@sema-agent/core 7.53.0 → 7.54.0

package/dist/core/runner/prepare-acquire-reconcile.js

@@ -8,7 +8,7 @@ import { detectConflicts, settleBranchWriteBack } from "./branch-writeback.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 const RECONCILE_MAX_RETRIES = 3;
 export async function prepareAcquireReconcile(input) {
-    const { sessions, spec, resume, toolEffects } = input;
+    const { sessions, spec, resume, wakeEffects } = input;
     let acquired;
     let session;
     let conflictRef;
@@ -64,7 +64,7 @@ export async function prepareAcquireReconcile(input) {
                         throw e;
                     }
                     if (userAttachmentOf(msg) !== undefined) {
-                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is an attachment frame that trails a user message; resume at that user message instead`);
+                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is an attachment frame — a file the engine delivered, not a turn boundary; resume at the user message it belongs to, or at another user message or finished assistant turn`);
                         e.code = "resume_at.not_a_message";
                         throw e;
                     }
@@ -100,7 +100,7 @@ export async function prepareAcquireReconcile(input) {
                 own.ids = new Set();
                 branch = { storage, leafBefore, leafSet, own };
             }
-            wakeRecovered = (await reconcileInterruptedSession(session, toolEffects, resume?.suspendedBatch)).recovered;
+            wakeRecovered = (await reconcileInterruptedSession(session, wakeEffects, resume?.suspendedBatch)).recovered;
             break;
         }
         catch (err) {

package/dist/core/runner/prepare-ask-lane.js

@@ -2,7 +2,7 @@ import { cardDisclosureOf } from "../allow-entry.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { classicEventBase, observeClassic } from "../mods/stations.js";
 import { advertisedWritableRootsSeat, exemptRootsSeat, attest, attestationOf, isLiveApproverSeat, resolveAsk } from "../tool-policy.js";
-import { boundInputHashOf } from "../canonical-json.js";
+import { exactBoundInputHashOf } from "../canonical-json.js";
 import { composeCallSignal, raceSettlementAgainstSignal } from "./abort-race.js";
 import { failedJudgmentDeny, policyCheckAbortedDeny } from "./policy-throw.js";
 import { askMandateMember } from "../ask-origin.js";
@@ -85,8 +85,8 @@ export function prepareAskLane(input) {
             };
             const settlement = { kind: "approver_unavailable", who: { party: "none" }, when: now() };
             return decision.action === "ask"
-                ? attest(intercepted, req, { settlement, ...(decision.origin !== undefined ? { origin: decision.origin } : {}), ...(decision.classes !== undefined ? { classes: decision.classes } : {}), inputDigest: boundInputHashOf(req.args) })
-                : attest(intercepted, req, { settlement, inputDigest: boundInputHashOf(req.args) });
+                ? attest(intercepted, req, { settlement, ...(decision.origin !== undefined ? { origin: decision.origin } : {}), ...(decision.classes !== undefined ? { classes: decision.classes } : {}), inputDigest: exactBoundInputHashOf(req.args) })
+                : attest(intercepted, req, { settlement, inputDigest: exactBoundInputHashOf(req.args) });
         }
         const grantReuse = consumeInheritedAskGrant(inheritedAskGrants, onAsk, humanReviewRef, decision, req);
         if (grantReuse !== undefined)

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -36,7 +36,7 @@ import type { AssertAllKeysHandled } from "../ask-origin.js";
 import { type ChildClampSource } from "../child-clamp-seats.js";
 import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
-import { RosterBuilder } from "../tool-roster.js";
+import { RosterBuilder, type RosterAxisTables } from "../tool-roster.js";
 import type { ParentSpecSeat } from "../parent-spec-seat.js";
 import { type RosterSpec } from "./caller-roster.js";
 export interface PrepareCapsAndWorkflowInput {
@@ -48,8 +48,7 @@ export interface PrepareCapsAndWorkflowInput {
     /** borrowed-readonly — the deployment seats, whole: `runtimeCapsResolver`, `compliancePostureResolver`, `onError`, `onNotice`,
      *  `autoMode`, `brain`, `models`, and the Workflow mount's dozen deps (`workflowScriptRunner`,
      *  `workflowGovernanceBaseline`, `workflowRunStore`, `workflowJournalStore`, `workflowScriptStore`,
-     *  `onWorkflowAgentSpawn`, `workflowCompletionNotifier`, `workflowLimits`, `agents`, `builtinAgents`, `onBackgroundChildEvent`).
-     *  The self-orchestration predicate takes the whole record. */
+     *  `onWorkflowAgentSpawn`, `workflowCompletionNotifier`, `workflowLimits`, `agents`, `builtinAgents`, `onBackgroundChildEvent`). The self-orchestration predicate takes the whole record. */
     deps: RunnerDeps;
     /** borrowed-readonly — the seat this run hands its children (`checkpointSeatOf`, minted once by the driver right after the
      *  config doors): the plan-pair face reads the store it names, the Workflow mount hands the seat itself to its children. */
@@ -58,6 +57,7 @@ export interface PrepareCapsAndWorkflowInput {
      *  `onTaskNotification`, `workflowDepth`, the capture-floor getter reads `memoryCaptureAncestors`, and the arming reads
      *  the chain's auto-mode face (`inheritedGate.autoModeFace`). */
     internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "questionFaceStripped" | "inheritedGate"> | undefined;
+    /** borrowed-readonly — the tree's cross-boundary token (inherited or minted), which the Workflow mount hands to its children. */ crossBoundaryTree: import("../cross-boundary-taint.js").CrossBoundaryTreeToken;
     /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
     session: Pick<StoredSession, "buildContext">;
     /** borrowed-readonly — the acquired session id (operator-line context, the refusal codes' phase record). */
@@ -76,9 +76,10 @@ export interface PrepareCapsAndWorkflowInput {
     thinking: ThinkingLevel | undefined;
     /** borrowed-readonly — the frozen preflight; only `mcp` (the compliance veto's mcp_servers conflict check). */
     lockedPreflight: Pick<LockedPreflight, "mcp">;
-    /** borrowed-mutable — the effect collection (`Prepared.toolEffects`). Writer here: ONE set, `Workflow → write`, at its mount.
-     *  Every other writer is the safety scan (the seed) and the later mounts (see the roster table on `Prepared.tools`). */
+    /** borrowed-mutable — the effect collection (`Prepared.toolEffects`): the safety scan's caller entries, then the mounts' writes. */
     toolEffects: Prepared["toolEffects"];
+    /** borrowed-mutable — the scan's axis tables, so the builder moves an alias's axes with its member (a phase test may omit them). */
+    safetyAxes?: RosterAxisTables;
     /** borrowed-readonly — the frozen tool-face snapshot the Workflow mount forwards (exclude / defer / alwaysLoad / restoreGated). */
     toolFaceSnapshot: ToolFaceSnapshot;
     /** borrowed-readonly — the resolved prompt profile (the Workflow mount's parentPromptProfile). */

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -117,8 +117,8 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, askSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, delegated, sideCallBookRef } = input;
-    const roster = new RosterBuilder(toolEffects);
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, safetyAxes, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, askSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, delegated, sideCallBookRef } = input;
+    const roster = new RosterBuilder(toolEffects, safetyAxes);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
         roster.mount(mounted, { source: callerMountSource(mounted), mountedBy: "scenario" });
@@ -329,7 +329,7 @@ export async function prepareCapsAndWorkflow(input) {
             scope: taskScope,
             notifier: deps.workflowCompletionNotifier,
             originatingSessionId: sessionId,
-            rootSessionId: internals?.rootSessionId ?? sessionId, ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}),
+            rootSessionId: internals?.rootSessionId ?? sessionId, ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}), crossBoundaryTree: input.crossBoundaryTree,
             taskRegistry: defaultTaskRegistry,
             taskNotification: internals?.onTaskNotification,
             taskOwner: hostTaskId,

package/dist/core/runner/prepare-config-doors.d.ts

@@ -10,8 +10,7 @@
  * the safety scan after it run BEFORE prepareTask's first await (`sessions.acquire`), so a caller
  * has no microtask window in which to mutate `spec.tools`/the face arrays between the snapshots,
  * the doors and the scan. An `async` wrapper — even with a zero-await body — would hand the caller
- * exactly that window (the driver's `await` yields one microtask). Pinned by the
- * `prepare-task-phase-pins` microtask-latch tests.
+ * exactly that window (the driver's `await` yields one microtask). Pinned by the `prepare-task-phase-pins` microtask-latch tests.
  *
  * Throws pass through unchanged: every `config.*` / `resume_at.*` refusal here is a DELIBERATE
  * at-the-door rejection (a throw before acquisition needs no cleanup), and the
@@ -23,6 +22,7 @@ import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
 import type { Model } from "../../internal/llm.js";
 import type { ThinkingLevel } from "../../internal/harness.js";
 import { type MicroCompactMachine } from "../context-edit.js";
+import { type CrossBoundaryPosture } from "../cross-boundary-taint.js";
 import { recordedModeSeed } from "../checkpoint-store.js";
 import { type ConfigDoorEntry, type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
@@ -137,8 +137,7 @@ export interface PrepareConfigDoorsInput {
 export interface PrepareConfigDoorsResult {
     /** owned (by the caller, from here on) — the REBOUND spec: identical to the input object unless
      *  `spec.agents` was set, in which case it is a shallow copy whose `tools` is the
-     *  withAgents-rebuilt roster. Every later phase (the safety scan above all — T21) must read THIS,
-     *  never the original input. */
+     *  withAgents-rebuilt roster. Every later phase (the safety scan above all — T21) must read THIS, never the original input. */
     spec: RosterSpec;
     /** owned — the frozen task-start copies of the caller's tool-face control arrays; the driver compiles the leg's selector
      *  from them, and the selector (with the disclosure lists) is the ONLY thing later face reads consult. Frozen-immutable. */
@@ -156,17 +155,15 @@ export interface PrepareConfigDoorsResult {
     resolvedInteractionPosture: "interactive" | "headless" | undefined;
     /** owned, frozen — the run's approval seat ({@link resolveAskSeat}), the one read of the seats; later phases read only this. */
     askSeat: AskSeat;
-    /** owned — the validated/resolved microCompact knob ({@link resolveMicroCompactKnob}
-     *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
-     *  the deps bag is never re-read after this door. */
+    /** owned — the validated/resolved microCompact knob ({@link resolveMicroCompactKnob} for the door + placement reasoning). The per-run
+     *  state builder consumes exactly these values — the deps bag is never re-read after this door. */
     microCompactKnob: {
         machine: MicroCompactMachine;
         clearOnRejection: boolean;
     };
     /** owned — the resolved role; its `systemPrompt` seat is still read at prompt-input time. */
     resolvedRole: ResolvedRole;
-    /** owned — the resolved main model (`resolvedRole.model`, re-exposed as the name every later
-     *  phase reads). */
+    /** owned — the resolved main model (`resolvedRole.model`, re-exposed as the name every later phase reads). */
     model: Model;
     /** owned — caller-explicit > role default > model default; undefined = off. */
     thinking: ThinkingLevel | undefined;
@@ -191,8 +188,7 @@ export interface PrepareConfigDoorsResult {
     /** owned — the NORMALIZED per-leg delegation-evidence standard: the deps seat read
      *  ONCE, in this synchronous pre-await stretch, screened, and absent folded to the "static-face"
      *  default. The delegation wrap consumes THIS value, never the live deps object — a deps seat
-     *  mutated (or getter-backed) after the door must not present an unscreened value to the mark
-     *  branch (the read-once posture). */
+     *  mutated (or getter-backed) after the door must not present an unscreened value to the mark branch (the read-once posture). */
     memoryDelegationEvidence: "static-face" | "attested-only";
     /** owned — the lowered skills-listing budget seats (`TaskSpec.skillListingBudgetFraction` /
      *  `skillListingMaxDescChars`): the renderer's two numbers, resolved once against the resolved main
@@ -213,9 +209,10 @@ export interface PrepareConfigDoorsResult {
     /** owned, out-param cell — created EMPTY here; the brain-call wiring later installs into
      *  `.current`. Returned so driver and harness share one cell identity. */
     brainCallGuardrailRef: BrainCallGuardrailRef;
-    /** owned — the resolved outer brain-call guardrail (task > deployment > default; undefined per
-     *  the resolver's off states). */
+    /** owned — the resolved outer brain-call guardrail (task > deployment > default; undefined per the resolver's off states). */
     brainCallGuardrailMs: number | undefined;
+    /** owned — the screened cross-boundary posture: the deps seat read ONCE, a bad value refused; absent stays `undefined` (undeclared is its own fact). */
+    crossBoundaryPosture: CrossBoundaryPosture | undefined;
 }
 /** The microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
  *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing:
@@ -240,7 +237,7 @@ export declare const checkpointStoreSeat: (spec: {
 export declare function assertResumeConfigRecord(config: unknown): void;
 /** The spec the value doors read: a prepare's (its roster is faces) or a resume's re-supplied config (no objective, no session id). */
 type ValueDoorSpec = Omit<TaskSpec, "tools" | "objective" | "sessionId" | "userAttachments"> & Partial<Pick<TaskSpec, "objective" | "sessionId">>;
-type ConfigValueDoorsResult = Pick<PrepareConfigDoorsResult, "toolFaceLists" | "promptHost" | "promptBinding" | "lockedPreflight" | "microCompactKnob" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "usageWindows" | "brainCallGuardrailMs"> & {
+type ConfigValueDoorsResult = Pick<PrepareConfigDoorsResult, "toolFaceLists" | "promptHost" | "promptBinding" | "lockedPreflight" | "microCompactKnob" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "usageWindows" | "brainCallGuardrailMs" | "crossBoundaryPosture"> & {
     skillListingSeats: {
         fraction: unknown;
         maxDescChars: unknown;
@@ -265,7 +262,7 @@ export declare function configValueDoors(input: {
  * The doors a RESUMED leg's prepare refuses at, run as one screen BEFORE the claim — prepare's own functions, so a refusal carries
  * the very sentence and code prepare throws: the mode doors (`refusePermissionModeDoors`), the output-style seat, the approval
  * reach, the skills invoked by name (the part no roster changes), the attachments (a resume sends no new human message, so any
- * entry is refused), this phase's value doors over the config, the deployment's deps and the session store the Runner holds
+ * entry is refused), the leg declarations of the tools it re-supplies (this phase's first door), this phase's value doors over the config, the deployment's deps and the session store the Runner holds
  * ({@link configValueDoors}, the retention capability door included) and the mode words the row recorded (`recordedModeSeed`).
  * It leaves by the resume's ONE refusal channel (`asResumeConfigRefusal`:
  * `checkpoint.config_refused`, `detail.code` = prepare's code, `detail.field` = `"taskConfig"`, `"deps"` or `"inheritedGate"`)

package/dist/core/runner/prepare-config-doors.js

@@ -2,6 +2,7 @@ import { resolveBrainCallGuardrailMs } from "../../brain/timeout.js";
 import { assertContainmentFaceValue } from "../../tools/fs/index.js";
 import { MICRO_COMPACT_MACHINES } from "../context-edit.js";
 import { assertAddOnlySeats } from "../child-clamp-seats.js";
+import { CROSS_BOUNDARY_POSTURES } from "../cross-boundary-taint.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { recordedModeSeed, resolveCheckpointStore } from "../checkpoint-store.js";
 import { asResumeConfigRefusal, refusePermissionModeDoors } from "../mode-policy.js";
@@ -26,6 +27,7 @@ import { assertPeerPresenceValue } from "../../agents/peer-directory.js";
 import { snapshotDefinitionLists } from "../../agents/tool-filter.js";
 import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
 import { rosterFaceOf } from "./caller-roster.js";
+import { assertToolBoundaryLegs } from "../tool-roster.js";
 import { refuseRenamedDelegationMounts } from "./sub-agent-deny-lists.js";
 const TASK_LIMIT_KEY_DICT = {
     maxTokens: true,
@@ -232,6 +234,7 @@ export function configValueDoors(input, enter = ENTER_AS_IS) {
     const memoryDelegationEvidence = enter("deps", () => deploymentWord(deps.memoryDelegationEvidence, "memoryDelegationEvidence", ["static-face", "attested-only"], "static-face", "config.memory_delegation_evidence", "an unevaluable evidence standard is refused loudly, never folded to either standard."));
     const memoryProvenance = enter("deps", () => deploymentWord(deps.memoryProvenance, "memoryProvenance", ["off", "carry"], "carry", "config.memory_provenance", "an unevaluable provenance mode is refused loudly, never folded to either mode."));
     const memoryCapturePolicy = enter("deps", () => deploymentWord(deps.memoryCapturePolicy, "memoryCapturePolicy", ["open", "governed", "capture-required"], "open", "config.memory_capture_policy", "an unevaluable capture posture is refused loudly, never folded to any posture (the fault arms differ per posture, so a guess would pick a polarity nobody configured)."));
+    const crossBoundaryPosture = enter("deps", () => deploymentWord(deps.crossBoundaryPosture, "crossBoundaryPosture", CROSS_BOUNDARY_POSTURES, undefined, "config.cross_boundary_posture", "an unevaluable posture is refused loudly, never folded to either word (an absent seat is undeclared, which is its own fact)."));
     enter("deps", () => assertAutoConsolidationWirable(deps));
     if (spec.resumeAtMode !== undefined)
         enter("taskConfig", () => {
@@ -314,7 +317,7 @@ export function configValueDoors(input, enter = ENTER_AS_IS) {
     }));
     if (taskStore !== undefined)
         enter("taskConfig", () => assertRetentionCapability({ ...retention, stores: [{ name: "checkpointStore", store: taskStore }] }));
-    return { toolFaceLists, promptHost, promptBinding, lockedPreflight, skillListingSeats, skills, microCompactKnob, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailMs };
+    return { toolFaceLists, promptHost, promptBinding, lockedPreflight, skillListingSeats, skills, microCompactKnob, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailMs, crossBoundaryPosture };
 }
 export function refuseResumeDoors(config, recordedGate, deps, sessions) {
     asResumeConfigRefusal("taskConfig", () => {
@@ -323,6 +326,7 @@ export function refuseResumeDoors(config, recordedGate, deps, sessions) {
         screenApprovalReach(config.approvalReach);
         screenUserInvokedSkills(config);
         screenUserAttachments(config.userAttachments, { resumeLeg: true });
+        assertToolBoundaryLegs(config.tools);
     });
     const { lockedPreflight, skills } = configValueDoors({ spec: config, deps, resumeLeg: true, sessions }, asResumeConfigRefusal);
     asResumeConfigRefusal("inheritedGate", () => void recordedModeSeed(recordedGate));
@@ -330,8 +334,9 @@ export function refuseResumeDoors(config, recordedGate, deps, sessions) {
 }
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;
+    assertToolBoundaryLegs(input.spec.tools);
     let spec = input.spec;
-    const { toolFaceLists, promptHost, promptBinding, lockedPreflight, skillListingSeats, skills, microCompactKnob, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailMs } = configValueDoors({ spec, deps, resumeLeg: resume !== undefined, sessions });
+    const { toolFaceLists, promptHost, promptBinding, lockedPreflight, skillListingSeats, skills, microCompactKnob, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailMs, crossBoundaryPosture } = configValueDoors({ spec, deps, resumeLeg: resume !== undefined, sessions });
     spec = Object.create(Object.getPrototypeOf(spec), { ...Object.getOwnPropertyDescriptors(spec), skills: { value: skills, enumerable: skills !== undefined, writable: false, configurable: false } });
     const promptProfile = resolveModelPromptTraits({ id: "" }, spec, internals).promptProfile;
     const resolvedInteractionPosture = spec.interactionPosture ?? internals?.parentInteractionPosture ?? deps.interactionPosture;
@@ -476,7 +481,7 @@ export function prepareConfigDoors(input) {
         memoryDelegationEvidence,
         skillListingBudget,
         memoryProvenance,
-        memoryCapturePolicy,
+        memoryCapturePolicy, crossBoundaryPosture,
         usageWindows,
         brainCallGuardrailRef,
         brainCallGuardrailMs,

package/dist/core/runner/prepare-context-lane.js

@@ -1,5 +1,6 @@
 import { DEFAULT_CHARS_PER_TOKEN, estimateContextTokens } from "../../internal/harness.js";
 import { TOOL_TURN_REPAIR_DROPS } from "../../internal/llm.js";
+import { droppedTransmissions } from "../user-attachment.js";
 import { clearStaleToolResults, createClearedProjectionLedger, dropEmptyFailureAssistants, editBudget, replayClearedProjection, resolveTriggerWindow } from "../context-edit.js";
 import { guardBudget, insertTrimNotice, protectGitFrame, trimToBudget } from "../context-guard.js";
 import { capAggregateMediaBytes, mediaBudgetBytes } from "../media-byte-cap.js";
@@ -155,14 +156,14 @@ function buildMicroCompactState(deps, model, sessionId, runId, offloadStore, kno
     };
 }
 export function landStaleResultClears(args) {
-    const clearedToolCallIds = [];
+    const transmissions = [];
     for (const c of args.cleared) {
         args.ledger.entries.set(c.key, { marker: c.marker, groupCount: c.groupCount, fp: c.fp });
         if (c.toolCallId !== undefined)
-            clearedToolCallIds.push(c.toolCallId);
+            transmissions.push(c.toolCallId);
     }
     if (args.readFileState !== undefined) {
-        applyContextShrinkToReadFileState(args.readFileState, { kind: "tool-results-cleared", clearedToolCallIds });
+        applyContextShrinkToReadFileState(args.readFileState, { kind: "transmissions-gone", transmissions });
     }
 }
 function recordFrontierClears(args) {
@@ -209,6 +210,8 @@ export async function runGuardChain(args) {
         if (dropped) {
             args.trimPressureRef.droppedMessages = true;
             const droppedCount = view.length - trimmed.length;
+            if (args.readFileState !== undefined)
+                applyContextShrinkToReadFileState(args.readFileState, { kind: "transmissions-gone", transmissions: droppedTransmissions(view, trimmed) });
             trimmed = insertTrimNotice(trimmed);
             emitTrace(deps.tracer, () => ({
                 kind: "context.trim",

package/dist/core/runner/prepare-delegation-surface.d.ts

@@ -75,8 +75,9 @@ export interface PrepareDelegationSurfaceInput {
      *  Writers here: the eight mounts (TaskOutput, TaskStop, SendMessage, AgentTranscript, ListAgents, Monitor, the worktree
      *  pair, the offload reader), every one a `mount`. */
     roster: RosterBuilder;
-    /** borrowed-mutable — the effect collection (`Prepared.toolEffects`). Writers here: TaskOutput → read, TaskStop / SendMessage
-     *  (built-in mount only) / Monitor / EnterWorktree / ExitWorktree → write. */
+    /** borrowed-readonly — not read by this phase: the effect collection (`Prepared.toolEffects`), the same map `roster` writes at each mount
+     *  (TaskOutput → read, TaskStop / SendMessage / Monitor / EnterWorktree / ExitWorktree → write, ReadInbox / ListAgents and its
+     *  alias → read), each from the mounted tool's own declaration; this phase writes nothing into it by name. */
     toolEffects: Map<string, ToolEffect>;
     /** borrowed-mutable — the explicit-negative axis declarations. Writer here: the built-in SendMessage mount's `egress: false`
      *  (report-face only). */

package/dist/core/runner/prepare-delegation-surface.js

@@ -13,7 +13,7 @@ import { deliverEngineNotice } from "../types.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { sendMessageContinuationSeats } from "./send-message-continuation.js";
 export function prepareDelegationSurface(input) {
-    const { spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, taskRootCanonical, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, sessionBox, roster, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, checkpointSeat, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle } = input;
+    const { spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, taskRootCanonical, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, sessionBox, roster, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, checkpointSeat, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle } = input;
     let worktreeSessionRef;
     const delegationSurfaceActive = backgroundTaskToolsActive || workflowToolsActive;
     const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
@@ -83,10 +83,9 @@ export function prepareDelegationSurface(input) {
         }
     }
     if (sessionBox !== undefined && internals?.onTaskNotification !== undefined && leaves({ name: READ_INBOX_TOOL_NAME }) && !(spec.tools ?? []).some((t) => t.name === READ_INBOX_TOOL_NAME)) {
-        toolEffects.set(READ_INBOX_TOOL_NAME, "read");
         roster.mount(firstPartyOffload(createReadInboxTool({ pull: () => peerLaneRefs.pull, ...(terminalsDrainPrincipalInbox(deps) ? { coversPrincipalInbox: true } : {}) })), { source: "builtin", mountedBy: "peerLane" });
     }
-    const listAgents = (peerLaneActive || delegationSurfaceActive) && peerSendMessageBuiltIn && listAgentsMountable({ leaves, specTools: spec.tools ?? [] }) ? mountListAgents({ ...(peerLaneActive ? { peerDirectory: deps.peerDirectory } : {}), freshWindowMs: resolvePeerLaneConfig(deps.peerLane, deps.onNotice).listingFreshWindowMs, sessionId, scope: taskScope, hostTaskId, ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}), ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}), registry: defaultTaskRegistry, ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}), ...(sendMessageTier !== undefined ? { continuationTier: sendMessageTier } : {}), ...(checkpointSeat !== undefined ? { readSeats: { checkpointSeat } } : {}), specTools: spec.tools ?? [], toolEffects }) : undefined;
+    const listAgents = (peerLaneActive || delegationSurfaceActive) && peerSendMessageBuiltIn && listAgentsMountable({ leaves, specTools: spec.tools ?? [] }) ? mountListAgents({ ...(peerLaneActive ? { peerDirectory: deps.peerDirectory } : {}), freshWindowMs: resolvePeerLaneConfig(deps.peerLane, deps.onNotice).listingFreshWindowMs, sessionId, scope: taskScope, hostTaskId, ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}), ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}), registry: defaultTaskRegistry, ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}), ...(sendMessageTier !== undefined ? { continuationTier: sendMessageTier } : {}), ...(checkpointSeat !== undefined ? { readSeats: { checkpointSeat } } : {}), specTools: spec.tools ?? [] }) : undefined;
     if (listAgents !== undefined)
         roster.mount(firstPartyOffload(listAgents), { source: "builtin", mountedBy: "peerLane" });
     if (backgroundTaskToolsActive) {

package/dist/core/runner/prepare-execution-env.d.ts

@@ -20,8 +20,7 @@ export interface PrepareExecutionEnvInput {
     /** borrowed-readonly — the trusted spawn-side requests: the explicit cwd (a contract), the isolation
      *  request and the parent's cwd (both threaded to the factory ctx). */
     internals: Pick<RunInternals, "requestedCwd" | "isolation" | "parentCwd" | "callerRoot" | "worktreeOffered"> | undefined;
-    /** borrowed-readonly — the resume leg, read only to refuse an explicit cwd that a checkpoint workspace
-     *  restore would overrule. */
+    /** borrowed-readonly — the resume leg: read to refuse an explicit cwd a checkpoint restore would overrule, and to tell the factory which workspace it rebuilds. */
     resume: Pick<PrepareResume, "workspaceHandle"> | undefined;
     /** borrowed-readonly — the run tree's placement fixed point, resolved ONCE by the driver; the factory
      *  door refuses an empty value loudly before the factory is asked. */

package/dist/core/runner/prepare-execution-env.js

@@ -1,5 +1,5 @@
 import { StubExecutionEnv } from "../stub-env.js";
-import { hasDestroy } from "../remote-env.js";
+import { frozenHandleCopy, hasDestroy } from "../remote-env.js";
 import { announceMalformedCapabilities } from "./env-capability-census.js";
 import { childPlacementOnLeg, deploymentCanRerootChild, worktreeNotHonored } from "./child-tree.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
@@ -24,6 +24,7 @@ export async function prepareExecutionEnv(input) {
                 taskId: spec.taskId,
                 ...(internals?.isolation ? { isolation: internals.isolation } : {}),
                 ...(internals?.parentCwd ? { parentCwd: internals.parentCwd } : {}),
+                ...(resume?.workspaceHandle !== undefined ? { resumeWorkspace: frozenHandleCopy(resume.workspaceHandle) } : {}),
             })
             : undefined;
         if (ownedEnv !== undefined)

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -170,6 +170,8 @@ export interface PrepareGateStationsInput {
     /** borrowed-readonly — the leg's shell READ STATION (`ToolGateInput.shellReadCheck`), mounted by the hands phase, or
      *  undefined with no real shell: no station, nothing judged. */
     shellReadCheck: ShellReadCheck | undefined;
+    /** borrowed-readonly — the leg's cross-boundary seat (`ToolGateInput.crossBoundaryCheck`), or undefined on a leg whose station is not engaged. */
+    crossBoundaryCheck: import("../cross-boundary-taint.js").CrossBoundaryCheck | undefined;
     /** borrowed-readonly — the leg's resolved read face (`undefined` with no hands), read per call into the class derivation. */
     readFace: () => ContainmentFace | undefined;
     /** borrowed-readonly — the per-tool irreversibility tier handed to the gate per call. */

package/dist/core/runner/prepare-gate-stations.js

@@ -46,7 +46,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, frameSettlement, seatInputsFor, modBus, inheritedToolChecks } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, crossBoundaryCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, frameSettlement, seatInputsFor, modBus, inheritedToolChecks } = input;
     const releasesAnnounced = new Map();
     const onModeReleased = (info) => {
         const table = info.readUnestablished === true ? input.readDenyInForce(info.toolCallId) : undefined;
@@ -86,7 +86,8 @@ export function prepareGateStations(input) {
                 spec.enablePlanMode === true ||
                 complianceDenies.has("web_fetch") ||
                 writeProtectionArmed ||
-                shellReadCheck !== undefined;
+                shellReadCheck !== undefined ||
+                crossBoundaryCheck !== undefined;
         if (toolCallGateArmedRef.armed) {
             harness.on("tool_call", async (called) => {
                 const e = { ...called, toolName: rosterToolName(toolRosterDeltas.current, called.toolName) };
@@ -132,7 +133,7 @@ export function prepareGateStations(input) {
                         egress: heldBy("gate.egress", egressTools, call),
                         peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
-                        ...(shellReadCheck !== undefined ? { shellReadCheck } : {}),
+                        ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(crossBoundaryCheck !== undefined ? { crossBoundaryCheck } : {}),
                         readFace,
                         irreversibility: tierSeat?.value,
                         reversibilityProbe: tierSeat?.read(reversibilityProbes),

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -260,8 +260,8 @@ export interface PrepareHandsReadFaceResult {
     grantReadRoot: GrantReadRoot | undefined;
     /** owned — the store cell {@link grantReadRoot} judges against; the driver threads it to its one writer, the Artifact phase. */
     artifactStoreRef: ArtifactStoreRef | undefined;
-    /** owned — the canonical containment root, published so the working-file ATTACHMENT
-     *  reader applies the same containment the hands tools do. Undefined ⇔ hands-less. */
+    /** owned — the canonical containment root, published so the compaction's kept-tail path
+     *  normalizer resolves the way the hands tools do. Undefined ⇔ hands-less. */
     attachmentRootCanonical: string | undefined;
     /** owned — the run's read deny table ({@link pathTables}' facade: the run's latest, `forCall` a call's own). Undefined ⇔
      *  hands-less (its consumers only exist with hands). */

package/dist/core/runner/prepare-hands-readface.js

@@ -254,7 +254,7 @@ export async function prepareHandsMount(input) {
                     if (rk === undefined)
                         continue;
                     if ("content" in rec)
-                        seedReadFileStateFromTranscript(readFileState, rk, rec.content, rec.at);
+                        seedReadFileStateFromTranscript(readFileState, rk, rec.content, rec.at, rec.transmittedByToolCallId);
                     else
                         readFileState.set(rk, { ...rec.observation, lastReadAt: rec.at });
                 }

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -70,6 +70,8 @@ export interface PrepareInheritedGateInput {
     deps: Pick<RunnerDeps, "autoMode" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "compliancePostureResolver" | "onError" | "onNotice" | "executionEnv" | "delegationEntryCaps" | "rosterStore" | "onBackgroundChildEvent" | "onQuestion">;
     /** borrowed-readonly — the run's approval seat as the config doors froze it: the frozen approver, and this leg's chain view. */
     askSeat: import("../wiring-manifest.js").AskSeat;
+    /** borrowed-readonly — the tree's cross-boundary token (the leg's lane: inherited, or minted by a root leg), handed to children. */
+    crossBoundaryTree: import("../cross-boundary-taint.js").CrossBoundaryTreeToken;
     /** borrowed-readonly — the trusted spawn-side channel: `inheritedGate` (the LIVE half of the chain fold), `ownOrgAdmissionRef`
      *  (the same-session continuation's freeze), `delegationProvenance` (the F-012 stamp), and the identity / peer / notification
      *  seats the ctx enrichment forwards. Never mutated. */

package/dist/core/runner/prepare-inherited-gate.js

@@ -246,6 +246,7 @@ export function prepareInheritedGate(input) {
             activeSkillGrants: () => skillGrants.records(),
             activeRequestAllowedTools: () => input.requestAllowedTools.entries(),
             inheritedGateForChildren,
+            crossBoundaryTreeForChildren: input.crossBoundaryTree,
             delegationProvenanceForChildren,
             delegationSettlement: delegationSettlementForChildren,
             ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),

package/dist/core/runner/prepare-park-ask.d.ts

@@ -20,7 +20,7 @@
  * closures, so the orchestrator grows no branch.
  */
 import type { AgentHarness, AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
-import type { CallTargetStamp } from "../effective-path-target.js";
+import { type CallTargetStamp } from "../effective-path-target.js";
 import { type OnQuestion } from "../ask-question.js";
 import { type CheckpointStore } from "../checkpoint-store.js";
 import type { GrantBindingOf } from "../skill-grant-binding.js";

package/dist/core/runner/prepare-park-ask.js

@@ -1,15 +1,17 @@
+import { callTargetReadingOf } from "../effective-path-target.js";
+import { approvalTargetsOf } from "../approval-object.js";
 import { uuidv7 } from "../../engine/session/uuid.js";
 import { Value } from "typebox/value";
 import { classifyQuestionOutcome, validateAskQuestions } from "../ask-question.js";
 import { hasBackgroundShell, sweepBackgroundShells, sweepRunBoundaryBackgroundShells } from "../background-shell.js";
-import { boundInputHashOf } from "../canonical-json.js";
+import { boundInputHashOf, exactBoundInputHashOf } from "../canonical-json.js";
 import { unencodableIn } from "../checkpoint-requirements.js";
 import { buildRiskDescriptor, debitLedger, encodeAtFidelity, mintCheckpointId, mintCheckpointToken, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { pauseOf } from "../pause-registry.js";
 import { askCarryRowMembers } from "../hooks.js";
 import { askMandateMember, ownedClearanceFacts } from "../ask-origin.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { advertisedWritableRootsSeat, exemptRootsSeat, isLiveApproverSeat, carriesBidiControls, describeThrown, ownArgs, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, exemptRootsSeat, isLiveApproverSeat, licenseCovers, carriesBidiControls, describeThrown, ownArgs, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
 import { InMemoryToolResultStore, ScopedToolResultStore, isVolatileOffloadStore } from "../tool-result-store.js";
 import { raceAbort, raceSettlementAgainstSignal } from "./abort-race.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
@@ -147,6 +149,9 @@ export function prepareParkAsk(input) {
                 const unencodable = unencodableIn(parkedArgs, "pendingAction.args");
                 if (unencodable !== undefined)
                     throw new ParkRefusal(`the arguments of "${req.toolName}" cannot be bound into the approval row's digest (${unencodable.kind} at ${unencodable.path}) — a durable approval row must hold an inert snapshot of exactly what a human approves and a resume executes`);
+                const parkedHash = exactBoundInputHashOf(parkedArgs);
+                if (parkedHash === undefined)
+                    throw new ParkRefusal(`the arguments of "${req.toolName}" hold a value no exact digest binds — no approval row can be bound to them`);
                 const projectionMovedArgs = backendFidelity !== "structured-clone" && !samePlainValue(parked.value, parkedArgs);
                 if (projectionMovedArgs && basePolicyForResumeEdit === undefined) {
                     throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and no policy is wired to re-adjudicate the stored shape ` +
@@ -306,6 +311,7 @@ export function prepareParkAsk(input) {
                         toolCallId: req.toolCallId,
                         toolName: req.toolName,
                         ...parkedToolIdentity(toolRosterDeltas.current, req.toolName), ...parkedToolFace(toolRosterDeltas.current, req),
+                        ...approvalTargetsOf(licenseCovers(parkedHash, req.args) ? callTargetReadingOf(req) : undefined),
                         args: parkedArgs,
                         ...(() => {
                             const p = approvalPreviewOf(req.toolName, parkedArgs);
@@ -320,7 +326,7 @@ export function prepareParkAsk(input) {
                         ...askMandateMember(clearanceFacts),
                         ...askCarryRowMembers(carry),
                         ...ruleOffersOf(req, parkedArgs, clearanceFacts),
-                        boundInputHash: boundInputHashOf(parkedArgs),
+                        boundInputHash: parkedHash,
                         ...grantBindingOf(req, parkedArgs),
                         batchToolCallIds,
                         completedCallIds,

package/dist/core/runner/prepare-policy-chain.js

@@ -639,7 +639,6 @@ export async function preparePolicyChain(input) {
             const finalReq = await withArgsReading(req, decision.updatedInput, signal);
             let asked;
             let revalidated;
-            let restated;
             try {
                 for (const layer of recheckLayers) {
                     const d = refuseOutOfContractDecision(await layer.check(finalReq, signal));
@@ -655,8 +654,6 @@ export async function preparePolicyChain(input) {
                     }
                     if (d.action === "ask" && asked === undefined)
                         asked = d;
-                    if (d.action === "allow" && restated === undefined && d.decisionReason !== undefined)
-                        restated = d.decisionReason;
                     revalidated = mergeAttestation(req, revalidated, d.attestation);
                 }
             }
@@ -666,10 +663,8 @@ export async function preparePolicyChain(input) {
             if (asked !== undefined && decision.action === "allow") {
                 return { ...asked, updatedInput: decision.updatedInput };
             }
-            if (decision.action === "allow") {
-                const owned = { ...decision, ...(decision.decisionReason === undefined && restated !== undefined ? { decisionReason: restated } : {}) };
-                return withAttestation(owned, mergeAttestation(req, attestationOf(decision, req), revalidated));
-            }
+            if (decision.action === "allow")
+                return withAttestation(decision, mergeAttestation(req, attestationOf(decision, req), revalidated));
             return decision;
         })
         : foldedPolicy;

package/dist/core/runner/prepare-safety-scan.d.ts

@@ -7,7 +7,7 @@ export interface PrepareSafetyScanInput {
      *  `tools`, `handsReadOnly` and `enablePlanMode`; it never mutates. Typed as a spec whose roster is snapshot faces. */
     spec: RosterSpec;
     /** borrowed-readonly — read only for the hands-enablement fact (`executionEnvFactory`/
-     *  `executionEnv` presence gates the hand-band effect preseed). */
+     *  `executionEnv` presence puts the hand band among the wake candidates). */
     deps: RunnerDeps;
 }
 /**
@@ -26,8 +26,13 @@ export interface PrepareSafetyScanInput {
  *    overrides a scanned value).
  */
 export interface PrepareSafetyScanResult {
-    /** borrowed-mutable — per-tool effect registry (alias-complete), the reconcile/path-policy read. */
+    /** borrowed-mutable — per-tool effect registry (alias-complete), the path-policy / gate read. This scan writes the caller tools'
+     *  own declarations (the roster's kept instance); every engine effect arrives with its tool's mount, never by name beforehand. Open
+     *  defect #2107 (7.55.0, design ticket): a selector that keeps a caller instance under a name and unmounts only the engine's leaves the engine's entry. */
     toolEffects: Map<string, ToolEffect>;
+    /** owned, read once — the wake reconcile's reading (`wakeEffectsOf`): `toolEffects` as this scan leaves it, with every catalog
+     *  definition this leg may still mount (`engineCandidatesOf`) folded in as a candidate. Built before any mount; no later phase writes it. */
+    wakeEffects: Map<string, ToolEffect>;
     /** borrowed-mutable — egress-marked tools (external writes; the gate never auto-allows them). */
     egressTools: Set<string>;
     /** borrowed-mutable — tools whose effect is irreversible (`always`, or `maybe` incl. by probe). */