@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/roles.js

@@ -1,4 +1,6 @@
 import { selectModel } from "./select-model.js";
+import { namesRoleBase } from "../prompt-assembly/role-base.js";
+import { readPromptRole } from "../prompt-assembly/select.js";
 import { MODEL_ROLES } from "./types.js";
 export { MODEL_ROLES } from "./types.js";
 function catalogModel(ref, models) {
@@ -180,7 +182,7 @@ function specParts(s, seat = "a role seat") {
         return { model: s };
     }
     const cfg = s;
-    return { model: cfg.model, select: cfg.select, thinking: cfg.thinking, systemPrompt: cfg.systemPrompt };
+    return { model: cfg.model, select: cfg.select, thinking: cfg.thinking, promptRole: readPromptRole(`${seat}.promptRole`, cfg.promptRole), systemPrompt: cfg.systemPrompt };
 }
 export function roleSpecNamesModel(spec) {
     const parts = specParts(spec);
@@ -203,11 +205,13 @@ function mergeRoleSpec(base, over) {
     if (!b)
         return over;
     const overHasSource = o.model !== undefined || o.select !== undefined;
+    const roleBase = namesRoleBase(o) ? o : b;
     return {
         model: overHasSource ? o.model : b.model,
         select: overHasSource ? o.select : b.select,
         thinking: o.thinking ?? b.thinking,
-        systemPrompt: o.systemPrompt ?? b.systemPrompt,
+        promptRole: roleBase.promptRole,
+        systemPrompt: roleBase.systemPrompt,
     };
 }
 function assertKnownRole(word, field, ofKey = false) {
@@ -216,19 +220,19 @@ function assertKnownRole(word, field, ofKey = false) {
     const shown = typeof word === "string" ? JSON.stringify(word).slice(0, 80) : `<${word === null ? "null" : typeof word}>`;
     throw modelBindingRefusal(field, "unknown_role_word", `${ofKey ? `${field} key` : field} names the model role ${shown}, which is not one of ${MODEL_ROLES.join(" / ")} — a word outside the vocabulary binds nothing and resolves nothing; bind the model on one of these roles, or name it on TaskSpec.model`);
 }
-function mergeRoles(base, over) {
-    for (const key of Object.keys(base ?? {}))
-        assertKnownRole(key, "RunnerDeps.roles", true);
-    for (const key of Object.keys(over ?? {}))
-        assertKnownRole(key, "TaskSpec.roles", true);
-    for (const roles of [base, over]) {
-        for (const [key, value] of Object.entries(roles ?? {})) {
-            const seat = `roles.${key}`;
-            const named = specParts(value, seat).model;
-            if (named !== undefined)
-                assertModelBindingShape(named, roleModelSeat(named, seat), ROLE_BINDS);
-        }
+export function screenRoleMap(roles, field) {
+    for (const key of Object.keys(roles ?? {}))
+        assertKnownRole(key, field, true);
+    for (const [key, value] of Object.entries(roles ?? {})) {
+        const seat = `roles.${key}`;
+        const named = specParts(value, seat).model;
+        if (named !== undefined)
+            assertModelBindingShape(named, roleModelSeat(named, seat), ROLE_BINDS);
     }
+}
+function mergeRoles(base, over) {
+    screenRoleMap(base, "RunnerDeps.roles");
+    screenRoleMap(over, "TaskSpec.roles");
     const out = { ...base };
     for (const role of Object.keys(over ?? {})) {
         out[role] = mergeRoleSpec(base?.[role], over?.[role]);
@@ -249,27 +253,35 @@ function partsModel(parts, models, seat = "a role seat") {
     }
     return undefined;
 }
-export function resolveTaskModel(spec, deps) {
+function chainHead(spec, deps) {
     const start = spec.modelRole === undefined ? "default" : spec.modelRole;
     assertKnownRole(start, "modelRole");
+    const merged = mergeRoles(deps.roles, spec.roles);
+    return { start, merged, startParts: specParts(merged[start], `roles.${start}`) };
+}
+export function presetRoleBaseOf(spec, deps) {
+    const { promptRole, systemPrompt } = chainHead(spec, deps).startParts;
+    return namesRoleBase({ promptRole, systemPrompt }) ? { ...(promptRole !== undefined ? { promptRole } : {}), ...(systemPrompt !== undefined ? { systemPrompt } : {}) } : undefined;
+}
+export function resolveTaskModel(spec, deps) {
+    const { start, merged, startParts } = chainHead(spec, deps);
     if (spec.model !== undefined) {
-        const startParts = specParts(mergeRoles(deps.roles, spec.roles)[start], `roles.${start}`);
         return {
             model: resolveModel(spec.model, deps.models, "TaskSpec.model"),
             modelRef: spec.model,
             thinking: spec.thinking ?? startParts.thinking,
+            promptRole: startParts.promptRole,
             systemPrompt: startParts.systemPrompt,
         };
     }
-    const merged = mergeRoles(deps.roles, spec.roles);
-    const startSystemPrompt = specParts(merged[start], `roles.${start}`).systemPrompt;
+    const { promptRole: startPromptRole, systemPrompt: startSystemPrompt } = startParts;
     for (const role of [start, ...FALLBACK[start]]) {
         const parts = specParts(merged[role], `roles.${role}`);
         const fromParts = partsModel(parts, deps.models, `roles.${role}`);
         const model = fromParts ?? roleTierModel(role, deps.models);
         if (model) {
             const modelRef = fromParts !== undefined ? (parts.model ?? model) : (ROLE_TIER_DEFAULTS[role] ?? model);
-            return { model, modelRef, thinking: spec.thinking ?? parts.thinking, systemPrompt: startSystemPrompt };
+            return { model, modelRef, thinking: spec.thinking ?? parts.thinking, promptRole: startPromptRole, systemPrompt: startSystemPrompt };
         }
     }
     throw new Error(`No model for role "${start}": set TaskSpec.model, or configure RunnerDeps.roles / TaskSpec.roles["${start}"] (or a "default" role). A "select" RoleSpec also fails here if no catalog model matches.`);

package/dist/core/rule-lane-reads.d.ts

@@ -34,16 +34,20 @@ export declare function normalizeOrgGateVerdict(answer: unknown, unreadable: str
 /**
  * Normalize the accepted {@link ToolGateInput.persistedRules} answers into one reading.
  *
- * `{}` = a clean negative (no rule admits this call). `{ unreadable: true }` = the lane could not read
- * its source. `{ hit }` = a match, whose `rules` is the non-empty coverage set (design/375). An answer
- * outside every accepted shape — a number, `null`, an object with neither `rules` nor `unreadable`, an
- * EMPTY `rules` array, the retired pre-375 `{ rule, dots? }` single-rule object — is read as a clean
- * negative rather than a match: this is a LOOSENING seam, so an answer nobody can name degrades toward
- * asking, never toward an allow built on it. All-or-nothing across the set's TEXTS for the same
- * reason: a set with one unreadable member is a different (smaller) claim than the lane made, and a
- * decision must not stand on a claim nobody made — one bad member drops the whole answer to the clean
- * negative. Per-member DOTS stay individually optional (identity lost ⇒ `"not_reported"`, exactly the
- * single-rule contract).
+ * Four readings, and the lane's own words pick them. `{}` = the lane SAID no rule speaks: the `undefined` answer
+ * (the store was read and holds nothing for this call) or a coverage answer (design/375 §5.2②, whose decision
+ * meaning is "no rule"). `{ hit }` = a match: a `behavior` of the closed set and a NON-EMPTY `rules` whose members each
+ * carry a text (design/375). `{ unreadable: true }` = the lane said it could not read its source (the store form).
+ * `{ unreadable: true, reason }` = the lane could not read the call against its rows (its own call form), OR the lane
+ * answered something this seam cannot read — `null`, a string or number, an object that is none of the shapes above, a
+ * `behavior` outside the closed set or absent, `rules` absent / not an array / empty, a member that is not a record or
+ * whose `rule` is not a string, a carrier that is not a plain object. The last arm is the one that matters: an answer the
+ * lane gave and nobody can read may be a DENY or an ASK row that did not survive the seam, and reading it as "no rule"
+ * would let the person's standing "never run this" fail silently — so it is read as the unreadable word (a
+ * real-approval ask no mode releases; headless, a refusal), the same word the org lane's unreadable answer takes.
+ * All-or-nothing across the set for the same reason: a set with one unreadable member is a different (smaller) claim than
+ * the lane made, and a decision must not stand on a claim nobody made. Per-member DOTS stay individually optional
+ * (identity lost ⇒ `"not_reported"`, exactly the single-rule contract).
  *
  * The hit's dots are COPIED, not aliased. The array travels onto an ask that may sit in front of a
  * person for a long time; a lane that retains and mutates its own array would otherwise change what the
@@ -68,11 +72,12 @@ export declare function readOrgRuleLane(org: {
 }, req: ToolCallRequest, signal: AbortSignal | undefined, timeoutMs?: number): Promise<OrgGateVerdict>;
 /**
  * The persisted-rule lane's one read for one call — every consumer's (the live gate, the synthetic-Read
- * judge), normalized once. A lane that throws, hangs past the dependency timeout, or answers something
- * unreadable is a lane that could not answer: a row nobody could read may forbid the call, so for the DECISION it
- * fails closed (`applyPersistedTightening` reads `{ unreadable }` without a reason as the store form: a real-approval
- * ask), and for the RECORD it is `"unavailable"`. A call the lane could not read against the rows (`reason`) fails
- * closed in the arms the same way, as the call form. Absent lane ⇒ the clean negative.
+ * judge), normalized once. A lane that throws or hangs past the dependency timeout is a lane that could not answer: a row
+ * nobody could read may forbid the call, so for the DECISION it fails closed (`applyPersistedTightening` reads `{ unreadable }`
+ * without a reason as the store form: a real-approval ask), and for the RECORD it is `"unavailable"`. A lane that ANSWERS
+ * something this seam cannot read, and a call the lane could not read against the rows, are `unreadable` with a `reason`
+ * (the normalizer's words, naming the field): they fail closed in the arms the same way, as the call form. Absent lane,
+ * or the lane's own `undefined` ⇒ the clean negative.
  */
 export declare function readPersistedRuleLane(lane: {
     adjudicate: (req: ToolCallRequest) => PersistedRuleAnswer | Promise<PersistedRuleAnswer>;

package/dist/core/rule-lane-reads.js

@@ -1,6 +1,6 @@
 import { describeThrown } from "./tool-policy.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "./permission-rule-org.js";
-import { isRuleBehavior } from "./permission-rule-model.js";
+import { isRuleBehavior, RULE_BEHAVIORS } from "./permission-rule-model.js";
 function isPlainOwnRecord(x) {
     try {
         if (x === null || typeof x !== "object" || Array.isArray(x))
@@ -21,6 +21,15 @@ function ownDataValue(obj, key) {
         return undefined;
     }
 }
+function bearsOwn(obj, key) {
+    try {
+        const d = Object.getOwnPropertyDescriptor(obj, key);
+        return d !== undefined && (!("value" in d) || d.value !== undefined);
+    }
+    catch {
+        return true;
+    }
+}
 export function normalizeOrgGateVerdict(answer, unreadable) {
     const clean = (v) => Object.assign(Object.create(null), v);
     const readable = (x) => {
@@ -94,16 +103,24 @@ function copiedUsableDots(dots) {
     const usable = copied?.every((d) => typeof d.actor === "string" && typeof d.counter === "number" && Number.isFinite(d.counter)) === true && copied.length > 0;
     return usable ? { dots: copied } : {};
 }
+function unreadableAnswer(where) {
+    return { unreadable: true, reason: `the host's persisted-rule lane, persistedRules.adjudicate, answered what this gate cannot read: ${where}` };
+}
 export function normalizePersistedRuleHit(hit) {
-    if (!isPlainOwnRecord(hit))
+    if (hit === undefined)
         return {};
+    if (!isPlainOwnRecord(hit))
+        return unreadableAnswer(hit === null ? "the answer is `null` — a lane with no rule for the call answers `undefined`" : "the answer is not a plain object");
     if (ownDataValue(hit, "unreadable") === true) {
         const reason = ownDataValue(hit, "reason");
         return typeof reason === "string" ? { unreadable: true, reason } : { unreadable: true };
     }
     const rulesRaw = ownDataValue(hit, "rules");
-    if (rulesRaw === undefined) {
+    const behavior = ownDataValue(hit, "behavior");
+    if (!bearsOwn(hit, "rules") && !bearsOwn(hit, "behavior") && !bearsOwn(hit, "unreadable")) {
         const coverageRaw = ownDataValue(hit, "segmentCoverage");
+        if (coverageRaw === undefined)
+            return unreadableAnswer("it names no `behavior`, no `rules`, no `unreadable` report and no `segmentCoverage` table");
         let rows;
         try {
             if (Array.isArray(coverageRaw)) {
@@ -120,27 +137,38 @@ export function normalizePersistedRuleHit(hit) {
         }
         return rows !== undefined && rows.length > 0 ? { coverage: rows.map((r) => ({ segment: r.segment, covered: r.covered })) } : {};
     }
-    let members;
+    if (!isRuleBehavior(behavior))
+        return unreadableAnswer(`\`behavior\` is not one of ${RULE_BEHAVIORS.join(" / ")}`);
+    const members = [];
+    let problem;
     try {
-        if (Array.isArray(rulesRaw)) {
-            const walked = [];
-            for (let i = 0; i < rulesRaw.length; i++) {
+        const count = Array.isArray(rulesRaw) ? rulesRaw.length : undefined;
+        if (!Array.isArray(rulesRaw))
+            problem = rulesRaw === undefined ? "`rules` is absent or not an own data property" : "`rules` is not an array";
+        else if (count === 0)
+            problem = "`rules` is empty — a hit names at least one rule";
+        else if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0)
+            problem = "`rules` has no readable length";
+        else {
+            for (let i = 0; i < count && problem === undefined; i++) {
                 const m = rulesRaw[i];
-                walked.push(isPlainOwnRecord(m) ? { rule: ownDataValue(m, "rule"), dots: ownDataValue(m, "dots") } : { rule: undefined, dots: undefined });
+                if (!isPlainOwnRecord(m))
+                    problem = `\`rules[${i}]\` is not a plain object`;
+                else {
+                    const rule = ownDataValue(m, "rule");
+                    if (typeof rule !== "string")
+                        problem = `\`rules[${i}].rule\` is not a string`;
+                    else
+                        members.push({ rule, dots: ownDataValue(m, "dots") });
+                }
             }
-            members = walked;
         }
     }
     catch {
-        members = undefined;
+        problem = "`rules` could not be read (a throwing element or a revoked proxy)";
     }
-    if (members === undefined || members.length === 0)
-        return {};
-    if (!members.every((m) => typeof m.rule === "string"))
-        return {};
-    const behavior = ownDataValue(hit, "behavior");
-    if (!isRuleBehavior(behavior))
-        return {};
+    if (problem !== undefined)
+        return unreadableAnswer(problem);
     const denial = behavior === "deny" ? copiedDenial(ownDataValue(hit, "denial"), members.map((m) => m.rule)) : undefined;
     return { hit: { behavior, rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })), ...(denial !== undefined ? { denial } : {}) } };
 }

package/dist/core/rule-owner.d.ts

@@ -5,8 +5,8 @@
  * The faces that read an owner out of data — the two adoption markers read back from disk, the two adoption entries'
  * source, a stored approval record's identity and the consent entries' `owner` option — read it through
  * {@link readRuleOwner}, so the source an adoption entry writes into its marker is one that marker's reader reads back.
- * Its one run-time import is the import-free record judge — the root adoption marker reader, which every file store
- * loads, depends on this module and is kept free of the rule store's own imports.
+ * Its run-time imports are the two import-free judges — the record judge and the principal-name judge — because the root
+ * adoption marker reader, which every file store loads, depends on this module and is kept free of the rule store's own imports.
  */
 import type { AssertAllKeysHandled } from "./ask-origin.js";
 /**
@@ -36,7 +36,7 @@ export declare function sameRuleOwner(a: RuleOwner, b: RuleOwner): boolean;
 /**
  * Read an owner from a value the engine did not just build, or `undefined` when it is not one: not a plain record (an
  * object whose prototype is `Object.prototype` or none, so no member comes from a prototype it was given), a `kind`
- * outside {@link RULE_OWNER_KINDS}, or a `principal` arm whose name is not a string with a non-whitespace character (an
+ * outside {@link RULE_OWNER_KINDS}, or a `principal` arm whose name is not a principal name ({@link principalNameOf}: an
  * identity-less bucket is the `local-owner` kind, never a blank name). Fail-closed: a caller treats `undefined` as
  * "owns nothing" or refuses — never as either arm. The answer is a fresh object holding only the members the type
  * declares; `kind` and `principal` are each read once.

package/dist/core/rule-owner.js

@@ -1,4 +1,5 @@
 import { isPlainRecord } from "./mods/kernel/receive.js";
+import { principalNameOf } from "./principal-name.js";
 export const RULE_OWNER_KINDS = Object.freeze(["principal", "local-owner"]);
 export function sameRuleOwner(a, b) {
     return a.kind === "principal" ? b.kind === "principal" && a.principal === b.principal : b.kind === "local-owner";
@@ -14,8 +15,8 @@ export function readRuleOwner(raw) {
         case "local-owner":
             return { kind: "local-owner" };
         case "principal": {
-            const principal = raw.principal;
-            return typeof principal === "string" && principal.trim() !== "" ? { kind: "principal", principal } : undefined;
+            const principal = principalNameOf(raw.principal);
+            return principal === undefined ? undefined : { kind: "principal", principal };
         }
         default: {
             const unhandled = word;

package/dist/core/runner/announce-once-ledger.d.ts

@@ -68,6 +68,20 @@ export declare function flushOwedAnnouncedSnapshot(prepared: {
     announcedListingsRef: AnnouncedListingSnapshotInput;
     session: Pick<AnnounceOnceSession, "appendAnnouncedListing">;
 }): Promise<void>;
+/**
+ * The one commit of a delivered `mcp_unavailable` frame — the receipt of the message that carried it (a leg's first request), run
+ * inside the `message_end` walk: the delivered pairs leave the pending list and join the session's told-failure record, whose
+ * snapshot write is parked for the next serialization point. The next prepare on the session announces only what the record lacks.
+ */
+export declare function settleMcpUnavailable(prepared: {
+    readonly mcpUnavailable?: {
+        pending: AnnouncedMcpFailure[];
+    };
+    readonly announcedListingsRef: AnnouncedListingSnapshotInput;
+    readonly frameReceipts: {
+        listingSnapshotOwed: boolean;
+    };
+}, delivered: ReadonlyArray<AnnouncedMcpFailure>): void;
 /** The run-local ledger — see the module header for the two commit disciplines it serves. */
 export interface AnnounceOnceLedger {
     /** The nearest announced snapshot on the branch as read at prepare (undefined = pre-entry

package/dist/core/runner/announce-once-ledger.js

@@ -47,6 +47,11 @@ export async function flushOwedAnnouncedSnapshot(prepared) {
         return;
     await prepared.session.appendAnnouncedListing(prepared.announcedListingsRef).catch(() => undefined);
 }
+export function settleMcpUnavailable(prepared, delivered) {
+    prepared.mcpUnavailable?.pending.splice(0, delivered.length);
+    prepared.announcedListingsRef.mcpFailed = [...(prepared.announcedListingsRef.mcpFailed ?? []), ...delivered];
+    prepared.frameReceipts.listingSnapshotOwed = true;
+}
 export async function loadAnnounceOnceLedger(session, checkpointMirror, onError) {
     let recovered = true;
     const entry = await session.getAnnouncedListing().catch(() => {

package/dist/core/runner/assemble-result.d.ts

@@ -148,6 +148,7 @@ export interface ResultFlags {
      *  ended for its own reason first) leaves this empty: the original terminal stands and the seat is
      *  NOT signed (the settle lane mints `task.halt_unconsumed` for it). */
     haltConsumption?: HaltConsumption;
+    answerEntryIds?: readonly string[];
     /** Call ids of answered-but-never-collected questions, echoed on
      *  `TaskResult.strandedHumanAnswers`. Pure pass-through; empty/absent ⇒ the field is omitted. The
      *  optional `onError` alert is NOT the disclosure — this mandatory result face is. */

package/dist/core/runner/assemble-result.js

@@ -178,5 +178,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
     const stampHaltedByUser = haltConsumed(flags.haltConsumption);
-    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, terminal, ...(flags.model !== undefined ? { model: flags.model } : {}), ...(responseModel !== undefined ? { responseModel } : {}), result: result.trim(), salvagedOutput, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveWriteFace !== undefined ? { effectiveWriteFace: flags.effectiveWriteFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), ...(flags.compaction !== undefined ? { compaction: flags.compaction } : {}), stats: publicStats };
+    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, terminal, ...(flags.model !== undefined ? { model: flags.model } : {}), ...(responseModel !== undefined ? { responseModel } : {}), result: result.trim(), ...(flags.answerEntryIds !== undefined ? { resultEntryIds: [...flags.answerEntryIds] } : {}), salvagedOutput, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveWriteFace !== undefined ? { effectiveWriteFace: flags.effectiveWriteFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), ...(flags.compaction !== undefined ? { compaction: flags.compaction } : {}), stats: publicStats };
 }

package/dist/core/runner/call-hook-stations.d.ts

@@ -89,8 +89,9 @@ export interface ApprovedCallScreenInput {
  * the call (the decide is the upper bound; the screen can only narrow): a deny, a failed or cancelled screening, or a
  * refused answer refuses the call in the live gate's own sentences; an ask is the question the decide already answered —
  * unless it demands a person and the decide was the deployment's policy (the one predicate every resume station holds a
- * decide against); a rewrite is what executes when the decide carried none of its own (the person's bytes are the upper
- * bound); context rides the result. Undefined when no handler hangs on `classic.PreToolUse`.
+ * decide against); a rewrite comes back as the args — what executes when the decide carried no edit, a refusal of the edit
+ * when it did (a person's bytes are the ceiling, rewrite-rejudge.ts); context rides the result. Undefined when no handler hangs
+ * on `classic.PreToolUse`.
  */
 export declare function createApprovedCallScreen(input: ApprovedCallScreenInput): ApprovedCallScreen | undefined;
 /**

package/dist/core/runner/caller-roster.d.ts

@@ -12,7 +12,8 @@
  * (string and symbol keys — what the mount's spread carries) plus every ToolSpec member name read through an ordinary
  * property read (how the phases read a declaration — non-enumerable, inherited or Proxy-answered included), each read once;
  * every declaration value is deep-copied and frozen by the one copier. A primitive is immutable and stays as read. A
- * read that throws refuses the run at the snapshot. Whether the ToolSpec arm can build the entry ({@link specArmCanConstruct})
+ * read that throws refuses the run at the snapshot, and so does an entry that carries a retired ToolSpec member under any
+ * reading of the key ({@link refuseRetiredMember}: the entry is asked once, before any face is minted). Whether the ToolSpec arm can build the entry ({@link specArmCanConstruct})
  * is asked of the entry once, there, and recorded on its face ({@link specArmCanBuild}); the mount refuses an entry it
  * cannot build from that record, so an `execute` that grows on the caller's object later is never read. The mount calls a
  * spec face's `execute` with the caller's own object as `this` ({@link callerEntryOrigin}). A `defineTool` product's face is
@@ -57,16 +58,27 @@ export declare function callerEntryOrigin(entry: object): object;
 /** Can the mount's ToolSpec arm build this roster entry? Only the verdict recorded at the snapshot answers: an object that
  *  is no face of this snapshot, a primitive, a product's face, is not built from. */
 export declare function specArmCanBuild(entry: RosterFace): boolean;
-/** A `TaskSpec.tools` spec declaring an engine contract (a `core.` id) its catalog did not mint for it — the id written by hand — refused where the
- *  declaration enters. An engine definition under any declared name carries the minted object; a host can forge the string, never the object. */
+/** A roster entry claiming an engine contract its catalog did not mint for it — the id written by hand, on a spec or on a product — refused where the
+ *  declaration enters. */
 export declare function callerEngineContractProblem(face: RosterFace): {
     code: ToolDeclarationCode;
     message: string;
 } | undefined;
+/** The retired-key door for one roster entry, asked of the LIVE entry once, before any member is copied: the key is present
+ *  iff ordinary property lookup answers a defined value ({@link retiredKeyOf} — an own enumerable member, a non-enumerable
+ *  one, a prototype's getter, a Proxy's trap alike), and a present one refuses the run by name with the sentence and code
+ *  the factory gives the same key on a `defineTool` spec (`config.deps_retired_key`). A lookup that throws is an entry whose
+ *  members cannot be read, refused as such. No face is ever minted from an entry that carries a retired member, so no later
+ *  phase has a key table of its own to consult for one. Every live object that is about to become a face meets it first:
+ *  {@link rosterFaceOf} asks it of each entry, and the per-task agents rebuild asks it of the object `withAgents` returned
+ *  before the stamp copy-back spreads that object (a spread drops a prototype's and a non-enumerable member). A value that
+ *  is no object holds no member. */
+export declare function refuseRetiredMember(entry: unknown, index: number): void;
 /** One entry of the roster, and the ONLY place a {@link RosterFace} is minted. Every object entry (a function included) becomes a frozen face, so no entry the snapshot holds is a
  *  live object: a primitive is immutable and stays as read; a `defineTool` product's face names the product for its sealed
  *  rebind; an entry the ToolSpec arm cannot build gets a face too, and the mount refuses it from the verdict recorded here —
- *  an `execute` or a mark that grows on the caller's object afterwards is never read. A read that throws refuses the run. */
+ *  an `execute` or a mark that grows on the caller's object afterwards is never read. An entry carrying a retired member is
+ *  refused first ({@link refuseRetiredMember}). A read that throws refuses the run. */
 export declare function rosterFaceOf(t: unknown, index: number): RosterFace;
 /** The mount's arm for a roster entry that is the face of a `defineTool` product: the exact product object is rebound to
  *  the run's ctx through the factory's sealed seat, compared with its face ({@link refuseProductDrift}), and the tool the

package/dist/core/runner/caller-roster.js

@@ -1,7 +1,8 @@
 import { TOOL_SPEC_MEMBERS, frozenExtra, frozenMember, newCopyState } from "../tool-spec-members.js";
+import { RETIRED_TOOL_SPEC_KEYS, retiredKeyOf, retiredKeyRefusal } from "../retired-keys.js";
 import { isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
 import { isCatalogContract } from "../tool-catalog-entries.js";
-import { contractOriginOf } from "../../prompt-assembly/tool-catalog.js";
+import { attachedContractOf, computeShapeDigest, contractOriginOf, isEngineDescriptor } from "../../prompt-assembly/tool-catalog.js";
 function specArmCanConstruct(t) {
     if (typeof t !== "object" || t === null)
         return false;
@@ -19,6 +20,8 @@ function faceKeys(t) {
     const keys = new Set(Reflect.ownKeys(t).filter((k) => Object.getOwnPropertyDescriptor(t, k)?.enumerable === true));
     for (const name of TOOL_SPEC_MEMBERS)
         keys.add(name);
+    for (const name of Object.keys(RETIRED_TOOL_SPEC_KEYS))
+        keys.delete(name);
     return [...keys];
 }
 const BUILDABLE = new WeakSet();
@@ -45,16 +48,42 @@ function refuseUnreadableEntry(index, entry, cause) {
     e.code = "config.tool_mount_denied";
     throw e;
 }
-const CATALOG_CONTRACT_FACES = new WeakSet();
+function unmintedEngineClaim(face) {
+    const declared = face.contract?.contractId;
+    if (typeof declared === "string" && contractOriginOf(declared) === "core" && !isCatalogContract(face.contract))
+        return declared;
+    const carried = attachedContractOf(face);
+    if (carried === undefined || carried === null || typeof carried !== "object")
+        return undefined;
+    const id = carried.contractId;
+    if (carried.origin !== "core" && !(typeof id === "string" && contractOriginOf(id) === "core"))
+        return undefined;
+    const describesFace = isEngineDescriptor(carried) && carried.wireName === face.name && carried.shapeDigest === computeShapeDigest(face.parameters);
+    return describesFace ? undefined : String(id);
+}
 export function callerEngineContractProblem(face) {
-    const id = face.contract?.contractId;
-    if (typeof id !== "string" || contractOriginOf(id) !== "core" || CATALOG_CONTRACT_FACES.has(face))
+    const id = unmintedEngineClaim(face);
+    if (id === undefined)
         return undefined;
     return { code: "config.tool_face_invalid", message: `tool ${JSON.stringify(String(face.name).slice(0, 40))} declares the engine contract ${JSON.stringify(id.slice(0, 64))}, which no engine definition minted for it — a contract id under \`core.\` belongs to the engine's own definitions; declare an id of your own, or none` };
 }
+export function refuseRetiredMember(entry, index) {
+    if ((typeof entry !== "object" && typeof entry !== "function") || entry === null)
+        return;
+    let hit;
+    try {
+        hit = retiredKeyOf(entry, RETIRED_TOOL_SPEC_KEYS);
+    }
+    catch (cause) {
+        return refuseEntry(index, entry, cause);
+    }
+    if (hit !== undefined)
+        throw retiredKeyRefusal(hit, "ToolSpec");
+}
 export function rosterFaceOf(t, index) {
     if ((typeof t !== "object" && typeof t !== "function") || t === null)
         return t;
+    refuseRetiredMember(t, index);
     try {
         const product = isDefineToolProduct(t) ? t : undefined;
         const buildable = product === undefined && specArmCanConstruct(t);
@@ -67,8 +96,6 @@ export function rosterFaceOf(t, index) {
             if (value === undefined && !own)
                 continue;
             let kept;
-            if (key === "contract" && isCatalogContract(value))
-                CATALOG_CONTRACT_FACES.add(face);
             if (typeof key === "string" && IS_MEMBER.has(key))
                 kept = frozenMember(key, value, ledger);
             else {

package/dist/core/runner/capability-withheld-seat.d.ts

@@ -0,0 +1,5 @@
+import type { Prepared } from "./contracts.js";
+import type { NoticeSeatInput } from "./notice-seat-input.js";
+/** The session's announced record and the leg's receipt ledger (the parked write). */
+export type CapabilityWithheldRecord = Pick<Prepared, "announcedListingsRef" | "frameReceipts">;
+export declare function createCapabilityWithheldScope(ids: NoticeSeatInput, announced: CapabilityWithheldRecord): <T>(fn: () => Promise<T>) => Promise<T>;

package/dist/core/runner/capability-withheld-seat.js

@@ -0,0 +1,24 @@
+import { runWithCapabilityWithheld } from "../../brain/status-sink.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { announceDigest, withAnnounceDigests } from "./announce-once-ledger.js";
+const CAPABILITY_DOWNGRADED = "model.capability_downgraded";
+export function createCapabilityWithheldScope(ids, announced) {
+    const announce = (report) => {
+        const digest = announceDigest(CAPABILITY_DOWNGRADED, `${report.modelId}\n${report.capability}`);
+        const record = announced.announcedListingsRef;
+        if (record.advisories?.includes(digest) === true)
+            return;
+        const why = report.cause === "declared_off"
+            ? `its catalog entry declares no image input (Model.input has no "image")`
+            : `its catalog entry does not declare image input, and images are not sent to an entry that does not`;
+        deliverEngineNotice(ids.onNotice, {
+            code: CAPABILITY_DOWNGRADED,
+            message: `Images in this conversation are not being sent to model "${report.modelId}": ${why}, so each image reaches the model as a one-line placeholder. ` +
+                `If the model reads images, declare it (input: ["text","image"]); otherwise switch to a model that reads images. Said once per conversation for this model.`,
+            detail: { model: report.modelId, capability: report.capability, status: report.cause, sessionId: ids.sessionId, runId: ids.runId },
+        });
+        record.advisories = withAnnounceDigests(record.advisories, [digest]);
+        announced.frameReceipts.listingSnapshotOwed = true;
+    };
+    return (fn) => runWithCapabilityWithheld(announce, fn);
+}

package/dist/core/runner/classifier-ladder.d.ts

@@ -179,14 +179,11 @@ export interface ClassifierUnavailableStation {
     budgetMs?: number;
 }
 /**
- * The classifier's REASONING SEAT, read off the model a classification is actually asked on — ONE predicate:
- * does the wire SPELL off ({@link thinkingOffSpelled})? Yes ⇒ `off` + the verdict-sized cap (the request pays
- * for the answer alone); no ⇒ `low` + the verdict cap + the low allowance (a model whose thinking the wire
- * cannot turn off is asked for the least it can grade, in the room that costs — spell off,
- * or leave thinking to the provider and pay 2048). A model that declares no reasoning at all is on the `low`
- * seat too: its wire carries nothing either way, so the request is the gateway's default, and a default-on
- * gateway thinks — the arm that used to read it as "never thinks" is the one the field report was about.
- * PER RUNG, not once per arming: the second rung is a different model with its own wire.
+ * The classifier's REASONING SEATS, read off the model a classification is actually asked on. The tier is the shared
+ * verdict ({@link lowestReasoningSeat}); the cap is the classifier's own: `off` carries the verdict-sized cap (the
+ * request pays for the answer alone), `low` carries the verdict cap plus the low allowance (spell off, or leave
+ * thinking to the provider and pay 2048). PER RUNG, not once per arming: the second rung is a different model with
+ * its own wire.
  *
  * The THINK seat is the RE-ASK seat ({@link classifierReplyAsksAgain}): a first attempt that produced no
  * verdict is asked once more with thinking allowed the room of CC's stage-2 classifier (8192) — an unknown
@@ -212,7 +209,8 @@ export type ClassifierSeatRequest = typeof CLASSIFIER_OFF_SEAT | typeof CLASSIFI
  * bound the engine can vouch for: a gateway may exclude reasoning tokens from `max_tokens` (a vLLM-fronted
  * Qwen gateway answered a cap of 128 with 938 output tokens and `stop`), so an over-long think is cut by the
  * round-trip timeout (`unavailable` / `timeout`), not by the cap (`parse_error` on an empty reply), and the
- * two are attested as the two different facts they are.
+ * two are attested as the two different facts they are. The seat's tier is not the classifier's to decide: it reads
+ * {@link lowestReasoningSeat}, and only the cap is its own.
  */
 export declare function classifierRungSeat(model: Model): typeof CLASSIFIER_OFF_SEAT | typeof CLASSIFIER_LOW_SEAT;
 /**

package/dist/core/runner/classifier-ladder.js

@@ -1,5 +1,5 @@
 import { sameRouteIdentity } from "../../brain/route-adjudicator.js";
-import { thinkingOffSpelled } from "../../brain/reasoning.js";
+import { lowestReasoningSeat } from "../../brain/reasoning-request.js";
 import { AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER, AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, AUTO_MODE_CLASSIFIER_MAX_TOKENS, AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS } from "../auto-mode-defaults.js";
 import { autoModeClassifierFallbackOf, parseAutoModeResponse } from "../auto-mode.js";
 import { classifierUnavailableDispositionOf } from "../classifier-unavailable-arm.js";
@@ -80,7 +80,7 @@ export function announceClassifierRoleDefaulted(args) {
     const { seat } = args;
     if (seat.defaulted === undefined)
         return;
-    const spelled = thinkingOffSpelled(seat.model);
+    const spelled = lowestReasoningSeat(seat.model) === "off";
     deliverEngineNotice(args.onNotice, {
         code: "classifier.role_defaulted",
         message: `no classifier role names a model — "${seat.model.id}" classifies this run (${seat.defaulted}); ` +
@@ -195,7 +195,7 @@ export const CLASSIFIER_OFF_SEAT = { reasoning: "off", maxTokens: AUTO_MODE_CLAS
 export const CLASSIFIER_LOW_SEAT = { reasoning: "low", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS + AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS };
 export const CLASSIFIER_THINK_SEAT = { reasoning: "low", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS + AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS };
 export function classifierRungSeat(model) {
-    return thinkingOffSpelled(model) ? CLASSIFIER_OFF_SEAT : CLASSIFIER_LOW_SEAT;
+    return lowestReasoningSeat(model) === "off" ? CLASSIFIER_OFF_SEAT : CLASSIFIER_LOW_SEAT;
 }
 export const CLASSIFIER_ATTEMPT_SUFFIX = {
     first: '\nErr on the side of blocking. Your ENTIRE response MUST begin with <block>. Do NOT output any analysis, reasoning, or commentary before <block>. No "Looking at..." or similar preamble.',

package/dist/core/runner/construction-doors.js

@@ -3,6 +3,7 @@ import { checkedMediaByteCap } from "../media-byte-cap.js";
 import { receiptRefusal, receiveOwnProperties, refuseProxy } from "../own-property-receipt.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { copyReadDenySeat, READ_DENY_DEPLOYMENT_SEATS } from "../read-face-seats.js";
+import { receiveHostFloor } from "../host-floor.js";
 import { holdOwnCredentialValues } from "../secret-env.js";
 export function retainRunnerDeps(deps) {
     const words = { subject: "RunnerDeps", unit: "seat", moment: "at new Runner" };
@@ -15,6 +16,8 @@ export function retainRunnerDeps(deps) {
         if (Object.hasOwn(retained, seat))
             Object.defineProperty(retained, seat, { value: copyReadDenySeat(Reflect.get(retained, seat)), enumerable: true, writable: true, configurable: true });
     }
+    if (Object.hasOwn(retained, "hostFloor"))
+        Object.defineProperty(retained, "hostFloor", { value: receiveHostFloor(Reflect.get(retained, "hostFloor")), enumerable: true, writable: true, configurable: true });
     let consolidationKey;
     try {
         const chat = retained.memoryConsolidationDriver?.chat;