@sema-agent/core 7.8.0 → 7.9.0

package/dist/core/runner/tool-end-body.d.ts

@@ -7,24 +7,31 @@
  *
  * Projections over values the caller already holds, with ONE clock read: `toolResultMsg` stamps the message
  * it mints with `Date.now()` (as it did inside the driver — the transcript's timestamp is minted where the
- * message is). Nothing here reads host state through a callback, awaits, or keeps state between calls.
+ * message is). The one callback here is the leg's card projector, handed in by every caller (it keeps the
+ * once-per-leg announce state; this module keeps none). Nothing here awaits.
  * Layer-1 machinery, not a driven lane; the prefix rule it follows is written once, on initial-run-state.ts.
  */
 import { type AgentMessage } from "../../internal/harness.js";
 import type { GateOutcome } from "../gate-outcome.js";
 import { type McpDelivered } from "../mcp-failure.js";
 import type { RecoveredOrphan } from "../session-reconcile.js";
+import { type StructuredProjector } from "./tool-output-projection.js";
 import type { WriteFamily } from "./turn-attachments.js";
 /** design/134 §3.1b — derive the thin `response` digest from a harness tool result: model-facing text
  *  content only (never `details` — the H4 thin-projection discipline), capped with a truncation note. */
 export declare function batchResponseDigest(result: unknown): string | undefined;
 /** The `tool_end` body fields projected from a harness tool result — output/truncated/totalChars via
- *  {@link toolOutputFrom} and the CC card via {@link structuredFrom}. Single construction point for BOTH
+ *  {@link toolOutputFrom} and the CC card via the LEG's projector (`Prepared.structuredProjector`: the engine card set
+ *  ∪ the caller rows' declared `renderHints.resultCards`, an undeclared type dropped and announced once per leg —
+ *  design/388 L4; handed in because the once-per-leg state lives on the leg). Single construction point for BOTH
  *  the live loop's frames and the resumed batch's frames (`resolvePendingCall` + the deferred-sibling
  *  close): the resumed frames used to carry only `isError`, so a client rendering tool output from frames
  *  showed an empty body for every durable-approved call. Same projection = same source as the transcript.
  *  Also the one place the gate outcome reaches a frame — see the parameter. */
 export declare function toolEndBodyFrom(result: unknown, isError: boolean, 
+/** The leg's card projector — see the doc above. A parameter, never a module default: a body minted with the engine
+ *  set alone would silently drop every declared caller card and never announce. */
+structured: StructuredProjector, 
 /** The gate's record of the pass that admitted or refused this call, supplied by the CALLER of this
  *  projection — the live loop reads it off the gate's per-call sideband, the resumed leg off the decide's
  *  minted record. Deliberately a parameter and never derived from `result`: a tool's own `details`
@@ -58,10 +65,10 @@ gatedCallIdOfRun?: string): {
  * disagreed. The projection goes through the same {@link toolEndBodyFrom} every live tool result uses, so
  * `output` = the persisted model-facing text and `errorCode` = the persisted `details.errorKind`
  * (`interrupted_never_started` / `interrupted_outcome_unknown`) — a consumer discriminates on the code
- * instead of prose-matching. No `structured`: the reconcile mints no CC card (no `details.type`), which
- * `structuredFrom`'s allowlist already enforces.
+ * instead of prose-matching. No `structured`: the reconcile mints no CC card (no `details.type`), which the
+ * leg's projector already enforces.
  */
-export declare function reconciledToolEndBody(orphan: Pick<RecoveredOrphan, "text" | "errorKind">): ReturnType<typeof toolEndBodyFrom>;
+export declare function reconciledToolEndBody(orphan: Pick<RecoveredOrphan, "text" | "errorKind">, structured: StructuredProjector): ReturnType<typeof toolEndBodyFrom>;
 /** task #51 F2/F3 — the CANONICAL write-tool → reminder-window mapping (CC qFm :480253-480254
  *  `a.name === bD || a.name === hF` = TaskCreate/TaskUpdate; BFm :480217-480219 = TodoWrite). Live
  *  deployment-alias resolution happens at the call sites (run-local `writeFamilyOf` over the mounted

package/dist/core/runner/tool-end-body.js

@@ -1,7 +1,7 @@
 import {} from "../../internal/harness.js";
 import { MCP_DELIVERY_VERDICTS } from "../mcp-failure.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
-import { structuredFrom, toolOutputFrom } from "./tool-output-projection.js";
+import { toolOutputFrom } from "./tool-output-projection.js";
 import { TASK_CREATE_TOOL_NAME, TASK_UPDATE_TOOL_NAME, TODO_WRITE_TOOL_NAME } from "../tool-catalog-entries.js";
 const BATCH_RESPONSE_MAX_CHARS = 500;
 export function batchResponseDigest(result) {
@@ -32,9 +32,9 @@ export function batchResponseDigest(result) {
         ? `${text.slice(0, BATCH_RESPONSE_MAX_CHARS)}…[+${text.length - BATCH_RESPONSE_MAX_CHARS} chars truncated]`
         : text;
 }
-export function toolEndBodyFrom(result, isError, gate, gatedCallIdOfRun) {
+export function toolEndBodyFrom(result, isError, structured, gate, gatedCallIdOfRun) {
     const o = toolOutputFrom(result);
-    const st = structuredFrom(result);
+    const st = structured(result);
     const det = isError ? result?.details : undefined;
     const codeRaw = det?.code;
     const kindRaw = det?.errorKind;
@@ -51,8 +51,8 @@ export function toolEndBodyFrom(result, isError, gate, gatedCallIdOfRun) {
         ...(gate !== undefined ? { gate } : {}),
     };
 }
-export function reconciledToolEndBody(orphan) {
-    return toolEndBodyFrom({ content: orphan.text, details: { code: orphan.errorKind } }, true);
+export function reconciledToolEndBody(orphan, structured) {
+    return toolEndBodyFrom({ content: orphan.text, details: { code: orphan.errorKind } }, true, structured);
 }
 export function writeFamilyOfCanonical(name) {
     if (name === TASK_CREATE_TOOL_NAME || name === TASK_UPDATE_TOOL_NAME)

package/dist/core/runner/tool-output-projection.d.ts

@@ -9,14 +9,17 @@ export declare const toolOutputFrom: (result: unknown) => {
     truncated: boolean;
     totalChars?: number;
 } | undefined;
+/** The `tool_end.structured` projection over a harness tool result: the CC card when `details.type` names a card
+ *  the leg admits, else undefined. Minted per leg by {@link createStructuredProjector}; every body projection takes it
+ *  as a parameter — there is no module-level card set to fall back to. */
+export type StructuredProjector = (result: unknown) => unknown;
 /**
  * L4's run-time half (design/388 §2.4): a per-leg projector — the engine card set plus the leg's declared
- * caller cards — that DROPS an undeclared `details.type` exactly as the module-level gate does and announces
- * it ONCE per leg (`config.tool_card_undeclared`, audience operator). The module-level {@link structuredFrom}
- * is this projector over the engine set alone, with no announce seat.
+ * caller cards — that DROPS an undeclared `details.type` and announces it ONCE per leg
+ * (`config.tool_card_undeclared`, audience operator). With no options it is the engine set alone, unannounced —
+ * the shape a caller outside a leg (a test, a fixture) uses.
  */
-export declare function createStructuredProjector(opts: {
+export declare function createStructuredProjector(opts?: {
     declaredCards?: Iterable<string>;
     onUndeclared?: (type: string) => void;
-}): (result: unknown) => unknown;
-export declare const structuredFrom: (result: unknown) => unknown;
+}): StructuredProjector;

package/dist/core/runner/tool-output-projection.js

@@ -58,7 +58,7 @@ export const toolOutputFrom = (result) => {
     return { output: raw, truncated: true, totalChars };
 };
 const CC_DETAIL_TYPES = engineCardTypes();
-export function createStructuredProjector(opts) {
+export function createStructuredProjector(opts = {}) {
     const allowed = new Set([...CC_DETAIL_TYPES, ...(opts.declaredCards ?? [])]);
     const announced = new Set();
     return (result) => {
@@ -89,20 +89,3 @@ function boundedCard(details) {
     }
     return details;
 }
-export const structuredFrom = (result) => {
-    const details = result !== null && typeof result === "object" ? result.details : undefined;
-    if (details === null || typeof details !== "object")
-        return undefined;
-    const t = details.type;
-    if (typeof t !== "string" || !CC_DETAIL_TYPES.has(t))
-        return undefined;
-    try {
-        const serialized = JSON.stringify(details) ?? "";
-        if (serialized.length > MAX_TOOL_END_OUTPUT_CHARS * 4)
-            return undefined;
-    }
-    catch {
-        return undefined;
-    }
-    return details;
-};

package/dist/core/runner/turn-attachments.d.ts

@@ -110,7 +110,7 @@ export interface TurnAttachment {
     source: AttachmentSource;
     body: string;
 }
-/** H4 — the thin projection of a todo list kept run-local (NEVER the wire-capped structuredFrom card).
+/** H4 — the thin projection of a todo list kept run-local (NEVER the wire-capped `tool_end.structured` card).
  *  Pure CONTENT memory: the write-window anchor lives on {@link AttachmentState.todoLastWriteTurn}
  *  (task #51 F3 — the window resets on tool-call INITIATION, which may precede/outlive any ingest). */
 export interface ListProjection {
@@ -273,7 +273,7 @@ export declare const INSTRUCTIONS_CHANGE_BYTE_CAP = 512;
  */
 export declare function createAttachmentState(): AttachmentState;
 /**
- * H4 — thin-projection reducer over a tool's RAW `result.details` (NOT the wire `structuredFrom`
+ * H4 — thin-projection reducer over a tool's RAW `result.details` (NOT the wire card projector
  * projection and its 4×16K caps: a huge todo list must shrink into a bounded snapshot here, never
  * disarm the reminder by being dropped wholesale). Only the first-party discriminants `todo` /
  * `task` / `task-list` are recognized — every other card type (subagent `agent`/`fork`/`task-output`,

package/dist/core/store-contracts/permission-rule-sync-contract.js

@@ -5,14 +5,15 @@ const GLOBAL = { kind: "global" };
 function add(actor, counter, origin = "user") {
     return { dot: { actor, counter }, origin, createdAt: "2026-01-01T00:00:00.000Z" };
 }
-function rule(text, adds, scope = GLOBAL) {
+function rule(text, adds, scope = GLOBAL, behavior = "allow") {
     const m = /^Bash\((.+?)(:\*)?\)$/.exec(text);
     if (m === null || m[1] === undefined)
         throw new Error(`contract fixture rule "${text}" is not a Bash(...) form`);
-    return { rule: text, tool: "Bash", match: m[2] !== undefined ? "prefix" : "exact", command: m[1], scope, adds };
+    return { behavior, rule: text, tool: "Bash", match: m[2] !== undefined ? "prefix" : "exact", command: m[1], scope, adds };
 }
-function tomb(text, removed, deletedBy, scope = GLOBAL) {
+function tomb(text, removed, deletedBy, scope = GLOBAL, behavior = "allow") {
     return {
+        behavior,
         rule: text,
         scope,
         removedDots: removed.map(([actor, counter]) => ({ actor, counter })),
@@ -25,10 +26,10 @@ function state(rules = [], tombstones = []) {
 function liveDots(s) {
     const out = new Set();
     for (const r of s.rules) {
-        const removed = s.tombstones.filter((t) => t.rule === r.rule && sameScope(t.scope, r.scope)).flatMap((t) => t.removedDots);
+        const removed = s.tombstones.filter((t) => t.behavior === r.behavior && t.rule === r.rule && sameScope(t.scope, r.scope)).flatMap((t) => t.removedDots);
         for (const a of r.adds) {
             if (!removed.some((d) => d.actor === a.dot.actor && d.counter === a.dot.counter))
-                out.add(`${r.rule}|${a.dot.actor}#${a.dot.counter}`);
+                out.add(`${r.behavior === "allow" ? "" : r.behavior + ":"}${r.rule}|${a.dot.actor}#${a.dot.counter}`);
         }
     }
     return out;
@@ -41,7 +42,7 @@ function sameScope(a, b) {
     return b.kind === "project" && a.root === b.root;
 }
 function allDots(s) {
-    return new Set(s.rules.flatMap((r) => r.adds.map((a) => `${r.rule}|${a.dot.actor}#${a.dot.counter}`)));
+    return new Set(s.rules.flatMap((r) => r.adds.map((a) => `${r.behavior === "allow" ? "" : r.behavior + ":"}${r.rule}|${a.dot.actor}#${a.dot.counter}`)));
 }
 export async function permissionRuleSyncContract(hooks = {}) {
     const join = hooks.join ?? joinRuleStates;
@@ -141,8 +142,24 @@ export async function permissionRuleSyncContract(hooks = {}) {
         assert.deepStrictEqual(new Set(ab.tombstones[0]?.removedDots.map((d) => `${d.actor}#${d.counter}`)), new Set(["a#1", "a#2"]), "the union — a one-sided pick can drop an observed removal");
         assert.deepStrictEqual(ab, join(b, a));
     });
+    run("behavior is an identity member: the same text as an allow and as a deny are two rows, each with its own adds and its own tombstone", async () => {
+        const both = state([rule("Bash(ls)", [add("a", 1)]), rule("Bash(ls)", [add("a", 2)], GLOBAL, "deny")], [tomb("Bash(ls)", [["a", 1]], ["a", 3])]);
+        const merged = join(both, state());
+        assert.strictEqual(merged.rules.length, 2, "one text, two behaviors — two identity groups, never folded");
+        assert.deepStrictEqual(liveDots(merged), new Set(["deny:Bash(ls)|a#2"]), "the allow tombstone must not reach the deny's add");
+        assert.deepStrictEqual(join(state(), both), merged, "commutative across the behavior axis");
+        const badWord = state([rule("Bash(pwd)", [add("b", 1)])], [Object.assign(tomb("Bash(pwd)", [["b", 1]], ["b", 2]), { behavior: "maybe" })]);
+        const screened = join(badWord, state());
+        assert.strictEqual(screened.tombstones.length, 0, "an unreadable behavior word on a tombstone must not land");
+        assert.ok(liveDots(screened).has("Bash(pwd)|b#1"), "…and must not cover anything");
+    });
+    run("closed-set identity: a row carrying a behavior word outside the closed set is refused like invalid text", async () => {
+        const forgedWord = Object.assign(rule("Bash(ls)", [add("z", 1)]), { behavior: "sometimes" });
+        const merged = join(state([forgedWord]), state());
+        assert.strictEqual(allDots(merged).size, 0, "a behavior this engine cannot read must not become an allow (or a deny) by falling through");
+    });
     run("metadata re-projection (r2-F2): a record whose stored fields contradict its rule text is refused, both orders", async () => {
-        const forged = { rule: "Bash(ls)", tool: "Bash", match: "prefix", command: "rm -rf /", scope: GLOBAL, adds: [add("z", 1)] };
+        const forged = { behavior: "allow", rule: "Bash(ls)", tool: "Bash", match: "prefix", command: "rm -rf /", scope: GLOBAL, adds: [add("z", 1)] };
         const clean = state([rule("Bash(git status)", [add("a", 1)])]);
         const ab = join(state([forged]), clean);
         const ba = join(clean, state([forged]));
@@ -150,9 +167,11 @@ export async function permissionRuleSyncContract(hooks = {}) {
         assert.deepStrictEqual(ab, ba, "refusal must preserve commutativity");
         assert.ok(allDots(ab).has("Bash(git status)|a#1"), "refusing one record must not disturb the rest");
     });
-    run("single-validator door: an illegal rule shape (bare-interpreter prefix) cannot ride a join", async () => {
+    run("single-validator door: an illegal ALLOW shape (bare-interpreter prefix) cannot ride a join — while the same text as a DENY is a legitimate wide tightening and lands", async () => {
         const merged = join(state([rule("Bash(node:*)", [add("z", 1)])]), state());
         assert.strictEqual(allDots(merged).size, 0, "Bash(node:*) must be refused by the shared validator inside the join");
+        const denied = join(state([rule("Bash(node:*)", [add("z", 1)], GLOBAL, "deny")]), state());
+        assert.deepStrictEqual(allDots(denied), new Set(["deny:Bash(node:*)|z#1"]), "the tightening floor admits the interpreter-headed prefix");
     });
     run("durable two-member face (design/382 §4.3): a session-scope row or tombstone never survives a join, and never poisons the round", async () => {
         const sessionScope = { kind: "session", sessionId: "sess-1" };
@@ -168,8 +187,8 @@ export async function permissionRuleSyncContract(hooks = {}) {
         const scopeA = { kind: "project", root: "/x" };
         const scopeB = { kind: "project", root: "/x a" };
         const s = state([rule("Bash(ls)", [add("v", 1)], scopeA), rule("Bash(ls)", [add("w", 1)], scopeB)], [
-            { rule: "Bash(ls)", scope: scopeA, removedDots: [{ actor: "v", counter: 1 }], deletedBy: { actor: "a 1", counter: 2 } },
-            { rule: "Bash(ls)", scope: scopeB, removedDots: [{ actor: "w", counter: 1 }], deletedBy: { actor: "1", counter: 2 } },
+            { behavior: "allow", rule: "Bash(ls)", scope: scopeA, removedDots: [{ actor: "v", counter: 1 }], deletedBy: { actor: "a 1", counter: 2 } },
+            { behavior: "allow", rule: "Bash(ls)", scope: scopeB, removedDots: [{ actor: "w", counter: 1 }], deletedBy: { actor: "1", counter: 2 } },
         ]);
         const merged = join(s, state());
         assert.strictEqual(merged.tombstones.length, 2, "two distinct delete intents must both survive — a colliding key folds one away");

package/dist/core/tool-roster.d.ts

@@ -396,6 +396,13 @@ export declare class RosterBuilder {
 /** Which source a `TaskSpec.tools` entry mounts as: a definition carrying a CORE contract is a built-in the host chose
  *  to mount; anything else is the caller's own tool. Identity follows the object, never the name. */
 export declare function callerMountSource(tool: AgentTool): RosterSource;
+/** The card namespace a roster row owns (design/388 §2.2 ④) — ONE mint, read by the row and by the prepare door that
+ *  judges a caller's `renderHints.resultCards` against it: `builtin:<name>` for engine-owned definitions,
+ *  `<mcp|a2a>:<peer>/<tool>` for protocol tools, `<caller|external>:<contractId>` for everything the caller mounts. */
+export declare function rosterCardId(source: RosterSource, toolName: string, peer: string | null, protocolTool: string, contractId: string): string;
+/** The card namespace a `TaskSpec.tools` entry will own once mounted — the same mint the row makes, so the prepare
+ *  door and the roster row cannot disagree about which namespace a caller card must live under. */
+export declare function callerCardIdOf(tool: Pick<AgentTool, "name" | "parameters">): string;
 /** One row (design/388 §2.5). Every axis is read off the instance or the leg facts; nothing off a name table. */
 export declare function mintRosterEntry(tool: AgentTool, meta: RosterMountMeta, facts: RosterSnapshotFacts): ToolRosterEntry;
 /**
@@ -414,6 +421,8 @@ export declare class ToolRosterDeltaSeat {
     republish(): ToolRosterDelta | undefined;
     /** Install the stream sink; anything published before is flushed in order. */
     subscribe(sink: (delta: ToolRosterDelta) => void): void;
+    /** The leg ended: drop the sink so a late republish never reaches a closed stream (it buffers, bounded, unread). */
+    unsubscribe(): void;
     /** Take the buffered deltas (a consumer that polls instead of subscribing). */
     drain(): ToolRosterDelta[];
 }

package/dist/core/tool-roster.js

@@ -335,17 +335,24 @@ export class RosterBuilder {
 export function callerMountSource(tool) {
     return getToolContract(tool, "caller").origin === "core" ? "builtin" : "caller";
 }
+export function rosterCardId(source, toolName, peer, protocolTool, contractId) {
+    return source === "builtin" || source === "synthetic"
+        ? `builtin:${toolName}`
+        : source === "mcp" || source === "a2a"
+            ? `${source}:${peer}/${protocolTool}`
+            : `${source === "external" ? "external" : "caller"}:${contractId}`;
+}
+export function callerCardIdOf(tool) {
+    const t = tool;
+    return rosterCardId(callerMountSource(t), t.name, null, t.name, getToolContract(t, "caller").contractId);
+}
 export function mintRosterEntry(tool, meta, facts) {
     const face = faceOf(tool);
     const fallbackOrigin = meta.source === "builtin" ? "core" : meta.source === "synthetic" ? "synthetic" : meta.source === "mcp" || meta.source === "a2a" ? meta.source : "caller";
     const d = getToolContract(tool, fallbackOrigin);
     const peer = meta.origin?.peer ?? null;
     const protocolTool = peer !== null ? protocolOf(tool.name)?.parse(tool.name)?.tool ?? tool.name : tool.name;
-    const cardId = meta.source === "builtin" || meta.source === "synthetic"
-        ? `builtin:${tool.name}`
-        : meta.source === "mcp" || meta.source === "a2a"
-            ? `${meta.source}:${peer}/${protocolTool}`
-            : `${meta.source === "external" ? "external" : "caller"}:${d.contractId}`;
+    const cardId = rosterCardId(meta.source, tool.name, peer, protocolTool, d.contractId);
     const { keys: inputKeys } = inputKeysOf(tool.parameters);
     const declaredEffect = face.effect;
     const foldedEffect = facts.effects.get(tool.name);
@@ -431,6 +438,9 @@ export class ToolRosterDeltaSeat {
         for (const d of pending)
             sink(d);
     }
+    unsubscribe() {
+        this.#sink = undefined;
+    }
     drain() {
         const pending = this.#pending;
         this.#pending = [];

package/dist/index.d.ts

@@ -186,8 +186,8 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, type SessionRulePartition, type SessionRuleAdd, type SessionRuleApplyResult, } from "./core/permission-rule-session.js";

package/dist/index.js

@@ -145,8 +145,8 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, } from "./core/permission-rule-session.js";

package/dist/stores/file/checkpoint-store.js

@@ -16,7 +16,7 @@ const KNOWN_CHECKPOINT_LEDGER_EVENTS = new Set(Object.keys(CHECKPOINT_LEDGER_EVE
 function applyCheckpointEvent(cps, ev) {
     if (!KNOWN_CHECKPOINT_LEDGER_EVENTS.has(ev.t)) {
         throw new CheckpointError("checkpoint.unsupported_version", `file checkpoint ledger: unrecognised event kind "${String(ev.t)}" — ` +
-            `it was written by a newer worker; refusing the replay rather than serving an incomplete authority`);
+            `it was written by a newer worker; refusing the replay rather than serving an incomplete authority`, { reason: "ledger_event_unknown" });
     }
     if (ev.t === "put") {
         cps.set(ev.token, ev.cp);

package/dist/stores/file/permission-rule-store.d.ts

@@ -2,17 +2,21 @@
  * design/179 §5/§8 / design/389 — the file backend of the permission-rule store's DURABLE partition (one
  * bucket file per owner), plus the file home of the ORG partition's durable state (`org.json`).
  *
- * ## Schema 3 and the one-time migration
+ * ## Schema 4 and the one-time migration
  *
  * Pre-389 files (schema 1/2) kept the org last-known-good snapshot as an `org` block INSIDE each
- * principal's bucket file — deployment-wide policy stored per person. Schema 3 drops that block; the org
- * state lives in one `org.json` beside the buckets. `FileDurableRulePartitionProvider` migrates every
- * legacy bucket file ONCE at construction (under the writer lock: the migration is a write, and a live
- * older writer over the same directory is refused rather than raced), folding each file's `org` block
- * into `org.json` by the anti-rollback rule (the highest high-water wins; an equal revision with
- * different content keeps what is already installed and discloses). After that the reader accepts
- * schema 3 ONLY — a 1/2/4 file is refused whole, loudly (zero rules + disclosure). There is no second
- * read path for the old shapes: the migrator is the only code that reads them, and it runs once.
+ * principal's bucket file — deployment-wide policy stored per person. Schema 3 dropped that block; the org
+ * state lives in one `org.json` beside the buckets. Schema 4 adds the `behavior` member to every rule row,
+ * tombstone and quarantine row (the rule identity is the (behavior, text, scope) triple): a schema-3 row has
+ * none, and every row a schema-3 engine wrote was an allow, so the migration stamps `"allow"` on each — the
+ * ONE reading of the pre-field row (`readRowBehavior`), applied once, here, never at a read face.
+ * `FileDurableRulePartitionProvider` migrates every legacy bucket file (1, 2 or 3) ONCE at construction
+ * (under the writer lock: the migration is a write, and a live older writer over the same directory is
+ * refused rather than raced), folding a 1/2 file's `org` block into `org.json` by the anti-rollback rule
+ * (the highest high-water wins; an equal revision with different content keeps what is already installed
+ * and discloses). After that the reader accepts schema 4 ONLY — a 1/2/3/5 file is refused whole, loudly
+ * (zero rules + disclosure). There is no second read path for the old shapes: the migrator is the only
+ * code that reads them, and it runs once.
  *
  * ## Why this store builds its own symlink refusal
  *
@@ -55,23 +59,23 @@
  * and is not: it detects corruption, and it does not detect an editor, because an editor recomputes it.
  * For this backend the trust is host = user, exactly as for the settings file it mirrors.
  */
-import type { PersistedAllowRule, RuleTombstone } from "../../core/permission-rule-model.js";
-import type { DurableRulePartition, DurableRulePartitionProvider, PermissionRuleWriter, QuarantinedRuleAdd, RuleOwner, RuleSyncFrontier, StoredAllowRules, WritableDurableRulePartition } from "../../core/permission-rule-store.js";
+import type { PersistedRule, RuleTombstone } from "../../core/permission-rule-model.js";
+import type { DurableRulePartition, DurableRulePartitionProvider, PermissionRuleWriter, QuarantinedRuleAdd, RuleOwner, RuleSyncFrontier, StoredRules, WritableDurableRulePartition } from "../../core/permission-rule-store.js";
 import { PERMISSION_RULE_WRITER } from "../../core/permission-rule-store.js";
 import type { OrgRuleStatePersistence, PersistedOrgRuleState } from "../../core/permission-rule-org.js";
 import type { StoreDurability, StoreFidelity } from "../../core/checkpoint-store.js";
 /**
  * The on-disk shape of one bucket. `schemaVersion` is the only field a future reader may rely on before
- * validating. Schema 3 (design/389): the five core fields plus the OPTIONAL `sync` block (observation
- * vector + round timestamp) and `quarantined` area (rows moved out of the live view, bytes preserved).
- * The org state is NOT here — see {@link OrgStateFile}.
+ * validating. Schema 4: the five core fields plus the OPTIONAL `sync` block (observation vector + round
+ * timestamp) and `quarantined` area (rows moved out of the live view, bytes preserved); every rule,
+ * tombstone and quarantine row carries its `behavior`. The org state is NOT here — see {@link OrgStateFile}.
  */
 interface RuleFile {
-    schemaVersion: 3;
+    schemaVersion: 4;
     actor: string;
     counter: number;
     rev: number;
-    rules: PersistedAllowRule[];
+    rules: PersistedRule[];
     tombstones: RuleTombstone[];
     sync?: {
         observedVector?: RuleSyncFrontier;
@@ -88,10 +92,10 @@ interface OrgStateFile {
 }
 /** The org partition's durable home in a rule directory. */
 export declare const ORG_STATE_FILE = "org.json";
-/** Written once the directory is known to hold only schema-3 buckets. Its presence ends the legacy
- *  scan for good: a schema 1/2 bucket that appears AFTERWARDS (an older engine writing after the
+/** Written once the directory is known to hold only schema-4 buckets. Its presence ends the legacy
+ *  scan for good: a schema 1/2/3 bucket that appears AFTERWARDS (an older engine writing after the
  *  cutover) is refused by the reader on every later construction too, never re-admitted by a restart. */
-export declare const SCHEMA3_MARKER_FILE = ".rule-schema-3";
+export declare const SCHEMA_MARKER_FILE = ".rule-schema-4";
 /** The anti-rollback contract's DESIGNED refusal (a lower high-water mark, or different content under
  *  the same revision) — distinguished by class from every other install failure, because the two are
  *  handled in opposite directions by the migration: a refusal means the block is superseded and may be
@@ -148,7 +152,7 @@ declare class FileDurableRulePartition implements WritableDurableRulePartition {
      */
     private screenDurableRows;
     private write;
-    list(): Promise<StoredAllowRules>;
+    list(): Promise<StoredRules>;
     /** The quarantine area (design/182 §5.2/§8.3): introspection only — never part of `list()`. */
     quarantined(): Promise<QuarantinedRuleAdd[]>;
     /**
@@ -209,7 +213,8 @@ export declare class FileDurableRulePartitionProvider implements DurableRulePart
         dataRoot?: string;
     });
     /**
-     * Fold every legacy bucket file in `dir` into schema 3 and its `org` block into `org.json`. A no-op on a
+     * Fold every legacy bucket file in `dir` into schema 4 (stamping `behavior: "allow"` on every pre-field
+     * row — the one pre-field reading) and a 1/2 file's `org` block into `org.json`. A no-op on a
      * directory with no legacy file (zero writes, the lock untouched — the second construction over a
      * migrated directory is byte-silent). A legacy file whose checksum or shape does not hold is NOT
      * migrated: its bytes stay where they are for a person to look at, and the reader keeps refusing it
@@ -220,10 +225,10 @@ export declare class FileDurableRulePartitionProvider implements DurableRulePart
      * shape — the old engine's buckets are refused whole until they are migrated.
      */
     private migrateLegacyBuckets;
-    /** Publish the schema-3 completion marker (idempotent, atomic, no lock: its content never changes and
+    /** Publish the schema-4 completion marker (idempotent, atomic, no lock: its content never changes and
      *  a concurrent writer of the same bytes is harmless). A failure to write it is disclosed, not thrown —
      *  the next construction simply scans again, which is the safe direction. */
-    private writeSchema3Marker;
+    private writeSchemaMarker;
     /** The org partition's durable home in this directory (design/182 §7.4 contract; `org.json`). Shares
      *  this provider's writer lock — an install is a write. */
     orgStatePersistence(): OrgRuleStatePersistence;