(" ")}`;
 }
+function earlierGrammarReadings(entries, field) {
+    return entries.map((entry) => ({ entry, reader: readsAsNoRule(entry, field) ? "no_rule" : "named_no_tool" }));
+}
+export function earlierGrammarNotice(input) {
+    const { rulesSessionId, sessionId, entries, field, grammar } = input;
+    return {
+        code: "config.session_rules_earlier_grammar",
+        message: earlierGrammarAdvisory(rulesSessionId, entries, field, grammar),
+        detail: {
+            bucket: field,
+            storedGrammar: grammar,
+            entries: earlierGrammarReadings(entries, field).map((r) => ({ entry: noticeRuleText(r.entry), reader: r.reader })),
+            rewrite: { by: "operator_write_without_rev", stampsGrammar: SESSION_RULES_GRAMMAR },
+            rulesSessionId,
+            sessionId,
+        },
+    };
+}
 function namedNoToolInGrammar0(entries) {
     const one = entries.length === 1;
     const wildcard = entries.some(readsAsWildcard);

package/dist/core/session-store.d.ts

@@ -1,4 +1,4 @@
-import { type SessionRepo } from "../internal/harness.js";
+import { type SessionPlacementRecord, type SessionRepo } from "../internal/harness.js";
 import { type AcquiredSession, type PlacedSessionRow, type SessionPlacement, type SessionStore, type SessionStoreSummary } from "./session.js";
 import type { StoreDurability } from "./checkpoint-store.js";
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
@@ -52,6 +52,37 @@ export interface TtlSessionStoreOptions {
         };
     };
 }
+/**
+ * The one placement admission of a session store's `acquire` — every backend that declares the placement partition
+ * judges each resolved session through it (this module's {@link TtlSessionStore} on its four resolution paths: cache
+ * hit, pending-promise inherit, open, idempotent re-create), so no backend writes the two directions a second time.
+ *
+ * Placement obligation 6 (claim closure): an EXISTING placed session refuses the claim-form
+ * acquire — no `requireExisting` (the read/revive form, obligation 5) and no creation placement
+ * (the trusted-internals form; the creating call and its dedup/retry re-acquires stay legal, and
+ * placement immutability means the argument can never REWRITE anything — the persisted tuple wins).
+ *
+ * …and the MIRROR direction (the pre-claim SQUAT race): the child session id is
+ * published on the spawn frame BEFORE the child's prepare creates the session, so a concurrent
+ * claim-form acquire could win first creation and hand the trusted placement caller an ORDINARY
+ * session — host-listable, never really-deleted, the declared full tier falsified in silence. On
+ * a store that DECLARES the partition (`capability.subagentPlacement`; an ignoring store legally drops
+ * placements), an acquire carrying a placement must therefore come back with a PERSISTED tuple whose
+ * join identity matches the declaration — a missing or foreign tuple refuses loudly.
+ *
+ * @param persisted the tuple the backend holds for `sessionId` as resolved (`undefined`: an unplaced session).
+ * @param request the `acquire` options the caller passed.
+ * @param capability whether the store declares the subagent placement partition. `subagentPlacement` is read once,
+ *   and only when the mirror direction is judged (a placement request that is not the read form, after `request`'s
+ *   members are read), so a store may pass a getter over its live declaration.
+ * @throws SessionError `placement_refused` on either direction; returns nothing when admitted.
+ */
+export declare function admitSessionPlacement(sessionId: string, persisted: SessionPlacementRecord | undefined, request: {
+    requireExisting?: boolean;
+    placement?: SessionPlacement;
+}, capability: {
+    subagentPlacement: boolean;
+}): void;
 /**
  * TTL-cached {@link SessionStore} over a pluggable {@link SessionRepo}.
  *
@@ -120,21 +151,9 @@ export declare class TtlSessionStore implements SessionStore {
         requireExisting?: boolean;
         placement?: SessionPlacement;
     }): Promise<AcquiredSession>;
-    /**
-     * Placement obligation 6 (claim closure): an EXISTING placed session refuses the claim-form
-     * acquire — no `requireExisting` (the read/revive form, obligation 5) and no creation placement
-     * (the trusted-internals form; the creating call and its dedup/retry re-acquires stay legal, and
-     * placement immutability means the argument can never REWRITE anything — the persisted tuple wins).
-     *
-     * …and the MIRROR direction (the pre-claim SQUAT race): the child session id is
-     * published on the spawn frame BEFORE the child's prepare creates the session, so a concurrent
-     * claim-form acquire could win first creation and hand the trusted placement caller an ORDINARY
-     * session — host-listable, never really-deleted, the declared full tier falsified in silence. On
-     * a store that DECLARES the partition (an ignoring store legally drops placements), an acquire
-     * carrying a placement must therefore come back with a PERSISTED tuple whose join identity
-     * matches the declaration — a missing or foreign tuple refuses loudly, on every resolution path
-     * (cache hit, pending-promise inherit, open, idempotent re-create).
-     */
+    /** The placement admission ({@link admitSessionPlacement}) for this store, judged on every resolution path. The
+     *  partition declaration is a getter over this store's live field, so it is read where the admission judges the
+     *  mirror direction (after the request's own members, and only then) — never captured at construction. */
     private assertPlacementAdmission;
     /** Resume an existing session from the repo, or create it if the backend has no such id (unless
      *  `requireExisting`, in which case a genuinely-missing id fails loud instead — design/114 Phase3). */

package/dist/core/session-store.js

@@ -4,6 +4,20 @@ import { readMember } from "./thrown-value.js";
 const DAY_MS = 24 * 60 * 60 * 1000;
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
 export { SESSION_DEFAULT_TTL_DAYS };
+export function admitSessionPlacement(sessionId, persisted, request, capability) {
+    if (persisted !== undefined && request.requireExisting !== true && request.placement === undefined) {
+        throw new SessionError("placement_refused", `session ${sessionId} belongs to the ${persisted.kind} placement partition — a claim-form acquire cannot attach to it (read it with requireExisting, or address the agent through its a* handle)`);
+    }
+    if (request.placement !== undefined && request.requireExisting !== true && capability.subagentPlacement) {
+        const want = request.placement;
+        if (persisted === undefined) {
+            throw new SessionError("placement_refused", `session ${sessionId} exists OUTSIDE the ${want.kind} placement partition it was declared into — refusing to run a subagent transcript on it (a concurrent claim-form create won this id, or the repo dropped the tuple)`);
+        }
+        if (persisted.kind !== want.kind || persisted.scope !== want.scope || persisted.handle !== want.handle) {
+            throw new SessionError("placement_refused", `session ${sessionId}'s persisted placement does not match the declared one (persisted ${persisted.kind}/${persisted.scope ?? "-"}/${persisted.handle ?? "-"} vs declared ${want.kind}/${want.scope ?? "-"}/${want.handle ?? "-"}) — refusing a cross-tuple attach`);
+        }
+    }
+}
 export class TtlSessionStore {
     retention = "none";
     durability;
@@ -74,18 +88,12 @@ export class TtlSessionStore {
         return { session, sessionId: meta.id };
     }
     assertPlacementAdmission(sessionId, placement, opts) {
-        if (placement !== undefined && opts?.requireExisting !== true && opts?.placement === undefined) {
-            throw new SessionError("placement_refused", `session ${sessionId} belongs to the ${placement.kind} placement partition — a claim-form acquire cannot attach to it (read it with requireExisting, or address the agent through its a* handle)`);
-        }
-        if (opts?.placement !== undefined && opts.requireExisting !== true && this.placements?.subagent !== undefined) {
-            const want = opts.placement;
-            if (placement === undefined) {
-                throw new SessionError("placement_refused", `session ${sessionId} exists OUTSIDE the ${want.kind} placement partition it was declared into — refusing to run a subagent transcript on it (a concurrent claim-form create won this id, or the repo dropped the tuple)`);
-            }
-            if (placement.kind !== want.kind || placement.scope !== want.scope || placement.handle !== want.handle) {
-                throw new SessionError("placement_refused", `session ${sessionId}'s persisted placement does not match the declared one (persisted ${placement.kind}/${placement.scope ?? "-"}/${placement.handle ?? "-"} vs declared ${want.kind}/${want.scope ?? "-"}/${want.handle ?? "-"}) — refusing a cross-tuple attach`);
-            }
-        }
+        const store = this;
+        admitSessionPlacement(sessionId, placement, opts ?? {}, {
+            get subagentPlacement() {
+                return store.placements?.subagent !== undefined;
+            },
+        });
     }
     async openOrCreate(id, requireExisting = false, placement) {
         try {