@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/mods/tool-call.js

@@ -0,0 +1,152 @@
+import { formatHookFeedback } from "../reminder-mint.js";
+import { toolFace } from "../tool-catalog-entries.js";
+import { declaredDelegationNameOf } from "../delegation-name.js";
+import { describeThrown } from "../tool-policy.js";
+import { extensionWords } from "../untrusted-egress.js";
+import { ENGINE_ORIGIN } from "./kernel/index.js";
+import { isPlainRecord } from "./kernel/receive.js";
+import { NEXT_IN_FLIGHT } from "./kernel/site-rules.js";
+import { classicEventBase, failedHandlerClause, judgedInputOf } from "./stations.js";
+import { runExtensionCall } from "./extension-call.js";
+import { randomUUID } from "node:crypto";
+const FORM = "tool.call takes next(e), { deny: <reason> } or { result } (a string, or a list of text blocks)";
+const denyOf = (a) => isPlainRecord(a) && Object.keys(a).length === 1 && typeof a["deny"] === "string" && a["deny"] !== "" ? a["deny"] : undefined;
+function substituteOf(a) {
+    if (!isPlainRecord(a) || Object.keys(a).length !== 1 || !Object.hasOwn(a, "result"))
+        return undefined;
+    const r = a["result"];
+    if (typeof r === "string")
+        return [{ type: "text", text: r }];
+    if (!Array.isArray(r) || r.length === 0)
+        return undefined;
+    const out = [];
+    for (const b of r) {
+        if (!isPlainRecord(b) || b["type"] !== "text" || typeof b["text"] !== "string" || Object.keys(b).some((k) => k !== "type" && k !== "text"))
+            return undefined;
+        out.push({ type: "text", text: b["text"] });
+    }
+    return out;
+}
+function viewOf(result) {
+    let blocks = [];
+    try {
+        const content = result.content;
+        blocks = (Array.isArray(content) ? content : []).map((b) => Object.freeze(Object.fromEntries(Object.entries(typeof b === "object" && b !== null ? b : {}).filter(([, v]) => v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean"))));
+    }
+    catch {
+        blocks = [];
+    }
+    return Object.freeze({ result: Object.freeze({ content: Object.freeze([...blocks]), isError: result.isError === true }) });
+}
+function letGoUnasked(occurrences, toolCallId) {
+    const latest = occurrences.get(toolCallId)?.gateRounds.at(-1);
+    if (latest === undefined || latest.disposition.kind !== "allowed" || latest.settlement !== undefined)
+        return false;
+    return latest.disposition.released === undefined && latest.disposition.clearedBy === undefined;
+}
+const RANKS = Object.freeze({ of: (a) => (denyOf(a) !== undefined ? 1 : 0), top: 1 });
+export function createToolCallStation(input) {
+    if (!input.bus.hasHandlers("tool.call"))
+        return undefined;
+    const refusal = (call, by, text) => {
+        if (input.occurrences.get(call.toolCallId) !== undefined) {
+            input.occurrences.refuse(call.toolCallId, "hook");
+            input.occurrences.answeredInPlace(call.toolCallId, by);
+        }
+        input.blockedToolCalls.add(call.toolCallId);
+        return { content: [{ type: "text", text: formatHookFeedback(text, input.reminderMark) }], details: {}, isError: true };
+    };
+    return async (call, run, signal) => {
+        const e = { ...classicEventBase(input.identity), tool: call.toolName, tool_use_id: call.toolCallId, input: judgedInputOf(call.args) };
+        const bodies = new Map();
+        let body;
+        const bottom = async () => {
+            body = run();
+            const result = await body;
+            const view = viewOf(result);
+            bodies.set(view, result);
+            return view;
+        };
+        const checkAnswer = (a, _e, _by, below, ran) => {
+            if (typeof a === "object" && a !== null && bodies.has(a))
+                return undefined;
+            const denied = denyOf(a) !== undefined;
+            if (!denied && substituteOf(a) === undefined)
+                return FORM;
+            if (ran.bottomStarted)
+                return `a ${denied ? "deny" : "result"} after the tool started (once the tool runs, only its own outcome stands)`;
+            if (denied)
+                return below.some((b) => denyOf(b) === undefined) ? "a deny while its next(e) still runs or after it was answered (deny in place of next)" : undefined;
+            if (below.includes(NEXT_IN_FLIGHT))
+                return "a result while its next(e) still runs (result in place of next)";
+            return letGoUnasked(input.occurrences, call.toolCallId) ? undefined : "a result in place of a call someone was asked about (a person's or a rule's yes is a yes to running the tool, so only the tool answers it)";
+        };
+        let outcome;
+        try {
+            outcome = await input.bus.dispatch("tool.call", e, { bottom, checkAnswer, ranks: RANKS, ...(signal !== undefined ? { signal } : {}) });
+        }
+        catch (err) {
+            if (body !== undefined)
+                return body;
+            return refusal(call, ENGINE_ORIGIN.plugin, `the tool.call station could not be raised (${describeThrown(err)}); this call to "${extensionWords(call.toolName, 80)}" was NOT executed (fail-closed)`);
+        }
+        if (outcome.kind === "aborted") {
+            if (body !== undefined)
+                return body;
+            return { content: [{ type: "text", text: "Operation aborted" }], details: {}, isError: true };
+        }
+        if (outcome.kind === "failed") {
+            return refusal(call, outcome.registration, `a tool.call extension ${failedHandlerClause(outcome)} before this call to "${extensionWords(call.toolName, 80)}" ran; the call was NOT executed (fail-closed)`);
+        }
+        const answer = outcome.answer;
+        const ran = typeof answer === "object" && answer !== null ? bodies.get(answer) : undefined;
+        if (ran !== undefined)
+            return ran;
+        const by = outcome.answeredBy ?? ENGINE_ORIGIN.plugin;
+        const reason = denyOf(answer);
+        if (reason !== undefined)
+            return refusal(call, by, `extension "${extensionWords(by, 80)}" refused this call to "${extensionWords(call.toolName, 80)}" before it ran: ${extensionWords(reason, 300)}`);
+        const content = substituteOf(answer);
+        if (content === undefined)
+            return refusal(call, by, `extension "${extensionWords(by, 80)}" answered this call in a form tool.call does not take; the call was NOT executed (fail-closed)`);
+        if (input.occurrences.get(call.toolCallId) !== undefined)
+            input.occurrences.answeredInPlace(call.toolCallId, by);
+        input.blockedToolCalls.add(call.toolCallId);
+        return { content, details: {} };
+    };
+}
+const AGENT_DOOR = "runs the Agent tool: that is $.agent.spawn";
+const OTHER_DOOR = new Map([
+    [toolFace("ask-user-question").contract.contractId, "runs the AskUserQuestion tool, which puts a question to the person: an extension's call does not ask the person"],
+    [toolFace("workflow").contract.contractId, "runs the Workflow tool, whose agents run outside the at-once bound on spawns: $.agent.spawn is the door"],
+]);
+export function createToolCallEntry(input) {
+    return async (args, ctx) => {
+        const by = ctx.origin.plugin;
+        const { tool, ...callInput } = args;
+        if (typeof tool !== "string" || tool === "")
+            throw new TypeError(`${by}: $.tool.call takes the event's input: { tool, ...args }`);
+        const toolCallId = `ext-${randomUUID()}`;
+        return runExtensionCall(input.bus, toolCallId, ctx, async (call) => {
+            const finalized = await input.harness.callTool({ type: "toolCall", id: toolCallId, name: tool, arguments: { ...callInput } }, ctx.signal, (t) => {
+                const contractId = input.faceOf(t.name)?.contractId;
+                const door = declaredDelegationNameOf(input.specOf(t.name)) !== undefined ? AGENT_DOOR : contractId !== undefined ? OTHER_DOOR.get(contractId) : undefined;
+                if (door !== undefined)
+                    throw new TypeError(`${by}: $.tool.call(${extensionWords(t.name, 80)}) ${door}`);
+            });
+            if (call.denied)
+                return Object.freeze({ deny: textOf(finalized.result.content) });
+            return viewOf({ ...finalized.result, isError: finalized.isError });
+        });
+    };
+}
+export function extensionCallOverlap(input) {
+    const others = input.occurrences.live().filter((o) => o.toolCallId !== input.toolCallId);
+    const name = extensionWords(input.toolName, 80);
+    if (!input.batchSafe(input.toolName, input.args)) {
+        return others.length === 0 ? undefined : `${name}: an extension's call of a tool that has the run to itself cannot run while another call is in flight`;
+    }
+    const exclusive = others.find((o) => o.life === "released" && !input.batchSafe(o.wireName ?? o.spelledName, o.finalInput ?? o.args));
+    return exclusive === undefined ? undefined : `${name}: an extension's call cannot run beside "${extensionWords(exclusive.wireName ?? exclusive.spelledName, 80)}", which has the run to itself`;
+}
+const textOf = (content) => (Array.isArray(content) ? content.map((b) => (isPlainRecord(b) && b["type"] === "text" && typeof b["text"] === "string" ? b["text"] : "")).join("") : "");

package/dist/core/namespaced-rule-name.d.ts

@@ -1,29 +1,49 @@
 /**
- * Linear-time `*` glob match (design/127 M6: NOT a RegExp — patterns may come from tenant-supplied
- * Settings layers; the classic two-pointer walk has zero ReDoS surface and the same semantics as CC's
- * anchored `^…$`+dotAll construction: every non-`*` char is literal, `*` spans anything incl. newlines).
+ * The name matchers of the rule grammar and of a run's tool-name lists: the linear `*` glob and the covering forms of a tool name —
+ * a glob over the whole name (`Re*d`, `mcp__*`, the lone `*`; read by a list that restricts) and the protocol-namespace peer
+ * (`<ns>__<peer>`). A leaf module — the allow layer's rule model and the run's list reader both import it, so neither needs the
+ * other's dependency tree.
+ */
+import type { ProtocolNamespace } from "./protocol-table.js";
+import type { RuleBehavior } from "./permission-rule-model.js";
+/**
+ * `*` glob match (design/127 M6: NOT a RegExp — patterns may come from tenant-supplied Settings layers; the same semantics as
+ * CC's anchored `^…$`+dotAll construction: every non-`*` char is literal, `*` spans anything incl. newlines). The literal
+ * before the first star and the one after the last are checked at the two ends, and each literal between two stars is put at
+ * its earliest place after the one before it (the earliest placement leaves the most room, so no later one need be tried):
+ * there is no backtracking, so no arrangement of stars multiplies the work and there is no ReDoS surface. The cost is at most
+ * the product of the two lengths, in the engine's native comparisons: a literal after the last star is refused at the end in
+ * one pass over its own length (`*` + k `a` + `b` against 2k `a`s costs k, not k²), and the shape that does reach the product
+ * is a long literal between two stars that matches over most of its length at every place — `*` + k `a` + `b` + k `a` + `*`
+ * against n `a`s is about k × n comparisons (49 ms at k = 1 000, n = 65 536).
  */
 export declare function wildcardMatch(pattern: string, value: string): boolean;
 /**
- * Does a namespaced RULE name cover `toolName`? — the tail branch of CC's rule matcher `VRp`
- * (:595780), which is UNCONDITIONAL there (its `globMatching` option gates only the whole-name glob
- * branch, so CC's allow lane — `mVo` :595803, which passes no options — matches MCP segments too).
- * Three covering forms, matching CC's three disjuncts (`<ns>` = any protocol-table prefix):
- *   · `<ns>__<peer>`           — every tool of that peer (rule tool segment absent);
- *   · `<ns>__<peer>__*`        — the same set, spelled with the star CC's own settings validator
- *                                recommends (`"MCP rules do not support patterns in parentheses …
- *                                use mcp__srv__*"`);
- *   · `<ns>__<peer>__get_*`    — a glob over the tool segment.
- * A LITERAL tool segment is deliberately NOT covered here: it is an exact tool name, and the exact
- * table already answers it — the same split CC makes with its leading `ruleName === toolName`.
- *
- * Rule and target must be in the SAME namespace, and peer segments compare EXACTLY (CC
- * `s.serverName === a.serverName`). A rule must therefore spell the peer the way the mint does; that
- * is the same string an operator reads off any mounted tool name, and inventing a fuzzier comparison
- * here would let one rule reach a peer — or a protocol — it does not name.
+ * True ⇔ this rule name reaches a SET of tool names rather than one exact name — the shapes {@link ruleNameCovers} answers and an
+ * exact-name table cannot hold — on a list of `behavior`. Every lane that keys entries by exact tool name asks it to know which
+ * entries it must NOT key that way. Two shapes:
+ *   · a `*` in the name — on a list that RESTRICTS (`deny`, `ask`; {@link readsNameGlob}) anywhere in it (`Re*d`, `mcp__*`, `*`);
+ *     on a list that GRANTS only in the tool segment after a literal `<ns>__<peer>__` (`mcp__srv__*`, `mcp__srv__get_*`): any other
+ *     `*` names no scope an allow widens ({@link grantWildcardRefusalOf}), so it is no covering name there — the readers refuse it;
+ *   · a protocol peer with no tool segment (`<ns>__<peer>`): every tool of that peer, in every list.
+ * `behavior` = the behavior of the list the name is written in — required: a list's `*` has no reading without it, so a value
+ * that is no behavior word (an array index handed by `filter`, say) is refused loudly, never read as either list.
+ */
+export declare function isCoveringRuleName(name: string, behavior: RuleBehavior): boolean;
+/**
+ * Does a covering rule name ({@link isCoveringRuleName}) cover `toolName`? A name with a `*` is a glob over the WHOLE name
+ * ({@link wildcardMatch} — the reference's `p` matcher): `mcp__srv__get_*` reaches `mcp__srv__get_issue`, `mcp__*` every MCP tool,
+ * `*` every tool. A protocol peer (`<ns>__<peer>`) reaches every tool minted under that peer, in the SAME namespace, the peer
+ * compared EXACTLY (CC `s.serverName === a.serverName`): a rule spells the peer the way the mint does. A literal name is an exact
+ * tool name, not a covering one — the exact tables answer it. This matcher does not know whose list a name was written in: a caller
+ * asks {@link isCoveringRuleName} with the list's behavior first and matches only what it admits.
+ */
+export declare function ruleNameCovers(ruleName: string, toolName: string): boolean;
+/**
+ * How far a covering rule name reaches into the peer `peer` of namespace `ns`: `"all"` — every tool of it; `"some"` — some tools of
+ * it (a glob over that peer's tool segment); `"none"` — none of it, as far as a list that dials peers needs to know. A glob reaches
+ * EVERY tool of the peer exactly when it ends in `*` and matches the peer's own prefix (`<ns>__<peer>__`): a prefix of every name
+ * minted under the peer is then matched by the glob up to its last `*`, which takes the rest; a glob that does not end in `*` leaves
+ * a tool name it does not match. The one reading of a name against a peer that the tool-name lists take.
  */
-export declare function namespacedRuleNameCovers(ruleName: string, toolName: string): boolean;
-/** True ⇔ this rule name is a namespaced name whose reach is a SET of tools rather than one exact tool
- *  — i.e. the shapes {@link namespacedRuleNameCovers} answers and an exact name table cannot. Every
- *  lane that keys rules by exact tool name needs this to know which entries it must NOT key that way. */
-export declare function isNamespacedCoveringRuleName(name: string): boolean;
+export declare function ruleNameReachIntoPeer(ruleName: string, ns: ProtocolNamespace, peer: string): "all" | "some" | "none";

package/dist/core/namespaced-rule-name.js

@@ -1,52 +1,59 @@
-import { splitNamespacedName } from "./tool-name-aliases.js";
+import { grantWildcardRefusalOf, readsNameGlob, splitNamespacedName } from "./tool-name-aliases.js";
 export function wildcardMatch(pattern, value) {
-    let p = 0;
-    let v = 0;
-    let star = -1;
-    let mark = 0;
-    while (v < value.length) {
-        if (p < pattern.length && pattern[p] === value[v] && pattern[p] !== "*") {
-            p++;
-            v++;
-        }
-        else if (p < pattern.length && pattern[p] === "*") {
-            star = p++;
-            mark = v;
-        }
-        else if (star >= 0) {
-            p = star + 1;
-            v = ++mark;
-        }
-        else {
-            return false;
+    const first = pattern.indexOf("*");
+    if (first < 0)
+        return pattern === value;
+    const last = pattern.lastIndexOf("*");
+    const head = pattern.slice(0, first);
+    const tail = pattern.slice(last + 1);
+    if (value.length < head.length + tail.length || !value.startsWith(head) || !value.endsWith(tail))
+        return false;
+    const end = value.length - tail.length;
+    let at = head.length;
+    for (let from = first + 1; from <= last;) {
+        const next = pattern.indexOf("*", from);
+        if (next > from) {
+            const literal = pattern.slice(from, next);
+            const found = value.indexOf(literal, at);
+            if (found < 0 || found + literal.length > end)
+                return false;
+            at = found + literal.length;
         }
+        from = next + 1;
     }
-    while (p < pattern.length && pattern[p] === "*")
-        p++;
-    return p === pattern.length;
+    return true;
 }
-function parseNamespacedRuleName(name) {
+function namespacedPeerOf(name) {
     const split = splitNamespacedName(name);
-    if (split === undefined || split.peer === "")
-        return undefined;
-    return split.tool !== undefined ? { protocol: split.ns.id, peer: split.peer, tool: split.tool } : { protocol: split.ns.id, peer: split.peer };
+    return split === undefined || split.peer === "" ? undefined : split;
 }
-export function namespacedRuleNameCovers(ruleName, toolName) {
-    const rule = parseNamespacedRuleName(ruleName);
-    if (rule === undefined)
-        return false;
-    const target = parseNamespacedRuleName(toolName);
-    if (target === undefined)
-        return false;
-    if (rule.protocol !== target.protocol)
-        return false;
-    if (rule.peer !== target.peer)
+export function isCoveringRuleName(name, behavior) {
+    if (behavior !== "deny" && behavior !== "ask" && behavior !== "allow") {
+        throw new TypeError(`isCoveringRuleName: the list's behavior must be "deny", "ask" or "allow" (got ${typeof behavior === "string" ? JSON.stringify(behavior) : typeof behavior}) — a "*" in a name reads one way on a list that restricts and another on one that grants`);
+    }
+    if (name.includes("*"))
+        return readsNameGlob(behavior) || grantWildcardRefusalOf(name) === undefined;
+    const peer = namespacedPeerOf(name);
+    return peer !== undefined && peer.tool === undefined;
+}
+export function ruleNameCovers(ruleName, toolName) {
+    if (ruleName.includes("*"))
+        return wildcardMatch(ruleName, toolName);
+    const rule = namespacedPeerOf(ruleName);
+    if (rule === undefined || rule.tool !== undefined)
         return false;
-    if (rule.tool === undefined || rule.tool === "*")
-        return true;
-    return target.tool !== undefined && rule.tool.includes("*") && wildcardMatch(rule.tool, target.tool);
+    const target = namespacedPeerOf(toolName);
+    return target !== undefined && target.ns.id === rule.ns.id && target.peer === rule.peer;
 }
-export function isNamespacedCoveringRuleName(name) {
-    const parsed = parseNamespacedRuleName(name);
-    return parsed !== undefined && (parsed.tool === undefined || parsed.tool.includes("*"));
+export function ruleNameReachIntoPeer(ruleName, ns, peer) {
+    if (ruleName.includes("*")) {
+        if (ruleName.endsWith("*") && wildcardMatch(ruleName, `${ns.prefix}${peer}__`))
+            return "all";
+        const rule = namespacedPeerOf(ruleName);
+        return rule !== undefined && rule.ns.id === ns.id && rule.peer === peer ? "some" : "none";
+    }
+    const rule = namespacedPeerOf(ruleName);
+    if (rule === undefined || rule.ns.id !== ns.id || rule.peer !== peer)
+        return "none";
+    return rule.tool === undefined ? "all" : "some";
 }

package/dist/core/output-style.d.ts

@@ -1,6 +1,6 @@
 /**
  * The longest output-style NAME the seat admits — the reference implementation's own bound (its `output_style`
- * renderer checks `style.length` against `HQe`, declared `HQe=256`; cli 2.1.280). Past it the reference drops the
+ * renderer checks `style.length` against `HQe`, declared `HQe=256`). Past it the reference drops the
  * per-turn reminder and logs an error; here the seat is refused at prepare (`config.output_style_invalid`), so a
  * name the deployment declared is never silently not stated.
  */

package/dist/core/param-rule-reach.d.ts

@@ -0,0 +1,15 @@
+/** The longest scalar an argument rule reads, unless a policy states its own (`caps.maxScalarValueChars`): a longer value is not
+ *  read, and the rule's lane wins (fail-closed). */
+export declare const DEFAULT_MAX_SCALAR_VALUE_CHARS = 16384;
+/** The call an argument rule is judged on: its arguments as the loop handed them, and its face (the tool's reading). */
+export interface ParamRuleCall {
+    readonly args: unknown;
+    readonly face?: object | undefined;
+}
+/**
+ * Does the rule on argument `param` with `pattern` reach this call? Non-object arguments ⇒ no; own top-level properties only
+ * (`param` is a literal key, never a dotted path); scalar values only, trimmed, matched whole by the `*` glob; a value longer than
+ * `maxScalarValueChars` FAIL-CLOSES (reached: it cannot be read, so the rule's lane wins). A call without the parameter is reached
+ * by a rule whose value the tool's reading folds away ({@link readingAbsorbs}).
+ */
+export declare function paramRuleReaches(call: ParamRuleCall, param: string, pattern: string, maxScalarValueChars?: number): boolean;

package/dist/core/param-rule-reach.js

@@ -0,0 +1,30 @@
+import { canonicalize, UNCANONICALIZABLE } from "./canonical-json.js";
+import { argsAsTheToolReads } from "./effective-path-target.js";
+import { wildcardMatch } from "./namespaced-rule-name.js";
+export const DEFAULT_MAX_SCALAR_VALUE_CHARS = 16_384;
+export function paramRuleReaches(call, param, pattern, maxScalarValueChars = DEFAULT_MAX_SCALAR_VALUE_CHARS) {
+    const args = call.args;
+    if (typeof args !== "object" || args === null || Array.isArray(args))
+        return false;
+    if (!Object.hasOwn(args, param))
+        return readingAbsorbs(call, args, param, pattern);
+    const raw = args[param];
+    if (raw === undefined || raw === null)
+        return false;
+    const t = typeof raw;
+    if (t === "object" || t === "function" || t === "symbol")
+        return false;
+    const value = String(raw).trim();
+    return value.length > maxScalarValueChars || wildcardMatch(pattern, value);
+}
+function readingAbsorbs(call, args, param, pattern) {
+    if (pattern.includes("*"))
+        return false;
+    try {
+        const read = canonicalize(argsAsTheToolReads(call, { ...args, [param]: pattern }));
+        return read !== UNCANONICALIZABLE && read === canonicalize(args);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/core/parent-spec-seat.d.ts

@@ -14,7 +14,7 @@ import type { EngineDollar } from "./mods/dollar.js";
 import type { ToolExecuteContext } from "./tool-spec.js";
 import type { TaskSpec } from "./types.js";
 /** The fields of a spec the seat carries — one `Pick`, shared by the mint's input and the apply's target. */
-export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "mods" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "memory" | "compaction" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "fileHistory" | "promptForm" | "promptBinding">;
+export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "mods" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "memory" | "compaction" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "fileHistory" | "projectMemory" | "promptForm" | "promptBinding" | "advisorModel" | "attachments">;
 /**
  * The seat a run hands its children. Every member is the parent's own value, frozen at mint (arrays copied and
  * frozen; the facts object copied). Members present iff the parent carries them — an absent member is "nothing to
@@ -50,11 +50,20 @@ export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "cli
  *    and every leg multiplies it by its own.
  *  · `fileHistory` — the request's file-history off switch (`"disabled"`, its only word), for the edits its delegates
  *    make on its behalf too. An ORDINARY member (fill law); with one word no child can author it back on.
+ *  · `projectMemory` — the request's off switch for the deployment's project context (`"disabled"`, its only word): the
+ *    delegates that work for it read no project context either. An ORDINARY member (fill law), the `fileHistory` shape.
  *  · `promptForm` — the host form of the system prompt (`"minimal"`, its only word: the core-behavior band is out). A
  *    host's product choice for the whole delegation tree, so every engine-built child (both delegation lanes and the
  *    observer sidecar) composes the same set of sections. An ORDINARY member (fill law).
  *  · `promptBinding` — the binding (a deployment's scenario name), a prompt selector value. A child composes its
  *    parent's center artifact, so its overlays' `when.binding` reads the same binding. An ORDINARY member (fill law).
+ *  · `advisorModel` — the person's advisor setting: every engine-built child judges it against its OWN model (an advisor
+ *    weaker than the child's model does not attach there). An ORDINARY member (fill law); the observer sidecar takes it and
+ *    excludes the tool by name.
+ *  · `attachments` — the request's attachment-lane declaration, WHOLE (which frames ride the legs' requests and which are
+ *    switched off): one declaration for the delegation tree, so a lane the parent turned on or off is on or off for the
+ *    delegates that work for it. An ORDINARY member (fill law): a child that authors `attachments` at all keeps exactly what it
+ *    authored, never half to the parent.
  */
 export interface ParentSpecSeat {
     readonly principal?: string;
@@ -73,8 +82,11 @@ export interface ParentSpecSeat {
     readonly skillListingBudgetFraction?: number;
     readonly skillListingMaxDescChars?: number;
     readonly fileHistory?: "disabled";
+    readonly projectMemory?: "disabled";
     readonly promptForm?: "minimal";
     readonly promptBinding?: string;
+    readonly advisorModel?: TaskSpec["advisorModel"];
+    readonly attachments?: TaskSpec["attachments"];
 }
 /** Refuse (by name, `config.deps_retired_key`) a seat that still carries a retired member. Read at every door a seat enters
  *  by hand: the ctx reader, the apply, and the send lane's waker clamps. */

package/dist/core/parent-spec-seat.js

@@ -22,8 +22,11 @@ export function parentSpecSeatOf(spec, frozenOnQuestion) {
         ...(spec.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: spec.skillListingBudgetFraction } : {}),
         ...(spec.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: spec.skillListingMaxDescChars } : {}),
         ...(spec.fileHistory !== undefined ? { fileHistory: spec.fileHistory } : {}),
+        ...(spec.projectMemory !== undefined ? { projectMemory: spec.projectMemory } : {}),
         ...(spec.promptForm !== undefined ? { promptForm: spec.promptForm } : {}),
         ...(spec.promptBinding !== undefined ? { promptBinding: spec.promptBinding } : {}),
+        ...(spec.advisorModel !== undefined ? { advisorModel: spec.advisorModel } : {}),
+        ...(spec.attachments !== undefined ? { attachments: Object.freeze({ ...spec.attachments }) } : {}),
         ...clampFieldSeatsOf(spec),
     });
 }
@@ -45,8 +48,11 @@ export function applyParentSpecSeat(child, seat) {
         ...fill("skillListingBudgetFraction", seat.skillListingBudgetFraction),
         ...fill("skillListingMaxDescChars", seat.skillListingMaxDescChars),
         ...fill("fileHistory", seat.fileHistory),
+        ...fill("projectMemory", seat.projectMemory),
         ...fill("promptForm", seat.promptForm),
         ...fill("promptBinding", seat.promptBinding),
+        ...fill("advisorModel", seat.advisorModel),
+        ...fill("attachments", (seat.attachments !== undefined ? { ...seat.attachments } : undefined)),
         ...(seat.oneShot === true ? { oneShot: true } : {}),
         ...(seat.memoryPersistenceCapable === false ? { memoryPersistenceCapable: false } : fill("memoryPersistenceCapable", seat.memoryPersistenceCapable)),
     };

package/dist/core/park-selfcheck.js

@@ -80,6 +80,7 @@ function syntheticCheckpoint(scope, fidelity) {
             origin: "denial_limit_fallback",
             askClass: "denial_limit_fallback",
             classes: ["denial_limit_fallback"],
+            engineMounted: true,
             batchToolCallIds: [`${scope}:call`],
             completedCallIds: [],
         },

package/dist/core/pause-registry.d.ts

@@ -82,15 +82,26 @@ export type PendingKind = (typeof PAUSE_REGISTRY)[GateKind]["pending"];
 export type ResumeGate = (typeof PAUSE_REGISTRY)[GateKind]["resume"] | "wake";
 /** Runtime twin of {@link GateKind}. */
 export declare function isGateKind(v: unknown): v is GateKind;
-/** The deadline semantic of a parked row — the registry's `facet` column, read with the gate's card: a question parked
- *  under an approval gate kind is not an approval, so its deadline voids it (`B`) instead of denying it (`A`). No gate
- *  kind of its own (the once-only winner, the reaper deadline and the batch stay one family). Only the literal
- *  `"question"` card marks a question. */
+/**
+ * The approval cards whose parked row takes another deadline semantic than its gate kind's: a question parked under an
+ * approval gate kind is not an approval, so its deadline voids it (`B`) instead of denying it (`A`). Read only on an
+ * approval gate, and only for a word of the closed card set ({@link parkedApprovalCardOf}). It is data so that a backend
+ * keeping the row's stored card word beside its gate kind (`checkpointIndexFacts`) generates its facet predicate from
+ * this table and the registry's `facet` column — the column's word IN this table's keys takes the key's facet, any other
+ * word, NULL or a non-approval kind takes the kind's — rather than from a list of its own. The facet itself is never
+ * stored: a stored copy goes stale the day a row of this table changes.
+ */
+export declare const CARD_FACET_OVERRIDES: Readonly<{
+    readonly question: "B";
+}>;
+/** The deadline semantic of a parked row — the registry's `facet` column, unless the approval gate's card is a key of
+ *  {@link CARD_FACET_OVERRIDES}. No gate kind of its own (the once-only winner, the reaper deadline and the batch stay
+ *  one family). */
 export declare function facetOf(gate: {
     readonly kind: GateKind;
     readonly approvalCard?: unknown;
 }): "A" | "B" | "-";
-/** Is this parked row a question to the user: an approval-kind gate whose card is the reserved `"question"`. */
+/** Is this parked row a question to the user: an approval gate whose card is the reserved `"question"`. */
 export declare function isQuestionGate(gate: {
     readonly kind: GateKind;
     readonly approvalCard?: unknown;

package/dist/core/pause-registry.js

@@ -10,11 +10,15 @@ export const PAUSE_REGISTRY = {
 export function isGateKind(v) {
     return typeof v === "string" && Object.prototype.hasOwnProperty.call(PAUSE_REGISTRY, v);
 }
+export const CARD_FACET_OVERRIDES = Object.freeze({ question: "B" });
 export function facetOf(gate) {
-    return isQuestionGate(gate) ? "B" : PAUSE_REGISTRY[gate.kind].facet;
+    const reading = parkedApprovalCardOf(gate);
+    const overrides = CARD_FACET_OVERRIDES;
+    return (reading.kind === "card" ? overrides[reading.card] : undefined) ?? PAUSE_REGISTRY[gate.kind].facet;
 }
 export function isQuestionGate(gate) {
-    return PAUSE_REGISTRY[gate.kind].pending === "tool_approval" && gate.approvalCard === "question";
+    const reading = parkedApprovalCardOf(gate);
+    return reading.kind === "card" && reading.card === "question";
 }
 export function parkedApprovalCardOf(gate) {
     const kind = gate.kind;

package/dist/core/peer-channel.d.ts

@@ -0,0 +1,70 @@
+import type { PeerSendVerdict } from "../agents/cross-session-judge.js";
+import type { PermissionModeClass } from "../agents/cross-session-envelope.js";
+/** The listening session: whose box an inbound frame lands in, and the host's hooks. */
+export interface PeerChannelSelf {
+    /** This session's id — its box is `session.<sessionId>`; a frame addressed to another id is not appended. */
+    sessionId: string;
+    /** The mailbox scope this session's box lives in. */
+    scope: string;
+    /** The doorbell rang (a peer appended to this session's box). The HOST decides what to do with it —
+     *  start a turn now, or let the next boundary drain; the engine never starts a turn on a frame. */
+    onNudge?: () => void;
+    /** One event per refused connection, dropped frame or appended frame (the channel's account — a host
+     *  logs or counts it). Never thrown into the listener. */
+    onEvent?: (event: PeerChannelEvent) => void;
+}
+/**
+ * Why the listener dropped a connection or a frame (closed set):
+ *  - `first_line_deadline` — no complete line within the first-line deadline (the connection closes);
+ *  - `line_too_long` — a line grew past the line wall before its newline (the connection closes);
+ *  - `unauthenticated` — the first line was not an auth frame, or was blank / not JSON (the connection closes);
+ *  - `bad_token` — the auth frame's token is not this session's (the connection closes);
+ *  - `malformed_line` — an authenticated line that is not JSON, not an object, or a message without text;
+ *  - `session_mismatch` — a message addressed to another session id;
+ *  - `box_full` — this session's box is at its queued-message bound, so the message was not appended;
+ *  - `unhandled_frame` — a frame type, control action or attachment this engine does not take over the socket;
+ *  - `append_failed` — the box refused the append (the store's own error).
+ */
+export declare const PEER_CHANNEL_DROP_REASONS: readonly ["first_line_deadline", "line_too_long", "unauthenticated", "bad_token", "malformed_line", "session_mismatch", "box_full", "unhandled_frame", "append_failed"];
+export type PeerChannelDropReason = (typeof PEER_CHANNEL_DROP_REASONS)[number];
+export type PeerChannelEvent = {
+    kind: "dropped";
+    reason: PeerChannelDropReason;
+    detail?: string;
+} | {
+    kind: "appended";
+    seq: number;
+} | {
+    kind: "nudged";
+};
+/** A bound listener. */
+export interface PeerChannelListener {
+    /** The address peers reach this session at (the socket path). */
+    readonly address: string;
+    /** Stop listening and withdraw everything `listen` published. */
+    close(): Promise<void>;
+}
+/** One outbound message (the reference agent's dialect is the channel's business). */
+export interface PeerChannelMessage {
+    /** The message text. */
+    body: string;
+    /** The sender's session id (self-claimed on the wire). */
+    fromSession?: string;
+    /** The sender's display name. */
+    fromName?: string;
+    /** The sender's self-attested permission-mode class. */
+    fromMode?: PermissionModeClass;
+    /** The prospective forwarding chain (this sender's own token already appended). */
+    hopChain: readonly string[];
+}
+/** The transport contract. A host wires one implementation; the engine dials and rings through it. */
+export interface PeerChannel {
+    /** Bind this session's inbound address and publish whatever peers need to reach it. */
+    listen(self: PeerChannelSelf): Promise<PeerChannelListener>;
+    /** Carry one message to a reference-agent session at `address`. Never throws: every outcome is a verdict
+     *  (`via: "uds"` on success; the `peer_send.*` transport codes otherwise). */
+    dial(address: string, message: PeerChannelMessage): Promise<PeerSendVerdict>;
+    /** Ring the doorbell of a session of this engine at `address`. Best-effort: `false` when the frame did not
+     *  go out; never throws — the message is already in the recipient's box either way. */
+    nudge(address: string): Promise<boolean>;
+}

package/dist/core/peer-channel.js

@@ -0,0 +1 @@
+export const PEER_CHANNEL_DROP_REASONS = Object.freeze(["first_line_deadline", "line_too_long", "unauthenticated", "bad_token", "malformed_line", "session_mismatch", "box_full", "unhandled_frame", "append_failed"]);