@sema-agent/core 7.6.3 → 7.8.0

package/dist/core/runner/active-skill-scope.js

@@ -1,4 +1,5 @@
-import { canonicalizeTarget, fileArgPath } from "../../tools/fs/safety.js";
+import { canonicalizeTarget } from "../../tools/fs/safety.js";
+import { pathTargetValue } from "../tool-registry.js";
 import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
 import { parseSkillToolEntry, skillSpecifierRejection } from "../skill-tool-specifier.js";
 export class ActiveSkillScope {
@@ -74,7 +75,9 @@ export function createActiveSkillScopePolicy(opts) {
                 }
             }
             const pathConstrainingActive = manifests.some((m) => m.allowPaths && m.allowPaths.length > 0);
-            if (pathConstrainingActive && !PATH_WRITE_TOOLS.has(toolName)) {
+            const declaredTarget = req.face?.pathTarget;
+            const skillScopeEligible = declaredTarget !== undefined && declaredTarget.skillScopeEligible === true;
+            if (pathConstrainingActive && !skillScopeEligible) {
                 const eff = toolEffects?.get(toolName) ?? "write";
                 if (eff !== "read") {
                     const ids = manifests.filter((m) => m.allowPaths?.length).map((m) => m.lineageId).join(", ");
@@ -85,10 +88,10 @@ export function createActiveSkillScopePolicy(opts) {
                     };
                 }
             }
-            if (PATH_WRITE_TOOLS.has(toolName)) {
+            if (skillScopeEligible) {
                 const constraining = manifests.filter((m) => m.allowPaths && m.allowPaths.length > 0);
                 if (constraining.length > 0) {
-                    const path = fileArgPath(req.args);
+                    const path = pathTargetValue(req.args, declaredTarget);
                     if (typeof path !== "string" || path.length === 0) {
                         return {
                             action: "deny",

package/dist/core/runner/clock-and-limits.d.ts

@@ -0,0 +1,117 @@
+/**
+ * The run loop's CLOCK and LIMIT machinery — the pieces that turn a budget, a deadline or a ceiling into
+ * something a lane can act on, shared by the turn boundary, the run body and the end-of-task lane:
+ *  · the limit-approach frames (budget-measured, advisory) and the turn-cap read;
+ *  · the governance-read budget against the environment's suspend deadline, the chunked absolute-deadline
+ *    race that enforces it, and the never-abandoned ledger charge with its slow-settle disclosure;
+ *  · the typed terminal for an external stop cause that could not be suspended durably;
+ *  · the once-per-task disclosure of an auto-compaction trigger that cannot be evaluated (a WeakSet keyed
+ *    on the task's `Prepared`, so the latch dies with the task and never touches the contract surface);
+ *  · the hard walltime backstop timer, chunked past the largest delay a timer honours.
+ *
+ * Every clock read is `Date.now()` or a timer; every host read is through the arguments a caller hands in.
+ * Layer-1 machinery rather than a driven lane — initial-run-state.ts says why no run-loop machinery module
+ * wears a family prefix.
+ */
+import { type AgentHarness } from "../../internal/harness.js";
+import type { PlatformLimitReason } from "../checkpoint-store.js";
+import type { TaskSpec } from "../types.js";
+import type { Prepared } from "./contracts.js";
+/**
+ * design/164 — the LIMIT-APPROACH frames, the successor to the retired deadline-nudge family. Two facts
+ * make them a different mechanism, not a rename:
+ *  - they are measured in BUDGET (the tightest armed axis's fill ratio), not in wall-clock, so they need
+ *    no throughput estimate and cannot mis-fire on a starved event loop;
+ *  - they are ADVISORY. Neither frame stops anything; the run ends when a ceiling is actually crossed.
+ *
+ * Rendered by {@link limitApproachFrames}; registered in the prompt-assembly event registry under
+ * `limit_approach_converge` / `limit_approach_deliver`.
+ */
+export declare const LIMIT_APPROACH_DEFAULT_THRESHOLDS: readonly [number, number];
+/** The output-token figure the pre-call worst-case assumes when the model declares no cap of its own.
+ *  Shared by the $ and token arms so the two gates cannot disagree about the same hypothetical call. */
+export declare const DEFAULT_PRECALL_OUTPUT_TOKENS = 4096;
+/** The two frame bodies, indexed by how many have already been sent (0 → converge, 1 → deliver now). */
+export declare function limitApproachFrames(index: 0 | 1, axis: string, percent: number, mark: string | undefined): string;
+/**
+ * Resolve the effective turn cap. `undefined` = no turn cap; `0` (explicit) = unbounded.
+ *
+ * design/164: this is now a pure read of what the caller wrote. The two clauses it used to carry —
+ * "a wall-clock bound was set, so drop the turn cap" and "neither was set, so apply the engine's
+ * safety net" — are both gone: the axes no longer interact (each binds on its own), and there is no
+ * engine-side net to apply. A task with no `maxTurns` has no turn ceiling.
+ */
+export declare function resolveMaxTurns(limits?: {
+    maxTurns?: number;
+}): number | undefined;
+/**
+ * How long past the environment's suspend deadline the turn-boundary lane will keep waiting for the
+ * usage ledger's READ.
+ *
+ * The precedence ruling (usage_window > env_lifetime) means the ledger must be read BEFORE the env
+ * cause can be adopted — you cannot rank a cause you have not read. But that read is store I/O with no
+ * bound of its own, and past this instant every millisecond it spends is spent out of the margin that
+ * exists to mint the env checkpoint. A stalled ledger must not cost a deployment the checkpoint it
+ * could still have had, so the read runs against an ABSOLUTE deadline (`envLifetimeSuspendAt + this`)
+ * and a run that gets no answer by then stops for the cause it can still prove.
+ *
+ * 5s against the 60s suspend margin: two orders of magnitude above any healthy ledger read (in-memory
+ * and file stores answer in ms; a remote one in tens of ms), and it still leaves 55s — more than the
+ * margin was sized for — to pause the workspace, mint the checkpoint and commit it. Not a knob: it is a
+ * fraction of an engine constant, and a deployment that wants a wider band declares a shorter lifetime.
+ *
+ * ABSOLUTE, never a fresh per-boundary allowance: a boundary that finds the deadline one millisecond
+ * away must not hand a stalled ledger the whole margin, and a boundary that is already overdue must get
+ * LESS than the budget, not the same. {@link raceUntilDeadline} is what keeps that true for a deadline
+ * of any distance, without an unrepresentable timer.
+ */
+export declare const ENV_DUE_GOVERNANCE_READ_BUDGET_MS = 5000;
+export declare const GOVERNANCE_READ_STALLED: unique symbol;
+/** Await a ledger charge, firing `onSlow` ONCE if it has not settled after
+ *  {@link CHARGE_SETTLE_DISCLOSE_MS}. The charge itself is always awaited to completion. */
+export declare function awaitChargeWithSlowDisclosure<T>(charge: Promise<T>, onSlow: () => void, discloseAfterMs?: number): Promise<T>;
+/**
+ * Await `p` until the absolute epoch `deadline`, then give up with {@link GOVERNANCE_READ_STALLED}.
+ *
+ * Chunked, and deliberately so: the deadline is derived from a caller-declared environment lifetime, so
+ * the distance to it can exceed {@link MAX_TIMER_DELAY_MS} — a single timer armed for that distance
+ * would fire at once and abandon a perfectly healthy read. Each chunk re-reads the wall clock, so the
+ * decision is always made against the deadline itself rather than against an allowance computed once.
+ *
+ * Exported for its own unit pin (the same posture as the brain-call guardrail primitive): the
+ * behaviors below are clock behaviors, and only a virtual clock can assert them without spending the
+ * wall-clock time they describe. Not re-exported from the package index.
+ *
+ * An already-overdue deadline still gets ONE zero-delay pass: a promise that is settled (or settles in a
+ * microtask, which is every in-process store) must be allowed to win, because giving up on an answer we
+ * already hold would be a fabricated stall. The second pass is what makes the loop terminate.
+ */
+export declare function raceUntilDeadline<T>(p: Promise<T>, deadline: number): Promise<T | typeof GOVERNANCE_READ_STALLED>;
+/**
+ * design/164 件四/件五 — the TYPED terminal for an external stop cause that could NOT be suspended durably.
+ * Carried on `rs.limits.platformTerminal` and adopted as the run's `threw`, so the caller reads the cause
+ * on `TaskResult.errorCode` (`errorCodeOf` lifts `.code`) instead of the anonymous error an abort produces.
+ * `retryAfterMs` rides the error object because a wait hint has no `TaskResult` seat — a host reads it from
+ * the `RunnerDeps.onError` sink this is also delivered to.
+ */
+export declare function platformLimitTerminal(reason: PlatformLimitReason, retryAfterMs: number | undefined, moment?: "entry" | "turn_boundary" | "resume"): Error & {
+    code: string;
+    retryAfterMs?: number;
+};
+export declare function discloseUnevaluableWindow(u: {
+    estTokens: number;
+    windowField: string;
+    windowValue?: number;
+    modelId?: string;
+}, prepared: Prepared, tracer: TaskSpec["tracer"], taskId: string, onError: ((err: unknown, context: {
+    phase: "config";
+    sessionId: string;
+}) => void) | undefined): void;
+/** 1.296 件2a — report the hard-abort timer's lateness on `task.end` only above this bar: sub-5s
+ *  jitter is ordinary scheduling noise (GC pauses, sync work) and would only add trace lint. */
+export declare const TIMER_LATENESS_REPORT_MS = 5000;
+export declare function startTimeout(harness: AgentHarness, abortController: AbortController, remainingMs?: number, softSuspendable?: boolean): {
+    fired: boolean;
+    latenessMs?: number;
+    clear: () => void;
+};

package/dist/core/runner/clock-and-limits.js

@@ -0,0 +1,118 @@
+import {} from "../../internal/harness.js";
+import { openSystemReminder } from "../reminder-mint.js";
+import { emitTrace } from "../trace.js";
+export const LIMIT_APPROACH_DEFAULT_THRESHOLDS = [0.8, 0.95];
+export const DEFAULT_PRECALL_OUTPUT_TOKENS = 4096;
+export function limitApproachFrames(index, axis, percent, mark) {
+    return index === 0
+        ? `${openSystemReminder(mark)}[limit approach] This task has used about ${percent}% of its ${axis}. ` +
+            `Start converging: finish the step you are on, drop work that is not required for the deliverable, and ` +
+            `avoid starting anything you cannot complete within what is left.</system-reminder>`
+        : `${openSystemReminder(mark)}[limit approach] About ${percent}% of the ${axis} is gone. Deliver now: ` +
+            `stop exploring, write up what you have — including what is incomplete and what you would do next — ` +
+            `and end the task. Work that is not reported before the allowance runs out is lost.</system-reminder>`;
+}
+export function resolveMaxTurns(limits) {
+    return limits?.maxTurns;
+}
+export const ENV_DUE_GOVERNANCE_READ_BUDGET_MS = 5_000;
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
+const DEADLINE_TICK = Symbol("deadline-tick");
+export const GOVERNANCE_READ_STALLED = Symbol("governance-read-stalled");
+const CHARGE_SETTLE_DISCLOSE_MS = 10_000;
+export async function awaitChargeWithSlowDisclosure(charge, onSlow, discloseAfterMs = CHARGE_SETTLE_DISCLOSE_MS) {
+    let timer = setTimeout(() => {
+        timer = undefined;
+        try {
+            onSlow();
+        }
+        catch {
+        }
+    }, discloseAfterMs);
+    try {
+        return await charge;
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+export async function raceUntilDeadline(p, deadline) {
+    for (let firstPass = true;; firstPass = false) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0 && !firstPass)
+            return GOVERNANCE_READ_STALLED;
+        let timer;
+        const tick = new Promise((res) => {
+            timer = setTimeout(() => res(DEADLINE_TICK), Math.max(0, Math.min(remaining, MAX_TIMER_DELAY_MS)));
+        });
+        const out = await Promise.race([p, tick]).finally(() => clearTimeout(timer));
+        if (out !== DEADLINE_TICK)
+            return out;
+    }
+}
+export function platformLimitTerminal(reason, retryAfterMs, moment = "turn_boundary") {
+    const message = moment === "entry"
+        ? `a deployment usage window is exhausted (RunnerDeps.usageWindows), so the task was refused before its first model call — nothing ran and nothing was spent. There is no checkpoint to suspend into at this point, so the caller re-submits after the window frees, in ${String(retryAfterMs ?? 0)}ms.`
+        : moment === "resume"
+            ? `a deployment usage window is exhausted (RunnerDeps.usageWindows), so the resumed leg was stopped BEFORE its first model call — nothing was delivered or executed on this leg. The window frees in ${String(retryAfterMs ?? 0)}ms.`
+            : reason === "env_lifetime"
+                ? "the execution environment's declared lifetime is expiring and the run could not be suspended durably (not eligible, or the suspend was refused — see remoteEnvFailures / onError). It was stopped at a clean turn boundary instead of being killed mid-turn when the platform reclaims the environment."
+                : `a deployment usage window is exhausted (RunnerDeps.usageWindows) and the run could not be suspended durably, so it was stopped at a clean turn boundary. The window frees in ${String(retryAfterMs ?? 0)}ms.`;
+    const e = new Error(message);
+    e.code = reason === "env_lifetime" ? "env.lifetime_expired" : "usage.window_exhausted";
+    if (retryAfterMs !== undefined)
+        e.retryAfterMs = retryAfterMs;
+    return e;
+}
+const disclosedUnevaluableWindow = new WeakSet();
+export function discloseUnevaluableWindow(u, prepared, tracer, taskId, onError) {
+    if (disclosedUnevaluableWindow.has(prepared))
+        return;
+    disclosedUnevaluableWindow.add(prepared);
+    emitTrace(tracer, () => ({ kind: "compaction.unevaluable", version: 1, taskId, estTokens: u.estTokens, ts: Date.now() }));
+    const modelClause = u.modelId !== undefined ? ` "${u.modelId}"` : "";
+    const cause = u.windowValue !== undefined
+        ? `its \`${u.windowField}\` is ${u.windowValue}, which is not a positive number of tokens — that field takes precedence over the ` +
+            `others, so fixing or removing it is what restores the threshold`
+        : `it declares no context window at all (\`autoCompactTokens\` / \`contextTokens\` / \`contextWindow\` are all absent) — declare one to restore the threshold`;
+    try {
+        onError?.(new Error(`auto-compaction cannot run for model${modelClause}: ${cause}. Until then there is no threshold to compare against, so the ` +
+            `context will grow until the provider refuses the request. The conversation is already about ${u.estTokens} estimated tokens.`), { phase: "config", sessionId: prepared.sessionId });
+    }
+    catch {
+    }
+}
+const WALLTIME_SUSPEND_GRACE_SEC = 120;
+export const TIMER_LATENESS_REPORT_MS = 5_000;
+export function startTimeout(harness, abortController, remainingMs, softSuspendable = false) {
+    const state = { fired: false, clear: () => { } };
+    if (remainingMs !== undefined) {
+        const hardMs = Math.max(0, remainingMs + (softSuspendable ? WALLTIME_SUSPEND_GRACE_SEC * 1000 : 0));
+        const scheduledAtMs = Date.now() + hardMs;
+        let leftMs = hardMs;
+        let timer;
+        const armChunk = () => {
+            const chunk = Math.max(0, Math.min(leftMs, MAX_TIMER_DELAY_MS));
+            timer = setTimeout(() => {
+                leftMs -= chunk;
+                if (leftMs > 0) {
+                    armChunk();
+                    return;
+                }
+                fireHardAbort();
+            }, chunk);
+        };
+        const fireHardAbort = () => {
+            if (state.fired)
+                return;
+            state.fired = true;
+            state.latenessMs = Math.max(0, Date.now() - scheduledAtMs);
+            abortController.abort();
+            void harness.abort();
+        };
+        armChunk();
+        state.clear = () => clearTimeout(timer);
+    }
+    return state;
+}

package/dist/core/runner/compaction-call-options.d.ts

@@ -15,7 +15,7 @@ import type { Prepared } from "./contracts.js";
  * end-of-task lane's deliberate ABSENCE of `signal`) is a legitimate per-lane difference and stays at
  * the call site, where its reason is written down.
  *
- * Every export is a free function: the turn-boundary lane assembles its call inside `makeTurnBoundary`
+ * Every export is a free function: the turn-boundary lane assembles its call inside `createTurnBoundary`
  * (a module-level function with no `this`), so a method would not be reachable from all three sites.
  * Nothing here reads or writes runner state — pure assembly over `spec` + `Prepared`.
  */

package/dist/core/runner/contracts.d.ts

@@ -27,6 +27,7 @@ import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
 import type { ActorAssertion, Checkpoint, CheckpointState, CheckpointStore, CheckpointToken, PendingSteerEntry, PlatformLimitReason, ReopenReason, ResourceLedger, ResourceLimitReason, ResumeOutcome, SerializedCheckpointState } from "../checkpoint-store.js";
+import type { ExecutionOutcomeRecordWord } from "../checkpoint-execution-record.js";
 import type { ClearedProjectionLedger, ContextEditMachine, OccurrenceIndex } from "../context-edit.js";
 import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, PostToolBatchResult, ToolGateInput } from "../hooks.js";
 import type { MaterializedMcp } from "../mcp.js";
@@ -717,7 +718,10 @@ export interface Prepared {
      *  the human already adjudicated it). Same wrapping (offload + ctx) the harness runs with.
      *
      *  ONE array, mutated in place; identity is the contract (every closure that resolves a name at run time
-     *  reads this exact array). WRITER TABLE (design/238 R-3) — the only stations that write it, in prepare order:
+     *  reads this exact array). Since design/388 the array is PRIVATE to the `RosterBuilder` (tool-roster.ts) —
+     *  every station below writes through its verbs (`mount` / `mountAll` / `unmountWhere` / `replaceAt` /
+     *  `replaceDomain`) and this field is the builder's read face. WRITER TABLE (design/238 R-3) — the only
+     *  stations that write it, in prepare order:
      *   · caps-and-workflow — MINTS it (`spec.tools` through the ctx wrap + the large-result wrapper), then pushes
      *     ReportBlocked (enableBlockedReport ≠ false), ReportFindings (no caller tool of that name/alias),
      *     ExitPlanMode + EnterPlanMode (enablePlanMode ∧ the plan-review face), Workflow (self-orchestration active
@@ -739,7 +743,28 @@ export interface Prepared {
      *     memory session or a recorder channel); the refresh seam re-runs the same pass through `contentOriginWrapRef`
      *     after a re-splice (identity-tracked, so a wrapper is never wrapped again).
      *  tool-disclosure and listings only READ it (`harnessTools` is a derived list; placeholders never enter here). */
-    tools: AgentTool[];
+    tools: readonly AgentTool[];
+    /**
+     * design/388 §2.5 — this leg's minted TOOL ROSTER (the same object `wiringManifest.tools` carries):
+     * one row per mounted instance in wire order. Minted ONCE at the prompt-assembly station (the same
+     * pass that projects the prompt manifest's tool rows, so the two agree by construction); the park
+     * station reads the gated call's identity off it, the exemption probe hands it to the host.
+     */
+    toolRoster: import("../tool-roster.js").ToolRoster;
+    /**
+     * design/388 §2.5 — the run-time delta seat: every roster change after prepare (the RefreshMcpTools
+     * seam) re-mints the roster here and publishes a `ToolRosterDelta`. The run loop subscribes at the
+     * point it emits `wiring_manifest` and forwards each delta as a `tool_roster_delta` event; until it
+     * does, deltas are buffered in order.
+     */
+    toolRosterDeltas: import("../tool-roster.js").ToolRosterDeltaSeat;
+    /**
+     * design/388 L4 — the leg's `tool_end.structured` projector: the engine card set ∪ the caller rows' declared
+     * `renderHints.resultCards`; an undeclared `details.type` is dropped and announced ONCE per leg
+     * (`config.tool_card_undeclared`). The run loop's tool_end body projection reads it in place of the
+     * module-level `structuredFrom` (which has no announce seat).
+     */
+    structuredProjector: (result: unknown) => unknown;
     /** Name→effect map for every tool this task can call (design/44 §3). Used by the abort-path orphan
      *  reconcile (design/64 §9) to make interrupted tool_results effect-aware (read/idempotent = safe to
      *  repeat; write/unknown = outcome unknown). Unknown names default to `write` (conservative). */
@@ -1984,7 +2009,7 @@ export interface ParkAsk {
  * Grouped by lifecycle semantics per the B15 pre-recon partition. Function members start as inert
  * placeholders and are assigned at their ORIGINAL declaration sites (the original code could not
  * call them earlier either — TDZ proved it). Not on the npm face; this extraction is what enabled
- * makeTurnBoundary / makeHarnessHandlers (三期, both in runtask.ts).
+ * createTurnBoundary / createHarnessHandlers (三期, both in runtask.ts).
  */
 export interface RunState {
     telemetry: {
@@ -2196,6 +2221,15 @@ export interface ResumeRun {
      *  replay the persisted winner (a system retry of the approved action), while a `tool_unavailable` reopen
      *  lets a human re-decide with the tool present (a fresh decision is allowed — preserves P-7). */
     onEnvRestoreFailed?: (reason: ReopenReason) => Promise<void>;
+    /** The row's execution-record verb, bound to THIS resume's token and scope by `resumeStream` (the
+     *  same closure form as {@link onEnvRestoreFailed}, but REQUIRED: the store contract requires the
+     *  verb, so there is no store this seat could be absent for). The pending-call resolver calls it
+     *  exactly once per resolution, right after it emits the resolved call's `tool_end` frame, with the
+     *  {@link import("../gate-outcome.js").GateOutcome} that frame carried — every disposition, the
+     *  executed allow included (see `CheckpointRow.executionOutcome`: absence means unknown, never
+     *  allowed). The word it answers is read through `EXECUTION_RECORD_LEAVES_ROW_UNRECORDED`; a
+     *  conflict throw propagates (an engine defect, not a store condition). */
+    recordExecutionOutcome: (gate: import("../gate-outcome.js").GateOutcome) => Promise<ExecutionOutcomeRecordWord>;
     /** RB-471/FR-C1 — set in the run body right after `applyResumeDecision` completes: the negative-
      *  decision twin of `pendingActionStarted`. A reject/deny consumes its gate BY BEING DELIVERED, and
      *  this bit is the delivery fact — every throw-arm cause (prepare failure, `session_not_found`, a

package/dist/core/runner/decide-continuation.d.ts

@@ -0,0 +1,98 @@
+/**
+ * The resumed leg's DECIDE vocabulary — everything the resume engine needs to read a decide outcome and
+ * carry it into the continuation, none of which is a step the driver calls with an Input:
+ *  · was the decision NEGATIVE (a delivered refusal consumes its gate; no reopen compensation may fire);
+ *  · is a replayed winner the SAME decision as the persisted one (design/80 D-1 reopen-by-reason guard,
+ *    with the structural JSON equality it needs);
+ *  · which call a CONTENT-ASK checkpoint parks on, and the one-shot answering face a decide's answer is
+ *    bound to for the redeemed call;
+ *  · the capture-time domain checks on a decide's TEXT payloads, and the label a rejected value gets;
+ *  · the model-facing text for a deferred batch sibling, and the continuation prompt itself.
+ *
+ * Pure over its arguments (the answering face is the one closure, and it closes over its own arguments
+ * only). Run-loop machinery (layer 1), named without the `resume-` family prefix: that prefix marks a
+ * driven rung of the resume decision ladder, which this is not.
+ */
+import { type OnQuestion, type QuestionAnswer } from "../ask-question.js";
+import { type Checkpoint, type ResolvedOutcome } from "../checkpoint-store.js";
+import type { ResumeRun } from "./contracts.js";
+/**
+ * RB-471 ([2315]) — was this resume driven by a NEGATIVE human decision (plan_review/dry_run_review
+ * `reject`, policy_ask `deny`)? Such a decision consumes its gate by being DELIVERED: there is no owed
+ * action whose non-start could waste it, so the reopen compensation (both the throw-path and the
+ * settle-path arm) must never fire for it — reopening re-asks a gate the human already refused, and on
+ * the plan_review reject leg it minted a zombie gate beside the re-plan's NEW park (the session then
+ * reported the same decidePath locked no matter how many times the human decided).
+ */
+export declare function resumeDecisionWasNegative(resume: ResumeRun): boolean;
+/** Model-facing result for a batch sibling of a suspended call that v1 does not blind-run (§4.ter). */
+export declare const DEFERRED_REISSUE: string;
+/**
+ * Structural deep equality of two JSON-serializable values (order-independent over object keys). Used ONLY
+ * by the Runner's `resumeStream` design/80 D-1 reopen-by-reason guard to confirm an `env_failed` re-resume
+ * replays the EXACT persisted winner (its `updatedInput` payload included). This is a same-runtime
+ * value-vs-value comparison of two payloads that already round-trip JSON in the durable store — it is NOT
+ * the cross-runtime `boundInputHash` canonicalization (design/80 D-1 §2, out of scope for slice 1b), which
+ * the spec deliberately keeps server-minted-opaque to avoid false mismatches.
+ */
+export declare function deepJsonEqual(a: unknown, b: unknown): boolean;
+/** design/80 D-1 (reopen-by-reason): two resume winners are the SAME decision iff they bind the same call,
+ *  the same allow/deny verdict, the same (deep-equal) `updatedInput` rewrite AND the same (deep-equal)
+ *  content-ask `answer`. An `env_failed` re-resume must replay an identical winner; any divergence is a
+ *  re-vote (rejected).
+ *
+ *  ORDER MATTERS — `incoming` is the decide being replayed, `persisted` is the row's recorded winner. The
+ *  `reason` dimension is compared ASYMMETRICALLY (see below), so the two arguments are not interchangeable. */
+export declare function sameWinner(incoming: ResolvedOutcome, persisted: ResolvedOutcome): boolean;
+/** The tool call a CONTENT-ASK checkpoint parks on — the pending `tool_approval` call of the reserved
+ *  question tool — or `undefined` when this checkpoint parks on anything else (a side-effecting tool's
+ *  approval, a resource slice, a review pause). The single predicate both the answer-binding guard and the
+ *  answering-face injection key on, so "is this decide answering a question?" is asked exactly one way. */
+export declare function pendingContentAskCallId(cp: Checkpoint): string | undefined;
+/**
+ * Bind a decide's content-ask answer as the resumed leg's answering face (ruled 2026-08-04) — the same
+ * shape the documented live arm builds by hand (`{ ...taskConfig, onQuestion: async () => answer }`), so
+ * the redeemed call executes against the SAME tool and the SAME untrusted-answer fence rather than a
+ * second, parallel answer path.
+ *
+ * ONE-SHOT, bound to the redeemed call id: a decide answers the question the operator was shown, and
+ * nothing else. Should the resumed leg ask a NEW question, this face must not replay the previous answer
+ * to it (the questions differ; the fence's `selected ⊆ options` would strip the selections and the
+ * operator's note would be re-delivered out of context). It falls through to whatever answering face the
+ * resume already had, and — with none — refuses, which the tool reports to the model as "no answer was
+ * obtained", its honest headless outcome. In the durable topology this fallthrough is normally
+ * unreachable: a second question is adjudicated `ask` and parks for its own decide before executing.
+ */
+export declare function answerFaceForRedeemedCall(answer: QuestionAnswer, redeemedCallId: string, base: OnQuestion | undefined, 
+/** Digest of the question batch the operator was shown, so redemption cannot be claimed by a
+ *  DIFFERENT question that happens to arrive under the same call id. */
+redeemedQuestionsHash: string): OnQuestion;
+/**
+ * A label for a REJECTED deployment-supplied value, safe to put in an error message. Never coerces:
+ * `String(x)` on an object with no `toPrimitive` path (a null-prototype record, a throwing
+ * `Symbol.toPrimitive`) throws, which would replace this module's typed refusal with a raw TypeError —
+ * the malformed input escaping the very classification the refusal exists to give.
+ */
+export declare function describeSuppliedValue(value: unknown): string;
+/**
+ * Capture-time domain check for a decide outcome's TEXT payloads — the review lanes' `editedPlan` /
+ * `reason` and the approval lane's deny `reason`. All are persisted (the recorded winner's payload,
+ * compared when an `env_failed` reopen replays it) and all are fenced into the model-facing
+ * continuation reminder. The declared wire type is a string; a value outside it reads one way in this
+ * process and another after a JSON round-trip, and reaches the reminder as whatever its stringification
+ * happens to be. Worse, the pre-CAS tag-hygiene check and the fence BOTH reach the value through
+ * `String.prototype.replace`: an object carrying its own `replace` is therefore read twice and may
+ * answer differently each time — the check passing on text it never inspected. Refused pre-CAS so the
+ * row stays `pending` for a well-formed decide, exactly like the other capture-time domain refusals,
+ * and BEFORE the hygiene check so no guard ever consults a value outside the domain. The rejected field
+ * is named in the message only — `CheckpointError`'s structured `detail.field` is a closed set covering
+ * the approval lane's payload names, and widening it is a wire-surface change of its own.
+ */
+export declare function assertOutcomeText(value: string | undefined, field: "editedPlan" | "reason"): void;
+/**
+ * The continuation prompt for a resumed run (design/45 §B6). The vendored harness only exposes
+ * `prompt(text)` (it always appends a user message — there is no "continue from tool results" entry), so
+ * resume re-enters via a `<system-reminder>`-wrapped user message that tells the model the gated decision
+ * was applied. The "user message wart" is accepted (API-valid, and clearer than a silent continuation).
+ */
+export declare function resumeContinuation(resume: ResumeRun, mark: string | undefined): string;

package/dist/core/runner/decide-continuation.js

@@ -0,0 +1,133 @@
+import { ASK_USER_QUESTION_TOOL_NAME, isLiveQuestionFace, markBoundOnlyQuestionFace } from "../ask-question.js";
+import { boundInputHashOf } from "../canonical-json.js";
+import { CheckpointError } from "../checkpoint-store.js";
+import { formatHookFeedback } from "../hooks.js";
+import { delimitUntrusted, REVIEWER_NOTE_MAX_BODY } from "../untrusted-text.js";
+export function resumeDecisionWasNegative(resume) {
+    const o = resume.outcome;
+    return o.decision === "reject" || o.decision === "deny";
+}
+export const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
+    "NOT executed on resume. If you still need it, issue it again now.";
+export function deepJsonEqual(a, b) {
+    if (a === b)
+        return true;
+    if (typeof a !== typeof b || a === null || b === null || typeof a !== "object") {
+        return false;
+    }
+    const aArr = Array.isArray(a);
+    const bArr = Array.isArray(b);
+    if (aArr !== bArr)
+        return false;
+    if (aArr && bArr) {
+        if (a.length !== b.length)
+            return false;
+        for (let i = 0; i < a.length; i++) {
+            if (!deepJsonEqual(a[i], b[i]))
+                return false;
+        }
+        const aExtra = Object.keys(a).filter((k) => !isCanonicalIndexKey(k, a.length));
+        const bExtra = Object.keys(b).filter((k) => !isCanonicalIndexKey(k, b.length));
+        if (aExtra.length !== bExtra.length)
+            return false;
+        return aExtra.every((k) => Object.prototype.hasOwnProperty.call(b, k) && deepJsonEqual(Reflect.get(a, k), Reflect.get(b, k)));
+    }
+    const ao = a;
+    const bo = b;
+    const aKeys = Object.keys(ao);
+    const bKeys = Object.keys(bo);
+    if (aKeys.length !== bKeys.length)
+        return false;
+    return aKeys.every((k) => Object.prototype.hasOwnProperty.call(bo, k) && deepJsonEqual(ao[k], bo[k]));
+}
+function isCanonicalIndexKey(key, length) {
+    return /^(0|[1-9]\d*)$/.test(key) && Number(key) < length;
+}
+export function sameWinner(incoming, persisted) {
+    return (incoming.boundCallId === persisted.boundCallId &&
+        incoming.decision === persisted.decision &&
+        deepJsonEqual(incoming.updatedInput, persisted.updatedInput) &&
+        deepJsonEqual(incoming.answer, persisted.answer) &&
+        (persisted.reason === undefined || incoming.reason === persisted.reason));
+}
+export function pendingContentAskCallId(cp) {
+    return cp.pendingAction.kind === "tool_approval" && cp.pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME
+        ? cp.pendingAction.toolCallId
+        : undefined;
+}
+export function answerFaceForRedeemedCall(answer, redeemedCallId, base, redeemedQuestionsHash) {
+    let consumed = false;
+    const face = async (req, signal) => {
+        if (!consumed && req.toolCallId === redeemedCallId && boundInputHashOf(req.questions) === redeemedQuestionsHash) {
+            consumed = true;
+            return answer;
+        }
+        if (base !== undefined)
+            return base(req, signal);
+        throw new Error("this resumed leg's answer was bound to the decided question only — a new question has no answer on this leg");
+    };
+    return isLiveQuestionFace(base) ? face : markBoundOnlyQuestionFace(face);
+}
+export function describeSuppliedValue(value) {
+    return typeof value === "string" ? value : value === null ? "null" : typeof value;
+}
+export function assertOutcomeText(value, field) {
+    if (value !== undefined && typeof value !== "string") {
+        throw new CheckpointError("checkpoint.invalid_outcome", `resume \`${field}\` is not a plain string (got ${typeof value}) — a decide's text payload is an operator's plain data, not a live object; refusing pre-CAS, the checkpoint stays pending`);
+    }
+}
+export function resumeContinuation(resume, mark) {
+    if (resume.outcome.gate === "wake") {
+        return formatHookFeedback("You were WOKEN from a parked pause by an operator. Before continuing, re-orient from the workspace: " +
+            "run `git status` and review your recent changes / last commits to confirm what is already done, then " +
+            "continue the remaining work. Do NOT restart the task or re-run work that is already committed.", mark);
+    }
+    if (resume.outcome.gate === "resource_limit") {
+        return formatHookFeedback("You were resumed after a pause. Before continuing, re-orient from the workspace: run `git status` and " +
+            "review your recent changes / last commits to confirm what is already done, then continue the " +
+            "remaining work. Do NOT restart the task or re-run work that is already committed.", mark);
+    }
+    if (resume.outcome.gate === "dry_run_review") {
+        const verdict = resume.outcome.decision === "approve"
+            ? "Your predicted change was REVIEWED and APPROVED; it has been applied"
+            : `Your predicted change was REVIEWED and REJECTED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}; it was NOT applied`;
+        return formatHookFeedback(`You were resumed after a dry-run review. ${verdict}. Before continuing, re-orient from the workspace ` +
+            "(run `git status` and review your recent changes) to confirm the current state, then continue the " +
+            "remaining work. Do NOT restart the task or re-run work that is already done.", mark);
+    }
+    if (resume.outcome.gate === "plan_review") {
+        if (resume.outcome.decision === "approve") {
+            return formatHookFeedback("Your proposed PLAN was REVIEWED and APPROVED. Proceed with that plan now — begin executing it. " +
+                "This is a RESUMED task; do NOT re-plan or restart from scratch, just carry out the approved plan.", mark);
+        }
+        if (resume.outcome.decision === "edit") {
+            if (!resume.outcome.editedPlan) {
+                return formatHookFeedback("Your proposed PLAN was REVIEWED and EDITED, but no revised plan text was supplied — proceed with your " +
+                    "ORIGINAL plan as-is, begin executing it now. This is a RESUMED task; do NOT re-plan or restart from scratch.", mark);
+            }
+            return formatHookFeedback("Your proposed PLAN was REVIEWED and EDITED by a human reviewer. Proceed with the REVISED plan below " +
+                "(it supersedes your earlier plan); begin executing it now. This is a RESUMED task; do NOT re-plan " +
+                "or restart from scratch, just carry out the revised plan.\n\nThe REVISED plan to follow is:\n" +
+                delimitUntrusted("revised plan", resume.outcome.editedPlan), mark);
+        }
+        const why = resume.outcome.reason ? ` Reviewer note: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : "";
+        return formatHookFeedback(`Your proposed PLAN was REVIEWED and REJECTED; it was NOT executed.${why} Produce a NEW plan that ` +
+            "addresses the concern, then continue. This is a RESUMED task — re-plan from the current state; do " +
+            "NOT execute the rejected plan.", mark);
+    }
+    const { pendingAction } = resume.cp;
+    if (pendingAction.kind !== "tool_approval") {
+        return formatHookFeedback("This is a RESUMED task — continue from where you left off without restarting or re-running prior work.", mark);
+    }
+    const decided = resume.outcome.decision === "allow"
+        ? "was APPROVED and has now been executed — its result is in the tool results above"
+        : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}`;
+    const remaining = pendingAction.batchToolCallIds.filter((id) => id !== pendingAction.toolCallId && !pendingAction.completedCallIds.includes(id)).length;
+    const batchNote = remaining > 0
+        ? ` ${remaining} other tool call(s) from that batch were returned as deferred and not run — re-issue any you still need.`
+        : "";
+    return formatHookFeedback(`The pending tool call "${pendingAction.toolName}" ${decided}.${batchNote} ` +
+        `This is a RESUMED task — every step before this point is already done and its results are in the ` +
+        `conversation above. Do NOT restart the task or re-run any tool you already ran; continue from this ` +
+        `exact point, building on the existing results, and finish the remaining work.`, mark);
+}

package/dist/core/runner/execution-record.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The execution-record settle half of the pending-call resolver's belt (run-loop machinery, layer 1):
+ * what the resolver does with the word the row's `recordExecutionOutcome` verb answered. The verb itself
+ * is bound by `resumeStream` (ResumeRun.recordExecutionOutcome); the resolver calls it once per
+ * resolution, right after the resolved call's `tool_end` frame, and hands the answer here. The rule is a
+ * table lookup, not a condition list: the words that leave the row unrecorded
+ * (`EXECUTION_RECORD_LEAVES_ROW_UNRECORDED`) announce `checkpoint.execution_outcome_unrecorded`; the
+ * others say nothing. The execution result is never changed by the answer — the record is an account of
+ * what ran, not a gate on it — so this module has no return value and no throw of its own (a conflict is
+ * the verb's own throw and propagates past the resolver untouched).
+ */
+import { type ExecutionOutcomeRecordWord } from "../checkpoint-execution-record.js";
+import type { GateOutcome } from "../gate-outcome.js";
+import { type RunnerDeps } from "../types.js";
+/** The facts the unrecorded notice carries — all from the resumed leg; the secret token never rides. */
+export interface ExecutionRecordFacts {
+    toolName: string;
+    gate: GateOutcome;
+    sessionId: string;
+    runId: string;
+    scope: string;
+    checkpointId?: string;
+}
+/** Settle the record verb's answer: announce the unrecorded words through the deployment's notice sink;
+ *  the recorded words are silent. */
+export declare function settleExecutionRecord(onNotice: RunnerDeps["onNotice"], word: ExecutionOutcomeRecordWord, facts: ExecutionRecordFacts): void;

package/dist/core/runner/execution-record.js

@@ -0,0 +1,19 @@
+import { EXECUTION_RECORD_LEAVES_ROW_UNRECORDED } from "../checkpoint-execution-record.js";
+import { deliverEngineNotice } from "../types.js";
+export function settleExecutionRecord(onNotice, word, facts) {
+    if (!EXECUTION_RECORD_LEAVES_ROW_UNRECORDED[word])
+        return;
+    deliverEngineNotice(onNotice, {
+        code: "checkpoint.execution_outcome_unrecorded",
+        message: `The resolved tool call "${facts.toolName}" was disposed (${facts.gate.disposition.kind}) but its execution record could not be filed on the checkpoint: ` +
+            `the store answered "${word}" — the row is no longer a resolved row of this scope (reopened, expired or removed under this leg). ` +
+            `The execution result stands as delivered; the row reads unknown on its execution axis.`,
+        detail: {
+            sessionId: facts.sessionId,
+            runId: facts.runId,
+            scope: facts.scope,
+            ...(facts.checkpointId !== undefined ? { checkpointId: facts.checkpointId } : {}),
+            word,
+        },
+    });
+}