@sema-agent/core 7.54.1 → 7.55.0

package/dist/core/tool-spec-members.js

@@ -3,7 +3,7 @@ export const TOOL_SPEC_MEMBERS = Object.keys({
     name: true, aliases: true, description: true, descriptionClassic: true, label: true, parameters: true, execute: true, effect: true,
     egress: true, irreversibility: true, reversibilityProbe: true, permissionSeat: true, isConcurrencySafe: true, executionMode: true,
     contentOrigin: true, offload: true, offloadThresholdChars: true, defer: true, alwaysLoad: true, prepareArguments: true,
-    validateInput: true, approvalPreview: true, family: true, pathTarget: true, ruleFace: true, renderHints: true, compactable: true,
+    validateInput: true, approvalPreview: true, family: true, pathTarget: true, hostTarget: true, ruleFace: true, renderHints: true, compactable: true,
     budgetExempt: true, modelGate: true, contract: true, agentListing: true, agentModels: true, agentToolFaces: true,
     agentToolLevelAllowTools: true, agentToolLevelDenyTools: true, agentToolPool: true, agentToolInheritsMcp: true, withAgents: true, boundaryLegs: true, boundaryLegsFor: true,
 });

package/dist/core/tool-spec.d.ts

@@ -15,7 +15,7 @@ import type { TaskEvent } from "./task-event.js";
 import type { TaskSpec } from "./task-spec.js";
 import type { BackgroundChildEvent } from "./delegation-frames.js";
 import type { ModelRef } from "./model-seat.js";
-import type { ToolFamily, ToolPathTarget, ToolRenderHints, ToolRuleFace } from "./tool-face.js";
+import type { ToolFamily, ToolHostTarget, ToolPathTarget, ToolRenderHints, ToolRuleFace } from "./tool-face.js";
 /**
  * Side-effect class of a tool. Used by wake/resume reconciliation: when a call was interrupted
  * before its result was recorded, the outcome is unknown, so core must decide whether re-doing it
@@ -62,12 +62,17 @@ export interface ReversibilityVerdict {
      * TIGHTENING (one more question survives one more configuration), so an over-claiming probe costs
      * its own deployment a re-confirmation and can never turn an ask into an allow.
      *
-     * The built-in shell probe sets it for exactly one family: a listed reader naming a path outside the
-     * session's allowed directories. That demotion HAS a clearing channel — widening the declared read
-     * directories retires it — and where the probe can name the directory, {@link readRootCandidate} carries
-     * it. A mandated ask WITHOUT that member has no configuration behind it: the rest of the family (an
-     * operator `shellGate:"always"`, the tool's egress/irreversibility marks, an org demand, an out-of-root
-     * arm with no named directory) is confirm-or-refuse, and must not be worded as though a grant answers it.
+     * The engine's own shell station raises a mandate for a path outside the session's allowed directories
+     * (read or written) and for a command whose reads it could not establish. A demotion by a path outside the
+     * directories HAS a clearing channel — widening the declared read directories retires it — and where the
+     * probe can name the directory, {@link readRootCandidate} carries it. A mandated ask WITHOUT that member has
+     * no configuration behind it: the rest of the family (an operator `shellGate:"always"`, the tool's
+     * egress/irreversibility marks, an org demand, an out-of-root arm with no named directory) is
+     * confirm-or-refuse, and must not be worded as though a grant answers it.
+     *
+     * WHY a matching allow rule did not clear the ask is said in the account of the finding and nowhere else:
+     * the card's disclosure sentence is {@link ReversibilityVerdict.reason} verbatim (the station's own sentence, for its findings).
+     * A mandated verdict with no `reason` is stated without one — the card names the outranked rule and stops.
      */
     mandated?: boolean;
     /**
@@ -145,7 +150,7 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
     aliases?: string[];
     description: string;
     /**
-     * R2 双形轴(2026-07-18 裁):the CLASSIC-profile variant of {@link description}. CC 2.1.212
+     * R2 双形轴(2026-07-18 裁):the CLASSIC-profile variant of {@link description}. The reference
      * keys its tool descriptions on `LT(model_id)` (simple short form vs classic long form); sema's
      * counterpart is {@link TaskSpec.promptProfile} — default "simple" (what CC serves every BYOM
      * model id). When the run resolves to "classic" and this field is present, it REPLACES
@@ -153,11 +158,9 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      */
     descriptionClassic?: string;
     /**
-     * Human label for UIs. Defaults to `name`.
-     *
-     * ⚠️ Currently INERT (design/71 liveness sweep, 2026-06-12): mapped onto the tool object but no
-     * runtime path or emitted event reads it — the model and TaskStream consumers only ever see
-     * `name`. Kept for API stability; wire it into tool events or drop it before building on it.
+     * Human label for UIs. Defaults to `name`. When it differs from `name`, it rides the call's `tool_start` and `tool_end`
+     * frames as `label` (the run builds the table from the leg's mounted tools) — the advisor tool's label is its advisor
+     * model's id. The model only ever sees `name`.
      */
     label?: string;
     /**
@@ -240,7 +243,7 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * gate station: PreToolUse hooks, policy, the auto-mode classifier), AFTER schema validation. A
      * refusal (`{ ok: false, message }`) is returned to the model as a typed error result and NO
      * approval card is shown for the call; `{ ok: true }` / `undefined` lets the call proceed to the
-     * gate unchanged. Upstream form (CC 2.1.250 `validateInput` → `{result:false, message, errorCode}`,
+     * gate unchanged. Upstream form (`validateInput` → `{result:false, message, errorCode}`,
      * consulted ahead of the permission prompt): a call the tool would refuse on its own precondition —
      * an Edit/Write/NotebookEdit whose target file was never Read this session — used to reach the
      * operator as a card that could only ever fail; the model then retried the same failing call under
@@ -425,7 +428,7 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
     contentOrigin?: ToolContentOrigin;
     /**
      * Batch execution mode (design/64 §1 P1, CC reads-parallel/writes-sequential partition). When omitted,
-     * `defineTool` derives it FAIL-CLOSED from `effect` (CC 2.1.206 `TOOL_DEFAULTS.isConcurrencySafe → false`):
+     * `defineTool` derives it FAIL-CLOSED from `effect` (`TOOL_DEFAULTS.isConcurrencySafe → false`):
      * `read` → `"parallel"`; `write`/`idempotent`/UNDECLARED → `"sequential"` — an unannotated tool never
      * silently rides a parallel batch, and two writes in one batch never race. Set explicitly to override.
      */
@@ -435,7 +438,7 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * refinement for a non-`"parallel"` tool — return `true` to let THIS CALL run in a parallel batch
      * (and, under `streamingToolExecution`, start in-stream). An explicit `executionMode:"parallel"`
      * needs no refinement (always safe); a throw = false (fail-closed). In the batch/stream paths the
-     * hook receives schema-VALIDATED (coerced) args — CC 206 `parsed.data` parity; a schema-invalid
+     * hook receives schema-VALIDATED (coerced) args — `parsed.data` parity; a schema-invalid
      * call is judged unsafe before the hook runs. Still treat defensively (direct callers may pass raw).
      * The one real consumer is Bash's read-only classifier.
      */
@@ -475,7 +478,7 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      */
     defer?: boolean;
     /**
-     * Inline-keep override, judged FIRST in the deferral chain (CC 220 counterpart:
+     * Inline-keep override, judged FIRST in the deferral chain (the reference's counterpart:
      * `alwaysLoad`, declared per MCP tool via `_meta["anthropic/alwaysLoad"]`, whose `isDeferredTool`
      * checks it before every deferral arm): `true` pins this tool's full schema inline in every
      * request — it is never deferred, regardless of its own {@link defer}, {@link TaskSpec.deferTools},
@@ -508,7 +511,9 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * CONTRACT this tool implements, independent of its presentation text. `defineTool` attaches it
      * to the materialized tool via the catalog side-table (identity follows the OBJECT, never the
      * wire name — a caller tool shadowing a built-in name never inherits the core contract). Omitted
-     * ⇒ the tool reports a deterministic `legacy:<shapeDigest>` contract in the assembly manifest.
+     * ⇒ the tool reports a deterministic `legacy:<shapeDigest>` contract in the assembly manifest. A `core.`
+     * id is the engine's: on a `TaskSpec.tools` spec it is refused (`config.tool_face_invalid`) unless it rides
+     * the contract object the engine's catalog minted (an engine definition mounted by hand) — never written by hand.
      */
     contract?: {
         /** Stable versioned id, e.g. `core.read@2` (built-ins) or `acme.deploy@1` (caller tools). */
@@ -548,6 +553,15 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * tool that merely takes a built-in's NAME inherits nothing).
      */
     pathTarget?: ToolPathTarget;
+    /**
+     * The parameter that names the URL this tool's call reaches ({@link ToolHostTarget}), for a tool whose own name host rules are
+     * written for (the engine's fetch tool name, `WebFetch`). Host rules on that name are then judged on the host this URL names:
+     * a deny or an ask reaches the tool whatever it declares (the catalog's slot is the protective floor), an allow only when it
+     * declares its own slot here (a tool that merely takes the name inherits nothing). Refused (`config.tool_face_invalid`) on a
+     * tool under any other name, an alias included — a host rule's grammar belongs to the rule's tool name, so the slot would never
+     * be read — and together with {@link pathTarget} (a face names one protected target). The `param` must be a top-level property.
+     */
+    hostTarget?: ToolHostTarget;
     /**
      * design/388 §2.2 ③ — the parameter vocabulary a permission rule (`Tool(param:pattern)`) may name.
      * DERIVED from the schema when absent (the scalar top-level parameters plus the path target's
@@ -590,7 +604,7 @@ export type ToolReturn = string | {
      *  Producer side of the tool-result 双面契约: `content` is the MODEL face (may carry model-directed
      *  framing/trailers), `details` is the HOST face (per-tool structured Output). Hosts render from the
      *  structured face and never re-parse the model face — see the `tool_end.structured` JSDoc
-     *  (CC 2.1.207 @765495, CC207-CORE-SWEEP P2-3) for the full contract. */
+     *  (P2-3) for the full contract. */
     details?: unknown;
     /** Hint the agent to stop after this tool batch. */
     terminate?: boolean;
@@ -1200,7 +1214,7 @@ export interface ToolExecuteContext {
         sessionId: string;
     } | undefined;
     /**
-     * RB-201 FO-3 (form-one audit, CC 220 `Ipd`/`ein` parity) — the auto-mode classifier decider ARMED
+     * RB-201 FO-3 (form-one audit) — the auto-mode classifier decider ARMED
      * for THIS task (auto-mode intent ∧ `RunnerDeps.autoMode` present ∧ `RuntimeCaps.autoMode !== false`
      * — see {@link TaskSpec.permissionMode}; the same
      * instance `runToolGate`'s per-call ask review already consults, carrying its own live breaker
@@ -1342,7 +1356,7 @@ export interface ToolExecuteContext {
      */
     insideFork?: boolean;
     /**
-     * OBS-2 (CC 2.1.206 observer parity) — present iff this run's principal resolved
+     * OBS-2 — present iff this run's principal resolved
      * {@link RuntimeCaps.allowObservers}` === true` (EXPLICIT opt-in, default OFF — see the polarity
      * note there). The delegation tool honors {@link AgentDefinition.observer} declarations only under
      * this flag; absent ⇒ declarations resolve to unobserved with NO warn (the gate, not a mistake).

package/dist/core/tools.js

@@ -3,7 +3,7 @@ import { formatToolError, formatZodValidationError } from "./tool-errors.js";
 import { readMember } from "./thrown-value.js";
 import { frozenToolSpec } from "./tool-spec-members.js";
 import { carryDelegationName } from "./delegation-name.js";
-import { attachToolContract } from "../prompt-assembly/tool-catalog.js";
+import { attachToolContract, contractOriginOf } from "../prompt-assembly/tool-catalog.js";
 function normalizeContent(ret) {
     if (typeof ret === "string") {
         return { content: [{ type: "text", text: ret }], details: undefined, terminate: false, isError: false };
@@ -98,6 +98,7 @@ function buildProduct(spec, owner, options) {
         ...(spec.boundaryLegs !== undefined ? { boundaryLegs: spec.boundaryLegs } : {}),
         ...(spec.boundaryLegsFor !== undefined ? { boundaryLegsFor: spec.boundaryLegsFor } : {}),
         ...(spec.pathTarget !== undefined ? { pathTarget: spec.pathTarget } : {}),
+        ...(spec.hostTarget !== undefined ? { hostTarget: spec.hostTarget } : {}),
         ...(spec.ruleFace !== undefined ? { ruleFace: spec.ruleFace } : {}),
         ...(spec.renderHints !== undefined ? { renderHints: spec.renderHints } : {}),
         ...(spec.compactable === true ? { compactable: true } : {}),
@@ -143,7 +144,7 @@ function buildProduct(spec, owner, options) {
         attachToolContract(tool, {
             contractId: spec.contract.contractId,
             implementationRevision: spec.contract.implementationRevision,
-            origin: spec.contract.contractId.startsWith("core.") ? "core" : "caller",
+            origin: contractOriginOf(spec.contract.contractId),
             ...(spec.aliases && spec.aliases.length > 0 ? { aliases: spec.aliases } : {}),
         });
     }

package/dist/core/trace.d.ts

@@ -339,6 +339,10 @@ export type TraceEvent = {
      * by them.
      */
     turn?: number;
+    /** Which call beside the loop this row is: a `SideCallLane` word (the closed set lives with the account,
+     *  `runner/side-call-account.ts`). Present exactly when {@link turn} is absent — the one writer of side-call rows
+     *  stamps it; a main-loop row carries `turn` and no `lane`. */
+    lane?: string;
     /** Normalized prompt tokens that MISSED the cache (Anthropic-protocol `input_tokens`
      *  shape) — disjoint from `cacheRead`/`cacheWrite`. Carried the cache-inclusive total up to 2.13.x. */
     promptTokens: number;

package/dist/core/untrusted-egress.d.ts

@@ -9,7 +9,7 @@ export { summarizeRedactions } from "./redaction-passes.js";
  * that tier. What a tool RETURNS is its content, read by the model that asked for it, and is not redacted (CC redacts
  * nothing there either); what is redacted is what the engine itself words or carries: errors, summaries, run rows.
  *
- * Two tiers, because the faces have two audiences (CC 2.1.212 alignment):
+ * Two tiers, because the faces have two audiences:
  *  - **`same-principal`** — the model, the script and the host that launched the work (tool results, workflow agent
  *    outputs / results / errors, run rows behind the scope-gated observe API, host error lanes): the credential
  *    vocabulary only. Paths and URLs in a worker's answer are the caller's OWN machine's paths — redacting them killed the

package/dist/core/untrusted-text.d.ts

@@ -138,7 +138,7 @@ export interface EnvelopeShapedScan {
 export declare function scanEnvelopeShaped(text: string): EnvelopeShapedScan;
 /**
  * Defuse a caller-declared occurrence of ONE specific envelope tag (opening AND closing) inside
- * content, CC `zZe` @8339092 verbatim: ``t.replace(new RegExp(`<(?=/?${e}(?:[>\\s/]|$))`, "gi"), "<\\")``.
+ * content, the reference's replacement: ``t.replace(new RegExp(`<(?=/?${e}(?:[>\\s/]|$))`, "gi"), "<\\")``.
  *
  * Homed here (beside {@link ENGINE_ENVELOPES}) rather than in the observer module that first needed
  * it: "escape one named envelope tag" is a containment primitive, and the registry's guard column

package/dist/core/warm-resume.d.ts

@@ -5,7 +5,7 @@ import type { TaskResult, TaskSpec } from "./types.js";
  * session, then run a continuation on the fork. Fork-first is the safe path (design/114 §3.2):
  *  - **idempotent** — each call branches a FRESH session, so resuming twice can't corrupt the source's linear
  *    history (vs `runTask({sessionId})` reuse, which appends two divergent continuations onto one history);
- *  - **orphan-safe** — the fork drops an in-flight tool call (`settledForkOptions`), so a continuation of an agent
+ *  - **orphan-safe** — the fork drops an in-flight tool call (`settledForkOptions`, the judge a store's `fork` shares; a package-root export), so a continuation of an agent
  *    that died mid-tool-call gets a clean point rather than inheriting an `[INTERRUPTED]` orphan;
  *  - **fail-loud** — a missing source returns `null`; it NEVER silently starts a fresh EMPTY run the way
  *    `runTask({sessionId})` would via create-on-miss (the "looks warm, actually fresh" trap). Cross-restart /

package/dist/core/wiring-manifest.d.ts

@@ -472,6 +472,39 @@ export interface WiringManifest {
      * derivation, never a state. Out of {@link configFingerprint}: the request word is a per-task seat (`mods` reasoning).
      */
     fileHistory?: "on" | "disabled";
+    /**
+     * EFFECTIVE half only, ALWAYS present on an engine-minted effective manifest: did this leg read the deployment's project context, and if not,
+     * which half kept it out — one word per state. `"on"` — its prepare called `RunnerDeps.loadProjectMemory` (what the seam answered, content or
+     * nothing, is the deployment's). `"disabled"` — a seam is wired and the request turned it off (`TaskSpec.projectMemory: "disabled"`).
+     * `"absent"` — no seam is wired (the manifest's word for a seat nothing supplied, as `ask` / `question` spell it), whatever the request said.
+     * The member missing = an older mint or an external derivation, never a state. Out of {@link configFingerprint}: the request word is a
+     * per-task seat (`fileHistory` reasoning).
+     */
+    projectMemory?: "on" | "disabled" | "absent";
+    /**
+     * EFFECTIVE half only, ALWAYS present on an engine-minted effective manifest: are the legs THIS leg delegates (sync,
+     * background, forked, workflow, retained, resumed and observer-sidecar legs, at any depth) bound by a rule written to this
+     * leg's session AFTER they started. `childrenReadLive: true` ⇔ the leg enforces its own session-rule layer (a
+     * `sessionPolicyStore` is wired and the task carries a `sessionId`) and so hands that session's key on to the legs it
+     * delegates, each of which re-reads the row at every tool gate: a rule written mid-run binds the agent's next call, whether
+     * or not the session had a row when the agent was spawned. `false` ⇒ no layer, so no key is handed on (no store wired, or
+     * the task names no session). ABSENT = an older engine: assume nothing. A statement about the DEPS-VISIBLE assembly — a
+     * delegation tool mounted over a Runner with no store of its own cannot re-read (it announces
+     * `config.session_rules_unreadable` and keeps the spawn-time snapshot). Leg-local (excluded from {@link configFingerprint}:
+     * `sessionId` is a per-task seat); the leg-start snapshot, like the rest of this object.
+     */
+    sessionRules?: {
+        childrenReadLive: boolean;
+    };
+    /**
+     * EFFECTIVE half only — the advisor tool on this leg, as the leg STARTED (a snapshot: a switch-off that lands later in the
+     * leg is not in it; a host reads the conversation's current state off the transcript, `advisorHoldOf`). Present ⇔ the leg's
+     * spec names an advisor model. `requested` = the ref as given (a Model's `id`; absent when the deployment switch ignored it
+     * unread); `main` = the leg's resolved model; `state` `on` (with `model`, the resolved advisor), `held` (the conversation
+     * switched it off; `hold` = the cause) or `not_attached` (`reason`; `routeCode` on `route_refused`). Out of
+     * {@link configFingerprint}: a per-task seat.
+     */
+    advisor?: WiringAdvisorFact;
     /** EFFECTIVE half only — a short, non-sensitive fingerprint (sha256 prefix over the canonical
      *  JSON of this manifest's own resolved facts; every field here is an enum/boolean/count, no
      *  secrets) so an operator can correlate legs that ran under the same resolved assembly. */
@@ -573,6 +606,22 @@ export interface WiringFacts {
     autoConsolidationOnRecommendation?: boolean;
     /** Effective half only — the file-history phase's word ({@link WiringManifest.fileHistory}); the engine always passes it. */
     fileHistory?: "on" | "disabled";
+    /** Effective half only — the project-context phase's word ({@link WiringManifest.projectMemory}); the engine always passes it. */
+    projectMemory?: WiringManifest["projectMemory"];
+    /** Effective half only — {@link WiringManifest.sessionRules}`.childrenReadLive`: this leg's session-rule layer published its key for its children's chain. Read off that wiring, never a constant. */
+    sessionRulesChildrenReadLive?: boolean;
+    /** Effective half only — the advisor phase's answer ({@link WiringManifest.advisor}), relayed, never re-derived. */
+    advisor?: WiringAdvisorFact;
+}
+/** {@link WiringManifest.advisor}. */
+export interface WiringAdvisorFact {
+    requested?: string;
+    main: string;
+    state: "on" | "not_attached" | "held";
+    model?: string;
+    reason?: import("./advisor-verdict.js").AdvisorNotAttachedReason;
+    routeCode?: import("../internal/llm.js").RouteRefusalCode;
+    hold?: import("./advisor-verdict.js").AdvisorHold;
 }
 /** Named view of the deps seats the static half reads (a `Pick` of the real {@link RunnerDeps} —
  *  single-source shapes, no parallel hand-copied interface). */

package/dist/core/wiring-manifest.js

@@ -150,11 +150,16 @@ function readHandsFact(fact) {
     }
     return mounted ? { mounted } : { mounted, reason };
 }
-function readFileHistoryFact(word) {
-    if (word !== "on" && word !== "disabled")
-        throw new Error(`the file-history wiring fact ${JSON.stringify(word)} is not one of on|disabled`);
+function readWordFact(word, words, label) {
+    if (!words.includes(word))
+        throw new Error(`the ${label} wiring fact ${JSON.stringify(word)} is not one of ${words.join("|")}`);
     return word;
 }
+function readSessionRulesFact(fact) {
+    if (typeof fact !== "boolean")
+        throw new Error(`the session-rules wiring fact ${JSON.stringify(fact)} is not a boolean`);
+    return { childrenReadLive: fact };
+}
 export function deriveWiringManifest(facts) {
     if (facts.half === "static" && facts.leg !== undefined) {
         throw new Error("a static wiring manifest has no leg — leg identity is an effective-half fact");
@@ -219,14 +224,17 @@ export function deriveWiringManifest(facts) {
             ? { readDeny: { builtinTiers: [...facts.readDenyBuiltinTiersActive] } }
             : {}),
         ...(facts.half === "effective" && facts.autoConsolidationOnRecommendation === true ? { autoConsolidation: { onRecommendation: true } } : {}),
-        ...(facts.half === "effective" && facts.fileHistory !== undefined ? { fileHistory: readFileHistoryFact(facts.fileHistory) } : {}),
+        ...(facts.half === "effective" && facts.fileHistory !== undefined ? { fileHistory: readWordFact(facts.fileHistory, ["on", "disabled"], "file-history") } : {}),
+        ...(facts.half === "effective" && facts.projectMemory !== undefined ? { projectMemory: readWordFact(facts.projectMemory, ["on", "disabled", "absent"], "project-memory") } : {}),
+        ...(facts.half === "effective" && facts.sessionRulesChildrenReadLive !== undefined ? { sessionRules: readSessionRulesFact(facts.sessionRulesChildrenReadLive) } : {}),
+        ...(facts.half === "effective" && facts.advisor !== undefined ? { advisor: { ...facts.advisor, ...(facts.advisor.hold !== undefined ? { hold: { ...facts.advisor.hold } } : {}) } } : {}),
         ...(facts.half === "effective" && facts.teamRole !== undefined ? { teamRole: facts.teamRole } : {}),
         ...(facts.half === "effective" && facts.peerPresence !== undefined && (facts.peerPresence.agent !== undefined || facts.peerPresence.intent !== undefined)
             ? { peerPresence: { ...(facts.peerPresence.agent !== undefined ? { agent: facts.peerPresence.agent } : {}), ...(facts.peerPresence.intent !== undefined ? { intent: facts.peerPresence.intent } : {}) } }
             : {}),
     };
     if (facts.half === "effective") {
-        const { leg: _leg, mcp: _mcp, tools: _tools, lsp: _lsp, mods: _mods, teamRole: _teamRole, peerPresence: _peerPresence, fileHistory: _fileHistory, permissionMode: _permissionMode, ...assembly } = manifest;
+        const { leg: _leg, mcp: _mcp, tools: _tools, lsp: _lsp, mods: _mods, teamRole: _teamRole, peerPresence: _peerPresence, fileHistory: _fileHistory, projectMemory: _projectMemory, permissionMode: _permissionMode, sessionRules: _sessionRules, advisor: _advisor, ...assembly } = manifest;
         const { provenance: _askSeat, ...askForHash } = assembly.ask;
         const { provenance: _questionSeat, ...questionForHash } = assembly.question;
         manifest.configFingerprint = createHash("sha256")

package/dist/core/workflow-journal-store.d.ts

@@ -1,4 +1,5 @@
 import type { TaskResult } from "./types.js";
+import { type CorruptBodyForm } from "./store-contracts/read-back-shape-contract.js";
 /**
  * design/97 CORE-7 — one recorded `ctx.agent` result in a workflow's RESUME journal. Unlike the observation-only
  * {@link WorkflowRunStore} (best-effort, swallowed on throw), the journal is LOAD-BEARING: a resume replays the
@@ -30,6 +31,67 @@ export type WorkflowJournalEntry = {
         }>;
     };
 };
+/** What {@link readWorkflowJournalEntry} answers: the entry, or the corrupt form the row takes plus a clause
+ *  naming what is wrong with it (worded to follow "journal entry #N"; it quotes no stored value). */
+export type WorkflowJournalEntryReading = {
+    entry: WorkflowJournalEntry;
+} | {
+    corrupt: CorruptBodyForm;
+    why: string;
+};
+/**
+ * The ONE reading of a journal row read back from a store: which arm it is, and whether the arm carries what a
+ * resume reads from it — an object result, or a paused terminal with its checkpoint token (the payload's other
+ * members, `sessionId` / `gate` / `stats` among them, are not judged here). `raw` is the DECODED LOGICAL ROW — an object carrying
+ * `callKey` and exactly one of `result` / `parked`; how a backend encodes that row on its medium (a JSONL
+ * line with its own `scope` / `ordinal` members, a SQL column holding an envelope) is the backend's format
+ * and is decoded before this is asked. Members other than those three are not read and are not carried into
+ * the entry, which is minted fresh from them.
+ *
+ * Corrupt, by form:
+ *  - `not-an-object` — the row is not an object;
+ *  - `missing-required` — no `callKey`; neither arm; a parked arm whose result carries no `terminal`, or
+ *    whose paused terminal carries no `token`;
+ *  - `wrong-type` — a non-string `callKey`; BOTH arms (the union admits one); a `result` that is not an
+ *    object; a `parked` that is not an object; a parked arm whose terminal is not `paused`, or whose token
+ *    is not a non-empty string.
+ *
+ * The parked arm's paused terminal and its checkpoint token are judged here because the type requires them
+ * and the arm is load-bearing: a row that says it parked but holds no paused result with a token can neither
+ * be driven nor be replayed as a finished call, and answering it as either would let a resume run that
+ * ordinal again beside the child pinned under its pending checkpoint. Whether a COMPLETED result carries a
+ * terminal cause the engine can replay is the resume's own admission (a journal written before
+ * `TaskResult.terminal` is incompatible, not damaged).
+ */
+export declare function readWorkflowJournalEntry(raw: unknown): WorkflowJournalEntryReading;
+/**
+ * Clamp an externally-supplied run identifier before it lands in a persisted field or an error message:
+ * `resumeFromRunId` is LLM-controlled text and a resume claim's `holder` is store-supplied, so neither may
+ * carry control characters / unbounded length into a record a human or a model reads.
+ */
+export declare function clampRunIdText(raw: string): string;
+/** The code of {@link WorkflowJournalIncompatibleError} — the word the journal store kit asserts on a refused `load`. */
+export declare const JOURNAL_INCOMPATIBLE_ERROR_CODE = "workflow.journal_incompatible";
+/** A resume journal entry the resume cannot admit is INCOMPATIBLE, and the resume is refused before any work is
+ *  dispatched: a row whose result carries no terminal cause (a journal written before `TaskResult.terminal`), or
+ *  a row {@link readWorkflowJournalEntry} reads as corrupt — refused by the engine's admission, or by a store's
+ *  own `load` (the journal store kit holds a backend's refused `load` to this code). The alternative (letting the
+ *  entry diverge into a live re-run) would execute the already-completed prefix again, side effects included.
+ *
+ *  `entry` is the row as read: when the journal reader finds it corrupt, the message carries that reader's clause
+ *  (fixed text that quotes no stored value), so no caller-supplied text reaches it; absent, or a row the reader
+ *  admits, the clause is the missing terminal cause. A backend whose own medium holds a line that is not one of the
+ *  run's records refuses with {@link WorkflowJournalIncompatibleError.ledgerLine}. `ordinal` is `-1` when the refusal
+ *  names no entry ordinal: a row with no readable call key, or a ledger line. The run id is clamped here. */
+export declare class WorkflowJournalIncompatibleError extends Error {
+    readonly ordinal: number;
+    readonly code = "workflow.journal_incompatible";
+    readonly fromRunId: string;
+    constructor(fromRunId: string, ordinal: number, entry?: unknown);
+    /** The refusal for line `line` (1-based) of a backend's ledger that is not one of the run's records, judged `form`
+     *  by the backend's line reader: dropping it would leave whatever it held looking never journaled. */
+    static ledgerLine(fromRunId: string, line: number, form: CorruptBodyForm): WorkflowJournalIncompatibleError;
+}
 /** REF-D5: the resume-claim key triple — ONE shape for the interface pair and every implementation
  *  (it was re-inlined seven times; a key-field rename must red every leg at once). */
 export interface ResumeClaimArgs {

package/dist/core/workflow-journal-store.js

@@ -1,4 +1,72 @@
 import { terminalProjection } from "./runner/terminal-projection.js";
+import { CORRUPT_BODY_FORMS } from "./store-contracts/read-back-shape-contract.js";
+const isRecordShaped = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const ownMember = (o, key) => (Object.hasOwn(o, key) ? o[key] : undefined);
+export function readWorkflowJournalEntry(raw) {
+    if (!isRecordShaped(raw))
+        return { corrupt: "not-an-object", why: "is not a journal entry (not an object)" };
+    const callKey = ownMember(raw, "callKey");
+    if (callKey === undefined)
+        return { corrupt: "missing-required", why: "carries no call key" };
+    if (typeof callKey !== "string")
+        return { corrupt: "wrong-type", why: "has a call key that is not a string" };
+    const result = ownMember(raw, "result");
+    const parked = ownMember(raw, "parked");
+    if (result === undefined && parked === undefined)
+        return { corrupt: "missing-required", why: "carries neither a result nor a parked arm" };
+    if (result !== undefined && parked !== undefined)
+        return { corrupt: "wrong-type", why: "carries both a result and a parked arm" };
+    if (parked === undefined) {
+        if (!isRecordShaped(result))
+            return { corrupt: "wrong-type", why: "has a result that is not an object" };
+        return { entry: { callKey, result: result } };
+    }
+    if (!isRecordShaped(parked))
+        return { corrupt: "wrong-type", why: "is recorded as parked but its parked arm is not an object" };
+    const terminal = ownMember(parked, "terminal");
+    if (terminal === undefined)
+        return { corrupt: "missing-required", why: "is recorded as parked but its parked result carries no terminal" };
+    if (!isRecordShaped(terminal) || ownMember(terminal, "kind") !== "paused") {
+        return { corrupt: "wrong-type", why: "is recorded as parked but its terminal is not a paused one" };
+    }
+    const token = ownMember(terminal, "token");
+    if (token === undefined)
+        return { corrupt: "missing-required", why: "is recorded as parked but its paused terminal carries no checkpoint token" };
+    if (typeof token !== "string" || token.length === 0)
+        return { corrupt: "wrong-type", why: "is recorded as parked but its paused terminal carries no checkpoint token" };
+    return { entry: { callKey, parked: parked } };
+}
+export function clampRunIdText(raw) {
+    return raw.replace(/[^A-Za-z0-9_.:-]/g, "").slice(0, 64);
+}
+export const JOURNAL_INCOMPATIBLE_ERROR_CODE = "workflow.journal_incompatible";
+export class WorkflowJournalIncompatibleError extends Error {
+    ordinal;
+    code = JOURNAL_INCOMPATIBLE_ERROR_CODE;
+    fromRunId;
+    constructor(fromRunId, ordinal, entry) {
+        const runIdText = clampRunIdText(fromRunId);
+        super(`workflow run "${runIdText}": ${refusedSubjectOf(ordinal, entry)} — this journal cannot be resumed. ${REPAIR_COST}`);
+        this.ordinal = ordinal;
+        this.fromRunId = runIdText;
+        this.name = "WorkflowJournalIncompatibleError";
+    }
+    static ledgerLine(fromRunId, line, form) {
+        return new WorkflowJournalIncompatibleError(fromRunId, -1, { [LEDGER_LINE]: { line, form } });
+    }
+}
+const REPAIR_COST = "Deleting what is damaged does not repair it (whatever goes missing runs again, live); restoring it needs a copy of the ledger kept outside the engine; a fresh run executes every step again, side effects included.";
+const LEDGER_LINE = Symbol("ledgerLine");
+function refusedSubjectOf(ordinal, entry) {
+    const at = isRecordShaped(entry) ? entry[LEDGER_LINE] : undefined;
+    if (at !== undefined) {
+        const line = Number.isSafeInteger(at.line) && at.line > 0 ? at.line : "?";
+        const form = CORRUPT_BODY_FORMS.includes(at.form) ? at.form : "unreadable";
+        return `ledger line ${String(line)} is not one of the run's records (${String(form)})`;
+    }
+    const read = entry === undefined ? undefined : readWorkflowJournalEntry(entry);
+    return `journal entry #${ordinal} ${read !== undefined && "corrupt" in read ? read.why : "carries no terminal cause (a journal written before TaskResult.terminal, or a malformed entry)"}`;
+}
 export const MAX_JOURNAL_RESULT_BYTES = 5 * 1024 * 1024;
 export function oversizeJournalResult(serialized) {
     return Buffer.byteLength(serialized, "utf8") > MAX_JOURNAL_RESULT_BYTES;
@@ -80,7 +148,15 @@ export class InMemoryWorkflowJournalStore {
         const rec = this.runs.get(runId);
         if (!rec || rec.scope !== scope)
             return [];
-        return [...rec.byOrdinal.entries()].sort((a, b) => a[0] - b[0]).map(([, e]) => snapshot(e));
+        const out = [];
+        for (const [ordinal, e] of [...rec.byOrdinal.entries()].sort((a, b) => a[0] - b[0])) {
+            const row = snapshot(e);
+            const read = readWorkflowJournalEntry(row);
+            if ("corrupt" in read)
+                throw new WorkflowJournalIncompatibleError(runId, ordinal, row);
+            out.push(read.entry);
+        }
+        return out;
     }
     async append(runId, scope, entry) {
         assertJournalEntryFits(entry);

package/dist/core/workflow-run-store.d.ts

@@ -46,6 +46,12 @@ export interface WorkflowRunSummary {
     description?: string;
     /** Lifecycle status ({@link WorkflowRun.status}): running / completed / failed. */
     status: WorkflowRunStatus;
+    /** `true` while the run is still `running` AND at least one leg is parked at an approval gate — somebody is being
+     *  waited on while `status` still says `running` ({@link runParkedOf}). ABSENT otherwise, never `false`: a run
+     *  that has since suspended on the park reads `failed` + `errorCode: "workflow.agent_parked"` (that code is its
+     *  "awaiting approval" word; a consumer shows both arms the same way), and a settled record never carries it.
+     *  DERIVED from the agent rows on every projection — not stored on the run, so no second copy to drift. */
+    parked?: true;
     /** The MACHINE code of the failure that ended the run ({@link WorkflowRun.errorCode}) — the same word,
      *  in the same vocabulary, that the full run carries; never re-derived and never a second taxonomy.
      *  The fourth member of the same family as {@link agentFailures} / {@link budgetOvershoot} /

package/dist/core/workflow-run-store.js

@@ -1,3 +1,4 @@
+import { runParkedOf } from "../orchestration/workflow-types.js";
 import { assertRetentionPolicy } from "./retention-policy.js";
 export function summarizeWorkflowRun(run) {
     const latestPhase = run.phases.at(-1);
@@ -8,6 +9,7 @@ export function summarizeWorkflowRun(run) {
         ...(run.name !== undefined ? { name: run.name } : {}),
         ...(run.description !== undefined ? { description: run.description } : {}),
         status: run.status,
+        ...(runParkedOf(run) ? { parked: true } : {}),
         ...(run.errorCode !== undefined ? { errorCode: run.errorCode } : {}),
         ...(run.agentFailures !== undefined ? { agentFailures: run.agentFailures } : {}),
         ...(run.budgetOvershoot !== undefined ? { budgetOvershoot: { ...run.budgetOvershoot } } : {}),

package/dist/engine/compaction/compaction.d.ts

@@ -17,7 +17,7 @@ export interface CompactionDetails {
      */
     modifiedFilesByRecency?: string[];
     /**
-     * Invoked-skill retention area (CC 2.1.207 parity): the skills invoked in the COMPACTED range
+     * Invoked-skill retention area: the skills invoked in the COMPACTED range
      * (merged over the previous compaction's retained set), most recent invocation first, already
      * budgeted (per-skill truncation marker + total-area skip semantics — see compaction/utils.ts).
      * Rendered onto the compaction summary message by `buildSessionContext`; kept OUT of the summary
@@ -131,7 +131,7 @@ export declare const DEFAULT_CLAMP_TOLERANCE = 0.1;
  * [new user]`, and a within-turn boundary keeps `[emitting assistant][its tool results]` because
  * a trailing tool-result batch pulls the floor back to its call site.
  *
- * That is the CC posture, arrived at through a different knob. CC 2.1.223's LOCAL threshold
+ * That is the CC posture, arrived at through a different knob. the reference's LOCAL threshold
  * compaction always routes to the reactive pipeline (`y9s` :432704 — the `GNo` full-compaction
  * branch with `messagesToKeep: []` :431788 is reached only for a remote/in-process runner, and a
  * `source:"auto"` window makes the local threshold not fire at all, `hky` :432687 / `aYe` :242816).
@@ -159,7 +159,7 @@ export declare const DEFAULT_COMPACTION_SETTINGS: CompactionSettings;
  * never split (estimate vs cut-point vs defense); per-model override via `Model.charsPerToken`.
  *
  * 4 → 3 (design/374 slice 4, ruled 2026-08-28) — this is a RE-ANCHORING, not a divergence.
- * CC's coefficient is a two-branch function, not a constant: `sf(model)` (cli250.js, `Z6` table) is
+ * CC's coefficient is a two-branch function, not a constant: `sf(model)` is
  *   `Z6.has(family) ? 4 : 3`
  * where `Z6` lists exactly the OLD families (claude-3.x, opus-4-0/4-1/4-5/4-6, sonnet-4-0/4-5/4-6,
  * haiku-4-5). **3 is CC's DEFAULT branch; 4 is the whitelist hit** — and CC's own current generation
@@ -189,7 +189,7 @@ export declare function calculateContextTokens(usage: Usage): number;
  *
  * design/123 D1 stale-anchor note (fable-m2, same-family point): this scans RAW session entries, so
  * unlike `buildSessionContext` (which shallow-strips the usage of kept-tail assistants replayed
- * across a compaction boundary — the anchor "naturally disappears", CC 198 parity) it CAN still see
+ * across a compaction boundary — the anchor "naturally disappears") it CAN still see
  * a pre-compaction anchor. Any consumer using this across a compaction boundary must treat such an
  * anchor as STALE: it reflects the pre-compaction request and overestimates the post-compaction
  * context. (Currently exported with no in-repo production consumer.)
@@ -265,7 +265,7 @@ export declare const SUMMARIZATION_SYSTEM_PROMPT = "You are a context summarizat
  */
 export declare function contextInstructionFilesSection(contextInstructionFiles?: string): string;
 /**
- * design/169-A (CC 220 :516490-516516 / :387325-387336) — the CC-form FORK context for a summary
+ * design/169-A — the CC-form FORK context for a summary
  * request: the main lane's latest REAL request. When present (and the summary model IS the main
  * model), the summary request is the main conversation itself — same `systemPrompt` bytes, same
  * message-list byte PREFIX, same tools — plus ONE appended user-role instruction message. The
@@ -310,7 +310,7 @@ export declare function extractForkSummaryEnvelope(text: string): string | undef
  *  messages above, un-serialized) + the fork-only instruction-file authority clause (see
  *  {@link FORK_CONTEXT_INSTRUCTION_AUTHORITY}) + the fork-only summary envelope (see
  *  {@link FORK_SUMMARY_ENVELOPE_DEMAND}; the independent form keeps its envelope-free contract).
- *  Instructions inject in the same CC-verbatim shape as the independent form so every channel keeps
+ *  Instructions inject in the same shape as the independent form so every channel keeps
  *  one injection grammar. */
 export declare function forkSummarizationInstruction(customInstructions?: string, contextInstructionFiles?: string): string;
 /**
@@ -327,7 +327,7 @@ export declare function forkSummarizationInstruction(customInstructions?: string
  *   base      = settings.summaryOutputBudgetTokens ?? settings.reserveTokens  (explicit knob wins)
  *   effective = min(base, summary model's max output)                          (never budget output
  *                                                                               the model can't emit)
- * CC contrast (2.1.207): CC's summary output cap is purely model-derived (its summary call runs at
+ * Contrast: the reference's summary output cap is purely model-derived (its summary call runs at
  * the model's max output) and fully separate from the trigger deduction — the `min(model.maxTokens,…)`
  * leg IS that posture. The base deliberately stays reserve-derived rather than jumping to the raw
  * model max: sema (unlike CC) clamps the summarization INPUT pre-send, and the clamp budgets
@@ -396,7 +396,7 @@ export interface SummarizationClampDryRun {
  * "prior summary + new increment", not the original history.
  */
 export declare function dryRunSummarizationClamp(preparation: CompactionPreparation, model: Model, customInstructions?: string, charsPerToken?: number): SummarizationClampDryRun;
-/** CC 198 jNl — verbatim marker inserted where the oldest conversation groups were dropped. */
+/** The marker inserted where the oldest conversation groups were dropped. */
 export declare const COMPACTION_PTL_RETRY_MARKER = "[earlier conversation truncated for compaction retry]";
 /** Generate or update a conversation summary for compaction.
  *  `summaryBudgetTokens` — the OUTPUT budget base (history leg = 0.8× it). Callers going through
@@ -488,6 +488,6 @@ export declare function compact(preparation: CompactionPreparation, model: Model
  *  the main model; an independent compaction model has no main prefix to share. */
 forkContext?: CompactionForkContext): Promise<Result<CompactionResult, CompactionError>>;
 /** The prefix leg's base prompt, with the caller's instructions injected in the SAME shape the
- *  history leg uses (`\n\nAdditional Instructions:\n${…}`, CC 198 verbatim). Single source so the
+ *  history leg uses (`\n\nAdditional Instructions:\n${…}`). Single source so the
  *  dry-run clamp charges exactly what the real call sends. */
 export declare function turnPrefixSummarizationPrompt(customInstructions?: string): string;