@sema-agent/core 7.53.0 → 7.54.0

package/dist/core/mcp-server-spec.d.ts

@@ -55,6 +55,8 @@ export interface McpServerSpec {
      * override is AUTHORITATIVE and may LOWER an effect (vouch a tool is `read`/`idempotent`) as well as raise it
      * (`egress` / irreversible). This is the ONLY trusted way to drop an MCP tool below the fail-closed `write`
      * default (design F). Folds over the server hints in prepare-task (caller > server hint > fail-closed write).
+     * `boundaryFlow: "engine"` vouches that a call's effect stays inside the engine: the tool's roster row states no boundary legs
+     * (`boundaryLegs: []`) instead of the legs its effect implies — it needs `egress: false` beside it (refused otherwise).
      *
      * A DIFFERENT AXIS from {@link contentOrigin}: this one is about what a call DOES (repeat-safety,
      * blast radius, reversibility — it feeds the approval gate); the content class is about what a call
@@ -75,16 +77,19 @@ export interface McpServerSpec {
         effect?: ToolEffect;
         egress?: boolean;
         irreversibility?: "always" | "never";
+        boundaryFlow?: "engine";
     }>;
     /**
      * design/388 §1.1 / §2.7 — the OPTIONAL per-tool FACE overlay for this server's tools (keyed by the server's
      * RAW tool name, like {@link allowTools} / {@link toolAxes}): a deployment lets an MCP tool enter a specialised
      * approval card, be confirmed by path, carry a display name / summary, or narrow its rule vocabulary. TRUSTED
-     * (the deployment writes it), but validated against the MATERIALIZED schema at every listing (first mount and
-     * every refresh): a `pathTarget.param` that is not a top-level property, an `approvalCard` whose keys the schema
-     * lacks, a `ruleFace` naming a non-scalar key ⇒ the tool mounts WITHOUT the overlay and the leg announces
-     * `config.tool_face_invalid` once; a key naming a tool the listing does not carry announces
-     * `config.tool_face_undeclared` once. Applied whole or not at all.
+     * (the deployment writes it). It is read once by `readToolFaces` at the preparation door and at `materializeMcpTools`: a
+     * declaration that does not fit on its own (a member the types do not have, a member of the wrong kind, a word outside a
+     * closed table, a reserved approval card, an empty tool name) refuses the entry under `config.tool_face_invalid` — the whole
+     * prepare at the door. What only the schema can say is judged at every listing (first mount and every refresh): a
+     * `pathTarget.param` that is not a top-level property, an `approvalCard` whose keys the schema lacks, a `ruleFace` naming a
+     * non-scalar key ⇒ that tool is NOT mounted and the leg announces `config.tool_face_invalid` once; a key naming a tool the
+     * listing does not carry announces `config.tool_face_undeclared` once. Applied whole or not at all.
      */
     toolFaces?: Record<string, {
         family?: ToolFamily;
@@ -185,6 +190,12 @@ export type ToolAxesRead = {
     ok: false;
     problem: string;
 };
+/** A name the declarer wrote, quoted and bounded for a sentence (the sentence names; it never carries a value). The bound holds on the
+ *  QUOTED form — escaping a quote, a backslash or a control character lengthens a name — so a sentence's budget is spent the same way
+ *  whatever the name holds. */
+export declare function quotedName(name: string): string;
+/** The kind of a value that is plain data, for a sentence that names what was declared without carrying it. */
+export declare function dataKind(value: unknown): string;
 /**
  * Where a declaration stops being one: the path from the declaration's root — a list index as a number, a member name as a string — and
  * the clause that says what is there ("it contains itself; …"): a kind and a remedy, never a value the declarer wrote.
@@ -220,6 +231,9 @@ export interface DeclarationPathRule {
  * surface's row: it is a member the surface does not read.
  */
 export declare const DECLARATION_PATH_RULES: Readonly<Record<ToolAxesSurface, readonly DeclarationPathRule[]>>;
+/** The rules of a declaration that fixes no path beyond plain data and lists of names (a `toolAxes` record, a lock declaration): the one
+ *  empty table, passed on purpose — {@link receiveDeclaration} takes its rules as an argument and refuses an absent one. */
+export declare const NO_DECLARATION_PATH_RULES: readonly DeclarationPathRule[];
 /**
  * The one reading of a declaration a caller hands the engine — an MCP server's or an A2A peer's entry (the snapshot), a `toolAxes`
  * record ({@link readToolAxes}), a lock declaration: the engine's one receipt of a caller's object in its declaration mode, so the
@@ -227,20 +241,62 @@ export declare const DECLARATION_PATH_RULES: Readonly<Record<ToolAxesSurface, re
  * vocabulary over the copy (a list holds names; no member is named `__proto__`; each path `rules` names holds what its rule says — an
  * entry's rules are its surface's {@link DECLARATION_PATH_RULES}). The copy is the answer — the caller's object is never handed on and
  * never read again. A copy that is not a record is answered as it is, for the reader that expected a record to word.
+ *
+ * `rules` is required: a surface's {@link DECLARATION_PATH_RULES} row, or an empty list ({@link NO_DECLARATION_PATH_RULES} is the engine's
+ * own) for a declaration that fixes no path. A value that is not a list (an absent one — what an `at` outside the surfaces indexes to — `null`, a string, an inherited
+ * member of the table) is a caller's mistake about which declaration it holds, refused loudly (`config.invalid_argument`) rather than
+ * read as "no path rule", which would judge the declaration by less than its surface fixes.
+ */
+export declare function receiveDeclaration(declared: unknown, rules: readonly DeclarationPathRule[]): DeclarationRead;
+/**
+ * The per-tool declarations a spec carries as ONE record keyed by the remote tool (or skill) name — what each is called in a
+ * sentence about it. Every reader of such a record ({@link readToolAxes}, `readToolFaces`) opens it through
+ * {@link receivePerToolDeclaration} and words a refusal through the two sentence functions below, so the one receipt, the one
+ * fault vocabulary and the one sentence shape are not written twice.
+ */
+declare const PER_TOOL_DECLARATIONS: {
+    readonly toolAxes: {
+        readonly plural: "axes";
+        readonly singular: "axis";
+    };
+    readonly toolFaces: {
+        readonly plural: "faces";
+        readonly singular: "face";
+    };
+};
+type PerToolDeclaration = keyof typeof PER_TOOL_DECLARATIONS;
+/** {@link receivePerToolDeclaration}'s answer: the receipt's copy as a record keyed by name, or the one sentence that says why not. */
+type PerToolDeclarationRead = {
+    readonly ok: true;
+    readonly perTool: Readonly<Record<string, unknown>>;
+} | {
+    readonly ok: false;
+    readonly problem: string;
+};
+/**
+ * A per-tool declaration's receipt: {@link receiveDeclaration} (plain data held to the engine's one depth, every own member read once,
+ * lists of names, no `__proto__`), then the copy must be a record of names. A refusal names the tool (or skill) and the member where
+ * reading stopped, never a value. `unit` is what the keys are called (`tool` / `skill`).
  */
-export declare function receiveDeclaration(declared: unknown, rules?: readonly DeclarationPathRule[]): DeclarationRead;
+export declare function receivePerToolDeclaration(declared: unknown, field: PerToolDeclaration, unit: string): PerToolDeclarationRead;
+/** The sentence for one tool's (or skill's) declaration that does not fit: `detail` says which member and why. */
+export declare function perToolEntryRefusal(field: PerToolDeclaration, unit: string, key: string, detail: string): string;
+/** The sentence for a per-tool declaration that names a tool (or skill) with an empty name. */
+export declare function perToolEmptyName(field: PerToolDeclaration, unit: string): string;
 /**
  * The one reader of a raw `toolAxes` declaration — {@link McpServerSpec.toolAxes} and {@link A2aServerSpec.toolAxes} are the same
  * declaration, and the engine's preparation door, its materialization of an MCP server and of an A2A peer, and every host that
  * assembles the field from JSON ask this same function. `at` names the surface the declaration sits on, because that decides what its
  * keys are called in the sentence: `"mcp"` — the server's remote tools; `"a2a"` — the peer's remote skills. Absent ⇒ `{ ok: true }`
  * (nothing declared). Anything else must be an object of per-tool objects whose members are exactly `effect` /
- * `egress` / `irreversibility` with legal values; a declaration of any other shape, an empty tool name, an
+ * `egress` / `irreversibility` / `boundaryFlow` with legal values; a declaration of any other shape, an empty tool name, an
  * unknown member, a word outside the vocabulary or a non-boolean `egress` on ANY one tool refuses the whole
  * declaration (`ok: false`) — the good tools are not kept and nothing is defaulted, since a caller axis is
  * two-way (it can vouch a tool down as well as mark it up) and a silently lost half is a trust root that is
- * not in force. The reader judges SHAPE only; whether the axes contradict each other (`egress` over a
- * non-write effect) is the ingestion's own arithmetic. The declaration is read once, as plain data, by {@link receiveDeclaration} — a
+ * not in force. `boundaryFlow: "engine"` (the call's effect stays inside the engine — the tool's roster row states no
+ * boundary legs) needs `egress: false` in the same entry — `egress: true` contradicts it and an absent one leaves a server hint
+ * or the peer default marking it an external write — refused here; whether the other axes contradict each other (`egress`
+ * over a non-write effect) is the ingestion's own arithmetic. The declaration is read once, as plain data, by {@link receiveDeclaration} — a
  * Proxy, a map, a class instance, a record built on a prototype or in another realm, a getter that throws, a structure that contains
  * itself, a tool named `__proto__` are refusals that say where they sit (never the thrown text), not a throw — and judged on that copy.
  * `at` is the caller's own word, not the declarer's: one outside {@link ToolAxesSurface} throws `config.invalid_argument` naming the
@@ -325,6 +381,7 @@ export interface A2aServerSpec {
         effect?: ToolEffect;
         egress?: boolean;
         irreversibility?: "always" | "never";
+        boundaryFlow?: "engine";
     }>;
 }
 /**

package/dist/core/mcp-server-spec.js

@@ -18,7 +18,7 @@ function toolAxesSurfaceOf(at) {
     throw invalidArgument(`toolAxes is read for a surface, and the surfaces are ${Object.keys(TOOL_AXES_SURFACES).map((s) => JSON.stringify(s)).join(" | ")} ` +
         `(an MCP server's tools, an A2A peer's skills); the surface named is not one of them.`);
 }
-const TOOL_AXIS_MEMBERS = { effect: true, egress: true, irreversibility: true };
+const TOOL_AXIS_MEMBERS = { effect: true, egress: true, irreversibility: true, boundaryFlow: true };
 const TOOL_AXIS_MEMBER_NAMES = Object.keys(TOOL_AXIS_MEMBERS);
 const TOOL_EFFECT_WORDS = SAFETY_AXIS_VOCABULARY.toolEffect;
 const ENGINE_DERIVED_IRREVERSIBILITY = "maybe";
@@ -27,9 +27,16 @@ const irreversibilityPolesLockstep = true;
 void irreversibilityPolesLockstep;
 const toolAxesDeclarationsAreOne = true;
 void toolAxesDeclarationsAreOne;
-function quotedName(name) {
-    return JSON.stringify(name.length > 80 ? `${name.slice(0, 80)}…` : name);
+export function quotedName(name) {
+    const whole = JSON.stringify(name);
+    if (name.length <= 80 && whole.length <= QUOTED_NAME_MAX)
+        return whole;
+    let cut = Math.min(name.length, 80);
+    while (cut > 0 && JSON.stringify(`${name.slice(0, cut)}…`).length > QUOTED_NAME_MAX)
+        cut--;
+    return JSON.stringify(`${name.slice(0, cut)}…`);
 }
+const QUOTED_NAME_MAX = 83;
 function memberNames(path) {
     let rendered = "";
     for (const [index, name] of path.entries()) {
@@ -39,7 +46,7 @@ function memberNames(path) {
     }
     return rendered;
 }
-function dataKind(value) {
+export function dataKind(value) {
     return value === null ? "null" : value === undefined ? "undefined" : Array.isArray(value) ? "an array" : typeof value === "object" ? "a record" : `a ${typeof value}`;
 }
 const RECEIPT_FAULT_PROBLEMS = {
@@ -63,12 +70,13 @@ export const DECLARATION_PATH_RULES = Object.freeze({
         { path: ["name"], holds: "a string", required: true },
         { path: ["transport", "env"], holds: "names to strings" },
         { path: ["transport", "headers"], holds: "names to strings" },
-    ]),
+    ].map((rule) => Object.freeze({ ...rule, path: Object.freeze([...rule.path]) }))),
     a2a: Object.freeze([
         { path: ["name"], holds: "a string", required: true },
         { path: ["headers"], holds: "names to strings" },
-    ]),
+    ].map((rule) => Object.freeze({ ...rule, path: Object.freeze([...rule.path]) }))),
 });
+export const NO_DECLARATION_PATH_RULES = Object.freeze([]);
 const PROTO_MEMBER = `it is a member named "__proto__", which a copy by assignment would turn into a prototype — not a name a declaration can carry`;
 function declarationVocabularyFault(root, rules) {
     const asked = new Set();
@@ -148,7 +156,11 @@ function declarationVocabularyFault(root, rules) {
     }
     return problem === undefined ? undefined : { path, problem };
 }
-export function receiveDeclaration(declared, rules = []) {
+export function receiveDeclaration(declared, rules) {
+    if (!Array.isArray(rules)) {
+        throw invalidArgument(`a declaration is received with the path rules of its surface (${Object.keys(DECLARATION_PATH_RULES).map((s) => `DECLARATION_PATH_RULES[${JSON.stringify(s)}]`).join(" | ")}), ` +
+            `or an empty list when it fixes no path; what was passed is ${dataKind(rules)}, not a list of rules.`);
+    }
     const received = receive(declared, DECLARATION_RECEIPT_MODE);
     if (!received.ok)
         return { ok: false, fault: declarationFaultOf(received.fault) };
@@ -175,38 +187,59 @@ function readToolAxisEntry(raw) {
             return `member ${quotedName(member)} is a hidden member: its name answers a value the declaration does not list as its own`;
         declared[member] = value;
     }
-    const { effect, egress, irreversibility } = declared;
+    const { effect, egress, irreversibility, boundaryFlow } = declared;
     if (effect !== undefined && !isToolEffectWord(effect))
         return `member "effect" is not one of ${TOOL_EFFECT_WORDS.join(" | ")}`;
     if (egress !== undefined && typeof egress !== "boolean")
         return `member "egress" is not a boolean`;
     if (irreversibility !== undefined && !isIrreversibilityPoleWord(irreversibility))
         return `member "irreversibility" is not one of ${IRREVERSIBILITY_POLE_WORDS.join(" | ")}`;
+    if (boundaryFlow !== undefined && boundaryFlow !== "engine")
+        return `member "boundaryFlow" is not "engine"`;
+    if (boundaryFlow === "engine" && egress !== false)
+        return `member "boundaryFlow": "engine" needs "egress": false in the same entry — add it, or drop "boundaryFlow" (${egress === true ? '"egress": true contradicts it' : 'with no "egress", the server hint or the peer default stays in force'})`;
     return {
         ...(effect !== undefined ? { effect } : {}),
         ...(egress !== undefined ? { egress } : {}),
         ...(irreversibility !== undefined ? { irreversibility } : {}),
+        ...(boundaryFlow !== undefined ? { boundaryFlow } : {}),
     };
 }
-export function readToolAxes(declared, at) {
-    const unit = toolAxesSurfaceOf(at).key;
-    if (declared === undefined)
-        return { ok: true };
-    const received = receiveDeclaration(declared);
+const PER_TOOL_DECLARATIONS = {
+    toolAxes: { plural: "axes", singular: "axis" },
+    toolFaces: { plural: "faces", singular: "face" },
+};
+export function receivePerToolDeclaration(declared, field, unit) {
+    const received = receiveDeclaration(declared, NO_DECLARATION_PATH_RULES);
     if (!received.ok) {
         const [key, ...member] = received.fault.path;
         if (key === undefined)
-            return { ok: false, problem: `toolAxes cannot be read: ${received.fault.problem}` };
+            return { ok: false, problem: `${field} cannot be read: ${received.fault.problem}` };
         const where = member.length > 0 ? `member ${memberNames(member)}: ` : "";
-        return { ok: false, problem: `the axes declared for ${unit} ${quotedName(String(key))} do not fit: ${where}${received.fault.problem}` };
+        return { ok: false, problem: perToolEntryRefusal(field, unit, String(key), `${where}${received.fault.problem}`) };
     }
     const perTool = received.value;
     if (!isPlainRecord(perTool))
-        return { ok: false, problem: `toolAxes is ${dataKind(perTool)}, not an object of per-${unit} axis declarations` };
+        return { ok: false, problem: `${field} is ${dataKind(perTool)}, not an object of per-${unit} ${PER_TOOL_DECLARATIONS[field].singular} declarations` };
+    return { ok: true, perTool };
+}
+export function perToolEntryRefusal(field, unit, key, detail) {
+    return `the ${PER_TOOL_DECLARATIONS[field].plural} declared for ${unit} ${quotedName(key)} do not fit: ${detail}`;
+}
+export function perToolEmptyName(field, unit) {
+    return `${field} has an empty ${unit} name`;
+}
+export function readToolAxes(declared, at) {
+    const unit = toolAxesSurfaceOf(at).key;
+    if (declared === undefined)
+        return { ok: true };
+    const received = receivePerToolDeclaration(declared, "toolAxes", unit);
+    if (!received.ok)
+        return { ok: false, problem: received.problem };
     const entries = [];
-    for (const [key, raw] of Object.entries(perTool)) {
+    for (const [key, raw] of Object.entries(received.perTool)) {
         if (key.length === 0)
-            return { ok: false, problem: `toolAxes has an empty ${unit} name` };
+            return { ok: false, problem: perToolEmptyName("toolAxes", unit) };
         let entry;
         try {
             entry = readToolAxisEntry(raw);
@@ -215,7 +248,7 @@ export function readToolAxes(declared, at) {
             entry = "a member threw while it was read";
         }
         if (typeof entry === "string")
-            return { ok: false, problem: `the axes declared for ${unit} ${quotedName(key)} do not fit: ${entry}` };
+            return { ok: false, problem: perToolEntryRefusal("toolAxes", unit, key, entry) };
         if (Object.keys(entry).length > 0)
             entries.push([key, entry]);
     }

package/dist/core/mcp.js

@@ -25,9 +25,10 @@ import { MARKED_BLOCK_AFTER_DATA } from "./reminder-mint.js";
 import { resolveMcpDeclaredResultSize, resolveMcpRequiresUserInteraction } from "./mcp-tool-meta.js";
 export { resolveMcpDeclaredResultSize } from "./mcp-tool-meta.js";
 import { withContentOrigin } from "./memory-engine/content-origin.js";
-import { judgeEntryToolAxes, snapshotMcpEntries } from "./locked-config.js";
+import { judgeMcpEntryDeclarations, snapshotMcpEntries } from "./locked-config.js";
 import { validateJsonSchemaShape } from "./runner/strict-output-schema.js";
 import { schemaKeyBoundProblem } from "./tool-roster.js";
+import { boundaryFlowFace } from "./cross-boundary-taint.js";
 import { readMember, thrownIs, thrownName, thrownText } from "./thrown-value.js";
 export const MCP_PREFIX = MCP_NAMESPACE.prefix;
 const MCP_OUTPUT_TOKENS_DEFAULT = 25_000;
@@ -161,7 +162,7 @@ export function mcpStartupTimeoutMs(server) {
         return fromEnv;
     if (typeof own === "number" && Number.isSafeInteger(own) && own >= MCP_ENV_MS_MIN && own <= MCP_ENV_MS_MAX)
         return own;
-    throw Object.assign(new Error(`MCP server "${inlineUntrusted(server.name, 160)}": startupTimeoutMs must be a whole number of milliseconds from ${MCP_ENV_MS_MIN} to ${MCP_ENV_MS_MAX} (got ${typeof own === "number" ? String(own) : own === null ? "null" : typeof own}) — not dialed`), { code: "config.mcp_startup_timeout_invalid" });
+    throw Object.assign(new Error(`MCP server ${typeof server.name === "string" ? `"${inlineUntrusted(server.name, 160)}"` : "(unnamed)"}: startupTimeoutMs must be a whole number of milliseconds from ${MCP_ENV_MS_MIN} to ${MCP_ENV_MS_MAX} (got ${typeof own === "number" ? String(own) : own === null ? "null" : typeof own}) — not dialed`), { code: "config.mcp_startup_timeout_invalid" });
 }
 function markMcpFailure(e, details) {
     e.details = details;
@@ -666,7 +667,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
     const snapshot = snapshotMcpEntries(specs);
     const axesRefused = new WeakMap();
     const entries = snapshot.map((spec) => {
-        const judged = judgeEntryToolAxes(spec, "mcp");
+        const judged = judgeMcpEntryDeclarations(spec);
         if (judged.ok)
             return judged.entry;
         axesRefused.set(spec, judged.error);
@@ -1704,7 +1705,7 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
             ...(mcpMaxResultSizeChars !== undefined ? { mcpMaxResultSizeChars } : {}),
             ...(mcpAlwaysLoad ? { mcpAlwaysLoad: true } : {}),
             ...(interaction.declared ? { mcpRequiresUserInteraction: true } : {}),
-            mcpRemoteName: remoteName, ...(t.annotations?.readOnlyHint === true ? { mcpReadOnlyHint: true } : {}), permissionSeat: "passthrough",
+            mcpRemoteName: remoteName, ...boundaryFlowFace(spec.toolAxes?.[remoteName]), ...(t.annotations?.readOnlyHint === true ? { mcpReadOnlyHint: true } : {}), permissionSeat: "passthrough",
             execute: async (_toolCallId, params, signal) => {
                 const what = `The call to tool ${inlineUntrusted(remoteName)}`;
                 if (isServerRevoked?.(spec.name) === true) {

package/dist/core/memory-engine/engine.js

@@ -4,6 +4,7 @@ import { dirname, join, relative, sep } from "node:path";
 import { uuidv7 } from "../../internal/harness.js";
 import { MAX_MEMORY_BYTES, composeMemoryBlock, firstSentence } from "../memory.js";
 import { inlineUntrusted } from "../untrusted-text.js";
+import { canonicalJsonStringify } from "../canonical-json.js";
 import { mintSystemReminder } from "../reminder-mint.js";
 import { formatMemoryAge } from "../memory-recall.js";
 import { committedDistilledOf, committedOriginOf, computeEntryRev, consolidationExposedFrontmatter, distilledEquals, hasDistilledFormExtra, hasOriginFormExtra, isValidEntryId, originEquals, parseEntryFile, serializeEntryFile, stripModelWrittenDistilled, stripModelWrittenOrigin, UNCLOSED_MEMORY_FILE_REASON } from "./frontmatter.js";
@@ -16,7 +17,7 @@ import { noReplaceRestore, retireStagingToCustody, stagingPathBeside } from "./d
 import { sessionWriteHomeOf } from "./session-write-home.js";
 import { landedUndecided, layerDigest, layerObservationLookup, readOnlyLayerCandidates, readOnlyLayerCensus, recordLayerObservations, settleUndecidedLayerObservations, observationBacked, sameObservation, undecidedLayerObservations } from "./layer-observations.js";
 import { markOriginClearanceTombstoned, openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
-import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, canonicalJsonStringify, captureErasureInput, erasureRequestInvalid, erasureSelectHash, scanEntryFiles, } from "./file-backend.js";
+import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, captureErasureInput, erasureRequestInvalid, erasureSelectHash, scanEntryFiles, } from "./file-backend.js";
 import { assembleMemoryExportBundle, computeMemoryBundleHash, memoryBundleInvalid, } from "./export-bundle.js";
 import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, restoreContainedBaseline, indexLineIsStale, readIndexRevs, writeIndexRevs, bumpScanFuse, scanFuseKey, canonicalize, anchorStoreRoot, landingPathOf, landsOutsideStore, storeActRefusal, storeRootMovedRefusal, adoptRootScopeLayout, clearScanFuse, effectiveControlRootOf, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, markSessionPolluted, readSessionPollution, fileSessionCaptureRecordStore, recordRetrievedAccount, writeFileNoFollow, withPermissionRemedy, permissionRemedyOf, readRetrievedAccount, registerScope, registeredScopes, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, readProjectionDebts, resolveChallengeEvent, settleProjectionDebts, stageLineagePending, stageProjectionDebts, } from "./layout.js";
 import { createSessionIncarnationSeat, recalledForAnyIdentity, recalledForIdentity, rememberForIdentity } from "./session-incarnation.js";

package/dist/core/memory-engine/export-bundle.d.ts

@@ -1,4 +1,4 @@
-import { type TransferEvidence } from "./file-backend.js";
+import type { TransferEvidence } from "./file-backend.js";
 import { type MemoryEntry } from "./types.js";
 /** One exported challenge event (unresolved generations only). Generations are DESTINATION-minted:
  *  the bundle deliberately carries no generation number — the importing store re-mints events under

package/dist/core/memory-engine/export-bundle.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { canonicalJsonStringify } from "./file-backend.js";
+import { canonicalJsonStringify } from "../canonical-json.js";
 import { computeEntryRev } from "./frontmatter.js";
 import { MEMORY_ORIGIN_CAUSES } from "./types.js";
 import { ambiguousOriginRepresentation, committedOriginOf } from "./frontmatter.js";

package/dist/core/memory-engine/file-backend.d.ts

@@ -126,10 +126,6 @@ export interface MemoryErasureAttestation {
         propagation: "local-store-only";
     };
 }
-/** Canonical JSON (recursively sorted keys, no whitespace) — the erasure protocol's ONE comparison
- *  and hash basis: `selectHash` complains bind to it, and evidence rows are written/compared in this
- *  form so a re-serialized import (key order changed by a middle layer) still compares equal. */
-export declare function canonicalJsonStringify(value: unknown): string;
 /** sha256 hex over the selector's canonical JSON + LF — the replay-identity judge (§4.6) and the
  *  anchor validator's recomputation basis (a 64-hex shape check alone would let a forged anchor swap
  *  the selector under a kept hash). */
@@ -373,13 +369,13 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
     /**
      * §3.1 (r3-④) — the migration retry judge: the PERSISTED schema form, set at every real disk read
      * of the ledger and flipped only by the locked migration. Deliberately NOT derived from the
-     * in-memory ledger shape: the v1 compat arm upgrades rows in memory (§3.2), so the memory shape
+     * in-memory ledger shape: the v1 compat arm (RL-1654-ledger-v1) upgrades rows in memory (§3.2), so the memory shape
      * reads "already v2" after the first stand-down and the retry would die. `"v1"` arms the
      * per-entry opportunistic retry (construction / reads / checkControlPlane / every locked
      * mutation); undefined = the disk form has not been observed yet.
      */
     private persistedSchemaVersion;
-    /** §3.1 — the v1-compat window is loud ONCE per instance (per-row unbound noise stays suppressed;
+    /** §3.1 — the v1-compat window (RL-1654-ledger-v1) is loud ONCE per instance (per-row unbound noise stays suppressed;
      *  the OVERALL state does not). */
     private announcedV1Compat;
     /** §3.4 — O(1) retry judge for the READ entries' unbound-convergence attempts: recomputed at

package/dist/core/memory-engine/file-backend.js

@@ -1,6 +1,7 @@
 import { existsSync, fstatSync, linkSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, openSync, fsyncSync, closeSync, utimesSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { dirname, join, relative } from "node:path";
+import { canonicalJsonStringify } from "../canonical-json.js";
 import { jaccardDistance, termSet } from "../memory-vector.js";
 import { MAX_MEMORY_BYTES } from "../memory.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -14,18 +15,6 @@ import { scanMemoryFileName, scanMemoryWrite } from "./scan.js";
 import { admittingLandings, cutPerLanding, LandingsNeedAdmission, requireLandingsAdmitted } from "./landing-admission.js";
 import { thrownText } from "../thrown-value.js";
 export { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, scanEntryFiles } from "./entry-scan.js";
-export function canonicalJsonStringify(value) {
-    if (Array.isArray(value))
-        return `[${value.map((v) => (v === undefined || typeof v === "function" || typeof v === "symbol" ? "null" : canonicalJsonStringify(v))).join(",")}]`;
-    if (value !== null && typeof value === "object") {
-        const rec = value;
-        const keys = Object.keys(rec)
-            .filter((k) => rec[k] !== undefined)
-            .sort();
-        return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJsonStringify(rec[k])}`).join(",")}}`;
-    }
-    return JSON.stringify(value);
-}
 export function erasureSelectHash(select) {
     return createHash("sha256").update(`${canonicalJsonStringify(select)}\n`, "utf8").digest("hex");
 }

package/dist/core/memory.d.ts

@@ -16,7 +16,7 @@ export interface ScoredMemory {
     /** design/84 Seam B (前置 BLOCKER): true when this note was CREATED by a consolidation ADD (not the
      *  `remember` tool / a caller). Periodic/incremental consolidation EXCLUDES these from its candidate set so
      *  it never re-consolidates its own output (infinite re-merge). Stores that don't track it leave it absent
-     *  (treated as not-generated — back-compat: the inline task-end path already excludes this-task notes by id). */
+     *  (treated as not-generated — back-compat, RL-1654-memorystore: the inline task-end path already excludes this-task notes by id). */
     consolidationGenerated?: boolean;
 }
 /**
@@ -86,7 +86,7 @@ export interface MemoryStore {
      */
     searchScored?(scope: string, query: string, limit?: number): Promise<ScoredMemory[]> | ScoredMemory[];
     /** The vector-ranking rung this store achieves (design/81 Slice 5). Absent ⇒ treated as `"lexical"`
-     *  (back-compat). A runtime observable — a deployment reads it to decide index/metrics, NOT to decide
+     *  (back-compat, RL-1654-memorystore). A runtime observable — a deployment reads it to decide index/metrics, NOT to decide
      *  whether to inject an embedder (injection is config-driven; this is the RESULT). See {@link MemoryVectorMode}. */
     readonly vectorMode?: MemoryVectorMode;
     /** Optional: replace a note's text by id (consolidation UPDATE). The id stays stable. Must be safe
@@ -437,7 +437,7 @@ export declare function expandLexicalTerms(term: string): string[];
  * Matching rule: tokenize `text` on word boundaries, then for each whitespace-separated `query` term the
  * text must match AT LEAST ONE of that term's {@link expandLexicalTerms} variants (OR within a term), and
  * EVERY query term must match (AND across terms). The ORIGINAL query term keeps its pre-Slice-2b SUBSTRING
- * semantics (back-compat); the EXPANDED synonym/stem variants are matched on WORD BOUNDARIES (set membership
+ * semantics (back-compat, RL-1654-memorystore); the EXPANDED synonym/stem variants are matched on WORD BOUNDARIES (set membership
  * over the text's token set) so a short injected synonym like "key"/"db" cannot substring-match an unrelated
  * word ("keyboard"/"double"). An empty/whitespace-only query never matches.
  */

package/dist/core/mode-policy.d.ts

@@ -15,7 +15,7 @@
  */
 import type { AgentTool, ExecutionEnv } from "../internal/harness-types.js";
 import type { ContainmentFace } from "../tools/fs/containment-face.js";
-import type { PermissionResult, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
+import { type PermissionResult, type ToolCallRequest, type ToolPolicy } from "./tool-policy.js";
 import { type ToolRoster } from "./tool-roster.js";
 import { type PermissionMode } from "./ask-origin.js";
 import type { RuntimeCaps } from "./runtime-caps.js";
@@ -35,7 +35,7 @@ export type PermissionModeFoldReason = (typeof PERMISSION_MODE_FOLD_REASONS)[num
  *  `writeFace`: the write face the mode states where no seat declared one (the mode row of {@link import("../tools/fs/containment-face.js").resolveContainmentFace}) —
  *  `bypassPermissions` writes outside the write roots (`open`); every other mode states nothing and the default fence stands.
  *  `unstated`: the mode's answer for a call to a tool that states no permission of its own (permission seat `passthrough`)
- *  when no layer of the fold stated the allow — `ask` (the arbitration then answers it as any ask: dontAsk refuses it, auto's
+ *  when no answer covers the fold's allow ({@link asksUnstated}) — `ask` (the arbitration then answers it as any ask: dontAsk refuses it, auto's
  *  classifier may answer it), or `none` (the call runs; `bypassPermissions`, which installs no gate and asks nothing it would
  *  release). */
 export interface ModePolicy {
@@ -77,13 +77,18 @@ export interface ModeGateSeats {
 /** Does the LAST mounted instance of this name (the one a call dispatches to) declare itself read-only — an MCP server's
  *  `readOnlyHint` ({@link AgentTool.mcpReadOnlyHint})? The mode gate's `readOnlyDeclared` seat over the leg's live tools. */
 export declare function mountedToolDeclaresReadOnly(tools: readonly AgentTool[], toolName: string): boolean;
-/** The ONE rule of the unstated question, read at the fold's last station and at the approved-edit round: an allow nobody
- *  stated (no `decisionReason`) on a tool that states no permission of its own, under a mode whose `unstated` answer is
- *  `ask`. Who may answer it is the allow layer's business (a hook's own `allow` is one of its members), not this rule's. */
-export declare function asksUnstated(d: PermissionResult, seat: "passthrough" | undefined, mode: PermissionMode | undefined): boolean;
+/** The ONE rule of the unstated question, read at the fold's last station and at the approved-edit round: an allow on a tool
+ *  that states no permission of its own, under a mode whose `unstated` answer is `ask`, that no answer covers — no engine
+ *  record of a settled wait licensing the bytes that run (`runs`; {@link answeredFor}). A layer's allow says nothing here
+ *  whatever words it carries; who else may clear the question is the allow layer's business (its members, a hook's own `allow`
+ *  among them), not this rule's. */
+export declare function asksUnstated(d: PermissionResult, call: {
+    toolCallId: string;
+    toolName: string;
+}, runs: unknown, seat: "passthrough" | undefined, mode: PermissionMode | undefined): boolean;
 /** The unstated question's sentence (the reference implementation's passthrough sentence, without its product name). */
 export declare const unstatedAskMessage: (toolName: string) => string;
-/** One call's permission seat: `passthrough` (an allow nobody stated meets the mode's unstated answer) and the question
+/** One call's permission seat: `passthrough` (an allow no answer covers meets the mode's unstated answer) and the question
  *  put when it does — absent ⇒ {@link unstatedAskMessage}. */
 export interface PermissionSeatReading {
     readonly seat: "passthrough";
@@ -91,7 +96,7 @@ export interface PermissionSeatReading {
 }
 /** The gate's permission-seat inputs (a member group of `ToolGateInput`), read through {@link permissionSeatAt}. */
 export interface PermissionSeatInputs {
-    /** The called tool's permission seat ({@link import("./tool-spec.js").ToolSpec.permissionSeat}): `"passthrough"` ⇒ an allow no layer stated
+    /** The called tool's permission seat ({@link import("./tool-spec.js").ToolSpec.permissionSeat}): `"passthrough"` ⇒ an allow no answer covers
      *  meets the mode's answer for an unstated call ({@link ModePolicy.unstated}). Absent ⇒ the tool answers for itself. */
     permissionSeat?: "passthrough";
     /** The seat read off THIS call's arguments, for a tool whose seat depends on them (the Runner wires it for the `Skill`

package/dist/core/mode-policy.js

@@ -1,5 +1,6 @@
 import { createFsWriteGatePolicy } from "./fs-write-gate-policy.js";
 import { isProtectedWrite } from "./tool-registry.js";
+import { answeredFor } from "./tool-policy.js";
 import { rosterEntryNamed } from "./tool-roster.js";
 import { wireOf } from "./tool-name-readings.js";
 import { clampPermissionMode, isPermissionMode, PERMISSION_MODES } from "./ask-origin.js";
@@ -41,8 +42,8 @@ export function modeAcceptsFileCommand(mode, toolName, args) {
 export function mountedToolDeclaresReadOnly(tools, toolName) {
     return tools.findLast((t) => t.name === toolName)?.mcpReadOnlyHint === true;
 }
-export function asksUnstated(d, seat, mode) {
-    return d.action === "allow" && d.decisionReason === undefined && seat === "passthrough" && mode !== undefined && modePolicyOf(mode).unstated === "ask";
+export function asksUnstated(d, call, runs, seat, mode) {
+    return d.action === "allow" && seat === "passthrough" && mode !== undefined && modePolicyOf(mode).unstated === "ask" && !answeredFor(d, call, runs);
 }
 export const unstatedAskMessage = (toolName) => `The agent requested permission to use ${toolName}, but it has not been granted yet.`;
 export function permissionSeatAt(input, args) {

package/dist/core/mods/kernel/receive.d.ts

@@ -24,7 +24,8 @@ export interface ReceiptMode {
      * once on the object (a getter that throws refuses the receipt; one that moves the object's prototype refuses it, but
      * under `others: "copy"`).
      * `refuse`: only own enumerable string-keyed DATA properties are members; an accessor, a non-enumerable property or
-     * a symbol-keyed one refuses the receipt (no getter ever runs).
+     * a symbol-keyed one refuses the receipt (no getter ever runs) — under `contain`, each is a member left out and reported
+     * (a symbol-keyed one at its container's path and its `String(symbol)`), its container received.
      */
     readonly accessors: "call-once" | "refuse";
     /** How many levels of containers are copied (`Infinity` = every level). */

package/dist/core/mods/kernel/receive.js

@@ -82,8 +82,13 @@ export function receive(value, mode, held) {
         const out = list ? [] : {};
         seen.set(v, out);
         open.add(v);
-        if (mode.accessors === "refuse" && Object.getOwnPropertySymbols(captured).length > 0)
-            refuseContainer(v, "hidden");
+        if (mode.accessors === "refuse") {
+            const symbols = Object.getOwnPropertySymbols(captured);
+            if (symbols.length > 0 && mode.contain !== true)
+                refuseContainer(v, "hidden");
+            for (const s of symbols)
+                faults.push(Object.freeze({ kind: "hidden", path: Object.freeze([...path, String(s)]) }));
+        }
         stack.push({ v, out, list, proto, captured, keys: Object.getOwnPropertyNames(captured), level, next: 0, height: 1, key: "", member: undefined });
         return out;
     };

package/dist/core/parent-spec-seat.d.ts

@@ -35,8 +35,9 @@ export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "cli
  *  · `envFacts` — the sandbox facts (profile / egress / scratchpad).
  *  · `memoryPersistenceCapable` — the deployment's DECLARED persistence statement: `false` is a REMOVAL (floor),
  *    `true` a default a child's own declaration may narrow.
- *  · `memoryOff` — the request-level "memory is off" FACT (`spec.memory.enabled === false`): a REMOVAL
- *    (floor) that REWRITES the child's own memory declaration instead of travelling as a value.
+ *  · `memory` — the request-level "memory is off" FACT, `{ enabled: false }` and nothing else of the declaration (the clamp
+ *    table's `memory.enabled` row; present only when the parent stated `enabled: false`): a REMOVAL (floor) that
+ *    REWRITES the one member on the child's own memory declaration — its scopes and knobs are the child's.
  *  · `compaction` — the request's CONTEXT-MANAGEMENT settings (enabled / withinTask / reserve / keepRecent /
  *    instructions / attachWorkingFiles / staleToolResultOffload / clampTolerance). One set of settings for the
  *    whole delegation tree, measured per leg against the leg's OWN window: the numbers are repaired against the
@@ -65,7 +66,9 @@ export interface ParentSpecSeat {
     readonly additionalReadDirectories?: readonly string[];
     readonly envFacts?: TaskSpec["envFacts"];
     readonly memoryPersistenceCapable?: boolean;
-    readonly memoryOff?: true;
+    readonly memory?: {
+        readonly enabled: false;
+    };
     readonly compaction?: TaskSpec["compaction"];
     readonly skillListingBudgetFraction?: number;
     readonly skillListingMaxDescChars?: number;
@@ -73,13 +76,16 @@ export interface ParentSpecSeat {
     readonly promptForm?: "minimal";
     readonly promptBinding?: string;
 }
+/** Refuse (by name, `config.deps_retired_key`) a seat that still carries a retired member. Read at every door a seat enters
+ *  by hand: the ctx reader, the apply, and the send lane's waker clamps. */
+export declare function assertParentSpecSeatCurrent(seat: object | undefined): void;
 /** Mint the seat off the parent's REBOUND spec and its frozen question face (spec over deps — the caller resolves it once,
  *  the same value the parent's own question routing reads). Absent fields stay absent; `oneShot` only when `true`. */
 export declare function parentSpecSeatOf(spec: Omit<ParentSpecSeatFields, "onQuestion">, frozenOnQuestion: OnQuestion | undefined): ParentSpecSeat;
 /**
  * Apply the seat to a child spec — ONE law for every member, both lanes:
  *   a value the child spec already carries WINS; the seat FILLS an unset one; the three REMOVAL values
- *   (`oneShot: true`, `memoryPersistenceCapable: false`, `memoryOff: true`) land UNCONDITIONALLY.
+ *   (`oneShot: true`, `memoryPersistenceCapable: false`, `memory: { enabled: false }`) land UNCONDITIONALLY.
  * "Already carries" is the child's own authorship — a deployment baseline, a trusted script, an agent definition's
  * fold (the Task lane folds the definition's `memoryPersistenceCapable` before applying; the workflow lane applies at
  * the launch site AFTER the agentType fold) — so a definition may narrow a parent `true` to `false`, a baseline-pinned
@@ -88,15 +94,6 @@ export declare function parentSpecSeatOf(spec: Omit<ParentSpecSeatFields, "onQue
  * No seat (a tool running outside a Runner task) ⇒ the child spec is returned as is.
  */
 export declare function applyParentSpecSeat<S extends ParentSpecSeatFields>(child: S, seat: ParentSpecSeat | undefined): S;
-/** The ONE way the memory-off floor is written onto a spec — the seat's apply above and the resume lane's
- *  clamp fold both call it: keep every field the spec authored (scopes, write scope, content-safety knobs)
- *  and state `enabled: false` over them. Returning a value rather than deleting the key IS the mechanism:
- *  the next seat mint reads `spec.memory.enabled === false`, so a spec whose `memory` was removed would end
- *  the floor one level down. A spec that declared nothing gets the bare `{ enabled: false }`, which the
- *  normalizer reads as "no usable scopes" — identical to the absent declaration it replaces. */
-export declare function memoryTurnedOff(memory: TaskSpec["memory"]): NonNullable<TaskSpec["memory"]> & {
-    enabled: false;
-};
 /** The ctx keys that restate a seat member as THIS run's own fact (tools read them for scope / receipts / clamps). */
 declare const SEAT_FACTS_ON_CTX: readonly ["principal", "oneShot", "onQuestion", "memoryPersistenceCapable"];
 /**