@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/canonical-json.js

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+import { types } from "node:util";
+import { describeFault, receive } from "./mods/kernel/receive.js";
 export function canonicalize(value) {
     try {
         return encode(value);
@@ -11,7 +13,115 @@ export const UNCANONICALIZABLE = "<uncanonicalizable>";
 export function boundInputHashOf(value) {
     return createHash("sha256").update(canonicalize(value), "utf8").digest("hex");
 }
-const MAX_DEPTH = 256;
+export function exactBoundInputHashOf(value) {
+    const bound = bindableValueOf(value);
+    if (!bound.ok)
+        return undefined;
+    const form = canonicalize(bound.value);
+    return form === UNCANONICALIZABLE ? undefined : createHash("sha256").update(form, "utf8").digest("hex");
+}
+export function bindableValueOf(value, top = "record") {
+    const received = receive(value, BINDING_RECEIPT);
+    if (!received.ok)
+        return received;
+    const copy = received.value;
+    const topOk = top === "list" ? Array.isArray(copy) : typeof copy === "object" && copy !== null && !Array.isArray(copy);
+    if (!topOk)
+        return { ok: false, fault: { kind: "not-container", path: [] } };
+    const fault = jsonFaultIn(copy, [], new Set());
+    return fault === undefined ? { ok: true, value: received.value } : { ok: false, fault };
+}
+export function capturedJsonOf(value, top = "record") {
+    const bound = bindableValueOf(value, top);
+    return bound.ok ? { ok: true, value: jsonFormOf(bound.value) } : bound;
+}
+function jsonFormOf(value) {
+    if (Object.is(value, -0))
+        return 0;
+    if (typeof value !== "object" || value === null)
+        return value;
+    if (Array.isArray(value))
+        return value.map(jsonFormOf);
+    const out = {};
+    for (const [key, member] of Object.entries(value))
+        if (member !== undefined)
+            Object.defineProperty(out, key, { value: jsonFormOf(member), enumerable: true, writable: true, configurable: true });
+    return out;
+}
+function jsonFaultIn(v, path, met) {
+    if (typeof v === "number")
+        return Number.isFinite(v) ? undefined : { kind: "not-finite", path: [...path] };
+    if (typeof v !== "object" || v === null)
+        return undefined;
+    if (met.has(v))
+        return { kind: "shared", path: [...path] };
+    met.add(v);
+    const members = [];
+    if (Array.isArray(v)) {
+        for (let i = 0; i < v.length; i++) {
+            if (!Object.hasOwn(v, i))
+                return { kind: "hole", path: [...path, String(i)] };
+            if (v[i] === undefined)
+                return { kind: "undefined-element", path: [...path, String(i)] };
+            members.push([String(i), v[i]]);
+        }
+        const named = Object.keys(v).find((k) => !isIndexBelow(k, v.length));
+        if (named !== undefined)
+            return { kind: "list-member", path: [...path, named] };
+    }
+    else
+        for (const entry of Object.entries(v))
+            members.push(entry);
+    for (const [key, member] of members) {
+        path.push(key);
+        const fault = jsonFaultIn(member, path, met);
+        path.pop();
+        if (fault !== undefined)
+            return fault;
+    }
+    return undefined;
+}
+export function describeBindingFault(value, fault) {
+    const path = ["args", ...fault.path];
+    const at = ` at ${path.join(".")}`;
+    switch (fault.kind) {
+        case "not-container":
+            return `a value that is not a record${at}`;
+        case "not-finite":
+            return `a number that is not finite${at}`;
+        case "hole":
+            return `a hole in a list${at}`;
+        case "list-member":
+            return `a named member on a list${at}`;
+        case "undefined-element":
+            return `an undefined list element${at}`;
+        case "shared":
+            return `one object met twice${at} (a shared reference)`;
+        case "too-deep":
+            return `containers nested deeper than ${MAX_DEPTH} levels`;
+        case "not-data":
+            return `${kindOfValueAt(value, fault.path)}${at}`;
+        default:
+            return describeFault({ ...fault, path });
+    }
+}
+function kindOfValueAt(value, path) {
+    let at = value;
+    for (const key of path)
+        at = typeof at === "object" && at !== null ? at[key] : undefined;
+    if (typeof at === "function" || typeof at === "symbol" || typeof at === "bigint")
+        return `a ${typeof at}`;
+    return typeof at === "object" && at !== null ? "an object that is not a plain record or list" : "a value that is not data";
+}
+export const MAX_DEPTH = 256;
+const BINDING_RECEIPT = Object.freeze({ accessors: "refuse", depth: MAX_DEPTH, past: "refuse", others: "refuse", freeze: true, isProxy: (v) => types.isProxy(v) });
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+function segment(text) {
+    if (!LONE_SURROGATE.test(text))
+        return `${Buffer.byteLength(text, "utf8")}:${text}`;
+    const spelled = JSON.stringify(text);
+    return `S${Buffer.byteLength(spelled, "utf8")}:${spelled}`;
+}
 function encode(value, depth = 0) {
     if (value === null)
         return "N";
@@ -25,7 +135,7 @@ function encode(value, depth = 0) {
         case "bigint":
             return `i:${value.toString()}`;
         case "string":
-            return `s${Buffer.byteLength(value, "utf8")}:${value}`;
+            return `s${segment(value)}`;
         case "function":
             return "fn";
         case "symbol":
@@ -66,7 +176,7 @@ function encodeOwnKeys(source, depth, skipIndicesBelow = 0) {
         catch {
             encoded = "<unreadable-property>";
         }
-        out += `${Buffer.byteLength(k, "utf8")}:${k}=${encoded}`;
+        out += `${segment(k)}=${encoded}`;
     }
     return `${out}}`;
 }
@@ -91,7 +201,7 @@ function encodeBranded(value, depth) {
         try {
             const { buffer, byteOffset, byteLength, elements, family } = viewRange(value);
             const bytesToken = digestBytes(new Uint8Array(buffer, byteOffset, byteLength));
-            return `V:${family}:${brand}:${byteLength}:${bytesToken}${encodeOwnKeys(value, depth, elements)}`;
+            return `V:${family}:${segment(brand)}:${byteLength}:${bytesToken}${encodeOwnKeys(value, depth, elements)}`;
         }
         catch {
         }
@@ -128,16 +238,16 @@ function encodeBranded(value, depth) {
             case "RegExp": {
                 const source = String(regexpSourceGetter.call(value));
                 const flags = String(regexpFlagsGetter.call(value));
-                return `r${Buffer.byteLength(source, "utf8")}:${source}/${flags}${own}`;
+                return `r${segment(source)}/${flags}${own}`;
             }
             case "Error": {
                 const name = String(value.name);
                 const message = String(value.message);
-                return `E${Buffer.byteLength(name, "utf8")}:${name}:${Buffer.byteLength(message, "utf8")}:${message}${own}`;
+                return `E${segment(name)}:${segment(message)}${own}`;
             }
             case "URL": {
                 const href = String(urlHrefGetter.call(value));
-                return `L${Buffer.byteLength(href, "utf8")}:${href}${own}`;
+                return `L${segment(href)}${own}`;
             }
             case "Boolean":
             case "Number":
@@ -158,7 +268,7 @@ function encodeBranded(value, depth) {
     }
     catch {
     }
-    return `x${Buffer.byteLength(brand, "utf8")}:${brand}${own}`;
+    return `x${segment(brand)}${own}`;
 }
 function primordialGetter(proto, key) {
     const get = Object.getOwnPropertyDescriptor(proto, key)?.get;
@@ -236,3 +346,15 @@ function encodeNumber(n) {
         return "0";
     return String(n);
 }
+export function canonicalJsonStringify(value) {
+    if (Array.isArray(value))
+        return `[${value.map((v) => (v === undefined || typeof v === "function" || typeof v === "symbol" ? "null" : canonicalJsonStringify(v))).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const rec = value;
+        const keys = Object.keys(rec)
+            .filter((k) => rec[k] !== undefined)
+            .sort();
+        return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJsonStringify(rec[k])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}

package/dist/core/checkpoint-requirements.d.ts

@@ -6,7 +6,7 @@ import { type StoreFidelity, type Checkpoint, type CheckpointFeature, type Check
  * had carried beside the one its word now names, and the members added after the table, each a capability a reader
  * must have. Downstream reads them for display only (`CheckpointError.detail.requires`).
  */
-export declare const REQUIREMENT_WORDS: readonly ["resource", "binding", "token", "orgAdmission", "f012", "realApproval", "face", "requirements_digest", "org_admission_inherited", "org_write_grant", "org_governed", "delegation_provenance", "skill_grants", "skill_card_binding", "hands_coordinates", "hands_home", "path_rule_anchors", "path_rule_installations", "permission_mode", "plan_mode_restore", "persisted_rule_mandate", "deployment_authored", "call_names", "write_face", "denial_limit_fallback", "leg_scope", "tool_ceiling", "tool_lists_judged", "own_tool_lists"];
+export declare const REQUIREMENT_WORDS: readonly ["resource", "binding", "token", "orgAdmission", "f012", "realApproval", "face", "requirements_digest", "org_admission_inherited", "org_write_grant", "org_governed", "delegation_provenance", "skill_grants", "skill_card_binding", "hands_coordinates", "hands_home", "path_rule_anchors", "path_rule_installations", "permission_mode", "plan_mode_restore", "persisted_rule_mandate", "deployment_authored", "call_names", "write_face", "denial_limit_fallback", "leg_scope", "tool_ceiling", "tool_lists_judged", "own_tool_lists", "approval_targets", "cross_boundary"];
 export type RequirementWord = (typeof REQUIREMENT_WORDS)[number];
 /** Runtime twin of {@link RequirementWord}. */
 export declare function isRequirementWord(word: unknown): word is RequirementWord;
@@ -227,6 +227,9 @@ export declare const CHECKPOINT_STATE_REQUIREMENTS: {
     readonly ownToolLists: {
         readonly word: "own_tool_lists";
     };
+    readonly crossBoundaryRecorded: {
+        readonly word: "cross_boundary";
+    };
 };
 export declare const PENDING_ACTION_REQUIREMENTS: {
     readonly tool_approval: {
@@ -308,9 +311,6 @@ export declare const PENDING_ACTION_REQUIREMENTS: {
         readonly implementationRevision: {
             readonly digest: "decision-read";
         };
-        readonly rosterDigest: {
-            readonly ignorable: "shown, never decided (card, listing, transcript or reported count): every read of the name renders, carries transcript or counts";
-        };
         readonly family: {
             readonly digest: "decision-read";
         };
@@ -320,6 +320,9 @@ export declare const PENDING_ACTION_REQUIREMENTS: {
         readonly names: {
             readonly word: "call_names";
         };
+        readonly targets: {
+            readonly word: "approval_targets";
+        };
         readonly hasBidiControls: {
             readonly ignorable: "shown, never decided (card, listing, transcript or reported count): every read of the name renders, carries transcript or counts";
         };
@@ -582,6 +585,9 @@ export declare const CHECKPOINT_REQUIREMENTS: {
             readonly ownToolLists: {
                 readonly word: "own_tool_lists";
             };
+            readonly crossBoundaryRecorded: {
+                readonly word: "cross_boundary";
+            };
         };
     };
     readonly resourceLedger: {
@@ -808,9 +814,6 @@ export declare const CHECKPOINT_REQUIREMENTS: {
                 readonly implementationRevision: {
                     readonly digest: "decision-read";
                 };
-                readonly rosterDigest: {
-                    readonly ignorable: "shown, never decided (card, listing, transcript or reported count): every read of the name renders, carries transcript or counts";
-                };
                 readonly family: {
                     readonly digest: "decision-read";
                 };
@@ -820,6 +823,9 @@ export declare const CHECKPOINT_REQUIREMENTS: {
                 readonly names: {
                     readonly word: "call_names";
                 };
+                readonly targets: {
+                    readonly word: "approval_targets";
+                };
                 readonly hasBidiControls: {
                     readonly ignorable: "shown, never decided (card, listing, transcript or reported count): every read of the name renders, carries transcript or counts";
                 };

package/dist/core/checkpoint-requirements.js

@@ -31,6 +31,8 @@ export const REQUIREMENT_WORDS = Object.freeze([
     "tool_ceiling",
     "tool_lists_judged",
     "own_tool_lists",
+    "approval_targets",
+    "cross_boundary",
 ]);
 export function isRequirementWord(word) {
     return typeof word === "string" && REQUIREMENT_WORDS.includes(word);
@@ -92,6 +94,7 @@ export const CHECKPOINT_STATE_REQUIREMENTS = {
     toolCeiling: { word: "tool_ceiling" },
     toolListsJudged: { word: "tool_lists_judged" },
     ownToolLists: { word: "own_tool_lists" },
+    crossBoundaryRecorded: { word: "cross_boundary" },
 };
 export const PENDING_ACTION_REQUIREMENTS = {
     tool_approval: {
@@ -121,10 +124,10 @@ export const PENDING_ACTION_REQUIREMENTS = {
         contractId: DECISION_READ,
         shapeDigest: DECISION_READ,
         implementationRevision: DECISION_READ,
-        rosterDigest: SHOWN,
         family: DECISION_READ,
         pathTarget: DECISION_READ,
         names: { word: "call_names" },
+        targets: { word: "approval_targets" },
         hasBidiControls: SHOWN,
         batchToolCallIds: DECISION_READ,
         completedCallIds: SHOWN,

package/dist/core/checkpoint-store.d.ts

@@ -1,6 +1,6 @@
 import type { GateOutcome, HostDecisionFacts } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
-import type { CheckpointPause } from "./pause-registry.js";
+import { type CheckpointPause } from "./pause-registry.js";
 import type { SystemInjectionPriority } from "./task-notification.js";
 import { type SteerReplayFacet } from "./steer-replay.js";
 import type { QuestionAnswer } from "./ask-question.js";
@@ -581,6 +581,16 @@ export type ResumeOutcome = {
     updatedInput?: unknown;
     /** Model-readable reason attached to a `deny` (else a default is used). */
     reason?: string;
+    /**
+     * What the approving PERSON wrote in the card's "and tell the agent what to do next" input — the `allow`
+     * arm's counterpart of a `deny`'s {@link reason}. The resumed run's continuation user message carries it to
+     * the model as the user's own words, after the batch's tool results, once, verbatim apart from the outer
+     * whitespace: no fence, no wrapper sentence, no length bound. PRESENT only when the person wrote something
+     * (blank — empty or whitespace-only — delivers nothing; a host whose card has no input omits the key).
+     * ARM- AND DECIDER-SCOPED like `answer`: a written value on a `deny` or on a decide whose `hostDecision.decidedBy`
+     * is not `"person"`, a non-string, or text carrying a `<system-reminder>` tag (opening or closing) is refused pre-CAS.
+     */
+    feedback?: string;
     /**
      * The ANSWER to a CONTENT-ASK (the reserved AskUserQuestion tool), carried by the decide itself
      * (ruled 2026-08-04). A content-ask is a question TO the user: `allow` alone says "let the tool
@@ -854,17 +864,15 @@ export type PendingAction = {
      * precedent: an optional group an older reader ignores): the IDENTITY of the row the park minted
      * this action against, read off the leg's tool roster at the suspend station — `capabilityId`
      * (engine-minted over {source, peer, name, contractId}), `contractId`, `shapeDigest`,
-     * `implementationRevision` — plus the roster `digest` of the leg that parked. The resume finds the
-     * same-name row on ITS leg and compares the FOUR identity members (`judgeParkedToolIdentity`): any
-     * mismatch is a replacement wearing the name and the resume refuses it
-     * (`resume.tool_contract_mismatch`, the `tool_unavailable` reopen family). All four ABSENT ⇒ a row
-     * minted before the members existed ⇒ the name-only path, never widened by their absence.
+     * `implementationRevision`. With the face below they are the TOOL member of the row's approval object
+     * (`judgeApprovalObject`): an identity member that differs from the same-name row on the resuming leg, or is missing
+     * while another is present, is a replacement wearing the name (`resume.tool_contract_mismatch`, a reopen); a face
+     * that differs vetoes the call (`resume.target_moved`). All four ABSENT ⇒ a pre-identity row: the name alone is bound.
      */
     capabilityId?: string;
     contractId?: string;
     shapeDigest?: string;
     implementationRevision?: string;
-    rosterDigest?: string;
     /**
      * design/388 B6 × B18 (additive; the identity group's precedent): the FACE the parked call was judged under —
      * display `family` + declared `pathTarget` — off the same roster row at the same mint. The pre-CAS resume-edit
@@ -880,6 +888,9 @@ export type PendingAction = {
      *  them, as the live gate judged the original, and the resume re-mints its face under the spelling while it still
      *  resolves to the row's tool. Absent on a row minted before it ⇒ the row's `toolName` alone. */
     names?: readonly string[];
+    /** The approval object's TARGETS (`approvalTargetsOf`): per reading of the path slot, where it resolved when the card
+     *  was asked; absent ⇒ not judged. A role resolving elsewhere at the execution vetoes the call (`resume.target_moved`). */
+    targets?: import("./approval-object.js").ApprovalTargets;
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
      * older reader ignores. Unlike that precedent seat — which resume DOES read, through its
@@ -1003,8 +1014,7 @@ export interface CheckpointState {
      * The WRITE-face containment state at suspend: the RESOLVED write face, written ONLY when it is
      * non-default ("open"). An absent section IS "roots" for every reader — which is why it carries NO
      * version stamp: losing it can only make a resume STRICTER. Resume folds STRICTER-WINS, the read seat's
-     * law: roots unless the section says open AND the live resolution says open. No deny half and no
-     * governance marker.
+     * law: roots unless the section says open AND the live resolution says open. No deny half and no governance marker.
      */
     writeFace?: {
         face: "open" | "roots";
@@ -1326,8 +1336,8 @@ export interface CheckpointState {
      * **persisted OR live declaration** (a monotonic join, never a downgrade): a run minted under a
      * declaring adapter keeps its memory fold and its prompt disclosure when resumed on an
      * undeclared/older adapter — the downgrade is closed in the derivation itself, deliberately
-     * WITHOUT a new refusal arm (one fewer failure path, same safety). Feeds the memory face and the
-     * prompt disclosure only — no gate/policy/roster behavior reads it (the design/378 red line).
+     * WITHOUT a new refusal arm (one fewer failure path, same safety). ONE declaration, two readers: the content-class fold (the memory
+     * face, the prompt disclosure — the design/378 red line binds it: no gate/policy/roster reads it) and the tree's cross-boundary taint bit.
      * Schema ADDITION (additive, Q5 posture; the version-gate residual is shared with
      * {@link placementRootSessionId} above and owned by the same version-lattice ticket).
      */
@@ -1362,6 +1372,9 @@ export interface CheckpointState {
         readonly definition?: string;
         readonly lists: string;
     };
+    /** The row's session holds a cross-boundary record (`CROSS_BOUNDARY_RECORD_TYPE`, written before the row is put): a reader must read
+     *  that record to resume the leg under its tree's state. Presence-coded; a capability mark only — the bits live in the session. */
+    crossBoundaryRecorded?: true;
 }
 /**
  * {@link CheckpointState} with **every** field made required-PRESENT, while each value keeps its original
@@ -1370,8 +1383,7 @@ export interface CheckpointState {
  * correctness field to {@link CheckpointState} is then a **compile error** at the serialization site until
  * it is explicitly handled — it can never be silently omitted and lost on resume. (Keying off
  * `keyof Required<…>` makes the mapped type non-homomorphic, so it forces presence of every key yet leaves
- * each value's `| undefined` intact — `workspaceHandle: undefined` for a process-local suspend still
- * type-checks.)
+ * each value's `| undefined` intact — `workspaceHandle: undefined` for a process-local suspend still type-checks.)
  */
 export type SerializedCheckpointState = {
     [K in keyof Required<CheckpointState>]: CheckpointState[K];
@@ -1603,6 +1615,10 @@ export interface ResolvedOutcome {
      *  the same decision" for no delivery benefit, since a replay is produced by re-presenting the same
      *  outcome, not by reconstructing an equivalent one. */
     reason?: string;
+    /** The approving person's FEEDBACK, if the `allow` carried any — recorded exactly as supplied (a blank value included)
+     *  and bound by the replay equality on the same ADDITIVE rule as {@link reason}: absence means "never recorded". No
+     *  reader requirement word guards it: `resolvedOutcome` is a store-written state-machine member, never minted with the row. */
+    feedback?: string;
     /** The settlement record core minted for this decide ({@link import("./gate-outcome.js").GateOutcome}):
      *  the row's own copy of what the resolved call's `tool_end` frame carries, written with the winner so
      *  an audit reading the row reads the same record the stream carried. NOT part of the replay equality
@@ -1930,8 +1946,7 @@ export interface CheckpointSummary {
     approvalCard?: import("./tool-face.js").ToolApprovalCard;
     /** design S1e: when the checkpoint was created ({@link Checkpoint.createdAt}, epoch ms) —
      *  projected so a supervisor inbox can sort/age pending entries (oldest-first triage) in ONE `listByScope`
-     *  call, no N+1 `getCheckpoint`. ECHO-ONLY display/triage; always present (a Checkpoint always has a
-     *  `createdAt`). */
+     *  call, no N+1 `getCheckpoint`. ECHO-ONLY display/triage; always present (a Checkpoint always has a `createdAt`). */
     createdAt?: number;
     /**
      * design S1e: a **BOUNDED, UNREDACTED** raw preview of the pending tool call's input
@@ -2099,24 +2114,33 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  | "installation_record_absent" | "installation_record_misaligned" | "installation_record_invalid"
 /** On `checkpoint.config_refused` with `detail.code` `config.tool_face_control` — the arm prepare's own refusal carries as its `detail.reason`:
  *  a tool-name list the row recorded is not a list / has a member that is not a string / has a spelling no tool name can have / is not in
- *  the one spelling a row records (`"not_a_list"`, `"not_a_string"`, `"unknown_name"`, `"unsupported_pattern"`); the record of the delegation tool that
+ *  the one spelling a row records (`"not_a_list"`, `"not_a_string"`, `"unknown_name"`, `"unsupported_pattern"`; the re-supplied config's own four lists —
+ *  `allowTools`, `excludeTools`, `deferTools`, `alwaysLoadTools` — are refused as `"not_a_list"` / `"not_a_string"`); the record of the delegation tool that
  *  wrote the leg's lists is not one (`"invalid_record"`); the roster the resume hands mounts a delegation tool under another name than it declares
  *  (`"renamed_mount"`); the process-wide table of declared names is occupied by a value that is not the engine's (`"registry_occupied"`). */
- | "not_a_list" | "not_a_string" | "unknown_name" | "unsupported_pattern" | "invalid_record" | "renamed_mount" | "registry_occupied";
+ | "not_a_list" | "not_a_string" | "unknown_name" | "unsupported_pattern" | "invalid_record" | "renamed_mount" | "registry_occupied"
+/** On `checkpoint.config_refused` with `detail.code` `config.unknown_role` — a role seat or a tier binding the deployment wrote that the engine cannot read:
+ *  a word the model catalog does not hold (`"unknown_model_ref"`), or a value that is no model reference at all — a number, a boolean, a list
+ *  (`"not_a_model_ref"`). The sentence names the seat (`roles.consolidate`, `tiers.pro`). */
+ | "unknown_model_ref" | "not_a_model_ref";
 /**
- * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the nine
- * words prepare's mode, output-style, approval-reach, invoked-skill, attachment, recorded-mode and tool-face doors throw, held unchanged so one refusal
- * reads the same on a fresh run (`TaskResult.errorCode`) and on a resume. `config.spec_retired_key`: a retired spec key;
- * `config.output_style_invalid`: a malformed output-style seat; `config.permission_mode_invalid`: a mode word outside the closed
- * set (the config's `permissionMode`, or one the row recorded); `config.shell_gate_value_retired`: a retired shell-floor word;
- * `config.approval_reach_invalid`: an `approvalReach` outside its set; `config.user_invoked_skill_unknown` / `skill_deny_unreadable`:
- * `userInvokedSkills` names a skill the config does not carry / one whose `disallowed-tools` entry the grammar reads as nothing;
- * `config.user_attachment_invalid`: the config declares `userAttachments` (a resume sends no new human message) or a malformed
- * value there; `config.tool_face_control`: the tool names the row recorded (its ceiling, its frozen policy chain, the record of who wrote
- * its lists) are not readable as written, or the roster the resume hands mounts a delegation tool under another name than it declares
- * (`detail.reason` names which: {@link CheckpointErrorReason}).
+ * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the words prepare's
+ * doors throw, held unchanged so one refusal reads the same on a fresh run (`TaskResult.errorCode`) and on a resume: the mode, output-style,
+ * approval-reach, invoked-skill, attachment, recorded-mode and tool-face doors (`config.spec_retired_key` … `config.tool_face_control`, the first
+ * nine — `detail.reason` names the tool-face arm: {@link CheckpointErrorReason}), and every value door of the config-door phase over the
+ * re-supplied config and the deployment's deps (`configValueDoors`, the rest): the retired deps seats and caller-policy members
+ * (`config.deps_retired_key`), the peer presence, the restore selector, the microCompact knob, the prompt selectors, `resumeAt` on a resume
+ * (`resume_at.conflicts_resume`, `resume_at.mode_without_target` — a resume carrying `resumeAt` is refused as a conflict before its mode is
+ * read, so `resume_at.invalid_mode` is a fresh run's word only), the containment faces, the add-only seats and the MCP / A2A `toolAxes` (`config.invalid_argument`), an MCP server's `toolFaces` (`config.tool_face_invalid`), the three memory seats,
+ * the auto-consolidation arming (its role key too, and the role seats and tier bindings it reads: `config.unknown_role`, `detail.reason` naming the arm), the materialize strategy and persistence flag, the lock layer (`config.locked_registry`,
+ * `config.locked_key`), an MCP server's content class, the skills-listing seats (`config.skill_listing_budget_invalid`), the limits and the
+ * resource-suspend knobs, the attachment modes, the governance windows, the brain-call guardrail and the retention declaration over the stores the leg
+ * would run on (`config.retention_policy`, `config.retention_capability`), and the checkpoint store seat itself (`config.invalid_checkpoint_store`: the
+ * retired `null` spelling, a store that declares no execution outcome), and the skills seat and the hands band (`config.invalid_argument`;
+ * a skill's `baseDir` by its own reader, `config.skill_base_dir_invalid`). A door not entered here (the leg's model, its rebuilt
+ * roster, its answer face, the approval seat's value) still refuses after the claim, each for a stated reason (INTEGRATION-CORE, "A resume's two doors").
  */
-export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control"];
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"];
 export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
 export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
@@ -2295,13 +2319,13 @@ export declare class CheckpointError extends Error {
      *  resolve, or try to supply the minted record), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
      *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
-     *  (the re-supplied config: correct it and resume the same token) or `"inheritedGate"` (the mode the row
-     *  recorded: no config reaches it; expire the row). The throw
+     *  (the re-supplied config: correct it and resume the same token), `"deps"` (the deployment's own seat — and the policies the
+     *  caller re-supplies as inherited constraints: correct them and resume the same token) or `"inheritedGate"` (the row's record: no config reaches it; expire the row). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     readonly detail?: {
-        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "inheritedGate";
+        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "deps" | "inheritedGate";
         /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
          *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
         code?: CheckpointConfigRefusalCode;
@@ -2498,13 +2522,13 @@ export declare class CheckpointError extends Error {
      *  resolve, or try to supply the minted record), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
      *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
-     *  (the re-supplied config: correct it and resume the same token) or `"inheritedGate"` (the mode the row
-     *  recorded: no config reaches it; expire the row). The throw
+     *  (the re-supplied config: correct it and resume the same token), `"deps"` (the deployment's own seat — and the policies the
+     *  caller re-supplies as inherited constraints: correct them and resume the same token) or `"inheritedGate"` (the row's record: no config reaches it; expire the row). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     detail?: {
-        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "inheritedGate";
+        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "deps" | "inheritedGate";
         /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
          *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
         code?: CheckpointConfigRefusalCode;
@@ -2937,7 +2961,7 @@ export interface CheckpointStore {
      * status === 'pending'`), so the list reflects exactly the rows that are still resumable. Order is unspecified
      * (the inbox sorts by `severity`/`deadline` itself). An empty scope returns `[]`.
      *
-     * **OPTIONAL** for backward-compat with external {@link CheckpointStore} impls (a caller probes
+     * **OPTIONAL** for backward-compat (RL-1336-checkpoint-listbyscope) with external {@link CheckpointStore} impls (a caller probes
      * `store.listByScope?.(scope) ?? []`); ALL THREE first-party impls (in-memory, file, Pg) provide it.
      */
     listByScope?(scope: string): Promise<CheckpointSummary[]>;

package/dist/core/checkpoint-store.js

@@ -6,10 +6,10 @@ import { isAutoModeFallbackCause, readDenialLimitFallback } from "./auto-mode.js
 import { isAskOrigin, isPersistedRuleMandate } from "./ask-origin.js";
 import { readBoundBinding } from "./skill-grant-binding.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
+import { parkedApprovalCardOf } from "./pause-registry.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { egressText } from "./untrusted-egress.js";
 import { steerReplayRefusal } from "./steer-replay.js";
-import { isToolApprovalCard } from "./tool-face.js";
 import { isPermissionMode } from "./ask-origin.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
@@ -251,7 +251,7 @@ export { REOPEN_REASONS } from "./resume-startup-cause.js";
 export function summarizeCheckpoint(cp) {
     const riskDescriptor = cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask" ? cp.gate.riskDescriptor : undefined;
     const severity = riskDescriptor !== undefined ? riskSeverity(riskDescriptor.axes) : undefined;
-    const gateCard = cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask" ? cp.gate.approvalCard : undefined;
+    const cardReading = parkedApprovalCardOf(cp.gate);
     const tool = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
     let toolInput;
     if (tool !== undefined) {
@@ -281,7 +281,7 @@ export function summarizeCheckpoint(cp) {
         ...(cp.sourceTaskId !== undefined ? { sourceTaskId: cp.sourceTaskId } : {}),
         ...(cp.principal !== undefined ? { principal: cp.principal } : {}),
         ...(tool !== undefined ? { toolCallId: tool.toolCallId, toolName: tool.toolName } : {}),
-        ...(isToolApprovalCard(gateCard) ? { approvalCard: gateCard } : {}),
+        ...(cardReading.kind === "card" ? { approvalCard: cardReading.card } : {}),
         ...(toolInput !== undefined ? { toolInput } : {}),
         ...(cp.state.workspaceHandle !== undefined
             ? { restoreMode: cp.state.workspaceHandle.restoreMode === "park_only" ? "park_only" : "snapshot" }
@@ -305,7 +305,7 @@ export function summarizeCheckpoint(cp) {
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;
@@ -399,13 +399,13 @@ export function resolveCheckpointStore(spec, deps) {
             throw checkpointStoreExecutionUndeclared("TaskSpec.checkpointStore", spec.checkpointStore);
         return spec.checkpointStore;
     }
-    if (deps.checkpointStore !== undefined && deps.checkpointStore.execution?.outcome !== true) {
+    if (deps.checkpointStore !== undefined && deps.checkpointStore?.execution?.outcome !== true) {
         throw checkpointStoreExecutionUndeclared("RunnerDeps.checkpointStore", deps.checkpointStore);
     }
     return deps.checkpointStore;
 }
 export function checkpointStoreExecutionUndeclared(seat, store) {
-    const ctor = store.constructor?.name;
+    const ctor = store?.constructor?.name;
     const name = typeof ctor === "string" && ctor.length > 0 && ctor !== "Object" ? ` (${ctor})` : "";
     const e = new Error(`${seat}: the wired CheckpointStore${name} does not declare \`execution = { outcome: true }\` — the execution-outcome ` +
         "record (recordExecutionOutcome, and reopen refusing a recorded row) is a required member of the store contract; " +
@@ -441,6 +441,7 @@ export function winnerFromOutcome(outcome) {
         ...(outcome.answer === undefined ? {} : { answer: outcome.answer }),
         ...(outcome.gateOutcome === undefined ? {} : { gateOutcome: outcome.gateOutcome }),
         ...(outcome.reason === undefined ? {} : { reason: outcome.reason }),
+        ...(outcome.feedback === undefined ? {} : { feedback: outcome.feedback }),
     };
 }
 const CHECKPOINT_CONTROL_CHARS_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;