@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/task-spec.d.ts

@@ -121,8 +121,7 @@ export interface TaskSpec {
      * long-lived child's per-request face is correct design, not a configuration lie, so those legs
      * are exempt). The park lane is deliberately NOT required (interactive-without-park is a
      * legitimate light deployment — a synchronous CLI/local UI). `"headless"` declares the opposite
-     * and checks nothing (a batch deployment carrying an onAsk for audit is legal). Absent = no
-     * check, bytes unchanged.
+     * and checks nothing (a batch deployment carrying an onAsk for audit is legal). Absent = no check, bytes unchanged.
      *
      * Seat resolution is THREE-leg: `spec.interactionPosture ?? <the spawning run's resolved posture>
      * ?? deps.interactionPosture` — a Runner serving both an interactive session and cron/batch legs
@@ -271,8 +270,7 @@ export interface TaskSpec {
      * when that turn began", so B(target) IS the before-state. A target with no boundary of its own (a
      * steer / follow-up entry, a turn that recorded no history, a mixed-epoch session) refuses at prepare
      * (`rewind_snapshot.unresolvable`) with the files untouched: an earlier boundary would also revert edits
-     * the conversation keeps, so the anchor never falls back to an ancestor and never crosses into an
-     * earlier turn.
+     * the conversation keeps, so the anchor never falls back to an ancestor and never crosses into an earlier turn.
      * Fail-loud: setting this without {@link resumeAt}, or an unknown mode value, rejects at prepare.
      */
     resumeAtMode?: "at" | "before";
@@ -294,14 +292,16 @@ export interface TaskSpec {
      *  self-compacts on its own main model, so the window-safety judgment is structurally never
      *  triggered in a subagent (guard-tested). */
     compactionModel?: ModelRef;
+    /** The ADVISOR model (CC's `advisorModel` setting): any ref {@link model} takes. Present ⇒ prepare judges it against this leg's own model (`advisorAttachVerdict`) and, when it attaches, mounts the no-argument `advisor` tool; a value that is neither a string nor a Model refuses prepare (`config.advisor_model_invalid`) unless `RunnerDeps.advisorTool` is `"disabled"`, which ignores it unread. Rides the parent spec seat — unlike {@link compactionModel}, a child inherits it and judges it against its own model. */
+    advisorModel?: ModelRef;
     /** Thinking level. If omitted, a default from the resolved role's `RoleSpec.thinking` applies. */
     thinking?: ThinkingLevel;
-    /** This task's role text: it replaces the selected role base (`promptRole`). Text carrying a locked section verbatim
-     *  (an already-assembled prompt) is refused by name (`prompt.assembled_role_refused`). */
+    /** This task's role text: it replaces the role base `promptRole` selects; the task names its role base first, above its role's preset (`RoleSpec`).
+     *  Text carrying a locked section verbatim (an already-assembled prompt) is refused by name (`prompt.assembled_role_refused`). */
     systemPrompt?: string;
-    /** The role base `core/role.base` selects: `"general"` (absent), `"code"`, `"coordinator"`, `"cowork"` (rendered from the
-     *  mounted tools and the working directory); `systemPrompt` replaces whichever is selected. Not inherited (a child gets
-     *  the sub-agent persona). A value outside the closed set (`HOST_ROLES`, tested by `isHostRole`) is refused at prepare. */
+    /** The role base `core/role.base` selects — `"general"`, `"code"`, `"coordinator"`, `"cowork"` (rendered from the mounted tools and the
+     *  working directory) — and the run's host role; `systemPrompt` replaces it. A task naming neither takes its role's preset (`RoleSpec.promptRole` /
+     *  `systemPrompt`) whole; an explicit `"general"` names the general base and ends that chain, absent does not. Not inherited (a child gets the sub-agent persona). Outside the closed set (`HOST_ROLES`, `isHostRole`) ⇒ refused at prepare. */
     promptRole?: import("../prompt-assembly/catalog/schema.js").HostRole;
     /** `"minimal"` leaves the core-behavior band out; the locked sections (mode sections in play among them) and
      *  `appendSystemPrompt` stay. Absent ⇒ standard. Rides the parent spec seat to every engine-built child (a clamp-table
@@ -344,10 +344,9 @@ export interface TaskSpec {
     /**
      * Enable long-term memory for this task. **design/138 S4 (BREAKING): requires `RunnerDeps.memoryBackend`**
      * (the injection-first memory engine — materialize → file ops → harvest). With a backend configured the
-     * task gets the CC-verbatim `# Memory` instruction + fenced derived index and works memory through its
-     * ordinary file tools. WITHOUT a backend this field is INERT: the legacy `RunnerDeps.memoryStore` fallback
-     * (remember/recall tools + legacy `<user_memory>` injection) was retired — the task runs memory-less and
-     * one deprecation warning is emitted via `onError` (phase `"config"`).
+     * task gets the `# Memory` instruction + fenced derived index and works memory through its
+     * ordinary file tools. WITHOUT a backend this field is INERT: the task runs memory-less and one warning is
+     * emitted via `onError` (phase `"config"`).
      *
      * **design/84 Seam A** — single opaque scope → an **ordered, opaque scope list + a single writeScope**.
      * The engine only does read-side **layered injection** (one `<user_memory>` block, a `<scope …>` subsection
@@ -396,6 +395,14 @@ export interface TaskSpec {
      * such a run, for that cycle); no word turns it back on below. Any other value refuses (`rewind.invalid_spec`).
      */
     fileHistory?: "disabled";
+    /** The per-run OFF SWITCH for the deployment's project context (`"disabled"`, the only word; {@link fileHistory}'s spelling). Omitted ⇒ the
+     *  deployment's `RunnerDeps.loadProjectMemory` is called as it always is. `"disabled"` ⇒ this leg's prepare does not call it: no project layer is
+     *  injected, no instruction source is declared (the instruction-change lane never runs), none of the seam's files is seeded as already read,
+     *  and the compaction lanes carry no instruction-file text. Not that seam, and unaffected: the engine's own git-status lane and the memory
+     *  engine (its index seed included). The manifest reports `projectMemory: "disabled"` (`"absent"` where no seam is wired). Children inherit it
+     *  (parent spec seat, a revived cycle included); no word turns it back on below. Any other value refuses prepare, and a resume's screen before its
+     *  claim, `config.invalid_argument`. */
+    projectMemory?: "disabled";
     /**
      * design/381 (DV-9) — the RESTORE half of file rewind: when this task uses {@link resumeAt} to branch at
      * a prior entry, ALSO converge the working tree's **agent-edited files** (the tracked set — files this
@@ -445,8 +452,7 @@ export interface TaskSpec {
      * that should cover those edits is the root session's action; a restore request on such a child run
      * is refused loud (`rewind.child_scope_unsupported`) rather than converging a scope that holds none
      * of its edits. A delegated child that was handed NO lineage — a revival, a workflow/team member —
-     * keeps its own scope: its edits are outside this target's reach, and its own restore request is an
-     * ordinary one.
+     * keeps its own scope: its edits are outside this target's reach, and its own restore request is an ordinary one.
      */
     rewindFilesTo?: string;
     /**
@@ -478,8 +484,8 @@ export interface TaskSpec {
      *
      * Entries are read like {@link excludeTools}: a wire name or an alias it declares, `mcp__srv` / `mcp__srv__*` for every tool
      * of a server (including tools it lists later), a glob over the tool segment. The engine resolves the list against its OWN
-     * roster at prepare — a host passes the names it was given. A spelling no tool name can have, `mcp__*`, or an entry that is not
-     * a string is REFUSED at prepare (`config.tool_face_control`); a name no tool answers to is kept and told once (`onError`, phase
+     * roster at prepare — a host passes the names it was given. A spelling no tool name can have, `mcp__*` / `mcp__*__*` (an allowed
+     * list names no peer by them), or an entry that is not a string is REFUSED at prepare (`config.tool_face_control`); a name no tool answers to is kept and told once (`onError`, phase
      * `"config"`). The same compiled selector is applied on every later roster change (an MCP refresh or re-dial, the
      * deferred-search lane). Deferral is reached through ToolSearch, so a list that leaves it out defers nothing.
      *
@@ -493,8 +499,8 @@ export interface TaskSpec {
      * mounted tool set AFTER assembly — their schemas never reach `tools[]` (unlike a policy deny, which gates calls but still
      * ships the schema bytes every request — measured at zero token savings). The DENY half of the run's tool selector, read
      * exactly as a sub-agent's denied tools are: a wire name or an alias it declares; `Tool(content)` names the whole `Tool`;
-     * `mcp__srv` / `mcp__srv__*` / a glob over the tool segment for a server's tools, `mcp__*` for every MCP tool (including tools
-     * a server lists later). A spelling no tool name can have, `"*"`, or an entry that is not a string is REFUSED at prepare; a name
+     * `mcp__srv` / `mcp__srv__*` / a glob over the tool segment for a server's tools, `mcp__*` / `mcp__*__*` for every MCP tool
+     * (including tools a server lists later). A spelling no tool name can have, `"*"`, or an entry that is not a string is REFUSED at prepare; a name
      * no tool answers to is kept (it hides a tool of that name mounted later) and told once. A deny wins over {@link allowTools}.
      * ⚠️ A list that reaches a tool this kind of leg relies on (see {@link allowTools}) is refused; excluding a host-requested
      * structural tool (the structured-output tool) can still strand the task — the caller owns that risk.
@@ -557,7 +563,7 @@ export interface TaskSpec {
     toolMaterializeStrategy?: "swap" | "static";
     /**
      * The inline-pin counterpart of {@link deferTools} (same wire-name addressing, opposite
-     * direction; CC 220 `alwaysLoad` 对位): names listed here are NEVER deferred — not by
+     * direction): names listed here are NEVER deferred — not by
      * `ToolSpec.defer`, not by the MCP constant-defer arm (besides the server's own
      * `_meta["anthropic/alwaysLoad"]` declaration this list is the only channel that keeps a chosen
      * MCP tool's full schema inlined), not by `deferTools`, not by the deferral gate under any `deferMode`. Unknown names
@@ -590,19 +596,18 @@ export interface TaskSpec {
      * arguments succeeds; activation only controls whether the model has SEEN the schema). Set
      * `false` to restore the strict posture: every call on an un-activated placeholder is rejected
      * with the ToolSearch teaching message regardless of argument shape. Governance is unaffected
-     * either way — policy/effect/irreversibility gates key on the tool NAME maps and run upstream
-     * of any execute.
+     * either way — policy/effect/irreversibility gates key on the tool NAME maps and run upstream of any execute.
      */
     deferSelfResolve?: boolean;
     /**
-     * R2 双形轴(2026-07-18 裁): which prompt-profile face this task speaks — "simple" (default;
-     * CC 2.1.212's short-form tool descriptions + lean system sections, what CC serves every non-claude
-     * model id) or "classic" (the long-form face, ≈ CC 4.x-era wording — switchable per task/model,
-     * e.g. serving classic to a model that scores better on it; center distribution rides this field).
-     * Affects PRESENTATION only (descriptions/section wording), never tool behavior or policy.
-     * Inherited by delegated children unless their spec overrides.
+     * The task's one switch on the prompt's shape: `true` adds the `lean_prompt` trait to the model's declared traits
+     * (`Model.promptTraits`), `false` removes it (the long, classic shape of the system sections and tool descriptions),
+     * absent leaves the model's answer. It moves no other trait — a model-family trait stays the model's. PRESENTATION
+     * only (section wording, tool descriptions), never tool behavior or policy. Inherited by delegated children (and
+     * workflow agents) unless their spec writes it; a value that is not a boolean refuses the task
+     * (`config.prompt_selector_invalid`).
      */
-    promptProfile?: "simple" | "classic";
+    promptLean?: boolean;
     /**
      * core half — PER-TASK custom sub-agents. Same shape as the boot injection point
      * ({@link RunnerDeps.agents} / `SubagentToolOptions.agents`): full {@link AgentDefinition} objects
@@ -649,7 +654,7 @@ export interface TaskSpec {
      *  this manager. Overrides `RunnerDeps.lspManager`. Neither seat set, or no hands ⇒ the engine mounts no `lsp` tool (the model uses grep/read_file). */
     lspManager?: import("./lsp.js").LspServerManager;
     /**
-     * design/121 (CC 198 parity): after the agent edits a file, NEW language-server diagnostics are
+     * design/121: after the agent edits a file, NEW language-server diagnostics are
      * injected into the model (`<new-diagnostics>` context message, 10/file · 30 total · 4000-char cap)
      * and emitted as a structured `diagnostics` event for the shell. **Default ON** whenever the
      * preconditions hold — an LSP manager with a diagnostics registry is wired AND the roster has
@@ -660,7 +665,7 @@ export interface TaskSpec {
      *  registrations hang handlers on the `classic.*` events the engine's stations raise (tool pre/post/failure/batch,
      *  prompt submit, stop, compaction, permission denied). A delegated child dispatches its parent's task seat as its own
      *  (the parent spec seat fills an unset one). */
-    mods?: readonly import("./mods/kernel/index.js").ModRegistration<import("./mods/dollar.js").EngineDollar>[];
+    mods?: readonly import("./mods/classic-events.js").EngineModRegistration[];
     /**
      * The session's SELF-REPORTED presence for the peer directory (`agent` = what it is, `intent` = what
      * it is doing; each ≤ 120 chars). The engine never writes a directory row: the same object goes out
@@ -831,8 +836,7 @@ export interface TaskSpec {
      * request is dropped with the existing `preempt.ignored` trace instead of pausing the run.
      *
      * Delegated children inherit it: the sync / background / fork spawn lanes copy the `"disabled"` word
-     * into every child spec (same discipline as `principal`), so a store-less run's whole tree stays
-     * store-less.
+     * into every child spec (same discipline as `principal`), so a store-less run's whole tree stays store-less.
      *
      * The off switch is the WORD `"disabled"`, never `null`: a string is not nullish, so the ordinary
      * `spec ?? deps` coalesce is the whole resolution rule and no reader has to remember a special
@@ -895,8 +899,7 @@ export interface TaskSpec {
      * notebook_edit refuse these paths exactly as before). Use `additionalDirectories` when the task
      * should also write there. Same canonicalization and fail-closed skip rules as
      * `additionalDirectories`. Typical use: a deployment's own user-config directory in an interactive
-     * assembly, where a read-classifying shell gate would otherwise consult the approver for every
-     * config read.
+     * assembly, where a read-classifying shell gate would otherwise consult the approver for every config read.
      */
     additionalReadDirectories?: string[];
     /**
@@ -970,7 +973,7 @@ export interface TaskSpec {
      */
     enablePlanMode?: boolean;
     /**
-     * Interactive-tool mounting override (CC 2.1.207/209 parity: AskUserQuestion / ExitPlanMode /
+     * Interactive-tool mounting override (AskUserQuestion / ExitPlanMode /
      * EnterPlanMode share one `isEnabled` gate — in non-interactive mode without an SDK permission-prompt
      * tool the tool is NOT offered at all, so the model never asks into the void). sema's automatic
      * criterion (this knob unset): a human-facing tool mounts only when the deployment has SOME face that
@@ -997,8 +1000,7 @@ export interface TaskSpec {
      * OPT-OUT default (flipped from the pre-136 opt-IN): `undefined`/`true` = fork is AVAILABLE, bounded by the
      * session capability (`hasSessionFork` durable store + a session id + not inside a fork — honest refusal
      * otherwise); an EXPLICIT `false` = fork is DENIED for this task with the honest `fork.disabled` result
-     * (never a silent downgrade). Multi-tenant deployments that previously relied on `undefined` being OFF must
-     * now send `enableFork: false` explicitly (or deny per-principal via `RuntimeCaps.allowFork`).
+     * (never a silent downgrade); `RuntimeCaps.allowFork` denies it per principal.
      */
     enableFork?: boolean;
     /**
@@ -1080,7 +1082,7 @@ export interface TaskSpec {
      *
      * Lives for this run — the steers it takes in included; a delegated child holds the entries until it ends; a resumed leg
      * holds them only when its spec supplies them again (they are not written into a checkpoint). An entry this grammar
-     * reads as nothing (`*`, `mcp__*`, a write-path or domain pattern) grants nothing and is announced at the start of the
+     * reads as nothing (`*`, `mcp__*` / `mcp__*__*`, a write-path or domain pattern) grants nothing and is announced at the start of the
      * run (`permission.allowed_tool_not_granted`); a list holding `*` grants nothing at all. A value that is not a list of
      * strings refuses the run before it starts (`config.invalid_permission_rules`, with its issues).
      */
@@ -1164,8 +1166,7 @@ export interface TaskSpec {
     /**
      * design/164 — the SINGLE task-limit surface. Every budget axis lives here (the former top-level
      * `maxTokens` / `maxCostUsd` / `budgetStreamCancel` / `degrade` were folded in), and **every axis is
-     * DEFAULT-EMPTY**: a task with no `limits` runs with no engine-imposed turn / token / cost / wall-clock
-     * ceiling at all.
+     * DEFAULT-EMPTY**: a task with no `limits` runs with no engine-imposed turn / token / cost / wall-clock ceiling at all.
      *
      * Consequence, stated plainly (ruled 2026-08-04): a zero-config runaway has NO task-level backstop.
      * What still binds is the ENGINEERING GUARDRAIL family — {@link TaskLimits.brainCallGuardrailMs} (a
@@ -1258,16 +1259,16 @@ export interface TaskSpec {
     streamingToolExecution?: boolean;
     /**
      * **Structured output** (1.41): constrain the task's FINAL result to this JSON schema (a typebox
-     * object schema). Injects a built-in `submit_output` tool whose parameters ARE this schema; the model
+     * object schema). Injects a built-in `StructuredOutput` tool whose parameters ARE this schema; the model
      * calls it to finish, the validated object is surfaced as `TaskResult.structuredOutput`, and the task
      * ends. Provider-agnostic (it's just a tool). If the model can't produce a valid object within a few
-     * tries the task fails with `errorCode="output.invalid"`. A caller tool named `submit_output` is
-     * rejected (reserved). The model may still answer in prose (then `structuredOutput` is undefined) or
-     * `report_blocked`. Cast the result with `Static<typeof yourSchema>`.
+     * tries the task fails with `errorCode="output.invalid"`. While this is set, a caller tool named
+     * `StructuredOutput` is rejected (reserved). The model may still answer in prose (then `structuredOutput`
+     * is undefined) or call `ReportBlocked`. Cast the result with `Static<typeof yourSchema>`.
      */
     outputSchema?: TSchema;
     /**
-     * How many times the model may **retry** a rejected `submit_output` before the task fails with
+     * How many times the model may **retry** a rejected `StructuredOutput` call before the task fails with
      * `errorCode="output.invalid"` (only meaningful when {@link outputSchema} is set). `0` = fail on the
      * first invalid submit (no in-loop retry); the caller decides whether to re-run. Default `2`
      * (3 total attempts). Clamped to a non-negative integer. This bounds only the *in-task* retry of a
@@ -1309,7 +1310,7 @@ export interface TaskSpec {
      * the recovery-class forced lanes (design/374 slice 3): a prompt-too-long recovery or the guard
      * chain's arm B may still legitimately compact WITHIN the task — error/pressure recovery is not
      * a routine boundary pass, so a within-task compaction under this flag is contract-conforming.
-     * `attachWorkingFiles` (LONGRUN-2; **default ON since 2026-07-03** — CC 198 hard-codes its
+     * `attachWorkingFiles` (LONGRUN-2; **default ON since 2026-07-03** — the reference hard-codes its
      * post-compact file restore, and LONGRUN-2 measured ≈2.3 extra read round-trips per compaction
      * without it): after each compaction, re-read the task's most recently READ files (CC
      * readFileState semantics; else modified-by-recency) the summary leaves out of view, with the Read tool's
@@ -1330,7 +1331,7 @@ export interface TaskSpec {
             maxCharsPerFile?: number;
         };
         /**
-         * design/169-F (CC 220 :386605-386659/:597965 lightweight-clear posture) — OPT-IN stale
+         * design/169-F (lightweight-clear posture) — OPT-IN stale
          * tool-result offload, a projection-layer clear below full compaction: in the REQUEST sent to
          * the model, same-tool results older than the most recent `keepRecentPerTool` are replaced by a
          * short pointer ("offloaded … saved to persisted output ref …", readable back via the
@@ -1371,7 +1372,7 @@ export interface TaskSpec {
      * coalesced `<system-reminder>` steer per clean turn boundary, lowest lane: finalize/deadline-nudge/
      * diagnostics at the same boundary — and the design/130 P2 / design/132 end-game latches — all
      * suppress it. The listing family ALSO delivers its initial full frames on the FIRST user turn
-     * (prompt-adjacent, CC 209 classic wire shape) — that first-frame delivery is part of the first
+     * (prompt-adjacent) — that first-frame delivery is part of the first
      * message, not a boundary steer, so none of the boundary gates apply to it.
      *
      *  - `todoReminder`: CC 10/10 cadence — when TodoWrite (or the task tools; both mounted ⇒ the
@@ -1392,7 +1393,7 @@ export interface TaskSpec {
      *    (re)announced; no deferred tools ⇒ permanently silent.
      *  - `agentListing` (G1 续批 — CC `agent_listing_delta` parity; [c209-C] DEFAULT-ON, see above):
      *    when a delegation tool built by `createSubagentTool` is mounted, the FIRST user turn carries
-     *    the full agent-type roster ("Available agent types for the Agent tool:", CC-verbatim; + the
+     *    the full agent-type roster ("Available agent types for the Agent tool:"; + the
      *    concurrency note when more than one type; + the Q4 "Models available for the 'model'
      *    parameter:" tail when a catalog is mounted). Boundaries announce only roster drift
      *    (adds/removals — static in practice; the delta lane serves dynamic-registration deployments
@@ -1409,7 +1410,7 @@ export interface TaskSpec {
      *    instructions stay in the stable system prompt (`# MCP Server Instructions`, design/64 §17.3 —
      *    deliberate CC deviation: CC injects them as reminders, sema's stable-prompt carrier is
      *    prefix-cache-correct). This member announces only DELTAS: a mid-task disconnect of an
-     *    instruction-bearing server ("The following MCP servers have disconnected…", CC-verbatim), and
+     *    instruction-bearing server ("The following MCP servers have disconnected…"), and
      *    the add lane for a future dynamic-connect face. Added instruction text is UNTRUSTED server
      *    text → fenced with `delimitUntrusted` (deliberate CC deviation: CC injects it raw).
      *
@@ -1425,8 +1426,8 @@ export interface TaskSpec {
     attachments?: {
         todoReminder?: true;
         /**
-         * task #51 口径③ — CC `r2o()` kill-switch parity (CC 198 pretty.js:479167-479171; both reminder
-         * producers consume it as `if (r2o() === "off") return []`, :480232/:480268). `"off"` silences the
+         * task #51 口径③ — kill-switch parity (both reminder
+         * producers consume it as `if (r2o() === "off") return []`). `"off"` silences the
          * todo/task reminder lane even when `todoReminder` is wired on (the other attachment producers are
          * untouched — CC's nudge gate is lane-scoped); any other value (or absence) = CC `"baseline"`.
          * CC resolves this from env `CLAUDE_CODE_TODO_REMINDER_MODE` / the `tengu_soft_slate_nudge` gate;
@@ -1434,7 +1435,7 @@ export interface TaskSpec {
          */
         todoReminderMode?: "baseline" | "off";
         /**
-         * `tool_search_usage_reminder` (CC 2.1.220 producer `Nop` @608915, renderer @626269): the
+         * `tool_search_usage_reminder`: the
          * REVERSE nudge for delayed tool disclosure. When tools are deferred (design/36), a model that has
          * gone N turns without calling `ToolSearch` and still has unloaded schemas is told they exist and
          * how to load them, so "this capability does not exist, I will build a workaround" stops being the
@@ -1452,12 +1453,12 @@ export interface TaskSpec {
             maxFiles?: number;
         };
         /**
-         * SR-3 (CC 198 `budget_usd` lane, producer QFm pretty.js:480424-480428 + renderer :600225): the
-         * progressive $-budget readout `USD budget: $used/$total; $remaining remaining` (CC-verbatim
+         * SR-3 (the `budget_usd` lane): the
+         * progressive $-budget readout `USD budget: $used/$total; $remaining remaining` (fixed
          * template). CC-exact activation: live ONLY while the task carries an effective cost ceiling
          * (`maxCostUsd`, or a resource-slice ledger remaining — CC `options.maxBudgetUsd`); no ceiling ⇒
          * permanently silent even when opted in. CC-exact cadence: NO threshold ladder and NO throttle —
-         * CC mounts it on every attachment cycle whose task carries a ceiling (RB-311: CC 220 @607474 puts
+         * CC mounts it on every attachment cycle whose task carries a ceiling (RB-311: CC puts
          * it in the SHARED producer group, so a SUBAGENT with its own ceiling sees it too — the `!agentId`
          * flag gates the main-agent-exclusive group next to it, not this lane), so
          * sema emits one line at every collected clean turn boundary; the "progression" is the numbers
@@ -1472,9 +1473,9 @@ export interface TaskSpec {
          */
         budgetUsd?: true;
         /**
-         * `total_tokens_reminder` (CC 2.1.245 producer `MPs`, renderer `Oje`):
+         * `total_tokens_reminder`:
          * the TOKEN twin of {@link budgetUsd}. One line per collected boundary,
-         * `<total_tokens>N tokens left</total_tokens>`, CC-verbatim bytes.
+         * `<total_tokens>N tokens left</total_tokens>`.
          *
          * Activation, CC-exact in shape and BYOM-honest in substance: opted in here AND — for the two
          * COUNTDOWN arms — the task carries a token ceiling (`limits.maxTokens`, or a resource-slice
@@ -1494,7 +1495,7 @@ export interface TaskSpec {
          * `true`-only 133 form. BREAKING for a deployment that declares a token ceiling: pre-flip it saw
          * no `<total_tokens>` frame without opting in, and a probe pinning that absence reds.
          *
-         * WHY THIS LANE AND NOT {@link budgetUsd}. CC 2.1.245+ ships the readout on by default (its own
+         * WHY THIS LANE AND NOT {@link budgetUsd}. The reference ships the readout on by default (its own
          * settings schema reads "Defaults to padded-countdown"), which is the fact that reopened the
          * 2026-07-30 registration; the design/74 "no budget language reaches the model" default is
          * relaxed here for the same reason CC relaxed it. The BYOM honesty objection does not survive
@@ -1508,7 +1509,7 @@ export interface TaskSpec {
          */
         totalTokensReminder?: boolean;
         /**
-         * Which arm of the readout, CC 2.1.245's closed set (`off` / `infinite` / `fixed` /
+         * Which arm of the readout, the reference's closed set (`off` / `infinite` / `fixed` /
          * `countdown` / `padded-countdown`); absent ⇒ CC's own default `"padded-countdown"`.
          *
          *  - `countdown` — remaining = ceiling − spend, raw.
@@ -1537,6 +1538,11 @@ export interface TaskSpec {
          *  the default was off — a probe pinning "no background_tasks frame without opt-in" reds. */
         backgroundTasks?: boolean;
         toolsDelta?: true;
+        /** The notice that a declared MCP server did not connect for this message: its tools are unavailable for now, and it is
+         *  tried again when the next message arrives. Rides the leg's first request (a fresh leg's first user message, a resumed leg's continuation),
+         *  once per session per server and error. DEFAULT ON — boolean: `false` is the opt-out, a non-boolean is refused at the
+         *  task's door (`config.invalid_argument`). BREAKING: the notice used to ride {@link toolsDelta}, and only a turn boundary. */
+        mcpUnavailable?: boolean;
         /** [c209-C] listing family — DEFAULT ON (boolean, not `true`: explicit `false` is the opt-out;
          *  see the family carve-out note above). BREAKING (B-3): pre-[c209-C] the default was off. */
         agentListing?: boolean;
@@ -1545,9 +1551,8 @@ export interface TaskSpec {
         mcpInstructions?: true;
     };
     /**
-     * Inject a built-in `report_blocked` tool the agent can call when it cannot finish
-     * (missing info, permission, ambiguity). When called, the task ends with status "blocked".
-     * Default: true.
+     * Inject a built-in `ReportBlocked` tool the agent can call when it cannot finish
+     * (missing info, permission, ambiguity). When called, the task ends with status "blocked". Default: true.
      */
     enableBlockedReport?: boolean;
     /**

package/dist/core/task-stream.d.ts

@@ -96,7 +96,7 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      *  - `"now"` — `"next"`'s delivery guarantee PLUS the boundary is manufactured early: the frame
      *    takes the queue's class head and, when a turn is in flight, the engine CUTS that turn at a
      *    reconciled boundary (finished tool calls keep their real results; never-started ones settle
-     *    as paired interrupted results; the CC-verbatim interruption marker lands) and the run
+     *    as paired interrupted results; the interruption marker lands) and the run
      *    CONTINUES with this input — never the run-level `interrupt()`. Best-effort accelerator:
      *    with nothing in flight (idle tail, between turns) delivery is exactly `"next"`'s. Every
      *    real cut is announced (`task.turn_interrupted` notice) and counts toward `maxTurns` —
@@ -202,11 +202,11 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      * (the run-end backstop resolves "mooted" without a frame; the task's terminal events are the signal).
      *
      * design/145 §4 (additive): `opts.instructions` — the CC `/compact <instructions>` parity face.
-     * Injected into the summarization prompt in the CC-verbatim shape (`\n\nAdditional Instructions:`),
+     * Injected into the summarization prompt in the standard shape (`\n\nAdditional Instructions:`),
      * REPLACING the spec-level `compaction.instructions` / default instructions for THIS pass (a
      * one-shot directive should out-rank standing configuration — sema judgment inside the superset;
-     * CC has no spec level). A `preCompact` hook's `additionalInstructions` still APPENDS (CC 207
-     * :348007 merge shape). Sanitized like every instructions channel (break-out tags defused, fence
+     * CC has no spec level). A `preCompact` hook's `additionalInstructions` still APPENDS.
+     * Sanitized like every instructions channel (break-out tags defused, fence
      * sentinels capped, ≤2048 code points). Concurrent `compact()` calls coalesce onto one boundary:
      * the LAST caller's instructions win that pass (all waiters share its outcome — same coalescing
      * contract as before).
@@ -302,7 +302,7 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      * is not (its contract is "never dials or re-dials"). Core holds no MCP connection across task
      * legs, so once a server's transport closes this leg is stuck with it: every one of its tools fails
      * fast and a refresh can only keep reporting `not_connected`. This is the verb a host hangs a
-     * "Reconnect" control on. ONE NAMED SERVER, required — CC 2.1.259's control-channel request carries
+     * "Reconnect" control on. ONE NAMED SERVER, required — the reference's control-channel request carries
      * a required `serverName` and has no all-servers form, and an all-servers form would CLOSE HEALTHY
      * connections to re-dial them (the stdio server owning a device or a port — the case this verb
      * exists for — is the one that cannot be re-dialed while its predecessor still holds the device).
@@ -353,7 +353,7 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      *
      * The CUT half is the design/373 S1 turn-scoped settle, verbatim: finished tool calls keep their
      * REAL results; never-started ones settle as paired interrupted results
-     * (`errorKind:"interrupted_never_started"`); the CC-verbatim interruption marker lands in the
+     * (`errorKind:"interrupted_never_started"`); the interruption marker lands in the
      * session as an engine-note user frame. Every REAL cut is announced (`task.turn_interrupted`
      * notice, `detail.cause:"user_halt"` — the steer-now landing keeps its own message and no
      * `cause` key). The STOP half: from acceptance on, NO new model turn starts — the loop ends at

package/dist/core/task-tool-shape.d.ts

@@ -44,13 +44,13 @@ export interface TaskToolCapabilities {
     /** TaskStop accepts a background agent's spawn NAME as task_id (registry name resolution only). */
     nameAddressing: boolean;
 }
-/** Full-capability profile = the registry-backed mount with notifications wired (CC 209 verbatim form). */
+/** Full-capability profile = the registry-backed mount with notifications wired. */
 export declare const REGISTRY_TASK_TOOL_CAPS: TaskToolCapabilities;
 /** The env-direct thin-shell profile: cursor polling over a background shell, nothing else. */
 export declare const ENV_DIRECT_TASK_TOOL_CAPS: TaskToolCapabilities;
 /**
  * TaskOutput description, composed per capability. With every flag true this reproduces the registry's
- * pre-S2 literal byte-for-byte — the first two sentences are the CC 2.1.209 A5 deprecated form
+ * pre-S2 literal byte-for-byte — the first two sentences are the A5 deprecated form
  * (209-verbatim except the task-type names, mapped to sema's lanes; divergence-logged; the anchor
  * commentary lives at the registry factory). With `notification` false the <task-notification> half is
  * honestly omitted and the cursor-polling guidance (the env side's long-standing wording) is composed in
@@ -58,8 +58,8 @@ export declare const ENV_DIRECT_TASK_TOOL_CAPS: TaskToolCapabilities;
  */
 export declare function composeTaskOutputDescription(caps: TaskToolCapabilities): string;
 /**
- * TaskStop description, composed per capability. All-true reproduces the registry literal (CC206-B 欠账:
- * the named-agent bullet is CC-verbatim; CC's teammate bullet stays honestly omitted — sema's team face is
+ * TaskStop description, composed per capability. All-true reproduces the registry literal (
+ * the named-agent bullet is the reference's; its teammate bullet stays honestly omitted — sema's team face is
  * in-process, not registry-addressable); `nameAddressing:false` drops exactly that bullet (the env shell
  * has no agent-name resolution), which reproduces the env-direct literal.
  */

package/dist/core/tighten-task-spec.d.ts

@@ -12,7 +12,7 @@ export declare class TaskSpecTightenError extends Error {
  *    the override can only ADD denials/asks). Either alone ⇒ that one. This is the central fix: a blind spread
  *    would drop the base policy entirely.
  *  - **every row of the clamp table** (`CLAMP_SET`: `handsReadOnly`, `interactiveTools`, `approvalReach`, the two
- *    containment faces, `readDenyPatterns`, `oneShot`, `memoryPersistenceCapable`, `fileHistory`, `promptForm`, and
+ *    containment faces, `readDenyPatterns`, `oneShot`, `memoryPersistenceCapable`, `fileHistory`, `projectMemory`, `promptForm`, and
  *    `memory.enabled`) — a base carrying the row's restricting value meeting an override that states a different one ⇒
  *    **throw** (loosening); otherwise the restricting value wins if either side carries it, an add-only list unions, and an
  *    override writing `undefined` erases nothing. `memory` is an object seat with ONE clamped member (`enabled: false`):

package/dist/core/tighten-task-spec.js

@@ -1,4 +1,5 @@
 import { combinePolicies } from "./tool-policy.js";
+import { namesEveryTool } from "../agents/tool-filter.js";
 import { clampPermissionMode } from "./ask-origin.js";
 import { CLAMP_SEATS, clampCellOf, clampCellPath, composeClampSeat, loosensClampSeat } from "./child-clamp-seats.js";
 export class TaskSpecTightenError extends Error {
@@ -25,7 +26,7 @@ export function tightenTaskSpec(base, overrides) {
     {
         const b = base.allowTools;
         const o = overrides.allowTools;
-        if (b !== undefined && o !== undefined && !b.includes("*")) {
+        if (b !== undefined && o !== undefined && !b.some(namesEveryTool)) {
             const wider = o.filter((entry) => !b.includes(entry));
             if (wider.length > 0)
                 throw new TaskSpecTightenError(`tightenTaskSpec: cannot widen allowTools beyond the base list (override names ${JSON.stringify(wider)}; the override may only narrow)`);

package/dist/core/tool-catalog-entries.d.ts

@@ -6,7 +6,8 @@
  *
  * SINGLE SOURCE, TWO READERS. Each definition module spreads its row's `face` into the `ToolSpec` it
  * hands `defineTool` (`...TOOL_FACES.read`), so the face a tool declares at mount time IS the face
- * listed here — there is no second declaration to drift. The effect roster (tool-roster.ts) reads every
+ * listed here — there is no second declaration to drift (a definition whose schema is built per mount leaves its row's rule
+ * `params` to the static view, `mountRuleFace`). The effect roster (tool-roster.ts) reads every
  * axis off the MOUNTED INSTANCE; the static catalog (`describeToolCatalog()`) reads this table without
  * an env or a deps object. The conformance gate (test/tool-catalog-conformance.test.ts) proves the two
  * agree for every definition it can instantiate; the catalog completeness gate
@@ -31,11 +32,16 @@ export declare const TASK_GET_TOOL_NAME = "TaskGet";
 export declare const TASK_UPDATE_TOOL_NAME = "TaskUpdate";
 export declare const TASK_LIST_TOOL_NAME = "TaskList";
 export declare const TODO_WRITE_TOOL_NAME = "TodoWrite";
+/** Reserved name of the injected structured-output tool (`StructuredOutput`). The name it retired, `submit_output`, resolves to
+ *  nothing: the retired-name table (`RETIRED_TOOL_NAMES`) only tells a caller this one. */
+export declare const OUTPUT_TOOL_NAME = "StructuredOutput";
 export declare const REFRESH_MCP_TOOLS_TOOL_NAME = "RefreshMcpTools";
 export declare const ARTIFACT_TOOL_NAME = "Artifact";
 /**
  * Every row. Order is documentation order (hands → delegation → scaffolds → memory → scheduler → host
- * scenarios); nothing reads the order.
+ * scenarios); nothing reads the order. A row's rule `params` is its definition's FULLEST mount's scalar vocabulary, the
+ * static view's (`catalogRuleFaceOf`); a row that declares none (StructuredOutput: its schema is each task's) can be judged
+ * on a leg only.
  */
 export declare const TOOL_CATALOG_ENTRIES: readonly ToolCatalogEntry[];
 /**
@@ -45,6 +51,34 @@ export declare const TOOL_CATALOG_ENTRIES: readonly ToolCatalogEntry[];
 export declare const ENGINE_CARDS: Readonly<Record<string, string>>;
 /** The declared face of one definition, by definition id — what a definition module spreads into its spec. */
 export declare function toolFace(id: string): ToolFaceDeclaration;
+/** Is `contract` a contract object the catalog minted for an engine definition ({@link toolFace}) — the one record of "the engine
+ *  declared this", which a value written by hand (the same id spelled out) is not. */
+export declare function isCatalogContract(contract: unknown): boolean;
+/**
+ * "Does this call dispatch to the ENGINE's own instance of one of these definitions?" — the one judge, read off the call's face:
+ * one of the engine's own mount sites mounted the tool (`engineMounted`, the one identity a caller cannot wear), and the
+ * contract it carries is the one the catalog gives one of `ids`. Never the name or the contract alone: a caller's tool can take
+ * an engine name, and a contract id can be written by hand. False for every other call — a caller's or a protocol peer's tool,
+ * a face rebuilt from a park row minted before the row recorded its mount site, a bare request (no face). A row minted since
+ * carries the mount site its roster entry had at the park, so the pre-claim recheck of its edit reads this judge's answer at park time.
+ */
+export declare function engineMountedAs(ids: readonly string[]): (face: {
+    readonly engineMounted?: true;
+    readonly contractId: string;
+} | undefined) => boolean;
+/** Is this call's face the engine's own shell tool (either of its two mounts)? */
+export declare const isEngineShellFace: (face: {
+    readonly engineMounted?: true;
+    readonly contractId: string;
+} | undefined) => boolean;
+/**
+ * The rule face a definition whose schema is BUILT PER MOUNT puts on its instance: its row's primaries only (none ⇒ no rule
+ * face). The row's `params` is the static view's vocabulary, the fullest mount's; a mount's own is read off the schema it
+ * carries — whatever a summarizer, a host's capabilities or a host's own schema made it (`ruleFaceOfInstance`).
+ */
+export declare function mountRuleFace(id: string): {
+    primaryParams: string[];
+} | undefined;
 /** Definition-id → face, for the modules that spread one (`...TOOL_FACES.read`). Frozen: a face is data. */
 export declare const TOOL_FACES: Readonly<Record<string, ToolFaceDeclaration>>;
 /**