@sema-agent/core 7.6.3 → 7.8.0

package/CHANGELOG.md

@@ -1,22 +1,82 @@
 # Changelog
 
-## 7.6.3 — 2026-09-08
+## 7.8.0 — 2026-09-08
 
-Maintenance patch on the 7.6.x line: one correction to 7.6.2's forwarding drain.
+One roster instead of 29 name tables. `ToolSpec` already described a tool completely; the engine, the server and the shells still re-asserted each tool's identity and axes by NAME in hand-kept tables (a retired name lived on as a key in five of them). This version mints ONE effect roster per prepared leg from the mounted instances, derives every remaining table from a static catalog, and closes the mount array behind a builder.
 
-### Fixed
-- **forwardSubagentEvents drain gate** — 7.6.2 gated the drain inside an `async` helper and awaited it unconditionally, so a run that did NOT opt in still yielded one extra microtask before its terminal push (the black-box round measured parent `done` at hop 356 vs 355 on 7.6.1). The gate is now a synchronous predicate at both terminal pushes and the helper is a plain Promise factory; the non-forwarding terminal depth is pinned (ratchet 58, the unconditional-await form reds it at 59). No change for opted-in runs.
+### BREAKING
+- `HAND_TOOL_EFFECTS`, `DEFAULT_BUDGET_EXEMPT_TOOLS`, `COMPACTABLE_TOOLS` leave `src/index.ts` (B1). Replacement: `describeToolCatalog()` — the hand band is `.filter((e) => e.mountedBy.includes("hands"))` (or `handBandEffects()`), the two policy sets `budgetExemptToolNames()` / `compactableToolNames()`. A host deriving its hand band (server `HANDS_BAND_TOOL_NAMES`) derives it over `HANDS_BAND_TAGS`; the derived band equals today's server list plus `ListAgents` (the peer-lane definition the hand-kept list predates) — the server's list is the stale side.
+- `Prepared.tools` is `readonly AgentTool[]` (the builder's read face); a prepare phase that wrote the array takes `roster: RosterBuilder`.
+
+### Narrowings (each a two-arm pin)
+- **B6/B17** — the policy faces read the call's OBJECT face (`ToolCallRequest.face`, stamped at the gate entry off the live roster and carried through the fold's re-mint over the final args). The active-skill `allowPaths` face judges `pathTarget.skillScopeEligible` and confines the DECLARED target's value (`pathTargetValue`: the face's `param` + aliases — an in-fence `file_path` beside an out-of-fence declared param is a decoy, not the write; a declared param absent from the args is denied as unresolvable): a bare request (a policy invoked outside a Runner) or a caller tool that merely took a built-in's name (`Write`) is an unconfirmable write and is denied where it used to pass by name. The transcript-directory gate reads the face and falls back to the catalog's declaration for the name (never wider than 7.7.0).
+- **B15** — the permission-rule lint's diagnostic set is closed: `unsupported.param_unknown` (renamed from `unsupported.unknown_param`), `unsupported.param_non_scalar` (`Edit(edits:…)` and every carried object/array key), `unsupported.tool_unknown` (only under a leg-supplied `ruleFaces` resolver — `ruleFacesFromRoster(prepared.toolRoster)`; without one the catalog alone judges and an unknown tool stays permissive). `RuleFaceView` / `catalogRuleFaceView` / `PermissionRulePolicyOptions.ruleFaces` are the seats.
+- **B14** — the micro-compaction whitelist is derived from the catalog's `compactable` declarations: eight members, no `PowerShell` row (no sema definition ever carried the name).
+- **B20** — a caller tool name / alias over 128 characters, or a contract member over 64, is refused typed at prepare (`config.tool_name_too_long` / `config.tool_contract_too_long`); an MCP assembled name can never exceed the bound — the namespacing helper already budgets it (peer segment absorbs the clamp, digest-suffixed; provider bound 64), so the design's "drop that tool" arm is satisfied by construction and no drop arm exists (design/388 S49's "core has no bound on the synthetic name" premise is stale as of RB-83/RB-107).
+- The compaction file-op summary reads the live names' path access off the catalog and the three pre-rename names off the frozen `DURABLE_HISTORY_NAMES`; a persisted `MultiEdit` block contributes no file-op metadata any more (the retired name is a key nowhere — G3).
+- **Every write fence judges the call's DECLARED slot** — two named readers for the two kinds of fence, shared by all of them (`writeTargetPath(call, target)`): a DENY-LIST (sensitive paths, frozen paths, write protection, the transcript gate, edit tracking) reads `protectivePathTargetOf` — the object face's declaration first, the catalog's declaration for the NAME as the floor (a bare request, or a face that declares none): reading the catalog for an undeclared same-name tool can only tighten a deny-list (the pre-388 posture, never wider). A GRANT that admits a write BY its path (session `allowDirs`, the fs-write gate's accept/exempt dirs, the active-skill allowPaths eligibility) reads `declaredPathTargetOf` — the face's OWN declaration only: a same-name tool that declares no path target is an unconfirmable write and the fence fails closed (allowDirs denies "declares no path target to confine"; the fs-write gate asks; the catalog's slot never buys an admission); a bare request (no face at all — a policy invoked outside a Runner) reads the catalog for the name. `isProtectedWrite` / `isDeclaredWrite` are the two membership predicates. The sensitive-path guard's DEFAULT membership is the same predicate (a caller tool under any name whose face declares a write target is guarded); an explicit `tools` list stays a name list. A decoy `file_path` beside an out-of-fence declared param is not the target; a declared param absent from the args is "no resolvable path" (containment fences deny/ask as they always did for an unresolvable write; the additive deny-lists — sensitive paths, frozen paths — see no target and pass, as their unresolvable arm always did). The cross-slot fallback that once read `notebook_path` for a Write, or `file_path` for a NotebookEdit, is gone (the tool's own schema refuses such a call before any write).
+- **Merge-seam adversarial rounds (codex r1/r2 over the merged 388 × 393 S1/S2 × #602 tree)** — (H1) the durable resume-edit rechecks judge under the call's face: the park row carries `family` + `pathTarget` beside its B18 identity members (additive optional; `parkedToolFace` mints them at the same station, `parkedCallFaceOf` rebuilds the face — present iff face + all four identity members are on the row), the pre-CAS recheck judges the edited args under the ROW face and the two post-CAS rechecks under the live roster face; a decoy in-fence `file_path` beside an out-of-fence declared `destination` is refused `resume.constraint_rejected` pre-CAS (the checkpoint stays pending). **@server**: two additive optional keys on the checkpoint row (JSON rows: zero DDL); the store-contract kit gained a seven-member round-trip run your pg store must pass. (H2) MCP intake keys the overlay's results by tool NAME — a tool the overlay refused is not mounted at all (previously an index pairing mounted it bare and shifted later tools onto a neighbour's face). (F2) the `resume` identity arm is wired (see the disclosure below): a same-name tool whose contract / shape / revision differ from the parked row's is refused `resume.tool_contract_mismatch` through the non-executing reopen path (`tool_unavailable` family), never executed under the new face. (F3) the park-time projection re-adjudication (a JSON-fidelity store moving the args) carries the call face too. Two review proposals were REJECTED on the documented contract (#549 ①, HRD-PRM-1, #286, CLS-C-4): protective fences judge the tool's declared/catalog slot only — no "legacy spelling floor" when the slot is empty and no "judge every candidate" union; a caller whose implementation writes another slot declares its face.
+- **B20 (keys)** — a schema property name is a SEMANTIC key every fence reads by and is never truncated on a roster row: a caller declaration over `TOOL_KEY_MAX_CHARS` (256) or `TOOL_KEYS_MAX` (1024 keys) is refused typed at prepare (`config.tool_schema_bound`); a caller face that does not fit its schema (a `pathTarget.param` outside the top-level keys, a `ruleFace` param outside the derived vocabulary — scalar keys ∪ the declared path target's param + aliases —, an approval card whose required keys are missing, a declared key or display hint over its bound) is refused `config.tool_face_invalid`; no display hint is truncated on a row either — the same validator the MCP `toolFaces` overlay passes; an MCP tool whose schema breaks the key bound is dropped with a disclosed reason (its siblings mount). `writeProtectionCheck(toolName, args, face?)` gains the call's face (additive).
+- The sensitive-path guard / frozen-path deny / edited-file tracking / `allowDirs` all derive their covered set from the catalog's path targets: `MultiEdit` is no longer a member of any of them (it mounts nowhere).
 
-## 7.6.2 — 2026-09-08
+### Added
+- `ToolSpec.family` / `pathTarget` / `ruleFace` / `renderHints` / `compactable` / `budgetExempt` (additive; `defineTool` forwards them + `modelGate` onto the materialized face); `TaskSpec.excludeAllTools: true` (the whole face unmounts; `"*"` stays a legal caller name); `McpServerSpec.toolFaces` (a per-tool face overlay for MCP tools, validated against the materialized schema at every listing).
+- The tool FACE vocabulary (`TOOL_FAMILIES`, `TOOL_MOUNT_TAGS`, `TOOL_APPROVAL_CARDS`, `TOOL_PATH_ACCESSES`, the render-hint bounds, `TOOL_WIRE_NAME_MAX_CHARS` / `TOOL_CONTRACT_MAX_CHARS`, `ToolPathTarget` / `ToolRuleFace` / `ToolRenderHints` / `ToolFaceDeclaration` / `ToolCatalogEntry`), the static catalog (`describeToolCatalog`, `catalogEntriesNamed`, `catalogToolNames`, `catalogRuleFaceOf`, `pathTargetOf`, `pathTargetValue`, the derived predicates, `engineCardTypes`, `predictMountedToolNames`, `HANDS_BAND_TAGS` / `MOUNT_TAG_IN_HANDS_BAND`), the roster (`ToolRosterEntry` / `ToolRoster` / `ToolRosterDelta` / `ToolRosterRenderHints` as typebox schemas AND `Static` types, `ROSTER_SOURCES`, `mintCapabilityId`, `toolIdentityOf`, `diffToolRoster`, `judgeParkedToolIdentity`, `parkedToolIdentity`, `ruleFacesFromRoster`, `toolCallFaceOf`, `inputKeysOf`, `ruleFaceOfInstance`, `ToolRosterDeltaSeat`), `TOOL_CONFORMANCE_VECTORS` / `describeToolConformanceVectors`, `applyMcpToolFaces` / `toolFaceProblem` / `APPROVAL_CARD_REQUIRED_KEYS`, `createStructuredProjector`, `ASK_USER_QUESTION_TOOL_NAME` (B5), `DURABLE_HISTORY_NAMES`.
+- **Wire (@server @cli @client-core @web-admin @desktop)**: `WiringManifest.tools?: ToolRoster` on every effective manifest (OUTSIDE `configFingerprint`; `schemaVersion` unchanged); `TaskEvent` arm `tool_roster_delta { delta: ToolRosterDelta }` (a run-time roster change: the whole post-change roster + a summary usable when the consumer holds `fromDigest`; a mismatch means adopt the snapshot, never reject); `ToolCallRequest.face?: ToolCallFace`; `FsWriteGateWiring.isExempt(toolName, canonicalPath, identity?)` (B22 — the identity triple beside the name for a store keyed on `capabilityId`); `PendingAction{kind:"tool_approval"}` gains `capabilityId? / contractId? / shapeDigest? / implementationRevision? / rosterDigest?` (B18; additive, no checkpoint-version bump; a row without them follows the name-only path); three `engine_notice` codes (B2, audience operator): `config.tool_card_undeclared`, `config.tool_face_undeclared`, `config.tool_face_invalid`.
+- Gates (all in `gate:all`): `gate:tool-catalog` (every core-owned definition spreads its catalog face; a face under another name, a ghost id, a row without family, a card minted by a file that does not list it — red, named), `gate:tool-names` (L1: every retained tool-name table registered in `docs/TOOL-NAME-TABLES.json`, disjoint from the retired names, inside the catalog), `gate:tool-docs` (the `ToolSpec` field reference in docs/sdk/04 is generated from the declaration — `scripts/gen-tool-spec-fields.mjs --check`). `ToolMountTag` registered in `docs/CLOSED-SETS.md`.
+- The catalog is data: every row is deep-frozen at module init and `toolFace(id)` hands out a deep COPY — two factory products never share a `pathTarget`, and a host adapting one instance's face cannot move another run's fences (or the catalog).
+- An MCP `toolFaces` overlay that does not fit the tool's materialized schema (at intake or after a refresh) means the tool is NOT mounted on that leg — announced once (`config.tool_face_invalid`); it never mounts bare (a bare mount would silently drop the write protection the operator declared, and an MCP name has no catalog floor). The approval-edit re-check and the edit ask carry the stamped face (a decoy in an approved edit is confined by the declared slot).
+- A deferred tool's placeholder carries the real tool's `aliases` (dispatch by alias resolves to the same slot before and after activation, the roster's name→row resolution agrees with the dispatcher's — wire name first, then alias, in mount order — and a transcript call under an alias activates the canonical entry on replay). The MCP `toolFaces` overlay binds to the RAW accepted tool name (`Tool.mcpRemoteName`, a typed carry the materializer stamps): two raw spellings folding onto one minted name cannot make a face land on the other tool — the unaccepted spelling is announced undeclared. `TOOL_KEY_MAX_CHARS` / `TOOL_KEYS_MAX`; `ToolCallLike` / `callPathTargetOf` / `isPathConfinableWrite` / `fileOpAccessOf` (the compaction summary records file ops for the FILE families only — a search tool's `path` is a root, not a file read).
+- The roster carries every name the model can call: the ToolSearch instance the deferred lane appends to the harness list rides the roster's ENGINE LANE (`RosterBuilder.mountEngineLane`) as the trailing row, minted after the disclosure lane (which reads the mount array and never writes it) — the prompt manifest's tool rows are the mount array; the roster is that plus the engine lane. The effect map follows the instance the harness dispatches to (a later same-name mount's declared effect is the name's truth). `gate:tool-catalog` rule ②b: a resolvable `defineTool({ name })` with no catalog row is red (per-file `HOST_FACTORY_DEFINITIONS` exemption list, empty today).
 
-Backport patch on the 7.6.x line (two field bugs the server 7.64.0 chain found; no store-contract change — that is 7.7.0).
+### Not wired in 7.8.0 — three runtask.ts seams deferred to design/393 S3 (the seats are minted; the driver does not yet consume them)
+- **Disclosure**: the three items below are the driver-side half of this slice. In 7.8.0 the roster, its delta seat and the structured projector all exist and are pinned at the seat/function level, but runtask.ts (design/393's domain, being decomposed in parallel) does not yet call them: no `tool_roster_delta` frame is pushed and `tool_end` still projects through the module-level card set. A consumer must not rely on `tool_roster_delta` frames until the version that lands 393 S3. (The `resume` identity arm — `judgeParkedToolIdentity` minting `resume.tool_contract_mismatch` — IS wired in 7.8.0: the merge-seam adversarial round showed a same-name replacement executing under a different face once the rechecks read faces, so it did not wait for S3.)
+- `tool_end`: the body projection reads `prepared.structuredProjector` (the per-leg card set + the once-per-leg announce) in place of the module-level `structuredFrom` (tool-end-body.ts:77 via runtask).
+- `wiring_manifest`: beside the manifest push (runtask.ts ≈:4149) subscribe `prepared.toolRosterDeltas.subscribe((delta) => queue.push({ type: "tool_roster_delta", delta, ...ident() }))`.
 
-### Fixed
-- **R12 (`forwardSubagentEvents`)** — a run that opted into forwarding did not wait for the frames its BACKGROUND children had already handed to the forward channel before saying `done`; the gap is one microtask ladder deep and moved when #594 split the tool gate into three async stations (a child's gated call went from 24 to 27 microtask hops between `tool_start` and `tool_end`), so a consumer that read the parent to `done` and then inspected the sink lost the child's `tool_end`. The parent now takes one macrotask turn right before its terminal push, only on opted-in runs, on both the success and the failure path. Pin: `test/forward-subagent-events-drain.test.ts`.
-- **R13 (checkpoint)** — the pre-CAS refusal of a pending approval row that carries no `origin` word (a row minted before the ask's origin was persisted on the park) now carries `reason: "origin_missing"` like its three `unsupported_version` siblings, so a host upgrading with parked cards can classify the orphaned row. Pin: `test/backlog-r13-origin-missing-reason.test.ts`.
+### Pins
+- `test/tool-catalog.test.ts` (L5 snapshots + the gate's discriminance), `test/tool-roster.test.ts` (the builder, the row mint, the delta seat, G1 / G5 / G6 / G6c / G6e), `test/tool-conformance.test.ts` (L3 over four vectors on a real NodeExecutionEnv, L6 lockstep + every param matches, L4's once-per-leg announce, G6d), the retired-table tests re-pointed at the catalog.
+
+## 7.7.0 — 2026-09-07
+
+One version for the first refactor wave and its bug fixes (the 7.6.2 patch folded in: main already carries the store-contract change, so the fix ships with it). #618 / B-040: The classifier request shape changes on the wire; the explicit "off" tier changes on both brain lanes.
+
+**BREAKING (store contract).** #602 — the durable half of a post-CAS veto. A person approved a parked call, the deployment's own re-check refused the approver's edit on the resumed leg, `tool_end.gate` said `denied/policy` beside the `human_allowed` settlement — and the row still said `resolvedOutcome.gateOutcome.disposition = allowed`, because the store contract had no verb for "how was the decided action finally disposed". A consumer rebuilding the run from the row after the stream broke read the pre-execution allow and nothing else.
+
+### BREAKING — `CheckpointStore` gains two REQUIRED members
+- `readonly execution: { readonly outcome: true }` — a declaration, read at the first read of the store seat (`resolveCheckpointStore`): a store without it is refused with `config.invalid_checkpoint_store` (the same door as the retired `null` spelling), naming the seat (`TaskSpec.checkpointStore` / `RunnerDeps.checkpointStore`) and the missing declaration. A store that satisfies the TypeScript type carries it; a JavaScript caller is told at prepare what the type would have told it.
+- `recordExecutionOutcome(token, scope, gate: GateOutcome): Promise<"recorded" | "already_recorded" | "not_resolved" | "absent">` — the CAS `status='resolved' AND execution_outcome IS NULL`; the same record again is idempotent (`already_recorded`, structural equality over the record's JSON); a DIFFERENT record throws `checkpoint.execution_outcome_conflict` (`ExecutionOutcomeConflictError`, carrying `recorded` + `attempted`); pending/expired rows answer `not_resolved`, missing and wrong-scope rows `absent`. Never touches `status` / `rev` / `resolvedOutcome` / `reopenReason`.
+- `reopen` gains the predicate `AND execution_outcome IS NULL` — a row whose decided action is already disposed is settled, never reopenable (the reopen answers `false`; the engine's compensation reads it as `checkpoint.reopen_failed`, definitive). Behaviour narrowing: an `env_failed` retry is offered only for a row whose action never reached its disposition.
+- Deployment stores (server's two) need two columns, `execution_outcome` (json) + `execution_at_ms`, the record CAS, and the reopen predicate; the store-contract kit (`checkpointStoreContract`) carries the six cases. The in-tree file store writes a new ledger event kind (`execution`); a binary older than 7.7.0 refuses to replay a directory whose live ledger carries one (loud) — but once compaction has folded the event into a snapshot row, that older binary reads the row with a field it does not know and its `reopen` ignores the record (the same rollback shape the parked-steer queue event disclosed in its release; a rollback across a recorded row is not supported).
+
+### Added
+- `CheckpointRow.executionOutcome?: GateOutcome` + `executionAtMs?: number` (additive row keys, present together) — the record the resumed call's `tool_end.gate` carried, written by the engine on EVERY resolution (an executed allow too); absence has one meaning: unknown, never "allowed". `resolvedOutcome.gateOutcome` stays the immutable record of the decision, so a vetoed row reads `allowed` there and `denied/policy` here.
+- `executionVerdict(cp)` → `{ kind: "executed", gate } | { kind: "unknown" }` — the one read face of the column (`type ExecutionVerdict`).
+- `EXECUTION_OUTCOME_RECORD_WORDS` / `type ExecutionOutcomeRecordWord` / `isExecutionOutcomeRecordWord`, the disposition table `EXECUTION_RECORD_LEAVES_ROW_UNRECORDED` (+ fence `ExecutionRecordTableCoversEveryWord`; registered in `docs/CLOSED-SETS.md`), `ExecutionOutcomeConflictError`, and the shared backend halves `executionRecordDisposition` / `checkpointExecutionRecorded` / `sameExecutionRecord` (every in-tree backend routes through them — `gate:single-mint` rows); `checkpointStoreExecutionUndeclared` (the refusal's one mint).
+- `engine_notice` code `checkpoint.execution_outcome_unrecorded` (audience operator) — the resolver disposed the decided action and the store answered `not_resolved` / `absent`: the execution result stands as delivered, the row reads unknown, and this names it; `detail: { sessionId, runId, scope, checkpointId?, word }`. A conflict is not a notice: the throw propagates and the resumed leg fails with `checkpoint.execution_outcome_conflict` (the action, if it ran, ran; the defect is reported, not hidden).
+- `@contract checkpoint.execution_outcome` (the row field's JSDoc is the one home).
 
 ### Changed
-- `CheckpointError.detail.reason` closed set gains `"origin_missing"` (terminal for the row's bytes; the host decides the orphaned card).
+- The pending-call resolver (`resolvePendingCall`) files the frame's record on every arm through one `settleEnd` helper, between the `tool_end` frame and the transcript append; a policy_ask decide reaching the resolver without its settlement record is refused (`checkpoint.invalid_outcome`) rather than settled unrecorded. `ResumeRun.recordExecutionOutcome` is the bound verb (required seat). The notice half lives in `runner/execution-record.ts` (layer 1).
+
+### Changed (refactor — byte-invariant on the runtime)
+- **design/393 S1** — six module-level helpers leave runtask.ts for layer-1 modules (initial-run-state / steer-admission / tool-end-body / decide-continuation / clock-and-limits / git-leg-delivery; runtask 11 963 → 11 059); dist runtask.js changes by import lines and moved bodies only, the await-boundary table is all-zero, the export snapshot is unchanged by this slice.
+
+### Pins
+- `test/backlog602-execution-outcome.test.ts` (17): store-level ③④⑤⑥ over both in-process backends + file-ledger replay; engine-level ① (person's edit vetoed post-CAS ⇒ frame and row both `denied/policy`, decision cell still `allowed`, `executionVerdict` executed, reopen refused), ② (executed allow recorded), a delivered refusal, the unrecorded notice, the conflict propagation, ⑦ (undeclared store refused on both seats with the declared control). Store-contract kit +6 cases (InMemory / File / Pg via pg-mem).
+
+### Fixed
+- **#618 (P1, B-040)** — the auto-mode classifier's request said nothing about thinking and carried no output cap, so a default-on Messages-compatible endpoint (deepseek's anthropic port in the field) spent the whole cap on reasoning and answered with zero text: every classification was a contract failure, three of them opened the session breaker, and every later ask in the session became a card for a person (3–7 s per classification on the way). The classify call now carries `reasoning:"off"` and `maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS` (256, derived from the engine's own `<block>…` output contract — the longest legal block verdict is ≈150 tokens; not upstream's 64 nor its 4096 critique cap), on every model whose wire can SAY off (`thinkingOffExpressible`); a model that thinks regardless (anthropic adaptive form; stock openai / Responses with no declared off spelling) keeps its own output budget — a cap sized for the answer alone would only cut its thinking. Explicit "off" is now spelled on every wire that has an off form, one rule with no absence-means-off exception: anthropic budget form `thinking:{type:"disabled"}` (adaptive form: field omitted — those models reject `disabled`); openai lane — deepseek `thinking:{type:"disabled"}`, qwen/zai `enable_thinking:false`, qwen-chat-template `chat_template_kwargs.enable_thinking:false`, openrouter/together `reasoning:{enabled:false}`; stock openai completions and the Responses lane the DEPLOYMENT-declared off spelling (`thinkingLevelMap.off`, e.g. a provider's `"none"` tier — `declaredOffSpelling`), else absence (an enabled tier is never inferred as off: it turns reasoning on). "Unset" still writes nothing on every format. A new trace frame `auto_mode.classified {toolCallId, model, ms, verdict, cause?}` reads one line per decision (breaker-open short-circuits included); `AutoModeDeciderOptions.onClassified` is the hook it rides. Repro `scripts/repro/B-040.mjs` (RED on 7.6.1, GREEN here) runs under `gate:repro`.
+
+### Changed (wire — consumers named, #618)
+- Classifier request body on the wire: `thinking:{type:"disabled"}` + `max_tokens: 256` (anthropic budget form); `reasoning:"off"` reaches every brain lane. A deployment that reads the classifier's request through a proxy sees the two new keys.
+- Explicit `"off"` on the main model's finalize turn (and any caller passing `reasoning:"off"`): anthropic budget models now receive `thinking:{type:"disabled"}` (was: no key); deepseek-format models receive `thinking:{type:"disabled"}` (was: no key); openrouter/together-format models receive `reasoning:{enabled:false}` (was: no key); stock-openai-format and Responses-lane models with a declared `thinkingLevelMap.off` receive that spelling as `reasoning_effort` / `reasoning.effort` (was: no key; without the mapping still no key). Unset requests are byte-identical to 7.6.1.
+
+### Added (#618)
+- `AUTO_MODE_CLASSIFIER_MAX_TOKENS`, `thinkingOffExpressible(model)`, `declaredOffSpelling(model)`, `type OffCapabilityModel`, `type AutoModeClassified`, `AutoModeDeciderOptions.onClassified`, trace frame kind `auto_mode.classified`.
+
+### Known limit (ticketed, not fixed here)
+- The off-capability table reads the WIRE's ability to say off; a thinking-only model served through a format that has a disable key (a Qwen thinking-only build, a mandatory-reasoning model behind openrouter/together) ignores that key, so its classifier still gets the 256-token cap and fails the verdict contract. The per-model fact the compat declaration would need (`mandatoryReasoning` / a classifier-specific budget knob) is a follow-up.
 
 ## 7.6.1 — 2026-09-07
 

package/dist/agents/agent-transcript-tool.js

@@ -6,14 +6,14 @@ import { inlineUntrusted } from "../core/untrusted-text.js";
 import { stepsFromMessages } from "./subagent-steps.js";
 import { REPORT_FIELD_MAX } from "./subagent.js";
 import { getSessionRetainLedger } from "./retain-ledger.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 export const AGENT_TRANSCRIPT_TOOL_NAME = "AgentTranscript";
 const AGENT_TRANSCRIPT_DEFAULT_N = 20;
 const AGENT_TRANSCRIPT_MAX_N = 50;
 export function createAgentTranscriptTool(opts) {
     return defineTool({
         name: AGENT_TRANSCRIPT_TOOL_NAME,
-        contract: { contractId: "core.agent_transcript@1", implementationRevision: "1" },
-        effect: "read",
+        ...toolFace("agent-transcript"),
         description: `Read the recent tool steps of a background agent you launched (task_id 'a…' from the Agent tool with ` +
             `run_in_background), so you can see precisely where it got to — useful before SendMessage-ing a follow-up, ` +
             `or to inspect a stopped agent's tail. Returns the last N steps (tool, target, outcome); it does not re-run ` +

package/dist/agents/list-agents-tool.js

@@ -4,15 +4,14 @@ import { inlineUntrusted } from "../core/untrusted-text.js";
 import { formatPeerNameRef } from "./cross-session-ref.js";
 import { entryAccessible } from "./roster-store.js";
 import { mintPeerSessionCandidates, peerSessionBoxHandle } from "./peer-directory.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 export const LIST_AGENTS_TOOL_NAME = "ListAgents";
 export const LIST_AGENTS_TOOL_ALIAS = "ListPeers";
 export const LIST_AGENTS_MAX_RESULT_CHARS = 10_000;
 export function createListAgentsTool(opts) {
     return defineTool({
         name: LIST_AGENTS_TOOL_NAME,
-        aliases: [LIST_AGENTS_TOOL_ALIAS],
-        contract: { contractId: "core.list_agents@1", implementationRevision: "1" },
-        effect: "read",
+        ...toolFace("list-agents"),
         isConcurrencySafe: () => true,
         description: `List the agents and peer sessions you can message with SendMessage. Peer sessions are other sessions of this ` +
             `engine running for the same user on this machine, shown as \`name [ref]\`; send to one with its name (or \`name [ref]\` ` +

package/dist/agents/observer.js

@@ -2,6 +2,7 @@ import { Type } from "typebox";
 import { defineTool } from "../core/tools.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
 import { escapeEnvelopeTag } from "../core/untrusted-text.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 export const OBSERVER_EVENT_TAGS = ["tool-call", "user-message", "tool-result", "turn-ended"];
 const TAG_ESCAPE_RE = new RegExp(`<(?=/?(?:${OBSERVER_EVENT_TAGS.join("|")})(?:[>\\s/]|$))`, "gi");
 export function escapeObserverTags(text) {
@@ -377,9 +378,8 @@ export function frameObserverReport(observerAgentName, report) {
 export function createObserverReportToolSpec(opts) {
     return {
         name: OBSERVER_REPORT_TOOL_NAME,
-        contract: { contractId: "core.observer_report@1", implementationRevision: "1" },
+        ...toolFace("observer-report"),
         description: OBSERVER_REPORT_DESCRIPTION,
-        effect: "write",
         parameters: Type.Object({
             report: Type.String({
                 minLength: 1,

package/dist/agents/peer-admission.d.ts

@@ -78,7 +78,7 @@ export interface PeerIdentity {
     ownTokens: string[];
 }
 /**
- * design/176 §4.1 — the LATE-BOUND self-identity carrier ({@link import("../core/runner/prepare-task.js").RunInternals}`.peerSelfRef`).
+ * design/176 §4.1 — the LATE-BOUND self-identity carrier ({@link import("../core/runner/contracts.js").RunInternals}`.peerSelfRef`).
  * A ref (same family as `ownOrgAdmissionRef`): revival replays a spread COPY of spawn-time
  * internals, so a plain field would freeze at its spawn value; and a root run's session axis only
  * exists once `prepareTask` acquires the session — no single assembly point can synthesize the full

package/dist/agents/send-message-tool.js

@@ -14,6 +14,7 @@ import { neutralizePeerBody } from "./cross-session-envelope.js";
 import { SUBAGENT_RESUME_CAP, SubagentRetainLedger, getSessionRetainLedger } from "./retain-ledger.js";
 import { createSubagentResume } from "./subagent.js";
 import { appendHopToken, judgePeerAdmission, peerAxisToken, resolvePeerAdmissionConfig, PEER_MESSAGE_NOTICE, } from "./peer-admission.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 export const SEND_MESSAGE_TOOL_NAME = "SendMessage";
 let uplinkSeqGlobal = Date.now();
 const UPLINK_RESULT_MAX = 8000;
@@ -134,7 +135,7 @@ export function createSendMessageTool(opts) {
     };
     return defineTool({
         name: SEND_MESSAGE_TOOL_NAME,
-        contract: { contractId: "core.send_message@1", implementationRevision: "1" },
+        ...toolFace("send-message"),
         executionMode: "parallel",
         description: `Send a follow-up message to a previously spawned background agent. ` +
             `Your plain text output is NOT visible to other agents — to communicate, you MUST call this tool. Messages addressed to you are delivered automatically; you don't check an inbox. ` +

package/dist/agents/subagent-steps.js

@@ -1,8 +1,9 @@
 import { redactSecrets } from "../core/untrusted-egress.js";
+import { isProtectedWrite } from "../core/tool-registry.js";
+import { writeTargetPath } from "../tools/fs/safety.js";
 export const STEP_CAP = 10;
 const FIELD_MAX = 80;
 const EDITED_FILES_CAP = 32;
-const EDITING_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 function firstLine(s) {
     const nl = s.indexOf("\n");
     return nl === -1 ? s : s.slice(0, nl);
@@ -57,10 +58,10 @@ export function extractTarget(args) {
     }
 }
 function editTargetPath(toolName, args) {
-    if (!EDITING_TOOLS.has(toolName) || args === null || typeof args !== "object")
+    const call = { toolName, args };
+    if (!isProtectedWrite(call) || args === null || typeof args !== "object")
         return undefined;
-    const a = args;
-    const p = a.file_path ?? a.path ?? a.notebook_path;
+    const p = writeTargetPath(call);
     return typeof p === "string" && p.length > 0 ? p : undefined;
 }
 function outputFirstLine(output) {

package/dist/agents/subagent.js

@@ -60,6 +60,7 @@ import { recordRosterSpawn } from "./roster-store.js";
 import { LAUNCH_RECEIPT_OWN_WORDS_CLAUSE, launchReceiptNoQuoteClause } from "./launch-receipt-contract.js";
 import { ObserverDigestTap, ObserverPairing, createObserverReportToolSpec, markObserverTaskId, unmarkObserverTaskId, isObserverTaskId, ObserverResumeStateError, ObserverStoppedByUserError, observerFramingPrompt, observerSlug, resolveObserverDeclaration, } from "./observer.js";
 import { SubagentStepRecorder } from "./subagent-steps.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 const BG_AGENT_RESULT_MAX = 4_000;
 const BG_AGENT_RESULT_FULL_MAX = 200_000;
 function resultSettleFields(result) {
@@ -243,7 +244,6 @@ function createToolStatsCounter(delegationToolName) {
                         t.bashCount++;
                         break;
                     case "Edit":
-                    case "MultiEdit":
                         t.editFileCount++;
                         recordEditLines(args);
                         break;
@@ -1392,13 +1392,12 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
         }));
     return {
         name: opts.name ?? DEFAULT_SUBAGENT_TOOL_NAME,
+        ...toolFace("agent"),
         agentListing,
         agentToolFaces,
         ...(agentToolPool !== undefined ? { agentToolPool } : {}),
-        contentOrigin: "local",
         ...(rosterNames !== undefined ? { agentModels: rosterNames } : {}),
         executionMode: "parallel",
-        contract: { contractId: "core.agent@1", implementationRevision: "1" },
         description: `Launch a new agent to handle complex, multi-step tasks. Each agent type has specific capabilities and tools available to it.\n` +
             (opts.purpose ? `\nThis sub-agent is for: ${opts.purpose}.\n` : "") +
             (hasAgents ? `\nAvailable agent types are listed in <system-reminder> messages in the conversation.\n` : "") +

package/dist/brain/anthropic.js

@@ -276,9 +276,11 @@ export function createAnthropicBrain(config = {}) {
                     body.temperature = options.temperature;
                 }
                 let builtReasoningFacts;
+                let thinkingOn = false;
                 if (reasoningRequestCarried(model, options?.reasoning)) {
                     if (anthCompat.thinkingMode === "adaptive") {
                         body.thinking = { type: "adaptive" };
+                        thinkingOn = true;
                     }
                     else {
                         const hardCap = overrides?.maxOutputTokens !== undefined || options?.maxTokens !== undefined;
@@ -292,11 +294,15 @@ export function createAnthropicBrain(config = {}) {
                             const { max, budget } = thinkingBudget(body.max_tokens, share, config.thinkingBudgetTokens, hardCap);
                             body.max_tokens = max;
                             body.thinking = { type: "enabled", budget_tokens: budget };
+                            thinkingOn = true;
                         }
                     }
-                    if (body.thinking !== undefined)
+                    if (thinkingOn)
                         delete body.temperature;
                 }
+                else if (model.reasoning && options?.reasoning === "off" && anthCompat.thinkingMode !== "adaptive") {
+                    body.thinking = { type: "disabled" };
+                }
                 const betas = [];
                 let sendEffortBeta = false;
                 const declaredEffort = declaredEffortLevels(anthCompat.effortLevels);
@@ -308,7 +314,7 @@ export function createAnthropicBrain(config = {}) {
                 }
                 if (sendEffortBeta)
                     betas.push("effort-2025-11-24");
-                if (anthCompat.contextManagement && body.thinking !== undefined) {
+                if (anthCompat.contextManagement && thinkingOn) {
                     body.context_management = { edits: [{ type: "clear_thinking_20251015", keep: "all" }] };
                     betas.push("context-management-2025-06-27");
                 }

package/dist/brain/open-responses.js

@@ -7,7 +7,7 @@ import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
 import { OUTPUT_CAP_KEYS, RESPONSES_RESERVED, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders } from "./request-params.js";
 import { adjudicateModelRoute, applyRouteCredentialHeaders, createBrainRouteJudge, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
-import { mintEffortWireValue, reasoningRequestCarried } from "./reasoning.js";
+import { declaredOffSpelling, mintEffortWireValue, reasoningRequestCarried } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
 const DEGENERATE_POLL_CHARS = 64;
 const MALFORMED_SAMPLE_CHARS = 160;
@@ -152,11 +152,13 @@ function toResponsesTools(ctx) {
     }));
 }
 function resolveWireEffort(model, reasoning) {
-    if (!reasoningRequestCarried(model, reasoning))
-        return undefined;
+    if (model.reasoning && reasoning === "off")
+        return declaredOffSpelling(model);
     const compat = responsesCompat(model);
     if (compat.supportsReasoningEffort === false)
         return undefined;
+    if (!reasoningRequestCarried(model, reasoning))
+        return undefined;
     return mintEffortWireValue(reasoning, model, compat.reasoningEffortLevels).wireValue;
 }
 function computeUsage(model, raw) {

package/dist/brain/openai.js

@@ -8,7 +8,7 @@ import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNot
 import { OPENAI_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders } from "./request-params.js";
 import { BrainError } from "./errors.js";
 import { adjudicateModelRoute, applyRouteCredentialHeaders, createBrainRouteJudge, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
-import { mintEffortWireValue, reasoningRequestCarried } from "./reasoning.js";
+import { declaredOffSpelling, mintEffortWireValue, reasoningRequestCarried } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
 function closeToolCallAccum(acc) {
     if (acc.closedTc)
@@ -78,13 +78,36 @@ function thinkingCompat(model) {
 }
 function applyThinking(body, model, reasoning) {
     if (model.reasoning && reasoning === "off") {
-        const offFormat = thinkingCompat(model).thinkingFormat ?? "openai";
-        if (offFormat === "qwen" || offFormat === "zai") {
-            body.enable_thinking = false;
-        }
-        else if (offFormat === "qwen-chat-template") {
-            const k = (typeof body.chat_template_kwargs === "object" && body.chat_template_kwargs) || {};
-            body.chat_template_kwargs = { ...k, enable_thinking: false };
+        const offCompat = thinkingCompat(model);
+        const offFormat = offCompat.thinkingFormat ?? "openai";
+        switch (offFormat) {
+            case "qwen":
+            case "zai":
+                body.enable_thinking = false;
+                break;
+            case "qwen-chat-template": {
+                const k = (typeof body.chat_template_kwargs === "object" && body.chat_template_kwargs) || {};
+                body.chat_template_kwargs = { ...k, enable_thinking: false };
+                break;
+            }
+            case "deepseek":
+                body.thinking = { type: "disabled" };
+                break;
+            case "openrouter":
+            case "together":
+                body.reasoning = { enabled: false };
+                break;
+            case "openai": {
+                const offSpelling = declaredOffSpelling(model);
+                if (offSpelling !== undefined)
+                    body.reasoning_effort = offSpelling;
+                break;
+            }
+            default: {
+                const _exhaustive = offFormat;
+                void _exhaustive;
+                break;
+            }
         }
         return;
     }

package/dist/brain/reasoning.d.ts

@@ -104,6 +104,38 @@ export declare const MIN_THINKING_TOKENS = 1024;
  * host the budget instead (`hardCap === false`).
  */
 export declare function budgetCapSkipsThinking(outputCapTokens: number, hardCap: boolean): boolean;
+/** The model slice the off-capability reads: the API family, the reasoning bit, the compat declaration and the levelmap. */
+export interface OffCapabilityModel {
+    api?: string;
+    reasoning?: boolean;
+    compat?: unknown;
+    thinkingLevelMap?: Readonly<Partial<Record<ThinkingLevel, string | null>>>;
+}
+/**
+ * The DEPLOYMENT-declared spelling of the explicit "off" tier on an effort-only wire (stock openai
+ * completions, the Responses lane): `thinkingLevelMap.off` as a non-empty string (a provider's own
+ * "none" tier), on an endpoint that takes an effort value at all (`supportsReasoningEffort` not
+ * false) — else `undefined`: there is nothing to send. The effort formats have no disable key, and an
+ * effort VALUE is never off (it enables reasoning at that tier), so off on those wires is spelled only
+ * when the deployment says how. The two appliers and {@link thinkingOffExpressible} read this ONE
+ * function, so what the wire carries and what the capability table claims cannot disagree.
+ */
+export declare function declaredOffSpelling(model: OffCapabilityModel): string | undefined;
+/**
+ * Whether this model's wire can SAY "off". A model that does not reason at all (`reasoning` falsy)
+ * never thinks, so off is trivially expressible. Otherwise, per wire: the anthropic budget form spells
+ * `{type:"disabled"}` (the ADAPTIVE form rejects it — those models think on every request); deepseek
+ * `{type:"disabled"}`, the binary enable keys at `false`, openrouter/together `reasoning:{enabled:false}`
+ * all say it; the effort-only wires (stock openai completions, the Responses lane) say it only through
+ * a deployment-declared off spelling ({@link declaredOffSpelling}).
+ *
+ * A caller that sizes an output cap for an ANSWER alone (the auto-mode classifier's block-verdict
+ * contract) applies the cap only when this is true: a model that will think regardless cannot have its
+ * cap derived from the answer's contract, and keeps its own budget. What this table cannot see is a
+ * model that IGNORES its wire's disable key (a thinking-only build served through a format that has
+ * one) — that is a per-model fact the compat declaration does not yet carry.
+ */
+export declare function thinkingOffExpressible(model: OffCapabilityModel): boolean;
 /**
  * OPTIONAL per-request facts for {@link resolveReasoning} — what the wire's budget arm knows at
  * request build that a per-leg eager resolution cannot: the resolved output cap and whether it is a

package/dist/brain/reasoning.js

@@ -23,6 +23,24 @@ export const MIN_THINKING_TOKENS = 1024;
 export function budgetCapSkipsThinking(outputCapTokens, hardCap) {
     return hardCap && outputCapTokens < MIN_THINKING_TOKENS * 2;
 }
+export function declaredOffSpelling(model) {
+    const compat = (model.compat ?? {});
+    if (compat.supportsReasoningEffort === false)
+        return undefined;
+    const mapped = model.thinkingLevelMap?.off;
+    return typeof mapped === "string" && mapped !== "" ? mapped : undefined;
+}
+export function thinkingOffExpressible(model) {
+    if (!model.reasoning)
+        return true;
+    const compat = (model.compat ?? {});
+    if (model.api === "anthropic-messages")
+        return compat.thinkingMode !== "adaptive";
+    if (model.api !== undefined && RESPONSES_APIS.has(model.api))
+        return declaredOffSpelling(model) !== undefined;
+    const format = compat.thinkingFormat ?? "openai";
+    return format === "openai" ? declaredOffSpelling(model) !== undefined : true;
+}
 export function declaredEffortLevels(v) {
     return Array.isArray(v) && v.length > 0 ? v : undefined;
 }

package/dist/core/ask-question.js

@@ -3,6 +3,7 @@ import { uuidv7 } from "../engine/session/uuid.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { defineTool, errorResult } from "./tools.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
+import { toolFace } from "./tool-catalog-entries.js";
 export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
 export function classifyQuestionOutcome(outcome) {
     let unavailable;
@@ -170,7 +171,7 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
     const continuationCard = askQuestionContinuationCard;
     return defineTool({
         name: ASK_USER_QUESTION_TOOL_NAME,
-        contract: { contractId: "core.ask_user_question@1", implementationRevision: "1" },
+        ...toolFace("ask-user-question"),
         description: "Ask the user a structured multiple-choice question when you are genuinely stuck or a decision is " +
             "the user's to make (which approach, which of these). Provide 1-4 questions, each with 2-4 options " +
             "(label + description). Use sparingly — not for anything you can determine yourself from the code or " +
@@ -226,7 +227,6 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
                 })),
             }), { minItems: 1, maxItems: 4, description: "Questions to ask the user (1-4 questions)" }),
         }),
-        effect: "read",
         executionMode: "sequential",
         execute: async (args, ctx) => {
             const { questions } = args;

package/dist/core/auto-mode-defaults.d.ts

@@ -6,6 +6,22 @@ export declare const AUTO_MODE_DEFAULT_FAILURE_THRESHOLD = 3;
 export declare const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
 /** Per-entry excerpt cap when `AutoModeWindowOptions.maxCharsPerEntry` is omitted. */
 export declare const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2000;
+/**
+ * The classifier call's output cap (`maxTokens`), sized from the engine's OWN output contract rather
+ * than copied from upstream: the parser (`parseAutoModeResponse`) accepts exactly two shapes,
+ * `<block>no</block>` and `<block>yes</block><category>NAME</category><reason>[NAME] one short
+ * sentence</reason>`. The longest rule name in the shipped rule sets is 46 characters and the reason
+ * is one short sentence naming that rule (≈200 characters at the outside, more when several rules
+ * match and the others are named in the reason), so the longest LEGAL reply is ≈350 characters —
+ * ≈120 tokens at the conservative 3 chars/token that tag-heavy text tokenizes at, ≈150 with a
+ * second and third rule name in the reason. Doubled for margin: a truncated block verdict still
+ * parses as a block (the parser tolerates a missing tail), a truncated allow does not exist (it is
+ * seven tokens), and the cap's job is to make a model that ignores the "no preamble" instruction —
+ * or that reasons in-text — cost a bounded, quickly-detected contract failure instead of a slow one.
+ * Paired with `reasoning:"off"` at the call: the cap hosts the ANSWER, so it applies only where the
+ * wire can say off (`thinkingOffExpressible`); a model that thinks regardless keeps its own budget.
+ */
+export declare const AUTO_MODE_CLASSIFIER_MAX_TOKENS = 256;
 /** The sentinel a deployment puts INSIDE a paired rule list to splice the CC default rules back in at
  *  that position (CC `XYt = "$defaults"`). It lives here, beside the other defaults, because the #503
  *  recipe canonicalizer needs its VALUE and must not load the assembly face (and its SHA-locked assets)

package/dist/core/auto-mode-defaults.js

@@ -2,6 +2,7 @@ export const AUTO_MODE_DEFAULT_TIMEOUT_MS = 15_000;
 export const AUTO_MODE_DEFAULT_FAILURE_THRESHOLD = 3;
 export const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
 export const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2_000;
+export const AUTO_MODE_CLASSIFIER_MAX_TOKENS = 256;
 export const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
 export const AUTO_MODE_DENIAL_LIMIT_DEFAULTS = Object.freeze({ maxConsecutive: 3, maxTotal: 20 });
 export const AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS = 120_000;

package/dist/core/auto-mode.d.ts

@@ -70,6 +70,25 @@ export interface AutoModeDeciderOptions {
         consecutiveFailures: number;
         lastCause: string;
     }) => void;
+    /**
+     * Fired once per `decide` call with the verdict the gate is about to act on and the wall time it
+     * waited (`ms`, integer ≥ 0; a timed-out round reads the deadline; a breaker-open short-circuit
+     * reads ~0 with `cause:"breaker_open"`). `cause` is present iff the verdict is `unavailable`. The
+     * engine's own wiring turns this into the `auto_mode.classified` trace frame; a hand-built decider
+     * need not implement it. Like the breaker alarm, a throwing hook never breaks the gate.
+     */
+    onClassified?: (info: AutoModeClassified) => void;
+}
+/** What {@link AutoModeDeciderOptions.onClassified} receives — one record per decision. */
+export interface AutoModeClassified {
+    /** The gated call the decision was about (`AutoModeClassifyInput.req.toolCallId`). */
+    toolCallId: string;
+    /** Wall-clock milliseconds between the decide call and its verdict. */
+    ms: number;
+    verdict: AutoModeVerdict["kind"];
+    cause?: Extract<AutoModeVerdict, {
+        kind: "unavailable";
+    }>["cause"];
 }
 export interface AutoModeDecider {
     /** Never rejects. Any internal failure surfaces as `unavailable`/`parse_error` (fail-closed). */