@sema-agent/core 7.54.1 → 7.55.0

package/dist/core/runner/run-telemetry-and-budget-seats.js

@@ -40,7 +40,7 @@ export function runTelemetryAndBudgetSeats(input) {
     rs.telemetry.pricingConfigured = isModelPriced(prepared.model, runner.deps.pricing);
     if (spec.limits?.degrade) {
         try {
-            rs.degrade.degradeToModel = resolveModel(spec.limits.degrade.to, modelCatalog);
+            rs.degrade.degradeToModel = resolveModel(spec.limits.degrade.to, modelCatalog, "TaskSpec.limits.degrade.to");
         }
         catch (e) {
             runner.deps.onError?.(e, { phase: "degraded", sessionId: prepared.sessionId });

package/dist/core/runner/run-turn-boundary.d.ts

@@ -29,6 +29,7 @@ export interface RunTurnBoundaryInput {
 export interface RunTurnBoundaryResult {
     (event: {
         model: Model;
+        continues: boolean;
     }): Promise<undefined>;
 }
 export declare function createTurnBoundary(input: RunTurnBoundaryInput): RunTurnBoundaryResult;

package/dist/core/runner/run-turn-boundary.js

@@ -13,7 +13,7 @@ import { droppedToolDigest, withAnnounceDigests } from "./announce-once-ledger.j
 import { formatDiagnosticsBlock, withholdListedDiagnostics } from "../lsp-diagnostics.js";
 import { workflowSizeGuidelineChangeNotice } from "../../orchestration/workflow-size-guideline.js";
 import { awaitChargeWithSlowDisclosure, discloseUnevaluableWindow, ENV_DUE_GOVERNANCE_READ_BUDGET_MS, GOVERNANCE_READ_STALLED, LIMIT_APPROACH_DEFAULT_THRESHOLDS, limitApproachFrames, platformLimitTerminal, raceUntilDeadline } from "./clock-and-limits.js";
-import { appendBoundaryFrames, compactionRestateOptions } from "./compaction-restate.js";
+import { appendBoundaryFrames, compactionRestateOptions, frameCarried } from "./compaction-restate.js";
 import { COMPACTION_FREED_EPSILON, COMPACTION_REGROWTH_FACTOR, MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
 import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions } from "./compaction-seams.js";
 import { contextUsageSections } from "../../prompt-assembly/section-usage.js";
@@ -27,6 +27,7 @@ export function createTurnBoundary(input) {
     let finalVerifySeenAtLastBoundary = 0;
     let legContinues = true;
     const boundaryPass = async (event) => {
+        const turnOwesRequest = event.continues;
         let boundarySteered = false;
         const noNextRequest = () => prepared.stopRequestedRef.current || deps.loopLatch.userHalted;
         const walltimeHit = walltimeMonotonicDeadline !== undefined && performance.now() >= walltimeMonotonicDeadline;
@@ -149,7 +150,7 @@ export function createTurnBoundary(input) {
         if (approachCfg !== false &&
             rs.counters.approachNoticesSent < LIMIT_APPROACH_DEFAULT_THRESHOLDS.length &&
             prepared.suspendForResource === undefined &&
-            rs.turn.lastTurnHadToolCalls &&
+            turnOwesRequest &&
             prepared.batchHaltRef.current === undefined &&
             !boundarySteered &&
             !prepared.abortController.signal.aborted) {
@@ -199,9 +200,10 @@ export function createTurnBoundary(input) {
             emitTrace(rs.telemetry.tracer, () => ({ kind: "review.dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
         }
         if (!noNextRequest() && !prepared.abortController.signal.aborted)
-            await appendBoundaryFrames(prepared, rs.turn.lastTurnHadToolCalls);
+            await appendBoundaryFrames(prepared, turnOwesRequest);
         if (prepared.lspDiagnostics &&
             !prepared.lspDiagnostics.registry.isEmpty() &&
+            turnOwesRequest &&
             !prepared.abortController.signal.aborted &&
             prepared.batchHaltRef.current === undefined) {
             const files = await withholdListedDiagnostics(prepared.lspDiagnostics.registry.drain(prepared.lspDiagnostics.runIdent), prepared.lspDiagnostics.withheldOf);
@@ -219,6 +221,7 @@ export function createTurnBoundary(input) {
             rs.attach.instrState !== undefined ||
             rs.attach.sizeGuidelineState !== undefined ||
             rs.attach.attachState !== undefined) &&
+            turnOwesRequest &&
             !boundarySteered &&
             prepared.batchHaltRef.current === undefined &&
             !noNextRequest() &&
@@ -265,21 +268,20 @@ export function createTurnBoundary(input) {
                 const mcpAdds = mcpInstructionsOn && mcpDelta.pendingAdds.length > 0 ? [...mcpDelta.pendingAdds] : undefined;
                 const mcpRemovals = mcpInstructionsOn && mcpDelta.pendingRemovals.length > 0 ? [...mcpDelta.pendingRemovals] : undefined;
                 const mcpDropped = mcpInstructionsOn && prepared.mcp.droppedTools.length > 0 ? selectMcpDroppedBatch(prepared.mcp.droppedTools) : undefined;
-                const budgetUsdOn = rs.attach.attachmentsCfg?.budgetUsd === true && rs.budget.maxCostMicroUsd !== undefined && rs.turn.lastTurnHadToolCalls;
+                const budgetUsdOn = rs.attach.attachmentsCfg?.budgetUsd === true && rs.budget.maxCostMicroUsd !== undefined;
                 const totalTokensDeclared = rs.attach.attachmentsCfg?.totalTokensReminder;
                 const totalTokensMode = rs.attach.attachmentsCfg?.totalTokensReminderMode ?? TOTAL_TOKENS_REMINDER_DEFAULT_MODE;
                 const totalTokensArmedByDefault = totalTokensDeclared === undefined &&
                     eventDefaultOn("total_tokens_reminder") &&
                     totalTokensMode !== "fixed" &&
                     totalTokensMode !== "infinite";
-                const totalTokensOn = (totalTokensDeclared === true || totalTokensArmedByDefault) && rs.turn.lastTurnHadToolCalls;
+                const totalTokensOn = totalTokensDeclared === true || totalTokensArmedByDefault;
                 const toolSearchReminderOn = rs.attach.attachmentsCfg?.toolSearchReminder === true && prepared.deferredToolNames !== undefined;
                 const undiscoveredTools = toolSearchReminderOn
                     ? [...prepared.deferredToolNames].filter((n) => !prepared.activeTools.has(n)).sort()
                     : undefined;
-                const receiptPending = (source) => prepared.frameReceipts.pending.some((r) => r.source === source);
-                const agentListingDue = rs.attach.agentListingOn && prepared.agentListing !== undefined && !receiptPending("agent_listing");
-                const skillsListingDue = rs.attach.skillsListingOn && prepared.skillsListing !== undefined && !receiptPending("skills_listing");
+                const agentListingDue = rs.attach.agentListingOn && prepared.agentListing !== undefined && !frameCarried(prepared.frameReceipts, "agent_listing");
+                const skillsListingDue = rs.attach.skillsListingOn && prepared.skillsListing !== undefined && !frameCarried(prepared.frameReceipts, "skills_listing");
                 const listingBudget = prepared.skillsListing?.budget ?? prepared.agentListing?.budget;
                 due.push(...collectDueAttachments(rs.attach.attachState, {
                     turn: stats.turns,
@@ -302,7 +304,7 @@ export function createTurnBoundary(input) {
                         skillsListing: rs.attach.skillsListingOn,
                         mcpInstructions: mcpInstructionsOn,
                     },
-                    ...(prepared.outputStyleFrame !== undefined && rs.turn.lastTurnHadToolCalls ? { outputStyle: prepared.outputStyleFrame } : {}),
+                    ...(prepared.outputStyleFrame !== undefined && !frameCarried(prepared.frameReceipts, "output_style") ? { outputStyle: prepared.outputStyleFrame } : {}),
                     ...(undiscoveredTools !== undefined && undiscoveredTools.length > 0
                         ? { undiscoveredTools, deferDirectCall: prepared.deferDirectCall }
                         : {}),
@@ -412,7 +414,7 @@ export function createTurnBoundary(input) {
                 if (announcedOnceDirty)
                     prepared.frameReceipts.listingSnapshotOwed = true;
             }
-            if (rs.attach.dateState !== undefined && rs.turn.lastTurnHadToolCalls && !prepared.frameReceipts.pending.some((r) => r.source === "date_change")) {
+            if (rs.attach.dateState !== undefined && !frameCarried(prepared.frameReceipts, "date_change")) {
                 const today = prepared.dateChange.today();
                 const cand = collectDateChange(rs.attach.dateState, today);
                 if (cand !== undefined) {
@@ -420,7 +422,7 @@ export function createTurnBoundary(input) {
                     receiptCommits.push({ source: "date_change", commit: () => void (rs.attach.dateState.announcedDate = today) });
                 }
             }
-            if (rs.attach.sizeGuidelineState !== undefined && rs.turn.lastTurnHadToolCalls) {
+            if (rs.attach.sizeGuidelineState !== undefined) {
                 const guideline = rs.attach.sizeGuidelineState.current();
                 if (guideline !== rs.attach.sizeGuidelineState.announcedGuideline) {
                     due.splice(due.length > 0 && due[0].source === "date_change" ? 1 : 0, 0, {
@@ -430,7 +432,7 @@ export function createTurnBoundary(input) {
                     rs.attach.sizeGuidelineState.announcedGuideline = guideline;
                 }
             }
-            if (rs.attach.instrState !== undefined && rs.attach.instrProbe !== undefined && rs.turn.lastTurnHadToolCalls) {
+            if (rs.attach.instrState !== undefined && rs.attach.instrProbe !== undefined) {
                 let probed = null;
                 try {
                     const PROBE_CEILING_MS = 2_000;

package/dist/core/runner/session-rule-policy.d.ts

@@ -52,18 +52,27 @@ export declare function isWithin(root: string, p: string): boolean;
 export interface SessionRuleSource {
     /** The prepare-time snapshot: the audit's view, and the floor no live read may loosen. */
     seed: SessionPermissionRules;
-    /** The per-call read, keyed on the call being adjudicated, and bounded by the gate's own signal. Absent
-     *  ⇒ the seed is the whole source. */
+    /** The live read, asked at every judgment and bounded by the gate's own signal; `toolCallId` names the call being
+     *  judged. Absent ⇒ the seed is the whole source. */
     read?: (toolCallId: string, signal?: AbortSignal) => Promise<SessionPermissionRules>;
 }
+/** May `row` follow `floor` by rev at all (the one reading of the live reader below and of the checkpoint/live merge): a floor
+ *  at rev 0 has enforced no row and has no lineage to defend; above it only the floor's own lineage ({@link continuesLineage}). */
+export declare function rowFollowsFloor(row: {
+    gen?: number;
+}, floor: {
+    rev: number;
+    gen?: number;
+}): boolean;
 /**
  * The LIVE half of {@link SessionRuleSource}: re-read `(sessionId, principal)` from the store on each
- * adjudicated call, floored by `seed`.
+ * adjudicated call, floored by `seed`. An ABSENT store is a source that cannot answer — a delegated leg on a
+ * runner wired without the store its ancestors' rules live in — and takes the arm a throwing store takes.
  *
  * ONE law, two consumers (this task's own session rules and each inherited ancestor's), where the policy
  * chain used to carry a hand-written live-preferring read for ancestors only and a frozen snapshot for the
- * task's own rules. Direction, unchanged from that read and stated once here: a whole-row replacement
- * includes RELAXATION — an operator's authorized post-prepare rule change propagates in BOTH directions;
+ * task's own rules. Direction, unchanged from that read and stated once here: a whole-row replacement includes RELAXATION
+ * — any post-prepare write the store's judge accepted propagates in BOTH directions (the replace is the delete port);
  * what the floor forbids is an UNAUTHORIZED loosening (a lagging replica, a deleted row, an unreachable
  * store), and nothing task-side can edit the rules row itself.
  *
@@ -80,30 +89,22 @@ export interface SessionRuleSource {
  *    recreated row is another generation and is never compared to the enforced one, whatever its rev, and
  *    a backend without lineages (gen 0 throughout) keeps the `>` protection above.
  *
- * The per-call handoff mirrors the permission-rule lanes': the first reader of a `toolCallId` takes the read
- * and hands it on, a second reader of the SAME call claims that one snapshot, and an unclaimed entry is
- * evicted first-in-first-out past a bound. It is a cost device, never a semantic one — a reader that cannot
- * claim simply reads again. Its firing path here is the fold itself: `policyLayers` re-appends the narrowing
- * layers AFTER a rewrite-capable caller layer, so one adjudication asks this layer twice under one id, and
- * the leading (original args) and trailing (rewritten args) passes must judge ONE set of rules.
- *
- * Two bounds keep a handed entry from ever being a STALE one, because `toolCallId` is not always unique —
- * the turn-boundary read-visibility query reuses one synthetic id for every path it screens and for every
- * turn of the run. The entry is taken ONCE, and a claimed snapshot is served only while its `rev` still
- * stands at the enforced floor; a claim from a later adjudication, whose floor has moved on, falls through
- * to a fresh read. A real call's id is the provider's: unique within one assistant response only (`brain/tool-call-id.ts`).
+ * Every ask is a store read, and nothing is kept between asks. Not by call id: a provider's id is unique within one
+ * assistant response only (`brain/tool-call-id.ts`) and the visibility probes share one synthetic id, so a read kept
+ * under it served a later call an earlier call's snapshot. Nor between the two passes of one judgment: the fold's
+ * trailing narrowing pass runs after a caller policy that may have waited on a person, and judges the rules as they
+ * stand then.
  */
-export declare function createLiveSessionRules(store: SessionPolicyStore, floor: {
+export declare function createLiveSessionRules(store: SessionPolicyStore | undefined, floor: {
     sessionId: string;
     principal?: string;
     seed: StoredSessionRules;
 }, hooks?: {
     /** A rule source this layer could not read, once per distinct reason. */
     onUnreadable?: (reason: string) => void;
-    /** The store row this layer now enforces, each time the floor ADVANCES. Never called for the synthetic
-     *  empty seed: it reports rows the store actually served, which is what a child may inherit. */
+    /** The store row this layer now enforces, each time the floor ADVANCES — never for the seed (its holder has it). */
     onEnforced?: (row: StoredSessionRules) => void;
-}): (toolCallId: string, signal?: AbortSignal) => Promise<SessionPermissionRules>;
+}): NonNullable<SessionRuleSource["read"]>;
 /**
  * Build the per-session deny-narrowing policy. For each tool call:
  *  - `toolDeny` → deny the calls its entries reach — the one list matcher's deny reading (`judgeAllowEntries`): a tool name

package/dist/core/runner/session-rule-policy.js

@@ -32,8 +32,10 @@ const deny = (tool, detail) => ({
     message: ruleDenialSentence({ source: "session", tool, ...(detail !== undefined ? { detail } : {}) }),
     decisionReason: "rule",
 });
-const HANDOFF_BOUND = 256;
 const ANNOUNCED_REASONS_BOUND = 8;
+export function rowFollowsFloor(row, floor) {
+    return floor.rev === 0 || continuesLineage(row, floor);
+}
 export function createLiveSessionRules(store, floor, hooks) {
     const announced = new Set();
     const announce = (reason) => {
@@ -46,6 +48,8 @@ export function createLiveSessionRules(store, floor, hooks) {
     let servedRow = false;
     let vanished = false;
     const read = async (signal) => {
+        if (store === undefined)
+            return (announce(`this leg's runner has no session-policy store to re-read the rules of session ${JSON.stringify(floor.sessionId)} from`), enforced);
         let live;
         try {
             live = await withGateTimeout(store.getRules(floor.sessionId, floor.principal), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "sessionRulesRead");
@@ -64,15 +68,13 @@ export function createLiveSessionRules(store, floor, hooks) {
             }
             return enforced;
         }
-        if (enforced.rev > 0) {
-            if (!continuesLineage(live, enforced)) {
-                announce(`session ${JSON.stringify(floor.sessionId)} has a rules row of a new lineage (generation ${live.gen}, rev ${live.rev}), which does not continue the row this leg enforces (generation ${enforced.gen})`);
-                return enforced;
-            }
-            if (vanished && live.gen === undefined) {
-                announce(`session ${JSON.stringify(floor.sessionId)} has a new rules row at rev ${live.rev} after the row this leg enforced was deleted, and its backend carries no lineage to continue it by`);
-                return enforced;
-            }
+        if (!rowFollowsFloor(live, enforced)) {
+            announce(`session ${JSON.stringify(floor.sessionId)} has a rules row of a new lineage (generation ${live.gen}, rev ${live.rev}), which does not continue the row this leg enforces (generation ${enforced.gen})`);
+            return enforced;
+        }
+        if (vanished && live.gen === undefined) {
+            announce(`session ${JSON.stringify(floor.sessionId)} has a new rules row at rev ${live.rev} after the row this leg enforced was deleted, and its backend carries no lineage to continue it by`);
+            return enforced;
         }
         if (live.rev <= enforced.rev) {
             if (live.rev < enforced.rev) {
@@ -85,24 +87,7 @@ export function createLiveSessionRules(store, floor, hooks) {
         hooks?.onEnforced?.(live);
         return live;
     };
-    const handed = new Map();
-    return async (toolCallId, signal) => {
-        const handedRead = handed.get(toolCallId);
-        if (handedRead !== undefined) {
-            handed.delete(toolCallId);
-            const claimed = await handedRead;
-            if (continuesLineage(claimed, enforced) && claimed.rev >= enforced.rev)
-                return claimed;
-        }
-        const p = read(signal);
-        handed.set(toolCallId, p);
-        if (handed.size > HANDOFF_BOUND) {
-            const oldest = handed.keys().next().value;
-            if (oldest !== undefined)
-                handed.delete(oldest);
-        }
-        return p;
-    };
+    return (_toolCallId, signal) => read(signal);
 }
 function compileSessionRules(rules) {
     const shaped = readSessionRulesShape(rules);

package/dist/core/runner/side-call-account.d.ts

@@ -1,22 +1,26 @@
 /**
  * The run's usage account for the model calls made BESIDE the main loop — the compaction summarizer, the permission
- * classifier, a mod's `$.model.complete`: the lanes, what a reply tells the account, the one door a lane books through, and the
- * ONE function behind it. The lane table says which `Stats` line keeps a lane's cost besides `costMicroUsd` (every lane folds
- * into the total — it is the budget coordinate and the reported figure); it is total over the lanes by its fence, so a fourth
- * lane is a row here, not a second accounting function.
+ * classifier, a mod's `$.model.complete`, the advisor tool: the lanes, what a reply tells the account, the one door a lane books
+ * through, and the ONE function behind it. The lane table says which `Stats` line keeps a lane's cost besides `costMicroUsd`
+ * (every lane folds into the total — it is the budget coordinate and the reported figure); it is total over the lanes by its
+ * fence, so another lane is a row here, not a second accounting function.
  */
 import type { AssistantMessageDiagnostic, Model, Usage } from "../../internal/llm.js";
 import { type ModelPricing } from "../pricing.js";
 import type { AssertAllKeysHandled } from "../ask-origin.js";
-import type { RunnerDeps, TaskSpec } from "../types.js";
+import type { Brain, RunnerDeps, TaskSpec } from "../types.js";
 import type { Stats } from "./assemble-result.js";
-/** Whose model call it is: the compaction summarizer, the permission classifier, a mod's `$.model.complete`. */
-export type SideCallLane = "compaction" | "classifier" | "mod";
-/** The `Stats` line a lane's cost is also kept in: compaction is its own partition line; the classifier and the mods share the side-call line. */
+/** Whose model call it is: the compaction summarizer, the permission classifier, a mod's `$.model.complete`, the advisor
+ *  tool's consultation of its advisor model. The word rides every side-call trace row (`brain.call.lane`). */
+export type SideCallLane = "compaction" | "classifier" | "mod" | "advisor";
+/** The `Stats` line a lane's cost is also kept in: compaction is its own partition line (the engine's upkeep); the
+ *  classifier, the mods and the advisor share the side-call line (calls the run's own agent caused, so they stay inside the
+ *  root agent's cost). */
 export declare const SIDE_CALL_LANE_TOTAL: {
     readonly compaction: "compactionMicroUsd";
     readonly classifier: "sideCallMicroUsd";
     readonly mod: "sideCallMicroUsd";
+    readonly advisor: "sideCallMicroUsd";
 };
 export type LaneTotalCoversEverySideCallLane = AssertAllKeysHandled<Exclude<SideCallLane, keyof typeof SIDE_CALL_LANE_TOTAL>>;
 /** A side call's reply as the account reads it: the provider's usage (absent ⇒ none reported), the marks of what is unknown,
@@ -64,5 +68,25 @@ export interface SideCallCall {
  * unknown is not free). A reply the brain itself marked `usageMissing` does the same for its zero-filled usage.
  */
 export declare function recordSideCallUsage(stats: Stats, usage: Usage | undefined, lane: SideCallLane, call: SideCallCall): void;
+/**
+ * The accounted brain of a DERIVED LEG — a model call made beside the main loop on the leg's behalf (the compaction summary,
+ * the advisor consultation): every reply is booked through `book` exactly once, under `lane`, and the call runs behind
+ * NO-OP status and reasoning-wire-facts sinks. Both arms obey the same law, whichever one the caller uses.
+ *
+ * The shields: a derived call fires inside the leg's `runWithStatusSink` scope (the compaction hook from `turn_boundary`
+ * within `harness.prompt`, the advisor from a tool call), so a 429/retry on it must not surface as a `status` event on the
+ * user's turn (status-sink.ts / TaskEvent.status), and its model, tier and output cap must not restate the leg's reasoning
+ * posture from a request the leg's caller never made — a no-op inner scope swallows the facts rather than consuming the
+ * leg's one correction.
+ *
+ * `complete` is ALWAYS provided (brainToRuntime prefers it), so the booking is awaited INLINE on both the native-complete and
+ * derived-from-stream paths, and the message is returned UNCHANGED (its `errorKind` is what the summary path's
+ * budget-escalation recovery reads). `stream` opens the inner stream inside the same scopes (the provider work it starts runs
+ * in them) and books the stream's final message when it settles: the inner `result()` settles once, whether the caller awaits
+ * it or only iterates, and the returned stream's `result()` is that booked settlement — a booking that throws rejects it rather
+ * than vanishing. A stream that ends without a final message books nothing; its caller owes the lower-bound mark. `brainOf`
+ * is read per call (a swapped deployment brain reaches legs already running).
+ */
+export declare function derivedLegBrain(brainOf: () => Brain, lane: SideCallLane, book: SideCallBook): Brain;
 /** The leg's door: `recordSideCallUsage` bound to the leg's `stats` and account, reading what the reply itself says (its marks, and who served it). */
 export declare function sideCallBookOf(stats: Stats, account: SideCallAccount): SideCallBook;

package/dist/core/runner/side-call-account.js

@@ -1,4 +1,5 @@
 import { readDegradation } from "../../brain/degrading.js";
+import { runWithReasoningWireFacts, runWithStatusSink } from "../../brain/status-sink.js";
 import { isModelPriced, modelCostToPricing } from "../pricing.js";
 import { emitTrace } from "../trace.js";
 import { cacheFamilyOf, usageCostMicroUsd } from "./usage-accounting.js";
@@ -6,6 +7,7 @@ export const SIDE_CALL_LANE_TOTAL = {
     compaction: "compactionMicroUsd",
     classifier: "sideCallMicroUsd",
     mod: "sideCallMicroUsd",
+    advisor: "sideCallMicroUsd",
 };
 function catalogModel(id, catalog) {
     if (catalog === undefined)
@@ -41,12 +43,32 @@ export function recordSideCallUsage(stats, usage, lane, call) {
     const total = SIDE_CALL_LANE_TOTAL[lane];
     stats[total] = (stats[total] ?? 0) + costMicroUsd;
     emitTrace(account.telemetry.tracer, () => ({
-        kind: "brain.call", version: 1, taskId: account.telemetry.taskId, model: modelId, ...(served !== undefined ? { provider: served.provider } : {}),
+        kind: "brain.call", version: 1, taskId: account.telemetry.taskId, model: modelId, lane, ...(served !== undefined ? { provider: served.provider } : {}),
         promptTokens: uncachedInputTokens, totalInputTokens, completionTokens: usage.output || 0,
         cacheRead: usage.cacheRead || 0, cacheWrite: usage.cacheWrite || 0,
         latencyMs: 0, ...(priced ? { costMicroUsd } : {}), ...(call.stopReason !== undefined ? { stopReason: call.stopReason } : {}), ts: Date.now(),
     }));
 }
+export function derivedLegBrain(brainOf, lane, book) {
+    const shielded = (fn) => runWithStatusSink(() => { }, async () => await runWithReasoningWireFacts(() => { }, fn));
+    return {
+        stream: (m, c, o) => shielded(async () => {
+            const inner = await Promise.resolve(brainOf().stream(m, c, o));
+            const booked = inner.result().then((msg) => {
+                book(lane, m, msg);
+                return msg;
+            });
+            booked.catch(() => { });
+            return { [Symbol.asyncIterator]: () => inner[Symbol.asyncIterator](), result: () => booked };
+        }),
+        complete: async (m, c, o) => {
+            const brain = brainOf();
+            const msg = await shielded(async () => (brain.complete ? await brain.complete(m, c, o) : await (await Promise.resolve(brain.stream(m, c, o))).result()));
+            book(lane, m, msg);
+            return msg;
+        },
+    };
+}
 export function sideCallBookOf(stats, account) {
     return (lane, model, reply) => {
         const degradedTo = readDegradation(reply)?.to;

package/dist/core/runner/strict-output-schema.d.ts

@@ -26,7 +26,7 @@ export type CompiledOutputSchema =
     fallbackReason: string;
 };
 /**
- * Validate + strict-derive a structured-output schema (CC 2.1.205 semantics):
+ * Validate + strict-derive a structured-output schema:
  *   invalid / oversized schema → `{error}` (the caller throws — no silent acceptance);
  *   in-subset schema → `{modelSchema: strictForm, strict:true}` (`additionalProperties:false` stamped);
  *   valid-but-unsupported schema → `{modelSchema: original, strict:false, fallbackReason}` (observable).

package/dist/core/runner/sub-agent-deny-lists.js

@@ -6,7 +6,7 @@ import { ENGINE_TOOLS } from "../tool-catalog-entries.js";
 import { callerToolNameProblem } from "../caller-tool-name.js";
 import { mintNamespacePrefix } from "../protocol-naming.js";
 import { PROTOCOL_TABLE, protocolOf } from "../protocol-table.js";
-import { mountedToolNames, splitNamespacedName } from "../tool-name-aliases.js";
+import { mountedToolNames, splitNamespacedName, wholeProtocolOf } from "../tool-name-aliases.js";
 import { projectionToolNames } from "../tool-policy.js";
 import { declaredDelegationNameOf } from "../delegation-name.js";
 export function renamedDelegationMountSentence(...rosters) {
@@ -117,10 +117,11 @@ function judgeToolNameList(where, side, value, universe, advise, code) {
         const content = side === "denied" && written;
         const reach = side === "denied" ? readDeniedToolList([entry]) : (readAllowedToolList([entry]) ?? readDeniedToolList([]));
         const split = splitNamespacedName(name);
-        if (split !== undefined && split.peer === "*" && split.tool === undefined) {
+        const whole = wholeProtocolOf(name);
+        if (whole !== undefined) {
             if (side === "denied")
                 continue;
-            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: an allowed list has no protocol-wide form — name a peer (\`${split.ns.prefix}<peer>\`) or its tools.`, code, "unsupported_pattern");
+            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: an allowed list has no protocol-wide form — name a peer (\`${whole.prefix}<peer>\`) or one of its tools (\`${whole.prefix}<peer>__<tool>\`).`, code, "unsupported_pattern");
         }
         const { inert } = compileAllowList([toolName], "deny", universe.known);
         const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry, ...(inert[0].reason === "near_miss" && inert[0].currentName !== undefined ? { carriedBy: universe.carrierOf(inert[0].currentName) } : {}) };

package/dist/core/runner/synthetic-tools.d.ts

@@ -3,12 +3,9 @@ import type { AgentTool } from "../../internal/harness-types.js";
 import type { TerminalBlockedDetail } from "../terminal-cause.js";
 import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import { type SkillGrantTable } from "../skill-grant.js";
-/** Reserved name of the injected structured-output tool (CC 2.1.187 `StructuredOutput`; batch-A rename — old
- *  "submit_output" is canonicalized for pre-rename durable state). */
-export declare const OUTPUT_TOOL_NAME = "StructuredOutput";
 /** Reserved name of the injected blocked-report signal tool (PascalCase: `report_blocked`→`ReportBlocked`). */
 export declare const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
-/** Name of the injected code-review findings echo tool (CC 2.1.207 parity — 锚 pretty.js:361412 `BCe`). */
+/** Name of the injected code-review findings echo tool. */
 export declare const REPORT_FINDINGS_TOOL_NAME = "ReportFindings";
 /** Default `submit_output` retries (council OS3); total attempts = retries + 1. Overridable via `TaskSpec.outputRetries`. */
 export declare const OUTPUT_DEFAULT_RETRIES = 2;
@@ -32,7 +29,7 @@ export interface OutputRef {
     set?: boolean;
 }
 /**
- * @param strictSchema CC 2.1.205 parity (strict-output-schema.ts): the STRICT derivation of `schema` when
+ * @param strictSchema (strict-output-schema.ts): the STRICT derivation of `schema` when
  *   it converted (`additionalProperties:false` stamped, subset-validated). It becomes the tool's
  *   `parameters` — both the model-visible wire schema (CC sends it as `strictInputJSONSchema`) and the
  *   validation schema (the strict form only TIGHTENS the caller's schema, so anything it accepts is valid
@@ -41,7 +38,7 @@ export interface OutputRef {
  */
 export declare function createOutputTool(ref: OutputRef, schema: TSchema, strictSchema?: TSchema): AgentTool;
 export declare function createReportBlockedTool(ref: BlockedRef): AgentTool;
-/** One reported finding (the CC 207 wire shape — see {@link createReportFindingsTool}). */
+/** One reported finding (the wire shape — see {@link createReportFindingsTool}). */
 export interface ReportedFinding {
     file: string;
     line?: number;
@@ -51,12 +48,12 @@ export interface ReportedFinding {
     verdict?: "CONFIRMED" | "PLAUSIBLE";
     outcome?: "fixed" | "skipped" | "no_change_needed";
 }
-/** Build the injected `ReportFindings` echo tool (CC 2.1.207 parity — description verbatim from 锚
- *  pretty.js:361413; `effect: "read"` mirrors CC `isReadOnly()`/`isConcurrencySafe()` → parallel-safe). */
+/** Build the injected `ReportFindings` echo tool (
+ *  `effect: "read"` mirrors CC `isReadOnly()`/`isConcurrencySafe()` → parallel-safe). */
 export declare function createReportFindingsTool(): AgentTool;
 /** Reserved name of the injected skill-loading tool (present only when `spec.skills` is non-empty). */
 export declare const SKILL_TOOL_NAME = "Skill";
-/** Per-skill LOAD gate on `SkillSpec.content` (CC 2.1.207 parity: CC's only invoke-time size door is a 1MB file-load gate — an over-limit skill is REJECTED
+/** Per-skill LOAD gate on `SkillSpec.content` (the reference's only invoke-time size door is a 1MB file-load gate — an over-limit skill is REJECTED
  *  WHOLE, never truncated, and the invoked body enters context untruncated). Sema skills are spec-supplied, so the equivalent gate sits at spec assembly:
  *  an oversized skill is excluded from the disclosure block and the tool, with an operator-visible config error. The compaction-time retention caps are a
  *  different door, deliberately. */
@@ -97,8 +94,8 @@ export interface SkillListingEntry {
      *  their descriptions when the block overflows its byte budget ({@link buildSkillsBlock} tier B); the
      *  DISPLAY order stays name-sorted, so adding this never moves a line.
      *
-     *  Why declaration order: CC 220's `sbs` (@317547) takes a priority function and is called with
-     *  `uNt(name)` (@608552 → @402383) = usage count decayed by recency of last use, and additionally
+     *  Why declaration order: the reference takes a priority function and is called with
+     *  a usage count decayed by recency of last use, and additionally
      *  pins every `bundled` skill's description unconditionally. Core has NEITHER axis — no cross-session
      *  skill-usage store, and no bundled/user distinction (every skill arrives through the same
      *  caller-supplied `TaskSpec.skills`). Declaration order is the one priority statement the deployment
@@ -140,7 +137,7 @@ export declare function buildSkillsBlock(skills: ReadonlyArray<SkillListingEntry
 /** Render the `<skills>` disclosure block (metadata only — bodies stay behind the tool).
  *  [c209-C] REVERSAL: no longer composed into the stable system prompt — this is now the RENDERER for
  *  the `skills_listing` initial frame (first-user-turn reminder / boundary re-announce), so the
- *  cached prefix carries zero skill bytes (design/C §2.3; CC 209 classic ships the same listing as a
+ *  cached prefix carries zero skill bytes (design/C §2.3; the reference ships the same listing as a
  *  first-turn reminder). `budget` absent ⇒ the seat reader's no-knob answer ({@link SKILL_LISTING_DEFAULT_BUDGET}).
  *
  *  The fence and its four header lines are this lane's frame; the budget arithmetic and the three
@@ -157,7 +154,7 @@ export declare function renderSkillsBlock(skills: ReadonlyArray<SkillListingEntr
  * reader resolved (`@contract skills.listing_budget_enforced_as_declared`), which is the frame's whole
  * bound: the listing is an intact-class attachment, so no delivery lane measures it a second time.
  *
- * Tier B follows CC 220 `sbs` @317547-317586 (reserve the marker + every name-only line, then spend
+ * Tier B follows the reference (reserve the marker + every name-only line, then spend
  * the slack on descriptions in {@link SkillListingEntry.declaredRank} order); tier C closes with an
  * honest `(… +N more skills …)` count line — the tool still serves all of them.
  */

package/dist/core/runner/synthetic-tools.js

@@ -3,11 +3,10 @@ import { defineTool } from "../tools.js";
 import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } from "../skill-listing-budget.js";
 import { readSkillTable, skillNamedBy } from "../skill-grant.js";
-import { toolFace } from "../tool-catalog-entries.js";
+import { OUTPUT_TOOL_NAME, mountRuleFace, toolFace } from "../tool-catalog-entries.js";
 import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
 import { readSkillsSeat } from "./skills-seat.js";
 import { foldListingWithin } from "./listing-fold.js";
-export const OUTPUT_TOOL_NAME = "StructuredOutput";
 export const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
 export const REPORT_FINDINGS_TOOL_NAME = "ReportFindings";
 export const OUTPUT_DEFAULT_RETRIES = 2;
@@ -36,6 +35,7 @@ export function createReportBlockedTool(ref) {
     return defineTool({
         name: REPORT_BLOCKED_TOOL_NAME,
         ...toolFace("report-blocked"),
+        ruleFace: mountRuleFace("report-blocked"),
         description: "Call this ONLY when you cannot complete the task — missing information, missing permission/credentials, or an ambiguous request you cannot resolve. Provide a concise reason that an external system or operator can act on. Calling this ends the task.",
         parameters: Type.Object({ reason: Type.String() }),
         execute: (args) => {
@@ -64,6 +64,7 @@ export function createReportFindingsTool() {
     return defineTool({
         name: REPORT_FINDINGS_TOOL_NAME,
         ...toolFace("report-findings"),
+        ruleFace: mountRuleFace("report-findings"),
         description: "Report code-review findings as a typed list so the host UI can render them. Use this only when the " +
             "active code-review instructions tell you to report findings with this tool; otherwise follow whatever " +
             "output format those instructions specify. When reporting a review's results, call it once with the " +
@@ -155,6 +156,7 @@ export function createSkillTool(skills, grants) {
     return defineTool({
         name: SKILL_TOOL_NAME,
         ...toolFace("skill"),
+        ruleFace: mountRuleFace("skill"),
         executionMode: "sequential",
         description: `Invoke a skill.\n\n` +
             `A skill is a packaged set of instructions the user or project has set up for a particular kind of task (deploy steps, a review checklist, a repo-specific workflow). ` +

package/dist/core/runner/tool-disclosure.js

@@ -2,7 +2,7 @@ import { Type } from "typebox";
 import { Value } from "typebox/value";
 import { defineTool, errorResult } from "../tools.js";
 import { formatZodValidationError, truncateError } from "../tool-errors.js";
-import { toolFace } from "../tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "../tool-catalog-entries.js";
 export const TOOL_SEARCH_NAME = "ToolSearch";
 export const TOOL_SEARCH_DEFAULT_MAX_RESULTS = 5;
 const MAX_QUERY_RESULTS = 25;
@@ -262,6 +262,7 @@ export function createToolSearchTool(opts) {
     return defineTool({
         name: TOOL_SEARCH_NAME,
         ...toolFace("tool-search"),
+        ruleFace: mountRuleFace("tool-search"),
         description: "Discover and activate deferred tools. " +
             activationPosture +
             "Query forms: " +

package/dist/core/runner/tool-face-overlay.d.ts

@@ -2,7 +2,8 @@
  * The MCP `toolFaces` OVERLAY: a deployment's per-tool face declaration for a
  * protocol tool that has no `ToolSpec` of its own (`McpServerSpec.toolFaces`, keyed by the server's RAW
  * tool name like `allowTools` / `toolAxes`). Validated against the MATERIALIZED schema at every listing
- * (the first mount and every RefreshMcpTools): `pathTarget.param` must be a top-level property; an
+ * (the first mount and every RefreshMcpTools): `pathTarget.param` / `hostTarget.param` must be a top-level property (and a
+ * face declares at most one of the two); an
  * `approvalCard` must find the keys the card needs; a `ruleFace` may only name scalar keys; `family`
  * must be a member of the closed set; every `resultCards` entry must live under the tool's own card namespace.
  * A failing overlay does NOT mount — the tool mounts BARE (no

package/dist/core/runner/tool-face-overlay.js

@@ -2,7 +2,7 @@ import { MCP_NAMESPACE } from "../protocol-table.js";
 import { mintNamespacePrefix } from "../protocol-naming.js";
 import { RESERVED_APPROVAL_CARDS, TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_PATH_ABSENCES, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_KEY_MAX_CHARS, } from "../tool-face.js";
 import { engineCardOf, inputKeysOf, offendingResultCard, protocolToolOf, rosterCardId } from "../tool-roster.js";
-import { engineCardTypes } from "../tool-registry.js";
+import { engineCardTypes, hostTargetingToolNames } from "../tool-registry.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 export const APPROVAL_CARD_REQUIRED_KEYS = Object.freeze({
     "file-edit": ["file_path"],
@@ -10,6 +10,8 @@ export const APPROVAL_CARD_REQUIRED_KEYS = Object.freeze({
     "notebook-edit": ["notebook_path"],
     shell: ["command"],
     fetch: ["url"],
+    skill: ["skill"],
+    workflow: [],
     plan: [],
     question: [],
     generic: [],
@@ -58,6 +60,19 @@ export function faceProblem(face, schema, tool) {
         for (const a of face.pathTarget.aliases ?? [])
             vocabulary.add(a);
     }
+    if (face.hostTarget !== undefined) {
+        const hostNames = hostTargetingToolNames();
+        if (tool === undefined || !hostNames.has(tool.toolName)) {
+            return `hostTarget is declared on a tool whose name host rules are not written for (they are written for ${[...hostNames].join(", ")}) — a host rule's grammar belongs to the rule's tool name, so the slot would never be read; declare it only on a tool of that name`;
+        }
+        if (face.pathTarget !== undefined)
+            return `hostTarget and pathTarget are both declared — a face names one protected target, the URL a call reaches or the path it touches`;
+        if (top !== undefined && (typeof face.hostTarget.param !== "string" || !top.has(face.hostTarget.param)))
+            return `hostTarget.param ${JSON.stringify(face.hostTarget.param)} is not a top-level property of the tool's schema`;
+        const long = overlong("hostTarget.param", [face.hostTarget.param]);
+        if (long !== undefined)
+            return long;
+    }
     const hints = face.renderHints;
     if (hints !== undefined) {
         const card = hints.approvalCard;
@@ -148,6 +163,7 @@ export function applyMcpToolFaces(input) {
             ...t,
             ...(f.family !== undefined ? { family: f.family } : {}),
             ...(f.pathTarget !== undefined ? { pathTarget: f.pathTarget } : {}),
+            ...(f.hostTarget !== undefined ? { hostTarget: f.hostTarget } : {}),
             ...(f.renderHints !== undefined ? { renderHints: f.renderHints } : {}),
             ...(f.ruleFace !== undefined ? { ruleFace: f.ruleFace } : {}),
         };

package/dist/core/runner/tool-progress-lane.d.ts

@@ -37,8 +37,8 @@
 import type { TaskEvent, TaskEventIdentity } from "../types.js";
 import type { ToolProgressLane } from "./contracts.js";
 import { type ToolOccurrenceTable } from "./tool-occurrence.js";
-/** How long a tool call may stay silent before this lane beats for it, in ms. ONE SOURCE, and CC
- *  2.1.259's own per-tool heartbeat interval (`Cct`) — this engine keeps the cadence and folds the beat
+/** How long a tool call may stay silent before this lane beats for it, in ms. ONE SOURCE, and the reference's
+ *  own per-tool heartbeat interval — this engine keeps the cadence and folds the beat
  *  into the one progress frame instead of minting a second shape (registered divergence). */
 export declare const TOOL_HEARTBEAT_MS = 30000;
 /** The floor between two frames of ONE call — the `tool_progress.cadence` contract, enforced here and