@sema-agent/core 7.6.3 → 7.7.0

package/dist/core/runner/steer-admission.js

@@ -0,0 +1,17 @@
+const humanInputOrdinals = new WeakMap();
+export function nextHumanInputSeq(key) {
+    let box = humanInputOrdinals.get(key);
+    if (box === undefined) {
+        box = { n: 0 };
+        humanInputOrdinals.set(key, box);
+    }
+    return ++box.n;
+}
+export function sameAcceptedSteerInput(a, b) {
+    return (a.payload === b.payload &&
+        a.trusted === b.trusted &&
+        a.priority === b.priority &&
+        a.actor?.id === b.actor?.id &&
+        a.actor?.hostAsserted === b.actor?.hostAsserted &&
+        a.actor?.issuer === b.actor?.issuer);
+}

package/dist/core/runner/tool-end-body.d.ts

@@ -0,0 +1,71 @@
+/**
+ * What the run loop derives from a tool call's END, in every leg that closes one: the `tool_end` frame
+ * body (the ONE projection the live loop, the resumed batch and the reconcile-recovered orphan all go
+ * through), the `toolResult` transcript message the resume engine closes pending calls with, the thin
+ * `response` digest the post-tool-batch observer is handed, and the canonical write-tool → reminder-window
+ * family the attachment reducer keys on when a write tool ends.
+ *
+ * Projections over values the caller already holds, with ONE clock read: `toolResultMsg` stamps the message
+ * it mints with `Date.now()` (as it did inside the driver — the transcript's timestamp is minted where the
+ * message is). Nothing here reads host state through a callback, awaits, or keeps state between calls.
+ * Layer-1 machinery, not a driven lane; the prefix rule it follows is written once, on initial-run-state.ts.
+ */
+import { type AgentMessage } from "../../internal/harness.js";
+import type { GateOutcome } from "../gate-outcome.js";
+import { type McpDelivered } from "../mcp-failure.js";
+import type { RecoveredOrphan } from "../session-reconcile.js";
+import type { WriteFamily } from "./turn-attachments.js";
+/** design/134 §3.1b — derive the thin `response` digest from a harness tool result: model-facing text
+ *  content only (never `details` — the H4 thin-projection discipline), capped with a truncation note. */
+export declare function batchResponseDigest(result: unknown): string | undefined;
+/** The `tool_end` body fields projected from a harness tool result — output/truncated/totalChars via
+ *  {@link toolOutputFrom} and the CC card via {@link structuredFrom}. Single construction point for BOTH
+ *  the live loop's frames and the resumed batch's frames (`resolvePendingCall` + the deferred-sibling
+ *  close): the resumed frames used to carry only `isError`, so a client rendering tool output from frames
+ *  showed an empty body for every durable-approved call. Same projection = same source as the transcript.
+ *  Also the one place the gate outcome reaches a frame — see the parameter. */
+export declare function toolEndBodyFrom(result: unknown, isError: boolean, 
+/** The gate's record of the pass that admitted or refused this call, supplied by the CALLER of this
+ *  projection — the live loop reads it off the gate's per-call sideband, the resumed leg off the decide's
+ *  minted record. Deliberately a parameter and never derived from `result`: a tool's own `details`
+ *  (which post-tool hooks may also replace) is writable by layers that adjudicate nothing, so reading
+ *  provenance out of it would let a failing tool claim a person approved it. Omitted ⇒ the call never
+ *  went through the gate (see the `tool_end.gate` doc, the one home). */
+gate?: GateOutcome, 
+/** WHICH call this run's committed durable park is holding ({@link import("./park-commit.js").gatedCallIdOf}), for the frames the
+ *  abort short-circuits. Same never-derived-from-`result` posture as the outcome above, and for the
+ *  sharpest version of that reason: this one is an assertion about a DIFFERENT call, so a tool able to
+ *  author it could point an approval UI at a call nobody is waiting on. Omitted ⇒ no park is holding a
+ *  call (nothing parked, or the park that did holds none), and the frame then carries no id at all. */
+gatedCallIdOfRun?: string): {
+    output?: unknown;
+    truncated?: boolean;
+    totalChars?: number;
+    structured?: unknown;
+    errorCode?: string;
+    delivered?: McpDelivered;
+    gatedCallId?: string;
+    gate?: GateOutcome;
+};
+/**
+ * scan-1/A1 — the BODY of the synthetic `tool_end` that closes a reconcile-recovered orphan. ONE
+ * construction point for BOTH minting legs (the live-abort loop at the end of a run, and the wake/crash
+ * leg's replay at run open), so the two can never disagree about the shape of the same event.
+ *
+ * Both frames used to carry `isError:true` and NOTHING else: a consumer rendering tool output from the
+ * event stream showed an EMPTY body for every interrupted call, even though the persisted transcript
+ * (which the model reads) carried the full `[INTERRUPTED]` explanation — the two faces of one call
+ * disagreed. The projection goes through the same {@link toolEndBodyFrom} every live tool result uses, so
+ * `output` = the persisted model-facing text and `errorCode` = the persisted `details.errorKind`
+ * (`interrupted_never_started` / `interrupted_outcome_unknown`) — a consumer discriminates on the code
+ * instead of prose-matching. No `structured`: the reconcile mints no CC card (no `details.type`), which
+ * `structuredFrom`'s allowlist already enforces.
+ */
+export declare function reconciledToolEndBody(orphan: Pick<RecoveredOrphan, "text" | "errorKind">): ReturnType<typeof toolEndBodyFrom>;
+/** task #51 F2/F3 — the CANONICAL write-tool → reminder-window mapping (CC qFm :480253-480254
+ *  `a.name === bD || a.name === hF` = TaskCreate/TaskUpdate; BFm :480217-480219 = TodoWrite). Live
+ *  deployment-alias resolution happens at the call sites (run-local `writeFamilyOf` over the mounted
+ *  roster); retired-name normalization is gone (RB-476-A, 5.0.0). */
+export declare function writeFamilyOfCanonical(name: string): WriteFamily | undefined;
+/** A `toolResult` transcript message (text content). Used by the resume engine to close pending calls. */
+export declare function toolResultMsg(toolCallId: string, toolName: string, text: string, isError: boolean): AgentMessage;

package/dist/core/runner/tool-end-body.js

@@ -0,0 +1,74 @@
+import {} from "../../internal/harness.js";
+import { MCP_DELIVERY_VERDICTS } from "../mcp-failure.js";
+import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
+import { structuredFrom, toolOutputFrom } from "./tool-output-projection.js";
+const BATCH_RESPONSE_MAX_CHARS = 500;
+export function batchResponseDigest(result) {
+    const content = result !== null && typeof result === "object" ? result.content : result;
+    if (content === undefined || content === null)
+        return undefined;
+    let text;
+    if (typeof content === "string") {
+        text = content;
+    }
+    else if (Array.isArray(content)) {
+        text = content
+            .map((c) => (c !== null && typeof c === "object" && typeof c.text === "string" ? c.text : ""))
+            .filter((t) => t.length > 0)
+            .join("\n");
+    }
+    else {
+        try {
+            text = JSON.stringify(content) ?? "";
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (text.length === 0)
+        return undefined;
+    return text.length > BATCH_RESPONSE_MAX_CHARS
+        ? `${text.slice(0, BATCH_RESPONSE_MAX_CHARS)}…[+${text.length - BATCH_RESPONSE_MAX_CHARS} chars truncated]`
+        : text;
+}
+export function toolEndBodyFrom(result, isError, gate, gatedCallIdOfRun) {
+    const o = toolOutputFrom(result);
+    const st = structuredFrom(result);
+    const det = isError ? result?.details : undefined;
+    const codeRaw = det?.code;
+    const kindRaw = det?.errorKind;
+    const code = typeof codeRaw === "string" ? codeRaw : typeof kindRaw === "string" ? kindRaw : undefined;
+    const deliveredRaw = det?.delivered;
+    const delivered = typeof deliveredRaw === "string" && MCP_DELIVERY_VERDICTS.includes(deliveredRaw) ? deliveredRaw : undefined;
+    const gatedCallId = code === "gate.parked" ? gatedCallIdOfRun : undefined;
+    return {
+        ...(o !== undefined ? { output: o.output, ...(o.truncated ? { truncated: true } : {}), ...(o.totalChars !== undefined ? { totalChars: o.totalChars } : {}) } : {}),
+        ...(st !== undefined ? { structured: st } : {}),
+        ...(typeof code === "string" ? { errorCode: code } : {}),
+        ...(delivered !== undefined ? { delivered } : {}),
+        ...(gatedCallId !== undefined ? { gatedCallId } : {}),
+        ...(gate !== undefined ? { gate } : {}),
+    };
+}
+export function reconciledToolEndBody(orphan) {
+    return toolEndBodyFrom({ content: orphan.text, details: { code: orphan.errorKind } }, true);
+}
+export function writeFamilyOfCanonical(name) {
+    if (name === "TaskCreate" || name === "TaskUpdate")
+        return "task";
+    if (name === "TodoWrite")
+        return "todo";
+    if (name === TOOL_SEARCH_NAME)
+        return "tool_search";
+    return undefined;
+}
+export function toolResultMsg(toolCallId, toolName, text, isError) {
+    return {
+        role: "toolResult",
+        toolCallId,
+        toolName,
+        content: [{ type: "text", text }],
+        isError,
+        timestamp: Date.now(),
+    };
+}

package/dist/core/store-contracts/checkpoint-store-contract.d.ts

@@ -1,4 +1,5 @@
 import { type Checkpoint, type CheckpointStore, type ResumeOutcome } from "../checkpoint-store.js";
+import type { GateOutcome } from "../gate-outcome.js";
 import { type CheckpointFields } from "../pause-registry.js";
 import { type ContractAssertionRunner } from "./contract-harness.js";
 /**
@@ -23,6 +24,9 @@ export declare function createCheckpointFixture(over?: Partial<CheckpointFields>
 export declare const ALLOW: Extract<ResumeOutcome, {
     gate: "policy_ask";
 }>;
+export declare const EXECUTED_ALLOW: GateOutcome;
+export declare const EXECUTED_ALLOW_REORDERED: GateOutcome;
+export declare const VETOED_BY_POLICY: GateOutcome;
 /**
  * The full cross-backend contract for {@link CheckpointStore} — the SAME assertions for every
  * backend. Entries are a 1:1 port of the vitest originals (assertion semantics unchanged).

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -1,4 +1,5 @@
 import { strict as assert } from "node:assert";
+import { executionVerdict } from "../checkpoint-execution-record.js";
 import { MAX_PENDING_STEER_ENTRIES, mintCheckpointToken, readPendingSteerQueue, } from "../checkpoint-store.js";
 import { checkpointFrom } from "../pause-registry.js";
 import { beginContract } from "./contract-harness.js";
@@ -36,6 +37,10 @@ export const ALLOW = {
     boundInputHash: "h0",
     hostDecision: { decidedBy: "person" },
 };
+const SETTLED = { kind: "human_allowed", who: { party: "person" }, when: 1_700_000_000_500 };
+export const EXECUTED_ALLOW = Object.freeze({ disposition: Object.freeze({ kind: "allowed" }), settlement: Object.freeze({ ...SETTLED, who: Object.freeze({ ...SETTLED.who }) }), origin: "policy" });
+export const EXECUTED_ALLOW_REORDERED = Object.freeze({ origin: "policy", settlement: Object.freeze({ when: 1_700_000_000_500, who: Object.freeze({ party: "person" }), kind: "human_allowed" }), disposition: Object.freeze({ kind: "allowed" }) });
+export const VETOED_BY_POLICY = Object.freeze({ disposition: Object.freeze({ kind: "denied", deniedBy: "policy" }), settlement: Object.freeze({ ...SETTLED, who: Object.freeze({ ...SETTLED.who }) }), origin: "policy" });
 export async function checkpointStoreContract(make, runAssertion) {
     const { run, settle } = beginContract(runAssertion);
     run("kit prerequisites: reopen/setPendingSteer/listByScope are implemented (REQUIRED by this kit)", async () => {
@@ -43,6 +48,86 @@ export async function checkpointStoreContract(make, runAssertion) {
         const missing = ["reopen", "setPendingSteer", "listByScope"].filter((m) => typeof probe[m] !== "function");
         assert.equal(missing.length, 0, `backend does not implement ${missing.join(", ")} — required for the CheckpointStore contract kit`);
     });
+    run("execution declaration: the backend declares execution.outcome === true (a REQUIRED member of the contract)", async () => {
+        const probe = make();
+        assert.equal(probe.execution?.outcome, true, "backend does not declare `execution = { outcome: true }` — the run refuses the store at its first read");
+        assert.equal(typeof probe.recordExecutionOutcome, "function", "backend does not implement recordExecutionOutcome — required by the CheckpointStore contract");
+    });
+    run("recordExecutionOutcome on a resolved row → `recorded`; the record and its stamp ride the row, the decision winner is untouched, executionVerdict reads executed", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        assert.equal(executionVerdict((await store.get(cp.token))).kind, "unknown");
+        await store.resolve(cp.token, cp.scope, ALLOW);
+        const before = (await store.get(cp.token));
+        assert.equal(executionVerdict(before).kind, "unknown", "a resolved row with no record reads UNKNOWN — never allowed by default");
+        assert.equal(await store.recordExecutionOutcome(cp.token, cp.scope, VETOED_BY_POLICY), "recorded");
+        const after = (await store.get(cp.token));
+        assert.deepEqual(after.executionOutcome, VETOED_BY_POLICY);
+        assert.equal(typeof after.executionAtMs, "number");
+        assert.equal(Number.isFinite(after.executionAtMs), true);
+        assert.deepEqual(executionVerdict(after), { kind: "executed", gate: VETOED_BY_POLICY });
+        assert.deepEqual(after.resolvedOutcome, before.resolvedOutcome);
+        assert.equal(after.status, "resolved");
+        assert.equal(after.rev, before.rev);
+    });
+    run("recordExecutionOutcome is idempotent on the SAME record (structural, key-order-blind) → `already_recorded`; a DIFFERENT record throws checkpoint.execution_outcome_conflict and the row is byte-identical", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        await store.resolve(cp.token, cp.scope, ALLOW);
+        assert.equal(await store.recordExecutionOutcome(cp.token, cp.scope, EXECUTED_ALLOW), "recorded");
+        const filed = (await store.get(cp.token));
+        assert.equal(await store.recordExecutionOutcome(cp.token, cp.scope, EXECUTED_ALLOW), "already_recorded");
+        assert.equal(await store.recordExecutionOutcome(cp.token, cp.scope, EXECUTED_ALLOW_REORDERED), "already_recorded", "equality is over the record's JSON — key order and freezing are not part of the value");
+        assert.equal(await store.recordExecutionOutcome(cp.token, cp.scope, structuredClone(EXECUTED_ALLOW)), "already_recorded", "an unfrozen structural twin is the same record");
+        await assert.rejects(store.recordExecutionOutcome(cp.token, cp.scope, VETOED_BY_POLICY), (e) => e.code === "checkpoint.execution_outcome_conflict");
+        const still = (await store.get(cp.token));
+        assert.deepEqual(still.executionOutcome, filed.executionOutcome);
+        assert.equal(still.executionAtMs, filed.executionAtMs, "a conflict writes nothing — not even a fresh stamp");
+    });
+    run("recordExecutionOutcome answers `not_resolved` for a pending and for an expired row, `absent` for a missing row and for a wrong-scope row; none of them write", async () => {
+        const store = make();
+        const pending = createCheckpointFixture();
+        await store.put(pending.token, pending);
+        assert.equal(await store.recordExecutionOutcome(pending.token, pending.scope, EXECUTED_ALLOW), "not_resolved");
+        assert.equal((await store.get(pending.token)).executionOutcome, undefined);
+        assert.equal(await store.recordExecutionOutcome(pending.token, "tenant-b", EXECUTED_ALLOW), "absent", "a wrong-scope row reads exactly like a missing one (the isolation rule)");
+        assert.equal(await store.recordExecutionOutcome(mintCheckpointToken(), pending.scope, EXECUTED_ALLOW), "absent");
+        const expired = createCheckpointFixture();
+        await store.put(expired.token, expired);
+        assert.equal(await store.expire(expired.token, expired.scope), true);
+        assert.equal(await store.recordExecutionOutcome(expired.token, expired.scope, EXECUTED_ALLOW), "not_resolved");
+        assert.equal((await store.get(expired.token)).executionOutcome, undefined);
+    });
+    run("reopen is refused on a row that carries an execution record (a settled action is not re-openable); the same row reopens before the record lands", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        await store.resolve(cp.token, cp.scope, ALLOW);
+        assert.equal(await store.reopen(cp.token, cp.scope, "env_failed"), true);
+        assert.equal(await store.resolve(cp.token, cp.scope, ALLOW, { rev: 2 }), true);
+        assert.equal(await store.recordExecutionOutcome(cp.token, cp.scope, EXECUTED_ALLOW), "recorded");
+        assert.equal(await store.reopen(cp.token, cp.scope, "env_failed"), false);
+        assert.equal(await store.reopen(cp.token, cp.scope, "tool_unavailable"), false, "no reason reopens a recorded row");
+        const got = (await store.get(cp.token));
+        assert.equal(got.status, "resolved");
+        assert.equal(got.rev, 3, "a refused reopen bumps nothing");
+        assert.equal(got.reopenReason, undefined);
+        assert.deepEqual(got.executionOutcome, EXECUTED_ALLOW);
+    });
+    run("a row filed WITH an execution record (a restored resolved row) keeps it authoritative: get() returns it, reopen is refused, a different record conflicts, the same one is already_recorded", async () => {
+        const store = make();
+        const cp = createCheckpointFixture({ status: "resolved", rev: 1, executionOutcome: EXECUTED_ALLOW, executionAtMs: 1_700_000_001_000 });
+        await store.put(cp.token, cp);
+        const back = (await store.get(cp.token));
+        assert.deepEqual(back.executionOutcome, EXECUTED_ALLOW);
+        assert.equal(back.executionAtMs, 1_700_000_001_000);
+        assert.equal(await store.reopen(cp.token, cp.scope, "env_failed"), false, "a restored recorded row is as settled as a live one");
+        await assert.rejects(store.recordExecutionOutcome(cp.token, cp.scope, VETOED_BY_POLICY), (e) => e.code === "checkpoint.execution_outcome_conflict");
+        assert.equal(await store.recordExecutionOutcome(cp.token, cp.scope, EXECUTED_ALLOW), "already_recorded");
+        assert.equal((await store.get(cp.token)).status, "resolved");
+    });
     run("put create-once → already_exists", async () => {
         const store = make();
         const cp = createCheckpointFixture();

package/dist/core/trace.d.ts

@@ -511,6 +511,30 @@ export type TraceEvent = {
     /** The boundary classification the admission asserted. */
     boundary: "sandbox_internal";
     ts: number;
+} | {
+    /**
+     * The auto-mode classifier decided (or declined to decide) one pending ask — one frame per
+     * `decide` call, including the breaker-open short-circuit, so a consumer can read the gate's
+     * wall-clock cost per tool call and the failure cause behind an ask that reached a person. A
+     * TRACE frame rather than a task event: it fires once per gated call, it is an operator's read
+     * (why did that ask take four seconds / why did it fall back), and the session-level breaker
+     * read face a shell renders is a separate, additive wire face. `ms` is the wall time from the
+     * decide call to its verdict (timeout included: a timed-out round reads the deadline).
+     */
+    kind: "auto_mode.classified";
+    version: 1;
+    taskId: string;
+    /** The gated call the classifier judged. */
+    toolCallId: string;
+    /** The classifier model (the resolved `classifier` role, or the main model it fell back to). */
+    model: string;
+    /** Wall-clock milliseconds the gate waited on this decision (integer, ≥ 0). */
+    ms: number;
+    /** The verdict kind the gate acted on (`allow` / `block` / `unavailable` / `parse_error`). */
+    verdict: "allow" | "block" | "unavailable" | "parse_error";
+    /** Present iff `verdict === "unavailable"`: `error` / `timeout` / `breaker_open`. */
+    cause?: "error" | "timeout" | "breaker_open";
+    ts: number;
 } | {
     /** C1 — the failover brain served this call from a FALLBACK entry (`createFailoverBrain`): the
      *  primary (and possibly earlier hops) failed cleanly upfront. Without this, same-model gateway

package/dist/index.d.ts

@@ -98,7 +98,8 @@ export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY
 export { deploymentReadFaceClampNotice, resolveReadFace, type ReadFace, type ReadFaceInputs } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, type CheckpointRow, realApprovalOrgFact, resolveCheckpointStore, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, type CheckpointRow, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreExecutionUndeclared, } from "./core/checkpoint-store.js";
+export { EXECUTION_OUTCOME_RECORD_WORDS, EXECUTION_RECORD_LEAVES_ROW_UNRECORDED, isExecutionOutcomeRecordWord, type ExecutionOutcomeRecordWord, type ExecutionRecordTableCoversEveryWord, type ExecutionRecordRowFacts, type ExecutionVerdict, ExecutionOutcomeConflictError, checkpointExecutionRecorded, executionRecordDisposition, sameExecutionRecord, executionVerdict, } from "./core/checkpoint-execution-record.js";
 export { PAUSE_REGISTRY, type GateKind, type PendingKind, type ResumeGate, isGateKind, resumeGateMatches, type CheckpointPause, type CheckpointFields, pauseOf, checkpointFrom } from "./core/pause-registry.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
@@ -152,8 +153,8 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL } from "./core/ask-origin.js";
 export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, type GateDisposition, type GateOutcome, screenGateOutcome } from "./core/gate-outcome.js";
 export { type AskCarry } from "./core/hooks.js";
-export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
-export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS } from "./core/auto-mode-defaults.js";
+export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
+export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, type AutoModeArmingRecipe, type AutoModeArmingFace, type AutoModeArmingFold, type AutoModeRebuildRefusal, } from "./core/auto-mode-arming.js";
@@ -209,7 +210,7 @@ export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore
 export { stripEngineMetadata } from "./internal/llm.js";
 export { EVENT_PROMPT_REGISTRY, eventDefaultOn, type CompiledEventPrompt, type CompiledMessageInjection, type EventDedupe, type EventDefaultPolicy } from "./prompt-assembly/event-registry.js";
 export type { CompiledSection, ComposedPrompt, PackSectionDeclaration, PromptCacheClass, PromptCarrier, PromptMutability, PromptOwner, PromptPack, PromptRenderCadence, PromptRuntimeFacts, PromptSlot, PromptTrust, SectionRenderInputs, } from "./prompt-assembly/types.js";
-export { type ReasoningIntensity, type ReasoningResolution, type ResolvedReasoning, type ReasoningFormat, DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, resolveBinary, reasoningBudgetShare, resolveReasoning, resolveReasoningProfile, type ReasoningTier, type ReasoningProfileFlags, } from "./brain/reasoning.js";
+export { type ReasoningIntensity, type ReasoningResolution, type ResolvedReasoning, type ReasoningFormat, DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffExpressible, declaredOffSpelling, type OffCapabilityModel, resolveReasoningProfile, type ReasoningTier, type ReasoningProfileFlags, } from "./brain/reasoning.js";
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, type ScenarioId, type CodeReviewMode, type ScenarioProfile, type RunScenarioOptions, type RunScenarioResult, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, type TeacherModePair, type TeacherProfile, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, type OrchestrationMode, type OrchestrationEnv, } from "./scenarios/env.js";

package/dist/index.js

@@ -77,7 +77,8 @@ export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY
 export { deploymentReadFaceClampNotice, resolveReadFace } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, realApprovalOrgFact, resolveCheckpointStore, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreExecutionUndeclared, } from "./core/checkpoint-store.js";
+export { EXECUTION_OUTCOME_RECORD_WORDS, EXECUTION_RECORD_LEAVES_ROW_UNRECORDED, isExecutionOutcomeRecordWord, ExecutionOutcomeConflictError, checkpointExecutionRecorded, executionRecordDisposition, sameExecutionRecord, executionVerdict, } from "./core/checkpoint-execution-record.js";
 export { PAUSE_REGISTRY, isGateKind, resumeGateMatches, pauseOf, checkpointFrom } from "./core/pause-registry.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
@@ -127,7 +128,7 @@ export { ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPR
 export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, screenGateOutcome } from "./core/gate-outcome.js";
 export {} from "./core/hooks.js";
 export { parseAutoModeResponse, createAutoModeDecider, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
-export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS } from "./core/auto-mode-defaults.js";
+export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
@@ -167,7 +168,7 @@ export { buildTurnPromptSnapshot, loweringRecordFor, LOWERING_VERSION, PREFIX_IN
 export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "./prompt-assembly/artifact-store.js";
 export { stripEngineMetadata } from "./internal/llm.js";
 export { EVENT_PROMPT_REGISTRY, eventDefaultOn } from "./prompt-assembly/event-registry.js";
-export { DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, resolveBinary, reasoningBudgetShare, resolveReasoning, resolveReasoningProfile, } from "./brain/reasoning.js";
+export { DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffExpressible, declaredOffSpelling, resolveReasoningProfile, } from "./brain/reasoning.js";
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, } from "./scenarios/env.js";

package/dist/stores/file/checkpoint-store.d.ts

@@ -1,4 +1,6 @@
+import { type ExecutionOutcomeRecordWord } from "../../core/checkpoint-execution-record.js";
 import { type Checkpoint, type PendingSteerInput, type CheckpointFaultMode, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ReopenReason, type ResolveExpectation, type ResumeOutcome } from "../../core/checkpoint-store.js";
+import type { GateOutcome } from "../../core/gate-outcome.js";
 export interface FileCheckpointStoreOptions {
     /** When false, an `appendLine` for a state transition is NOT fsync'd. The checkpoint COMMIT POINT always
      *  fsyncs regardless (its crash-safety depends on it); this governs the `put` and `setPendingSteer`
@@ -25,6 +27,10 @@ export declare class FileCheckpointStore implements CheckpointStore {
     readonly redecision: {
         readonly reopen: true;
     };
+    /** The execution-outcome record verb below is the contract's CAS (journaled), and `reopen` honours the record. */
+    readonly execution: {
+        readonly outcome: true;
+    };
     private readonly fsyncEnabled;
     private readonly compactEvery;
     /** RB-134: the directory's ONE authority (map + token mutex + append log), joined not rebuilt. */
@@ -50,6 +56,7 @@ export declare class FileCheckpointStore implements CheckpointStore {
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
     get(token: CheckpointToken): Promise<Checkpoint | null>;
     resolve(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): Promise<boolean>;
+    recordExecutionOutcome(token: CheckpointToken, scope: string, gate: GateOutcome): Promise<ExecutionOutcomeRecordWord>;
     reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
     setPendingSteer(token: CheckpointToken, scope: string, steer: PendingSteerInput): Promise<boolean>;
     expire(token: CheckpointToken, scope: string): Promise<boolean>;

package/dist/stores/file/checkpoint-store.js

@@ -1,11 +1,13 @@
 import { join } from "node:path";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
+import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "../../core/checkpoint-execution-record.js";
 import { appendPendingSteer, CheckpointError, checkpointOccMatches, checkpointRowMatches, summarizeCheckpoint, validatePendingSteer, winnerFromOutcome, } from "../../core/checkpoint-store.js";
 import { SharedLedgerTable } from "./shared-ledger.js";
 const CHECKPOINT_LEDGER_EVENT_REGISTRY = {
     put: true,
     resolve: true,
     reopen: true,
+    execution: true,
     expire: true,
     steer: true,
     steer_append: true,
@@ -36,6 +38,10 @@ function applyCheckpointEvent(cps, ev) {
             cp.rev = ev.rev;
             cp.reopenReason = ev.reason;
             break;
+        case "execution":
+            cp.executionOutcome = ev.gate;
+            cp.executionAtMs = ev.atMs;
+            break;
         case "expire":
             cp.status = "expired";
             break;
@@ -64,6 +70,7 @@ export class FileCheckpointStore {
     durability = "durable";
     fidelity = "json";
     redecision = { reopen: true };
+    execution = { outcome: true };
     fsyncEnabled;
     compactEvery;
     ledger;
@@ -126,10 +133,22 @@ export class FileCheckpointStore {
             return true;
         });
     }
+    async recordExecutionOutcome(token, scope, gate) {
+        return this.withLock(token, () => {
+            const cp = this.cps.get(token);
+            const disposition = executionRecordDisposition(cp, scope, gate);
+            if (disposition === "conflict")
+                throw new ExecutionOutcomeConflictError(cp.executionOutcome, gate);
+            if (disposition !== "commit")
+                return disposition;
+            this.commit({ t: "execution", token, gate: structuredClone(gate), atMs: Date.now() }, true);
+            return "recorded";
+        });
+    }
     async reopen(token, scope, reason) {
         return this.withLock(token, () => {
             const cp = this.cps.get(token);
-            if (!checkpointRowMatches(cp, scope, "resolved")) {
+            if (!checkpointRowMatches(cp, scope, "resolved") || checkpointExecutionRecorded(cp)) {
                 return false;
             }
             const rev = (cp.rev ?? 0) + 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.6.3",
+  "version": "7.7.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",