@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/session.js

@@ -4,9 +4,62 @@ export { BaseSessionStorage, leafIdAfterEntry, } from "../internal/harness.js";
 export { SessionError } from "../internal/harness.js";
 import { SessionError } from "../internal/harness.js";
 import { readMember, thrownIs } from "./thrown-value.js";
+import { receiptRefusal, receiveOwnProperties } from "./own-property-receipt.js";
+import { principalNameFault, principalNameOf } from "./principal-name.js";
 export function isSessionConflict(err) {
     return thrownIs(err, SessionError) && readMember(err, "code") === "conflict";
 }
+export const SESSION_LIST_LIMITS = Object.freeze({ default: 50, max: 1000 });
+const LIST_QUERY_MEMBERS = ["owner", "includeUnowned", "after", "limit"];
+export function readSessionListQuery(raw, extensions = []) {
+    if (raw === undefined)
+        return { includeUnowned: false, limit: SESSION_LIST_LIMITS.default, extensions: {} };
+    if (typeof raw !== "object" || raw === null)
+        throw receiptRefusal(`SessionStore.list: the query must be an object, got ${raw === null ? "null" : typeof raw}`);
+    const got = receiveOwnProperties(raw, { subject: "SessionListQuery", unit: "member", moment: "at SessionStore.list" });
+    const extended = {};
+    for (const name of Object.keys(got)) {
+        if (LIST_QUERY_MEMBERS.includes(name))
+            continue;
+        if (!extensions.includes(name))
+            throw receiptRefusal(`SessionStore.list: this store does not filter by "${name}" — refused rather than listing the rows that filter would exclude`);
+        extended[name] = got[name];
+    }
+    const { owner: ownerGiven, includeUnowned, after, limit } = got;
+    const owner = ownerGiven === undefined ? undefined : principalNameOf(ownerGiven);
+    if (ownerGiven !== undefined && owner === undefined) {
+        throw receiptRefusal(`SessionListQuery.owner must be a principal name (a string with a visible character, no control or separator character, and no format character but a joiner) when present, got ${principalNameFault(ownerGiven)}`);
+    }
+    if (includeUnowned !== undefined && typeof includeUnowned !== "boolean")
+        throw receiptRefusal(`SessionListQuery.includeUnowned must be a boolean when present, got ${typeof includeUnowned}`);
+    if (includeUnowned !== undefined && owner === undefined)
+        throw receiptRefusal("SessionListQuery.includeUnowned is a member of the owner filter and was given without owner — refused rather than read as every owner's list");
+    if (limit !== undefined && !(typeof limit === "number" && Number.isSafeInteger(limit) && limit >= 1 && limit <= SESSION_LIST_LIMITS.max)) {
+        throw receiptRefusal(`SessionListQuery.limit must be an integer in 1..${SESSION_LIST_LIMITS.max} when present`);
+    }
+    return {
+        ...(owner !== undefined ? { owner } : {}),
+        includeUnowned: includeUnowned === true,
+        ...(after !== undefined ? { after: readListCursor(after) } : {}),
+        limit: limit ?? SESSION_LIST_LIMITS.default,
+        extensions: extended,
+    };
+}
+function readListCursor(raw) {
+    if (typeof raw !== "object" || raw === null)
+        throw receiptRefusal(`SessionListQuery.after must be an object when present, got ${raw === null ? "null" : typeof raw}`);
+    const got = receiveOwnProperties(raw, { subject: "SessionListQuery.after", unit: "member", moment: "at SessionStore.list" });
+    for (const name of Object.keys(got)) {
+        if (name !== "lastActiveAt" && name !== "sessionId")
+            throw receiptRefusal(`SessionListQuery.after carries "${name}" — a cursor is a lastActiveAt and a sessionId`);
+    }
+    const { lastActiveAt, sessionId } = got;
+    if (typeof lastActiveAt !== "number" || !Number.isFinite(lastActiveAt))
+        throw receiptRefusal("SessionListQuery.after.lastActiveAt must be a finite number");
+    if (typeof sessionId !== "string")
+        throw receiptRefusal(`SessionListQuery.after.sessionId must be a string, got ${typeof sessionId}`);
+    return { lastActiveAt, sessionId };
+}
 export function hasSessionFork(store) {
     return typeof store.fork === "function";
 }

package/dist/core/shell-read-silence.d.ts

@@ -1,7 +1,7 @@
 import type { ShellReadVerdict } from "../tools/fs/shell-read-check.js";
 import { type ShellReadDisposition } from "../tools/fs/shell-read-judge.js";
 import type { GatePass } from "./runner/gate-exit.js";
-import type { AskGuard } from "./tool-policy.js";
+import type { PermissionResult } from "./tool-policy.js";
 /** One station answer, received and read: what a reader acts on (`kind`) and the answer it acts on (`verdict` — the engine's own
  *  copy, received once). `unbelieved`: the station's answer was not received or contradicted its own finding, and `verdict` is the
  *  engine's refusal of it (its sentence names the station's words only where they are words of the closed sets — nothing a station
@@ -35,17 +35,16 @@ export interface StationAnswerCall {
  * ({@link silencedBy}).
  */
 export declare function readStationAnswer(answer: ShellReadVerdict, call: StationAnswerCall): StationAnswerReading;
-/** Whose silence a station's answer carries, each its own class on the question it keeps or mints: unread rows are a rule that could
- *  not be read (the rule lane's class); the finding `unanswered` is, unless rows are unread, the environment's silence — shell text the
- *  engine cannot read (a guard) — and the marks only pick whose. Either is a question only a person answers; `probe` follows the finding. */
-export declare function silencedBy(verdict: ShellReadVerdict, d: {
-    readonly guards?: readonly AskGuard[];
-    readonly ruleUnreadable?: unknown;
-}): {
-    ruleUnreadable?: "persisted_rows";
-    guards?: readonly AskGuard[];
-    requiresRealApproval?: true;
-};
+/** The ask `d` with the silence a station's answer carries, each its own class on the question it keeps or mints: unread rows are a
+ *  rule that could not be read (the rule lane's class); the finding `unanswered` is, unless rows are unread, the environment's silence —
+ *  shell text the engine cannot read (a guard, attested on the ask's record for `call` beside the guards it already carries) — and the
+ *  marks only pick whose. Either is a question only a person answers; `probe` follows the finding. No silence ⇒ `d` itself. */
+export declare function silencedBy<D extends Extract<PermissionResult, {
+    action: "ask";
+}>>(d: D, verdict: ShellReadVerdict, call: {
+    readonly toolCallId: string;
+    readonly toolName: string;
+}): D;
 /** The station's SILENCE ({@link readStationAnswer}), applied once, before any disposition arm: a station — a host-mounted one
  *  included — may spell `vouch`, `mandated` or `ordinary` beside it, and no word vouches for what nobody judged. A deny stands; an
  *  ask keeps its words and gains the silence's class; an allow becomes the silence's question (`ask.message`), one only a person

package/dist/core/shell-read-silence.js

@@ -3,6 +3,7 @@ import { dispositionsOfRow, SHELL_READ_FINDINGS } from "../tools/fs/shell-read-j
 import { receiveContract } from "./decision-receipt.js";
 import { egressThrownText } from "./untrusted-egress.js";
 import { receive } from "./mods/kernel/receive.js";
+import { attest, attestationOf } from "./engine-attestation.js";
 const DISPOSITIONS = ["refuse", "mandated", "ordinary", "vouch"];
 const MEMBER_KINDS = {
     disposition: "word",
@@ -71,21 +72,24 @@ export function readStationAnswer(answer, call) {
     call.report?.(new Error(`shell read station answered out of its contract for tool "${call.toolName}"${call.toolCallId !== undefined ? ` (toolCallId ${call.toolCallId})` : ""} — ${sentence}`));
     return { kind: "refuse", verdict: { disposition: "refuse", finding: "none", sentence }, unbelieved: true };
 }
-export function silencedBy(verdict, d) {
+export function silencedBy(d, verdict, call) {
     const environment = verdict.environmentSilent === true || (verdict.finding === "unanswered" && verdict.rowsUnread !== true);
+    if (!environment && verdict.rowsUnread !== true)
+        return d;
     const rows = verdict.rowsUnread === true && d.ruleUnreadable === undefined ? { ruleUnreadable: "persisted_rows" } : {};
-    const guards = environment && d.guards?.includes("unverifiable_shell_text") !== true ? { guards: [...(d.guards ?? []), "unverifiable_shell_text"] } : {};
-    return environment || verdict.rowsUnread === true ? { ...rows, ...guards, requiresRealApproval: true } : {};
+    const out = { ...d, ...rows, requiresRealApproval: true };
+    const held = attestationOf(d, call)?.guards ?? [];
+    return environment && !held.includes("unverifiable_shell_text") ? attest(out, call, { guards: [...held, "unverifiable_shell_text"] }) : out;
 }
 export function applyUnansweredSilence(pass, verdict, ask) {
     if (verdict.details !== undefined)
         pass.shellReadDetails = verdict.details;
     if (pass.decision.action === "ask") {
-        pass.decision = { ...pass.decision, ...silencedBy(verdict, pass.decision) };
+        pass.decision = silencedBy(pass.decision, verdict, pass.req);
         return;
     }
     if (pass.decision.action !== "allow")
         return;
-    pass.decision = { action: "ask", message: ask.message, decisionReason: "safety", ...silencedBy(verdict, {}), ...(ask.account !== undefined ? { probeReason: ask.account } : {}) };
+    pass.decision = silencedBy({ action: "ask", message: ask.message, decisionReason: "safety", ...(ask.account !== undefined ? { probeReason: ask.account } : {}) }, verdict, pass.req);
     pass.tightenedBy = ask.tightenedBy;
 }

package/dist/core/shell-run-candidates.js

@@ -276,7 +276,7 @@ function unwrap(words) {
     if (row.viaShell === true)
         return `\`${name}\` evaluates its operands as shell input this reader does not read`;
     if (row.executes !== undefined) {
-        const hit = words.slice(1).find((w) => w.expands !== false || row.executes.includes(w.text));
+        const hit = words.slice(1).find((w) => w.expands !== false || row.executes.some((x) => w.text === x || (x.length === 2 && /^-[^-]/.test(w.text) && w.text.includes(x[1]))));
         return hit === undefined ? words : hit.expands !== false ? `an expansion where \`${name}\` reads its arguments` : `\`${name} ${hit.text}\` runs a command this reader does not read`;
     }
     const valueFlags = new Set(row.valueFlags);
@@ -394,6 +394,8 @@ function unwrap(words) {
         if (r !== true)
             return r;
         i++;
+        if (durationTaken && positionalTaken)
+            break;
     }
     if (i >= words.length)
         return words;

package/dist/core/shell-wrapper-projection.js

@@ -30,7 +30,7 @@ const runsCommand = (spec) => spec.effect === "executes" || spec.value?.kind ===
 function projectRow(row) {
     const sorted = (xs) => [...new Set(xs)].sort();
     const all = spellings(row);
-    const viaShell = row.reentry?.kind === "shell" || row.launcher?.shellText !== undefined || row.body === "first-operand" || row.body === "assignment-values" || (row.operands?.rest?.kind === "program-text" && row.operands.rest.language === "arithmetic");
+    const viaShell = (row.reentry?.kind === "shell" && row.reentry.text !== "history") || row.launcher?.shellText !== undefined || row.body === "first-operand" || row.body === "assignment-values" || (row.operands?.rest?.kind === "program-text" && row.operands.rest.language === "arithmetic");
     if (row.launcher === undefined) {
         if (viaShell)
             return { valueFlags: [], flags: [], commandString: [], viaShell: true };

package/dist/core/shell-wrapper-table.d.ts

@@ -181,6 +181,12 @@ export declare const SHELL_WRAPPER_TABLE: {
         readonly commandString: readonly [];
         readonly viaShell: true;
     };
+    readonly fc: {
+        readonly valueFlags: readonly [];
+        readonly flags: readonly [];
+        readonly commandString: readonly [];
+        readonly executes: readonly ["-e", "-s"];
+    };
     readonly source: {
         readonly valueFlags: readonly [];
         readonly flags: readonly [];
@@ -289,14 +295,14 @@ export declare const SHELL_WRAPPER_TABLE: {
         readonly viaShell: true;
     };
     readonly chroot: {
-        readonly valueFlags: readonly [];
-        readonly flags: readonly [];
+        readonly valueFlags: readonly ["--groups", "--userspec", "-G", "-g", "-u"];
+        readonly flags: readonly ["--help", "--skip-chdir", "--version"];
         readonly commandString: readonly [];
         readonly positional: RegExp;
     };
     readonly setpriv: {
-        readonly valueFlags: readonly [];
-        readonly flags: readonly [];
+        readonly valueFlags: readonly ["--ambient-caps", "--apparmor-profile", "--bounding-set", "--egid", "--euid", "--groups", "--inh-caps", "--pdeathsig", "--regid", "--reuid", "--rgid", "--ruid", "--securebits", "--selinux-label"];
+        readonly flags: readonly ["--clear-groups", "--dump", "--help", "--init-groups", "--keep-groups", "--nnp", "--no-new-privs", "--reset-env", "--version", "-V", "-d", "-h"];
         readonly commandString: readonly [];
     };
     readonly numactl: {
@@ -305,8 +311,9 @@ export declare const SHELL_WRAPPER_TABLE: {
         readonly commandString: readonly [];
     };
     readonly prlimit: {
-        readonly valueFlags: readonly [];
-        readonly flags: readonly [];
+        readonly valueFlags: readonly ["--output", "--pid", "-o", "-p"];
+        readonly flags: readonly ["--as", "--core", "--cpu", "--data", "--fsize", "--help", "--locks", "--memlock", "--msgqueue", "--nice", "--nofile", "--noheadings", "--nproc", "--raw", "--rss", "--rtprio", "--rttime", "--sigpending", "--stack", "--verbose", "--version", "-V", "-h"];
+        readonly attached: readonly ["-c", "-d", "-e", "-f", "-i", "-l", "-m", "-n", "-q", "-r", "-s", "-t", "-u", "-v", "-x", "-y"];
         readonly commandString: readonly [];
     };
     readonly "systemd-run": {
@@ -316,7 +323,7 @@ export declare const SHELL_WRAPPER_TABLE: {
     };
     readonly valgrind: {
         readonly valueFlags: readonly [];
-        readonly flags: readonly [];
+        readonly flags: readonly ["--alignment", "--allow-mismatched-debuginfo", "--avg-transtab-entry-size", "--cachegrind-out-file", "--callgrind-out-file", "--child-silent-after-fork", "--default-suppressions", "--demangle", "--dhat-out-file", "--dsymutil", "--error-exitcode", "--error-limit", "--error-markers", "--errors-for-leak-kinds", "--exit-on-first-error", "--expensive-definedness-checks", "--fair-sched", "--free-fill", "--freelist-big-blocks", "--freelist-vol", "--fullpath-after", "--gen-suppressions", "--help", "--help-debug", "--help-dyn-options", "--ignore-range-below-sp", "--ignore-ranges", "--input-fd", "--keep-debuginfo", "--keep-stacktraces", "--kernel-variant", "--leak-check", "--leak-check-heuristics", "--leak-resolution", "--log-fd", "--log-file", "--main-stacksize", "--malloc-fill", "--massif-out-file", "--max-stackframe", "--max-threads", "--merge-recursive-frames", "--num-callers", "--num-transtab-sectors", "--partial-loads-ok", "--quiet", "--read-inline-info", "--read-var-info", "--redzone-size", "--resync-filter", "--run-cxx-freeres", "--run-libc-freeres", "--show-below-main", "--show-emwarns", "--show-error-list", "--show-leak-kinds", "--show-mismatched-frees", "--show-possibly-lost", "--show-reachable", "--sigill-diagnostics", "--sim-hints", "--smc-check", "--soname-synonyms", "--suppressions", "--time-stamp", "--tool", "--trace-children", "--trace-children-skip", "--trace-children-skip-by-arg", "--track-fds", "--track-origins", "--undef-value-errors", "--unw-stack-scan-frames", "--unw-stack-scan-thresh", "--valgrind-stacksize", "--verbose", "--version", "--vgdb", "--vgdb-error", "--vgdb-poll", "--vgdb-shadow-registers", "--vgdb-stop-at", "--workaround-gcc296-bugs", "--xml", "--xml-fd", "--xml-file", "--xml-user-comment", "--xtree-leak", "--xtree-leak-file", "--xtree-memory", "--xtree-memory-file", "-h", "-q", "-s", "-v"];
         readonly commandString: readonly [];
     };
     readonly firejail: {

package/dist/core/shell-wrapper-table.js

@@ -27,6 +27,7 @@ export const SHELL_WRAPPER_TABLE = {
     unshare: { valueFlags: ["--boottime", "--map-group", "--map-user", "--monotonic", "--propagation", "--root", "--setgid", "--setgroups", "--setuid", "--wd", "-G", "-R", "-S", "-w"], flags: ["--cgroup", "--fork", "--help", "--ipc", "--keep-caps", "--kill-child", "--map-current-user", "--map-root-user", "--mount", "--mount-proc", "--net", "--pid", "--time", "--user", "--uts", "--version", "-C", "-T", "-U", "-c", "-f", "-i", "-m", "-n", "-p", "-r", "-u"], commandString: [] },
     nsenter: { valueFlags: ["--setgid", "--setuid", "--target", "-G", "-S", "-t"], flags: ["--all", "--cgroup", "--help", "--ipc", "--mount", "--net", "--no-fork", "--pid", "--preserve-credentials", "--root", "--time", "--user", "--uts", "--version", "--wd", "-C", "-F", "-T", "-U", "-Z", "-a", "-i", "-m", "-n", "-p", "-u"], attached: ["-r", "-w"], commandString: [] },
     eval: { valueFlags: [], flags: [], commandString: [], viaShell: true },
+    fc: { valueFlags: [], flags: [], commandString: [], executes: ["-e", "-s"] },
     source: { valueFlags: [], flags: [], commandString: [], viaShell: true },
     ".": { valueFlags: [], flags: [], commandString: [], viaShell: true },
     trap: { valueFlags: [], flags: [], commandString: [], viaShell: true },
@@ -45,12 +46,12 @@ export const SHELL_WRAPPER_TABLE = {
     busybox: { valueFlags: [], flags: [], commandString: [] },
     su: { valueFlags: ["--group", "--shell", "--supp-group", "--whitelist-environment", "-G", "-g", "-s", "-w"], flags: ["--fast", "--help", "--login", "--no-pty", "--preserve-environment", "--pty", "--version", "-P", "-T", "-V", "-f", "-h", "-l", "-m", "-p"], commandString: ["--command", "--session-command", "-c"], viaShell: true },
     runuser: { valueFlags: ["--group", "--shell", "--supp-group", "--user", "--whitelist-environment", "-G", "-g", "-s", "-u", "-w"], flags: ["--fast", "--help", "--login", "--no-pty", "--preserve-environment", "--pty", "--version", "-P", "-T", "-V", "-f", "-h", "-l", "-m", "-p"], commandString: ["--command", "--session-command", "-c"], viaShell: true },
-    chroot: { valueFlags: [], flags: [], commandString: [], positional: /^/ },
-    setpriv: { valueFlags: [], flags: [], commandString: [] },
+    chroot: { valueFlags: ["--groups", "--userspec", "-G", "-g", "-u"], flags: ["--help", "--skip-chdir", "--version"], commandString: [], positional: /^/ },
+    setpriv: { valueFlags: ["--ambient-caps", "--apparmor-profile", "--bounding-set", "--egid", "--euid", "--groups", "--inh-caps", "--pdeathsig", "--regid", "--reuid", "--rgid", "--ruid", "--securebits", "--selinux-label"], flags: ["--clear-groups", "--dump", "--help", "--init-groups", "--keep-groups", "--nnp", "--no-new-privs", "--reset-env", "--version", "-V", "-d", "-h"], commandString: [] },
     numactl: { valueFlags: [], flags: [], commandString: [] },
-    prlimit: { valueFlags: [], flags: [], commandString: [] },
+    prlimit: { valueFlags: ["--output", "--pid", "-o", "-p"], flags: ["--as", "--core", "--cpu", "--data", "--fsize", "--help", "--locks", "--memlock", "--msgqueue", "--nice", "--nofile", "--noheadings", "--nproc", "--raw", "--rss", "--rtprio", "--rttime", "--sigpending", "--stack", "--verbose", "--version", "-V", "-h"], attached: ["-c", "-d", "-e", "-f", "-i", "-l", "-m", "-n", "-q", "-r", "-s", "-t", "-u", "-v", "-x", "-y"], commandString: [] },
     "systemd-run": { valueFlags: [], flags: [], commandString: [] },
-    valgrind: { valueFlags: [], flags: [], commandString: [] },
+    valgrind: { valueFlags: [], flags: ["--alignment", "--allow-mismatched-debuginfo", "--avg-transtab-entry-size", "--cachegrind-out-file", "--callgrind-out-file", "--child-silent-after-fork", "--default-suppressions", "--demangle", "--dhat-out-file", "--dsymutil", "--error-exitcode", "--error-limit", "--error-markers", "--errors-for-leak-kinds", "--exit-on-first-error", "--expensive-definedness-checks", "--fair-sched", "--free-fill", "--freelist-big-blocks", "--freelist-vol", "--fullpath-after", "--gen-suppressions", "--help", "--help-debug", "--help-dyn-options", "--ignore-range-below-sp", "--ignore-ranges", "--input-fd", "--keep-debuginfo", "--keep-stacktraces", "--kernel-variant", "--leak-check", "--leak-check-heuristics", "--leak-resolution", "--log-fd", "--log-file", "--main-stacksize", "--malloc-fill", "--massif-out-file", "--max-stackframe", "--max-threads", "--merge-recursive-frames", "--num-callers", "--num-transtab-sectors", "--partial-loads-ok", "--quiet", "--read-inline-info", "--read-var-info", "--redzone-size", "--resync-filter", "--run-cxx-freeres", "--run-libc-freeres", "--show-below-main", "--show-emwarns", "--show-error-list", "--show-leak-kinds", "--show-mismatched-frees", "--show-possibly-lost", "--show-reachable", "--sigill-diagnostics", "--sim-hints", "--smc-check", "--soname-synonyms", "--suppressions", "--time-stamp", "--tool", "--trace-children", "--trace-children-skip", "--trace-children-skip-by-arg", "--track-fds", "--track-origins", "--undef-value-errors", "--unw-stack-scan-frames", "--unw-stack-scan-thresh", "--valgrind-stacksize", "--verbose", "--version", "--vgdb", "--vgdb-error", "--vgdb-poll", "--vgdb-shadow-registers", "--vgdb-stop-at", "--workaround-gcc296-bugs", "--xml", "--xml-fd", "--xml-file", "--xml-user-comment", "--xtree-leak", "--xtree-leak-file", "--xtree-memory", "--xtree-memory-file", "-h", "-q", "-s", "-v"], commandString: [] },
     firejail: { valueFlags: [], flags: [], commandString: [] },
     bwrap: { valueFlags: [], flags: [], commandString: [] },
     ash: { valueFlags: [], flags: [], commandString: [], viaShell: true },

package/dist/core/side-query.js

@@ -1,5 +1,8 @@
 import { ensureToolTurnInvariants } from "../internal/llm.js";
 import { resolveTaskModel } from "./roles.js";
+import { runRenderer } from "../prompt-assembly/renderers.js";
+import { roleBaseOf } from "../prompt-assembly/role-base.js";
+import { effectiveTraitsOf, readModelPromptTraits, selectorsOf } from "../prompt-assembly/select.js";
 import { readDegradation } from "../brain/degrading.js";
 import { extractErrorCode } from "../brain/errors.js";
 import { cacheFamilyOf, uncachedInputTokensOf } from "./runner/usage-accounting.js";
@@ -9,6 +12,11 @@ function normalizeSideQueryUsage(model, u) {
     const input = uncachedInputTokensOf(cacheFamilyOf(model), u);
     return input === u.input ? u : { ...u, input };
 }
+const NO_RUN_FACTS = Object.freeze({ policyEnabled: false, hooksEnabled: false, isolationEnabled: false, withinTaskCompactionEnabled: false, supervisorEnabled: false, orchestrationEnabled: false, awarenessEnabled: false, goalEnabled: false, worktreeIsolated: false, teammateEnabled: false });
+function sideQueryRoleBase(role, model, tools) {
+    const selectors = selectorsOf(NO_RUN_FACTS, { role }, undefined, effectiveTraitsOf(readModelPromptTraits(model), undefined));
+    return runRenderer("role-base", { facts: NO_RUN_FACTS, toolNames: (tools ?? []).map((t) => t.name) }, selectors)?.text;
+}
 export async function runSideQuery(spec, deps) {
     if (!Array.isArray(spec.messages) || spec.messages.length === 0) {
         throw new Error("sideQuery requires a non-empty messages array");
@@ -40,7 +48,8 @@ export async function runSideQuery(spec, deps) {
         }
         return { role: "user", content: m.content, timestamp };
     };
-    const effectiveSystemPrompt = spec.systemPrompt ?? resolved.systemPrompt;
+    const decided = roleBaseOf([spec.systemPrompt !== undefined ? { systemPrompt: spec.systemPrompt } : undefined, resolved]);
+    const effectiveSystemPrompt = decided?.systemPrompt ?? (decided?.promptRole !== undefined ? sideQueryRoleBase(decided.promptRole, resolved.model, spec.tools) : undefined);
     const context = {
         ...(effectiveSystemPrompt !== undefined ? { systemPrompt: effectiveSystemPrompt } : {}),
         messages: ensureToolTurnInvariants(spec.messages.map(normalize)).messages,

package/dist/core/skill-grant.d.ts

@@ -199,6 +199,10 @@ export declare class SkillGrantTable {
     private readonly rowKeys;
     private mounted;
     private activations;
+    private scopes;
+    /** State the leg's skill scopes (the mods bus's record): every activation this table writes opens its skill's scope there. A
+     *  table never told opens nothing (the resume's pre-claim probe). */
+    bindScopes(scopes: Pick<import("./mods/spec-seats.js").SkillScopes, "open">): void;
     /** State where the run's mounted names are read (prepare, once the roster is assembled): a skill's entries are read against
      *  them when seeded and whenever the skill is activated. A table never told reads the grammar alone. */
     bindMountedNames(mounted: MountedToolNames): void;
@@ -211,8 +215,9 @@ export declare class SkillGrantTable {
      *  capture re-supplied beside the frozen rows that already carry it. Keyed on the ROW, not the skill: a definition that
      *  changed across a park writes its new rows when it is activated again. */
     private hold;
-    /** Write a skill's rows (rows already held are not held twice) — or none, refused with {@link SKILL_DENY_UNREADABLE_CODE},
-     *  when its `disallowed-tools` holds an entry that reads as nothing. Returns the allow entries that read as nothing. */
+    /** Write a skill's rows (rows already held are not held twice) and open its scope — or neither, refused with
+     *  {@link SKILL_DENY_UNREADABLE_CODE}, when its `disallowed-tools` holds an entry that reads as nothing. Returns the allow
+     *  entries that read as nothing. */
     activate(skill: SkillGrantSource, origin: SkillGrantOrigin): readonly SkillInertEntry[];
     /** Seed portable records (a delegated child's capture, a resumed leg's frozen rows): a record the model wrote keeps that
      *  word, every other record seeds under `origin` — `user` is written only from this leg's own spec, never seeded. Each

package/dist/core/skill-grant.js

@@ -180,6 +180,10 @@ export class SkillGrantTable {
     rowKeys = new Set();
     mounted;
     activations;
+    scopes;
+    bindScopes(scopes) {
+        this.scopes = scopes;
+    }
     bindMountedNames(mounted) {
         this.mounted = mounted;
     }
@@ -203,6 +207,7 @@ export class SkillGrantTable {
             throw skillDenyUnreadable(skill.name, unreadDeny, "activation");
         for (const row of rows)
             this.hold(row);
+        this.scopes?.open(skill.name);
         return inert;
     }
     seed(records, origin) {

package/dist/core/skills-directory.js

@@ -23,13 +23,15 @@ const SEQUENCE_NOT_AN_ENTRY = "its `- name` entries are not indented alike";
 const SEQUENCE_NOT_A_NAME = "an entry is not a plain or quoted name (nested, mapping, anchor, tag, flow and block-scalar entries, and number, boolean and null entries, are not read)";
 const VALUE_IS_A_MAPPING = "its value is a mapping or holds one (`key: value` or `{…}`), not a list of names";
 const VALUE_NOT_A_STRING = "its value is a number or a boolean, not a list of names";
+const YAML_ALIAS = 'it holds a YAML alias (an unquoted `*<name>`), which the reader does not resolve — quote a value or entry that is meant as a tool-name pattern ("*Edit")';
+const YAML_ALIAS_START = /^\*[^\s,[\]{}]/;
 const QUOTE_NOT_CLOSED = "a quote in it does not close";
 const flowNotClosed = (opener) => `its \`${opener}\` does not close within its lines`;
 const strayLine = (line) => `a flush-left line that is no key follows it (line ${line})`;
 const NOT_A_KEY_LINE = "a flush-left frontmatter line is a key — letters, digits, `_` and `-`, or one quoted scalar — then `:` and a blank or nothing; a comment starts with `#`";
 const PARENS_NOT_ONE_ZONE = "an entry's parentheses are not one group that closes it (a `(` that does not close, a `)` with no `(`, or text after the closing `)` — `\\(` / `\\)` are a rule's own text)";
 const KEY_REPEATED = "the key is written more than once";
-const notARule = (position) => `entry ${position} is no rule spelling (a tool name of ASCII letters, digits and \`_ - . : *\`, starting with a letter, a digit or \`_\`, then at most one parenthesized rule)`;
+const notARule = (position) => `entry ${position} is no rule spelling (a tool name of ASCII letters, digits and \`_ - . : *\`, starting with a letter, a digit, \`_\` or \`*\`, then at most one parenthesized rule)`;
 const keyInsideValue = (inner) => `an indented line under its value is a mapping key, \`${inlineUntrusted(inner, 64)}\` — YAML reads no key there (under a value that is not a mapping, or indented less than the nested block it follows)`;
 const toolListOutOfPlace = (inner) => `it holds the tool-list key \`${inner}\` — a tool list is read only as a key of the frontmatter, written flush left; anywhere else its list would be lost`;
 const isBlank = (ch) => ch === " " || ch === "\t";
@@ -434,7 +436,9 @@ function scanValue(text, seat) {
         const written = trimBlanks(plain);
         plain = "";
         breaks = 0;
-        if (opened.length > 0 || seat === "item") {
+        if (YAML_ALIAS_START.test(written))
+            cut.fail(YAML_ALIAS);
+        else if (opened.length > 0 || seat === "item") {
             if (YAML_NULL.test(written) || YAML_BOOL_OR_NUMBER.test(written))
                 cut.fail(SEQUENCE_NOT_A_NAME);
         }

package/dist/core/store-contracts/checkpoint-store-contract.d.ts

@@ -39,7 +39,17 @@ export declare const POLICY_ALLOW: Extract<ResumeOutcome, {
  * The full cross-backend contract for {@link CheckpointStore} — the SAME assertions for every
  * backend. Entries are a 1:1 port of the vitest originals (assertion semantics unchanged).
  */
-export declare function checkpointStoreContract(make: () => CheckpointStore, runAssertion?: ContractAssertionRunner): Promise<void>;
+export declare function checkpointStoreContract(make: () => CheckpointStore, runAssertion?: ContractAssertionRunner, 
+/** `sessionHeads` = the map the binding's stores read their session heads from (their `deleteSessionCheckpoints` guard): the kit writes
+ *  the heads its delete case needs into it. Required only to judge a store that offers `deleteSessionCheckpoints`.
+ *  `holders` = the set of current claim holders the binding's store judges by (its `holderIsCurrent`, or the claim table it
+ *  reads): the kit adds and removes holders in it. Required only to judge a store that declares `fence.holder`. */
+options?: {
+    readonly sessionHeads?: Map<string, {
+        readonly owner: string | null;
+    }>;
+    readonly holders?: Set<string>;
+}): Promise<void>;
 /** Seed the canonical listByScope fixture into `store` and return the sorted summaries. Compare the
  *  result against {@link EXPECTED_LISTBYSCOPE_SUMMARIES} (deep equality) to prove the backend's
  *  summary projection matches the reference — the caller owns the comparison (harness-specific). */

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -48,7 +48,7 @@ export const POLICY_ALLOWED = Object.freeze({
     origin: "policy",
 });
 export const POLICY_ALLOW = { ...ALLOW, hostDecision: { decidedBy: "policy", approver: "unattended_class_answer" }, gateOutcome: POLICY_ALLOWED };
-export async function checkpointStoreContract(make, runAssertion) {
+export async function checkpointStoreContract(make, runAssertion, options = {}) {
     const { run, settle } = beginContract(runAssertion);
     run("kit prerequisites: reopen/setPendingSteer/listByScope are implemented (REQUIRED by this kit)", async () => {
         const probe = make();
@@ -308,7 +308,7 @@ export async function checkpointStoreContract(make, runAssertion) {
         const stored = (await store.get(bitless.token)).pendingAction;
         assert.equal("hasBidiControls" in stored, false, "projection backfill must not write back to the row");
     });
-    run("the approval object's members: a row's identity + face group and its targets (capabilityId/contractId/shapeDigest/implementationRevision + family/pathTarget/hostTarget/names + targets) survive the round-trip verbatim; an absent group stays absent", async () => {
+    run("the approval object's members: a row's identity + face group and its targets (capabilityId/contractId/shapeDigest/implementationRevision + family/pathTarget/hostTarget/names + targets + engineMounted) survive the round-trip verbatim; an absent group stays absent", async () => {
         const store = make();
         const carried = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "id-carried" });
         const group = {
@@ -320,6 +320,7 @@ export async function checkpointStoreContract(make, runAssertion) {
             pathTarget: { param: "destination", aliases: ["path"], access: "create", skillScopeEligible: true },
             names: ["AcmeWrite", "acme_write"],
             targets: { protective: "/srv/work/out.txt", declared: "/srv/work/out.txt" },
+            engineMounted: true,
         };
         Object.assign(carried.pendingAction, group);
         const bare = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "id-bare" });
@@ -463,6 +464,143 @@ export async function checkpointStoreContract(make, runAssertion) {
             assert.deepEqual(checkpointIndexFacts(back), checkpointIndexFacts(cp), `the index facts of the row ${cp.gate.kind} came back different`);
         }
     });
+    run("listOverdue (when offered): pending rows of every scope past the cutoff, one facet per call (facetOf, the question card included), deadline-then-token order, the bound cut with a cursor that resumes without a gap or a repeat, a bad query refused", async () => {
+        const store = make();
+        if (store.listOverdue === undefined)
+            return;
+        const human = (over) => createCheckpointFixture(over);
+        const question = createCheckpointFixture({ token: "ov-q", deadline: 1_000, gate: { kind: "human", reason: "ask", toolName: "Write", approvalCard: "question" } });
+        const rows = [
+            human({ token: "ov-a2", deadline: 1_500 }),
+            human({ token: "ov-a1", deadline: 1_000, scope: "tenant-b" }),
+            human({ token: "ov-a0", deadline: 1_000 }),
+            question,
+            createCheckpointFixture({ token: "ov-r", deadline: 900, gate: { kind: "resource_limit", reason: "turns" }, pendingAction: { kind: "resource_limit", reason: "turns" } }),
+            createCheckpointFixture({ token: "ov-t", deadline: 900, gate: { kind: "task_done" }, pendingAction: { kind: "task_done" } }),
+            human({ token: "ov-late", deadline: 5_000 }),
+            human({ token: "ov-none" }),
+            human({ token: "ov-done", deadline: 1_000 }),
+        ];
+        for (const cp of rows)
+            await store.put(cp.token, cp);
+        await store.resolve("ov-done", "tenant-a", ALLOW);
+        const tokensOf = (page) => page.rows.map((r) => r.token);
+        assert.deepEqual(tokensOf(await store.listOverdue({ cutoff: 2_000, facet: "A" })), ["ov-a0", "ov-a1", "ov-a2"], "facet A = the approval rows past the cutoff, every scope, (deadline, token) ascending");
+        assert.deepEqual(tokensOf(await store.listOverdue({ cutoff: 2_000, facet: "B" })), ["ov-r", "ov-q"], "facet B = the abandonment rows, the question parked under an approval gate kind among them");
+        assert.deepEqual(tokensOf(await store.listOverdue({ cutoff: 2_000, facet: "-" })), ["ov-t"], "facet - = the non-gate park");
+        const first = await store.listOverdue({ cutoff: 2_000, facet: "A", limit: 2 });
+        assert.deepEqual(tokensOf(first), ["ov-a0", "ov-a1"], "the bound cuts the page");
+        assert.ok(first.next !== undefined, "a cut page carries the next cursor");
+        const second = await store.listOverdue({ cutoff: 2_000, facet: "A", limit: 2, after: first.next });
+        assert.deepEqual(tokensOf(second), ["ov-a2"], "the cursor resumes after the last row of the page before");
+        assert.equal(second.next, undefined, "the last page carries no cursor");
+        assert.equal((await store.get(question.token)).status, "pending", "read-only: the listing mutates nothing");
+        for (const bad of [{ cutoff: 2_000, facet: "A", limit: 0 }, { cutoff: 2_000, facet: "A", limit: 501 }, { cutoff: 2_000, facet: "A", limit: 1.5 }, { cutoff: Number.NaN, facet: "A" }, { cutoff: 2_000, facet: "C" }, { cutoff: 2_000, facet: "A", scope: "tenant-a" }]) {
+            await assert.rejects(store.listOverdue(bad), (e) => e.code === "config.invalid_argument", `refused loudly: ${JSON.stringify(bad)}`);
+        }
+    });
+    run("listBySession (when offered): one session's rows in any status narrowed by status / gate kinds / tool call / scope / createdSince, oldest or newest first, the bound cut with a resuming cursor, an empty gate-kind list matching nothing, a bad query refused", async () => {
+        const store = make();
+        if (store.listBySession === undefined)
+            return;
+        const s = "sess-list";
+        const rows = [
+            createCheckpointFixture({ token: "ls-1", sessionId: s, createdAt: 1 }),
+            createCheckpointFixture({ token: "ls-2", sessionId: s, createdAt: 2, pendingAction: { kind: "tool_approval", origin: "policy", toolCallId: "call-9", toolName: "Write", args: {}, boundInputHash: "h9", boundGrantAbsence: "not_bindable", batchToolCallIds: ["call-9"], completedCallIds: [] } }),
+            createCheckpointFixture({ token: "ls-3", sessionId: s, createdAt: 3, gate: { kind: "resource_limit", reason: "turns" }, pendingAction: { kind: "resource_limit", reason: "turns" } }),
+            createCheckpointFixture({ token: "ls-4", sessionId: s, createdAt: 4, scope: "tenant-b" }),
+            createCheckpointFixture({ token: "ls-x", sessionId: "another-session", createdAt: 1 }),
+        ];
+        for (const cp of rows)
+            await store.put(cp.token, cp);
+        await store.resolve("ls-1", "tenant-a", ALLOW);
+        await store.expire("ls-3", "tenant-a");
+        const tokensOf = (page) => page.rows.map((r) => {
+            const read = r;
+            assert.equal(read.kind, "row", "a readable row is answered as a row");
+            return read.checkpoint.token;
+        });
+        assert.deepEqual(tokensOf(await store.listBySession({ sessionId: s })), ["ls-1", "ls-2", "ls-3", "ls-4"], "every status, every scope, oldest first; another session's row never");
+        assert.deepEqual(tokensOf(await store.listBySession({ sessionId: s, order: "newest" })), ["ls-4", "ls-3", "ls-2", "ls-1"]);
+        assert.deepEqual(tokensOf(await store.listBySession({ sessionId: s, status: "pending", gateKinds: ["human"], order: "newest", limit: 1 })), ["ls-4"], "the session's newest pending row of a gate kind");
+        assert.deepEqual(tokensOf(await store.listBySession({ sessionId: s, status: "pending", gateKinds: ["human"], scope: "tenant-a" })), ["ls-2"]);
+        assert.deepEqual(tokensOf(await store.listBySession({ sessionId: s, gateKinds: [] })), [], "an empty gate-kind list matches no row");
+        assert.deepEqual(tokensOf(await store.listBySession({ sessionId: s, status: "expired", limit: 1 })), ["ls-3"]);
+        assert.deepEqual(tokensOf(await store.listBySession({ sessionId: s, toolCallId: "call-3" })), ["ls-1", "ls-4"], "the rows that parked this tool call (a park with no tool call never matches)");
+        assert.deepEqual(tokensOf(await store.listBySession({ sessionId: s, toolCallId: "call-9", status: "pending" })), ["ls-2"]);
+        assert.deepEqual(tokensOf(await store.listBySession({ sessionId: s, createdSince: 3 })), ["ls-3", "ls-4"]);
+        const first = await store.listBySession({ sessionId: s, limit: 3, order: "newest" });
+        assert.deepEqual(tokensOf(first), ["ls-4", "ls-3", "ls-2"]);
+        assert.ok(first.next !== undefined, "a cut page carries the next cursor");
+        const second = await store.listBySession({ sessionId: s, limit: 3, order: "newest", after: first.next });
+        assert.deepEqual(tokensOf(second), ["ls-1"]);
+        assert.equal(second.next, undefined);
+        const read = (await store.listBySession({ sessionId: s, toolCallId: "call-9" })).rows[0];
+        read.checkpoint.status = "expired";
+        assert.equal((await store.get("ls-2")).status, "pending", "a listed row is a copy: mutating it changes nothing stored");
+        for (const bad of [{ sessionId: "" }, { sessionId: s, limit: 101 }, { sessionId: s, limit: 0 }, { sessionId: s, status: "done" }, { sessionId: s, gateKinds: ["nope"] }, { sessionId: s, order: "latest" }, { sessionId: s, createdSince: Number.POSITIVE_INFINITY }, { sessionId: s, owner: "x" }]) {
+            await assert.rejects(store.listBySession(bad), (e) => e.code === "config.invalid_argument", `refused loudly: ${JSON.stringify(bad)}`);
+        }
+    });
+    run("deleteSessionCheckpoints (when offered): every row of the session, in any status, only when the session row exists and its owner equals the guard's (null-safe); otherwise nothing is deleted and the answer is 0", async () => {
+        const store = make();
+        if (store.deleteSessionCheckpoints === undefined)
+            return;
+        const heads = options.sessionHeads;
+        assert.ok(heads !== undefined, "a store offering deleteSessionCheckpoints is judged with the binding's `sessionHeads` (the map its session head read reads)");
+        heads.set("del-owned", { owner: "alice" });
+        heads.set("del-anon", { owner: null });
+        const owned = [
+            createCheckpointFixture({ sessionId: "del-owned" }),
+            createCheckpointFixture({ sessionId: "del-owned" }),
+            createCheckpointFixture({ sessionId: "del-owned" }),
+            createCheckpointFixture({ sessionId: "del-owned", scope: "tenant-b" }),
+        ];
+        const anon = createCheckpointFixture({ sessionId: "del-anon" });
+        const orphan = createCheckpointFixture({ sessionId: "del-no-row" });
+        const bystander = createCheckpointFixture({ sessionId: "del-other" });
+        for (const cp of [...owned, anon, orphan, bystander])
+            await store.put(cp.token, cp);
+        await store.resolve(owned[1].token, owned[1].scope, ALLOW);
+        await store.expire(owned[2].token, owned[2].scope);
+        assert.equal(await store.deleteSessionCheckpoints("del-owned", { owner: "bob" }), 0, "another owner deletes nothing");
+        assert.equal(await store.deleteSessionCheckpoints("del-owned", { owner: null }), 0, "the anonymous guard does not match an owned session");
+        assert.equal(await store.deleteSessionCheckpoints("del-no-row", { owner: null }), 0, "no session row deletes nothing");
+        assert.ok((await store.get(orphan.token)) !== null && (await store.get(owned[0].token)) !== null, "a refused guard leaves every row");
+        assert.equal(await store.deleteSessionCheckpoints("del-owned", { owner: "alice" }), 4, "the owner's guard deletes the session's rows — pending, resolved, expired, in every scope");
+        for (const cp of owned)
+            assert.equal(await store.get(cp.token), null);
+        assert.equal(await store.deleteSessionCheckpoints("del-anon", { owner: null }), 1, "the anonymous guard deletes an anonymous session's rows");
+        assert.ok((await store.get(bystander.token)) !== null, "another session's row stays");
+        assert.equal(await store.deleteSessionCheckpoints("del-owned", { owner: "alice" }), 0, "a second delete finds nothing");
+        const deleteWith = store.deleteSessionCheckpoints;
+        for (const guard of [{}, { owner: undefined }, { owner: 7 }]) {
+            const call = () => Reflect.apply(deleteWith, store, ["del-other", guard]);
+            await assert.rejects(call, (e) => e.code === "config.invalid_argument", `refused loudly: ${JSON.stringify(guard)}`);
+        }
+        assert.ok((await store.get(bystander.token)) !== null, "a refused guard deletes nothing");
+    });
+    run("claim holder (when declared `fence.holder`): a resolve carrying `expect.holder` wins only while the holder is current; a superseded holder loses with the row pending at the same rev (claimTerminal, when offered, answers that reading); no holder is unchanged", async () => {
+        const store = make();
+        if (store.fence?.holder !== true)
+            return;
+        const holders = options.holders;
+        assert.ok(holders !== undefined, "a store declaring `fence.holder` is judged with the binding's `holders` (the set its holder judge reads)");
+        holders.add("kit-holder-current");
+        const [a, b, c] = [createCheckpointFixture(), createCheckpointFixture(), createCheckpointFixture()];
+        for (const cp of [a, b, c])
+            await store.put(cp.token, cp);
+        assert.equal(await store.resolve(a.token, a.scope, ALLOW, { rev: 0, holder: "kit-holder-gone" }), false, "a holder that is not current loses");
+        const after = (await store.get(a.token));
+        assert.deepEqual([after.status, after.rev ?? 0], ["pending", 0], "the row is untouched by the lost CAS");
+        if (store.claimTerminal !== undefined) {
+            assert.deepEqual(await store.claimTerminal(a.token, a.scope, { kind: "resolve", outcome: ALLOW, expect: { rev: 0, holder: "kit-holder-gone" } }), { claimed: false, current: { status: "pending", rev: 0 } });
+        }
+        assert.equal(await store.resolve(a.token, a.scope, ALLOW, { rev: 0, holder: "kit-holder-current" }), true, "the current holder wins");
+        holders.delete("kit-holder-current");
+        assert.equal(await store.resolve(b.token, b.scope, ALLOW, { rev: 0, holder: "kit-holder-current" }), false, "a holder released after an earlier win is judged afresh");
+        assert.equal(await store.resolve(c.token, c.scope, ALLOW, { rev: 0 }), true, "no holder: the CAS is as before");
+    });
     await settle();
 }
 const sortByToken = (a, b) => a.token.localeCompare(b.token);