@sema-agent/core 7.9.1 → 7.10.0

package/dist/core/swappable-deps.d.ts

@@ -0,0 +1,90 @@
+/**
+ * The deployment seats a Runner may HOT-SWAP after construction — the vocabulary behind the ONE door,
+ * `Runner.swapDeps` (runtask.ts).
+ *
+ * WHY ONE DOOR. Each hot-swappable seat used to be a verb of its own (`swapModels` was the first), and a
+ * verb per seat restates the same three laws every time — validate the candidate BEFORE anything is
+ * written, write the deps object ONCE (a swap is atomic: a refused candidate leaves the current deps
+ * byte-identical), announce the change under a notice code — while the question "which seats may be
+ * swapped at all" was answered by the list of verbs, i.e. by nothing a compiler could see. With one door
+ * the laws are stated once, the swappable set is THIS closed list, and every seat carries its rows in
+ * the tables beside it: the compiler refuses a member without its rows ({@link AssertAllKeysHandled}),
+ * the door refuses a key outside the set at run time (never a silent ignore — a hot-config driver
+ * handing `{ brain }` must learn that the brain is not a swappable seat, not watch nothing happen).
+ *
+ * WHAT A SWAP MEANS — the natural snapshot, one sentence for every seat: a running task reads the deps
+ * object it was handed at its prepare and holds that reference; a swap replaces the Runner's object, so
+ * every LATER prepare reads the new seat and every in-flight leg keeps the value it prepared under.
+ * Nothing is re-routed, re-priced or re-fenced mid-run; the divergence window is exactly the in-flight
+ * legs' lifetime, by design (the `swapModels` precedent, now the rule for the whole set).
+ *
+ * KEY PRESENCE IS THE INSTRUCTION: a key present on the candidate is REPLACED (an explicit `undefined`
+ * CLEARS an optional seat back to its engine default — `readFace: undefined` ⇒ the deployment declares
+ * no read face, `tiers: undefined` ⇒ no tier bindings); a key absent is KEPT. `Object.hasOwn`, never
+ * truthiness, so the two spellings cannot be confused. An EMPTY candidate is refused: a swap that names
+ * no seat is a caller defect, not a no-op.
+ */
+import type { AssertAllKeysHandled } from "./ask-origin.js";
+import type { RunnerDeps } from "./runner-deps.js";
+/**
+ * The closed set of hot-swappable deployment seats.
+ *  - `models`   — the model catalog generation (the same-name redirect, re-pricing and retirement rules
+ *                 of the former `swapModels`: a string ref resolves against the new catalog at the next
+ *                 prepare; a `Model` object a leg already holds is untouched).
+ *  - `tiers`    — the tier bindings, a BINDING OVER a catalog: it may only be swapped together with
+ *                 `models` (the door refuses `tiers` alone — re-expanding bindings over an already
+ *                 expanded catalog would keep the retired tier words as ordinary keys, which is exactly
+ *                 the stale-generation shape the swap exists to end). Omitted beside `models` ⇒ the
+ *                 current bindings are re-applied over the new catalog; present (including `undefined`)
+ *                 ⇒ replaced.
+ *  - `readFace` — the deployment's read-face declaration ({@link RunnerDeps.readFace}); screened by the
+ *                 same value gate every prepare applies (`assertReadFaceValue`: `"open"` | `"roots"`
+ *                 | absent, anything else refused loudly). The RESOLVED face of a leg is still the
+ *                 resolver's business (task seat, governance, the read-only mount); the swap changes the
+ *                 deployment seat that resolution reads.
+ */
+export declare const SWAPPABLE_DEP_SEATS: readonly ["models", "tiers", "readFace"];
+export type SwappableDepSeat = (typeof SWAPPABLE_DEP_SEATS)[number];
+/** The candidate a swap takes: the swappable seats of {@link RunnerDeps}, each optional (presence = instruction). */
+export type SwappableDeps = Pick<RunnerDeps, SwappableDepSeat>;
+/** Whether a key names a swappable seat. */
+export declare function isSwappableDepSeat(k: unknown): k is SwappableDepSeat;
+/**
+ * Which notice a seat's successful swap is announced under — the disposition table over the set (a seat
+ * with no row does not compile: {@link SwapNoticeTableCoversEverySeat}). `models` and `tiers` share the
+ * catalog-generation line (one swap, one line, both counts); the read face has its own.
+ */
+export declare const SWAP_SEAT_NOTICE: {
+    readonly models: "config.models_swapped";
+    readonly tiers: "config.models_swapped";
+    readonly readFace: "config.read_face_swapped";
+};
+/** The fence over the notice table: `never` while every seat has a row. */
+export type SwapNoticeTableCoversEverySeat = AssertAllKeysHandled<Exclude<SwappableDepSeat, keyof typeof SWAP_SEAT_NOTICE>>;
+/** What the screen hands back: the seats present (set order) and the ONE read of each present seat's value,
+ *  copied at screen time — the door writes from THIS object and never re-reads the caller's. */
+export interface ScreenedSwappableDeps {
+    readonly seats: readonly SwappableDepSeat[];
+    /** A fresh plain object: the screened value of every present seat (`models`/`tiers` shallow-copied,
+     *  `readFace` the screened word; an explicit `undefined` is kept as a PRESENT own key so the door can
+     *  tell "clear this seat" from "not named"). */
+    readonly candidate: SwappableDeps;
+}
+/**
+ * Screen a swap candidate BEFORE anything is written: the object shape, the key set (every own key must
+ * be a member of {@link SWAPPABLE_DEP_SEATS}; at least one), the `tiers`-rides-with-`models` rule, and
+ * each present seat's own value gate. Returns the seats present (set order) and a SNAPSHOT of their values
+ * — the one read. Throws on the first defect; the caller has written nothing yet, so the current deps stay
+ * in force byte-identical.
+ *
+ * ONE READ, BY CONSTRUCTION: every seat value is read off the caller's object exactly once, here, and the
+ * screened copy is what the door writes and announces. A getter-backed or concurrently-mutated candidate
+ * therefore cannot present a legal value to the screen and a different one to the write (or to the
+ * announcement, which runs AFTER the write — a throw there would have left a half-announced swap in
+ * force). The prepare doors read their deps seats the same way.
+ *
+ * The per-seat gate is the SAME one the seat's prepare-time reader applies (`readFace` ⇒
+ * `assertReadFaceValue` with the deployment-seat name a prepare door uses — one value, one loudness, one
+ * seat name on every leg), so a value the door admits is a value every later prepare admits.
+ */
+export declare function screenSwappableDeps(next: unknown): ScreenedSwappableDeps;

package/dist/core/swappable-deps.js

@@ -0,0 +1,55 @@
+import { assertReadFaceValue } from "../tools/fs/read-face.js";
+export const SWAPPABLE_DEP_SEATS = ["models", "tiers", "readFace"];
+const SWAPPABLE_DEP_SEAT_SET = new Set(SWAPPABLE_DEP_SEATS);
+export function isSwappableDepSeat(k) {
+    return SWAPPABLE_DEP_SEAT_SET.has(k);
+}
+export const SWAP_SEAT_NOTICE = {
+    models: "config.models_swapped",
+    tiers: "config.models_swapped",
+    readFace: "config.read_face_swapped",
+};
+export function screenSwappableDeps(next) {
+    if (next === null || typeof next !== "object" || Array.isArray(next)) {
+        throw new Error(`swapDeps: the candidate must be a plain object naming the seats to swap (got ${next === null ? "null" : Array.isArray(next) ? "array" : typeof next}) — the current deps stay in force`);
+    }
+    const keys = Object.keys(next);
+    const unknown = keys.filter((k) => !isSwappableDepSeat(k));
+    if (unknown.length > 0) {
+        throw new Error(`swapDeps: ${unknown.map((k) => JSON.stringify(k)).join(", ")} is not a hot-swappable seat (the closed set is ${SWAPPABLE_DEP_SEATS.join(" | ")}) — the current deps stay in force`);
+    }
+    const present = SWAPPABLE_DEP_SEATS.filter((seat) => Object.hasOwn(next, seat));
+    if (present.length === 0) {
+        throw new Error(`swapDeps: the candidate names no seat (an empty swap is a caller defect, not a no-op) — the current deps stay in force`);
+    }
+    const raw = next;
+    const candidate = {};
+    for (const seat of present) {
+        const v = raw[seat];
+        switch (seat) {
+            case "models":
+                if (v === null || typeof v !== "object" || Array.isArray(v)) {
+                    throw new Error(`swapDeps: models must be a plain Record<string, Model> (got ${v === null ? "null" : Array.isArray(v) ? "array" : typeof v}) — the current generation stays in force`);
+                }
+                candidate.models = { ...v };
+                break;
+            case "tiers":
+                if (!present.includes("models")) {
+                    throw new Error(`swapDeps: tiers is a binding over models — pass the catalog it binds in the same swap (\`{ models, tiers }\`); the current generation stays in force`);
+                }
+                if (v !== undefined && (v === null || typeof v !== "object" || Array.isArray(v))) {
+                    throw new Error(`swapDeps: tiers must be a plain Record<string, ModelRef> or undefined (got ${v === null ? "null" : Array.isArray(v) ? "array" : typeof v}) — the current generation stays in force`);
+                }
+                candidate.tiers = v === undefined ? undefined : { ...v };
+                break;
+            case "readFace":
+                candidate.readFace = assertReadFaceValue(v, "readFace (deployment seat)");
+                break;
+            default: {
+                const _exhaustive = seat;
+                throw new Error(`swapDeps: unhandled seat ${String(_exhaustive)}`);
+            }
+        }
+    }
+    return { seats: present, candidate: candidate };
+}

package/dist/core/tool-policy.d.ts

@@ -204,6 +204,23 @@ export type PermissionResult = {
      *  same safe direction as `matchedAskRule`); it cannot state a window of its own, because the
      *  route it would be a window for has not been chosen yet. */
     denialLimitFallback?: import("./auto-mode.js").UnarmedDenialLimitFallback;
+    /** #616 (additive): the auto-mode classifier was CONSULTED on this ask and could not run — the ask
+     *  flows the original chain exactly as it would have (routing, origin, bit and members unchanged),
+     *  carrying the station FACT beside them so a card can say "asked because the classifier was
+     *  unavailable (timeout)" instead of reading as ordinary hesitation. `cause` is the verdict's own
+     *  word ({@link import("./auto-mode.js").AutoModeUnavailableCause}: `error` / `timeout` /
+     *  `breaker_open`). A FACT, not an origin: CC 2.1.250 marks the same condition as a denial KIND on
+     *  the outcome (`automode-unavailable`) beside the decision's provenance, never in place of it, and
+     *  this engine's divergence (the ask reaches a person instead of being denied) does not move the
+     *  fact onto the origin axis either. ENGINE-STAMPED at the classifier stations (the gate's own and
+     *  the inherited-lane arms) only when the verdict was `unavailable`; `parse_error` stamps nothing
+     *  (the classifier ran and answered outside its contract — a different sentence). Display metadata:
+     *  nothing reads it to decide anything, so a policy that self-declares it can only put its own
+     *  sentence on its own card. Carried onto the approval request and the durable row by the carry
+     *  stations. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /** #144 disclosure (additive): a persisted allow rule MATCHED this call but could not clear the
      *  ask, because the ask is MANDATED (operator shellGate:"always", or the tool's own
      *  egress/irreversibility marks) rather than a classifier's hesitation — "allow rules silence
@@ -1191,6 +1208,15 @@ export interface AskRequest {
      *  that forwards a decision's member here does not compile, which is the point: the window is the
      *  route's fact, and forwarding it silently is how a configured window becomes a wait with none. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** #616 (additive) — present ⇔ the auto-mode classifier was consulted on this ask and could not run (see
+     *  the {@link PermissionResult} ask-arm member of the same name): the card's "asked because the
+     *  classifier was unavailable" fact, with the verdict's own cause word. Absent on every ask the classifier
+     *  answered, was not eligible for, or was not wired for — read presence, never absence. Filled by the
+     *  carry stations from the decision, never a caller/worker-settable field; the durable park row carries
+     *  the same member (`PendingAction.tool_approval.classifierUnavailable`). */
+    readonly classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /** (additive) WHICH AUTHORITY raised this ask — the wire twin of the {@link PermissionResult} ask-arm
      *  member of the same name, one word from the closed {@link import("./ask-origin.js").AskOrigin} set.
      *  The gate's own mint station copies the engine-stamped word; the three inherited-lane stations

package/dist/core/tool-policy.js

@@ -410,6 +410,7 @@ export function combinePolicies(...policies) {
             let ruleAskText;
             let probeMandateSeen = false;
             let fallbackSeen;
+            let classifierUnavailableSeen;
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
@@ -440,13 +441,16 @@ export function combinePolicies(...policies) {
                     probeMandateSeen = true;
                 if (d.action === "ask" && d.denialLimitFallback !== undefined && fallbackSeen === undefined)
                     fallbackSeen = d.denialLimitFallback;
+                if (d.action === "ask" && d.classifierUnavailable !== undefined && classifierUnavailableSeen === undefined)
+                    classifierUnavailableSeen = d.classifierUnavailable;
             }
             if (asked) {
                 const merged = rewrite?.updatedInput;
                 const withRuleAsk = ruleAskText !== undefined && asked.matchedAskRule === undefined ? { ...asked, matchedAskRule: ruleAskText } : asked;
                 const withMark = probeMandateSeen && withRuleAsk.probeMandated !== true ? { ...withRuleAsk, probeMandated: true } : withRuleAsk;
                 const withFallback = fallbackSeen !== undefined && withMark.denialLimitFallback === undefined ? { ...withMark, denialLimitFallback: fallbackSeen, requiresRealApproval: true } : withMark;
-                return merged !== undefined ? { ...withFallback, updatedInput: merged } : withFallback;
+                const withFact = classifierUnavailableSeen !== undefined && withFallback.classifierUnavailable === undefined ? { ...withFallback, classifierUnavailable: { cause: classifierUnavailableSeen.cause } } : withFallback;
+                return merged !== undefined ? { ...withFact, updatedInput: merged } : withFact;
             }
             const allowed = rewrite ?? ALLOW;
             if (settledAllow === undefined)

package/dist/core/wiring-manifest.d.ts

@@ -244,10 +244,21 @@ export interface WiringManifest {
      * classifier decider was minted for this leg), and `reason` names the first arm that failed
      * otherwise — see {@link AUTO_MODE_ARM_REASONS}. A serving layer that used to infer the mode from
      * spec shape reads it here instead.
+     *
+     * `breaker` (#616) — the SESSION-level breaker read face: the most recent one-way breaker trip recorded
+     * for this session on this Runner (an EARLIER leg's decider — the latch is a per-run fact and a leg-start
+     * manifest's own decider is closed by construction, which is why there is no `open` boolean here: it
+     * would read `false` on every mint; the reason vocabulary reserves `latch_open` for a mid-leg re-read
+     * face nothing mints today). Present ⇔ a trip was recorded (never tripped, evicted or a standalone
+     * prepare ⇒ absent). `{ openedAtMs, lastCause, failures, runId }` — see
+     * {@link import("./auto-mode.js").AutoModeBreakerTrip}. A per-leg observation like `mcp`, so it is NOT
+     * part of {@link configFingerprint}: legs of one assembly must fingerprint alike whether or not a
+     * classifier was down.
      */
     autoMode?: {
         armed: boolean;
         reason: AutoModeArmReason;
+        breaker?: import("./auto-mode.js").AutoModeBreakerTrip;
     };
     /**
      * EFFECTIVE half only, and ALWAYS present on an engine-minted effective manifest (the `autoMode`
@@ -336,10 +347,13 @@ export interface WiringFacts {
         restore: string;
     };
     /** Effective half only — see {@link WiringManifest.autoMode}; the static half has no leg to arm.
-     *  `armed` must agree with `reason` (`armed ⇔ reason === "armed"`); a contradicting pair is refused. */
+     *  `armed` must agree with `reason` (`armed ⇔ reason === "armed"`); a contradicting pair is refused.
+     *  `breaker` (#616) is the session's most recent recorded trip, or absent; a trip whose cause is outside
+     *  the closed set or whose numbers are not finite is refused. */
     autoMode?: {
         armed: boolean;
         reason: AutoModeArmReason;
+        breaker?: import("./auto-mode.js").AutoModeBreakerTrip;
     };
     /** Effective half only — see {@link WiringManifest.mcp}; the static half materializes nothing.
      *  Copied entry-wise onto the manifest (the caller's array is never aliased). */

package/dist/core/wiring-manifest.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { AUTO_MODE_BREAKER_CAUSES, isAutoModeBreakerCause } from "./auto-mode.js";
 import { canonicalize } from "./canonical-json.js";
 import { resolveCheckpointStore } from "./checkpoint-store.js";
 import { isLiveQuestionFace } from "./ask-question.js";
@@ -71,7 +72,13 @@ function readAutoModeFact(fact) {
     if (!AUTO_MODE_ARM_REASONS.includes(fact.reason) || fact.armed !== (fact.reason === "armed")) {
         throw new Error(`the auto-mode wiring fact is inconsistent (armed=${String(fact.armed)}, reason=${JSON.stringify(fact.reason)}) — armed must hold exactly when reason is "armed", and reason must be one of ${AUTO_MODE_ARM_REASONS.join("|")}`);
     }
-    return { armed: fact.armed, reason: fact.reason };
+    const b = fact.breaker;
+    if (b === undefined)
+        return { armed: fact.armed, reason: fact.reason };
+    if (!isAutoModeBreakerCause(b.lastCause) || !Number.isFinite(b.openedAtMs) || !Number.isInteger(b.failures) || b.failures < 1 || typeof b.runId !== "string" || b.runId === "") {
+        throw new Error(`the auto-mode breaker fact is malformed (${JSON.stringify(b)}) — lastCause must be one of ${AUTO_MODE_BREAKER_CAUSES.join("|")}, openedAtMs finite, failures a positive integer, runId a non-empty string`);
+    }
+    return { armed: fact.armed, reason: fact.reason, breaker: { openedAtMs: b.openedAtMs, lastCause: b.lastCause, failures: b.failures, runId: b.runId } };
 }
 export function deriveWiringManifest(facts) {
     if (facts.half === "static" && facts.leg !== undefined) {
@@ -133,8 +140,9 @@ export function deriveWiringManifest(facts) {
         const { leg: _leg, mcp: _mcp, tools: _tools, ...assembly } = manifest;
         const { provenance: _askSeat, ...askForHash } = assembly.ask;
         const { provenance: _questionSeat, ...questionForHash } = assembly.question;
+        const { breaker: _breaker, ...autoModeForHash } = assembly.autoMode ?? {};
         manifest.configFingerprint = createHash("sha256")
-            .update(canonicalize({ ...assembly, ask: askForHash, question: questionForHash }))
+            .update(canonicalize({ ...assembly, ask: askForHash, question: questionForHash, ...(assembly.autoMode !== undefined ? { autoMode: autoModeForHash } : {}) }))
             .digest("hex")
             .slice(0, 16);
     }

package/dist/core/workflow-journal-store.d.ts

@@ -5,12 +5,31 @@ import type { TaskResult } from "./types.js";
  * longest unchanged PREFIX of these (keyed by the deterministic {@link workflowAgentCallKey}) and runs only the
  * first changed/new call + everything after it live. Same script + same args → 100% cache hit.
  */
-export interface WorkflowJournalEntry {
+export type WorkflowJournalEntry = {
     /** The agent's deterministic call key (`ordinal:specIdentityHash`) — the replay match key. */
     callKey: string;
     /** The agent's TaskResult, replayed verbatim when a resume's call key matches at the same ordinal. */
     result: TaskResult;
-}
+    parked?: never;
+} | {
+    callKey: string;
+    result?: never;
+    /**
+     * #642 — the ordinal's leg is PARKED at a durable approval gate: the child's own paused `TaskResult`
+     * (its `terminal` carries the checkpoint token + gate, its `sessionId` the pinned session). A resume
+     * reaching this ordinal with a matching call key does NOT run the call live (the parked child's
+     * session is pinned under a pending checkpoint; a fresh spawn would duplicate it) — it drives the
+     * parked child's resume when the caller hands it a decision for the token, else re-parks. Deliberately
+     * a DIFFERENT key from `result`: a journal reader from before this entry kind existed finds no
+     * `result.terminal` and refuses the whole resume (`WorkflowJournalIncompatibleError`) instead of
+     * admitting a paused cause it would re-run live — one-way, loud, like every journal schema step.
+     */
+    parked: TaskResult & {
+        terminal: Extract<TaskResult["terminal"], {
+            kind: "paused";
+        }>;
+    };
+};
 /** REF-D5: the resume-claim key triple — ONE shape for the interface pair and every implementation
  *  (it was re-inlined seven times; a key-field rename must red every leg at once). */
 export interface ResumeClaimArgs {

package/dist/core/workflow-journal-store.js

@@ -65,7 +65,7 @@ export class InMemoryWorkflowJournalStore {
         return [...rec.byOrdinal.entries()].sort((a, b) => a[0] - b[0]).map(([, e]) => snapshot(e));
     }
     async append(runId, scope, entry) {
-        if (oversizeJournalResult(JSON.stringify(entry.result)))
+        if (oversizeJournalResult(JSON.stringify(entry.parked !== undefined ? entry.parked : entry.result)))
             return;
         let rec = this.runs.get(runId);
         if (!rec) {

package/dist/engine/execution-env/node-execution-env.d.ts

@@ -79,6 +79,8 @@ export declare function openSpoolPair(base: string): {
 };
 export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCapability, SchedulerCapability {
     cwd: string;
+    /** #644 — this adapter runs on the engine host, so the host's home IS the environment's (`ExecutionEnv.homeDir`). */
+    readonly homeDir: string;
     private shellPath?;
     private shellEnv?;
     private inheritEnv;

package/dist/engine/execution-env/node-execution-env.js

@@ -2,7 +2,7 @@ import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { closeSync, constants, createReadStream, mkdtempSync, openSync, readSync, statSync, truncateSync, unlinkSync } from "node:fs";
 import { access, appendFile, lstat, mkdir, mkdtemp, open, readdir, readFile, readlink, realpath, rename, rm, unlink, writeFile, } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { ExecutionError, err, FileError, ok, toError, } from "../harness/types.js";
@@ -284,6 +284,7 @@ export function openSpoolPair(base) {
 }
 export class NodeExecutionEnv {
     cwd;
+    homeDir = homedir();
     shellPath;
     shellEnv;
     inheritEnv;

package/dist/engine/harness/types.d.ts

@@ -498,6 +498,17 @@ export interface ExecutionEnv extends FileSystem, Shell {
      * SSH env to an organization-managed build host can be non-isolated yet omit this flag.
      */
     readonly externalContentTarget?: boolean;
+    /**
+     * #644 — declared by the ADAPTER: the HOME DIRECTORY of the user this environment runs as, as an absolute
+     * path in the environment's own namespace. The base a `~/`-relative permission rule (`Edit(~/.ssh/**)`)
+     * resolves against for calls executing in this env. Omitted ⇒ the environment declares no home, and every
+     * `~/` deny/ask rule reads UNREADABLE for its calls (a fail-closed ask a person clears), because the only
+     * other candidate — the ENGINE PROCESS's home — is the wrong directory on any leg whose environment is not
+     * the engine host (a remote executor, a sandbox), and guarding the wrong directory silently was the
+     * defect. A local Node environment declares `os.homedir()` (it IS the host). A declared value that is not
+     * an absolute path is refused at prepare (`config.execution_env_home_dir_invalid`), never read as absent.
+     */
+    readonly homeDir?: string;
 }
 /** Base fields shared by append-only session tree entries. */
 export interface SessionTreeEntryBase {

package/dist/index.d.ts

@@ -54,6 +54,7 @@ export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure, type McpFailure, type McpFailureKind, type McpDelivered } from "./core/mcp-failure.js";
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
+export { askUnresolvableNotice, type AskUnresolvableFacts } from "./core/ask-unresolvable-notice.js";
 export { materializeA2aTools, A2aRpcError, type MaterializedA2a, type A2aPeerStatus, type A2aRefreshResult, type A2aToolAxis } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
@@ -166,7 +167,8 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL } from "./core/ask-origin.js";
 export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, type GateDisposition, type GateOutcome, screenGateOutcome } from "./core/gate-outcome.js";
 export { type AskCarry } from "./core/hooks.js";
-export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
+export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps, type SwappableDepSeat, type SwappableDeps } from "./core/swappable-deps.js";
+export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, AUTO_MODE_BREAKER_CAUSES, isAutoModeBreakerCause, AutoModeBreakerLedger, type AutoModeUnavailableCause, type AutoModeBreakerCause, type AutoModeBreakerTrip, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -188,7 +190,7 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReach, type ProgramRunReachOutcome, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReach, type ProgramRunReachOutcome, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBase, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
@@ -228,7 +230,7 @@ export { type ReasoningIntensity, type ReasoningResolution, type ResolvedReasoni
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, type ScenarioId, type CodeReviewMode, type ScenarioProfile, type RunScenarioOptions, type RunScenarioResult, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, type TeacherModePair, type TeacherProfile, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, type OrchestrationMode, type OrchestrationEnv, } from "./scenarios/env.js";
-export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, type WorkflowFanOutSlotError, type WorkflowFanOutOptions, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, type WorkflowHandle, MAX_WORKFLOW_ITEMS, type WorkflowRun, type WorkflowRunStatus, type WorkflowItemStatus, type WorkflowPhase, type WorkflowGroup, type WorkflowAgentRun, type WorkflowAgentHandle, type WorkflowRunStats, type WorkflowEvent, type WorkflowBudget, type WorkflowAgentOptions, type WorkflowRunContext, type WorkflowInternals, type RunWorkflowOptions, type RunWorkflowResult, type WorkflowTimers, } from "./orchestration/workflow.js";
+export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, WorkflowAgentParkedError, WORKFLOW_AGENT_PARKED_ERROR_CODE, type WorkflowParkedResume, type WorkflowFanOutSlotError, type WorkflowFanOutOptions, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, type WorkflowHandle, MAX_WORKFLOW_ITEMS, type WorkflowRun, type WorkflowRunStatus, type WorkflowItemStatus, type WorkflowPhase, type WorkflowGroup, type WorkflowAgentRun, type WorkflowAgentHandle, type WorkflowRunStats, type WorkflowEvent, type WorkflowBudget, type WorkflowAgentOptions, type WorkflowRunContext, type WorkflowInternals, type RunWorkflowOptions, type RunWorkflowResult, type WorkflowTimers, } from "./orchestration/workflow.js";
 export { listWorkflowRuns, getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, type AgentDisplayStatus } from "./orchestration/workflow-observe.js";
 export { runGoal, DECLARE_DONE_TOOL_NAME, type GoalSpec, type GoalResult, type GoalStatus, type GoalBudgetCause, type GoalVerdict, type GoalTurnState, type GoalVerificationKind, } from "./orchestration/goal.js";
 export { emitTaskOutcome, type TaskOutcome } from "./core/task-outcome.js";

package/dist/index.js

@@ -41,6 +41,7 @@ export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure } from "./core/mcp-failure.js";
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice } from "./core/mcp-injection-drop.js";
+export { askUnresolvableNotice } from "./core/ask-unresolvable-notice.js";
 export { materializeA2aTools, A2aRpcError } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, } from "./core/session-policy-store.js";
@@ -140,14 +141,15 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export { ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL } from "./core/ask-origin.js";
 export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, screenGateOutcome } from "./core/gate-outcome.js";
 export {} from "./core/hooks.js";
-export { parseAutoModeResponse, createAutoModeDecider, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
+export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
+export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, AUTO_MODE_BREAKER_CAUSES, isAutoModeBreakerCause, AutoModeBreakerLedger, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, } from "./core/permission-rule-provider.js";
@@ -186,7 +188,7 @@ export { DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf,
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, } from "./scenarios/env.js";
-export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, MAX_WORKFLOW_ITEMS, } from "./orchestration/workflow.js";
+export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, WorkflowAgentParkedError, WORKFLOW_AGENT_PARKED_ERROR_CODE, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, MAX_WORKFLOW_ITEMS, } from "./orchestration/workflow.js";
 export { listWorkflowRuns, getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus } from "./orchestration/workflow-observe.js";
 export { runGoal, DECLARE_DONE_TOOL_NAME, } from "./orchestration/goal.js";
 export { emitTaskOutcome } from "./core/task-outcome.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -307,6 +307,23 @@ export interface RunWorkflowToolDeps {
      *  Absent on both seats ⇒ byte-identical baseline: a child's asks keep the pre-#342 resolution
      *  (`RunnerDeps.onAsk`, else the fail-closed headless auto-deny). */
     parentOnAsk?: import("../core/tool-policy.js").OnAsk;
+    /** #642 — the HOST run's `durableApproval` opt-in (value copy; the Runner mints it from `spec.durableApproval`
+     *  beside `parentOnAsk`, the same seat the delegation tool reads as `ctx.durableApprovalForChildren`). Folded
+     *  into `RunWorkflowOptions.defaultDurableApproval` at execute — ONLY when a `store` is wired (the wa* row's
+     *  durable home; without it the child keeps the pre-#642 lifecycle: its unavailable ask denies fail-closed
+     *  and the `delegation.ask_unresolvable` notice says so). `ctx.durableApprovalForChildren` wins when a
+     *  wrapping path provides it; this dep covers the auto-mounted tool's minimal execute ctx, like `parentOnAsk`.
+     *  Absent on both seats ⇒ byte-identical: a workflow child's ask keeps the host-seat resolution alone. */
+    parentDurableApproval?: {
+        scope: string;
+        ttlMs?: number;
+    };
+    /** #642 — the decisions a host holds for PARKED wa* rows of a prior run, read at execute when the model
+     *  re-invokes with `resumeFromRunId` (a call-time getter over the run id: the decisions arrive on the host's
+     *  trusted run channel, `RunInternals.workflowParkedResume`, and only the ones naming THIS resume's source run
+     *  apply). Threaded into `RunWorkflowOptions.parkedResume`: the resume drives the parked child on with the
+     *  decision instead of re-parking. Never a tool argument — a model cannot decide an approval. */
+    parkedResume?: (resumeFromRunId: string) => ReadonlyArray<import("./workflow.js").WorkflowParkedResume> | undefined;
     /** The HOST run's display sink (its `RunInternals.onForwardEvent` behind the runner's ctx wrapper:
      *  `task_progress` always, plus the children's content events — `text_delta`/`text_end`/
      *  `reasoning_delta`/`tool_start`/`tool_end`, UNTRUSTED-RAW: the consumer must redact — when the HOST spec set

package/dist/orchestration/run-workflow-tool.js

@@ -5,6 +5,7 @@ import { redactSecrets, redactHostLeaks, boundedRedactedSummary } from "../core/
 import { withDelegationProvenance } from "../core/tool-policy.js";
 import { LAUNCH_RECEIPT_OWN_WORDS_CLAUSE, launchReceiptNoQuoteClause } from "../agents/launch-receipt-contract.js";
 import { startWorkflow } from "./workflow.js";
+import { WORKFLOW_AGENT_PARKED_ERROR_CODE } from "./workflow-types.js";
 import { buildWorkflowPrimitives } from "./workflow-primitives.js";
 import { parseWorkflowMeta, splitWorkflowMeta, workflowScriptReadsClockOrRandom } from "./workflow-meta.js";
 import { mergeWorkflowArgs, normalizeStringArg } from "./workflow-script-store.js";
@@ -51,6 +52,7 @@ function workflowUsageBlock(run) {
         agent_count: agents.length,
         agents_done: agents.filter((a) => a.status === "completed").length,
         agents_error: agents.filter((a) => a.status === "failed").length,
+        ...(agents.some((a) => a.status === "parked") ? { agents_parked: agents.filter((a) => a.status === "parked").length } : {}),
         agents_empty_result: agents.filter((a) => a.status === "completed" && (a.output === undefined || a.output === "")).length,
         agents_replayed: agents.filter((a) => a.replayed === true).length,
         ...(run.journalSkips !== undefined && run.journalSkips > 0 ? { journal_skipped: run.journalSkips } : {}),
@@ -76,6 +78,7 @@ function workflowDiagnostics(runId, journalRef, resumeMiss) {
 }
 const SCRIPT_ERROR_CODES = new Set([
     "workflow.script_error",
+    "workflow.parked_call_changed",
     "workflow.nesting",
     "workflow.model_not_allowed",
     "workflow.agent_schema",
@@ -86,6 +89,12 @@ const SCRIPT_ERROR_CODES = new Set([
 function failureSummary(err, runId) {
     const e = err;
     const code = typeof e?.code === "string" ? e.code : undefined;
+    if (code === WORKFLOW_AGENT_PARKED_ERROR_CODE) {
+        const msg = typeof e?.message === "string" ? redactSecrets(e.message) : "";
+        return (`workflow parked (${code}): ${msg.length > 200 ? `${msg.slice(0, 200)}…` : msg} — it did not fail and is not finished` +
+            (runId ? `; per-agent rows via TaskOutput("${runId}") (the parked row reads status "parked")` : "") +
+            `; do not re-issue the same call — once the approval is decided, the deployment resumes this run${runId ? ` (resumeFromRunId: "${runId}")` : ""} and the script continues from the parked call`);
+    }
     const guide = runId
         ? `; per-agent rows via TaskOutput("${runId}"); after fixing, re-invoke with resumeFromRunId: "${runId}" (completed agents replay from the journal)`
         : "";
@@ -465,6 +474,7 @@ export async function createRunWorkflowTool(d) {
                 return structuredError(`workflow script failed to compile: ${err instanceof Error ? err.message : String(err)}`);
             }
             const hostOnAsk = ctx.onAsk ?? d.parentOnAsk;
+            const hostDurableApproval = ctx.durableApprovalForChildren ?? d.parentDurableApproval;
             const runGovernance = hostOnAsk !== undefined && governance.baseline.base.onAsk === undefined
                 ? {
                     ...governance,
@@ -537,6 +547,8 @@ export async function createRunWorkflowTool(d) {
                     })(),
                     ...(d.parentModel !== undefined ? { defaultModel: d.parentModel } : {}),
                     ...(d.parentGetApiKeyAndHeaders !== undefined ? { defaultGetApiKeyAndHeaders: d.parentGetApiKeyAndHeaders } : {}),
+                    ...(hostDurableApproval !== undefined && d.store !== undefined ? { defaultDurableApproval: { ...hostDurableApproval } } : {}),
+                    ...(resumeFromRunId !== undefined && d.parkedResume !== undefined && d.parkedResume(resumeFromRunId) !== undefined ? { parkedResume: d.parkedResume(resumeFromRunId) } : {}),
                     ...(parentCenterArtifactDigest !== undefined ? { parentCenterArtifactDigest } : {}),
                     ...(parentCenterSourceRevision !== undefined ? { parentCenterSourceRevision } : {}),
                     ...((ctx.forwardEvent ?? d.forwardEvent) !== undefined ? { onForwardEvent: (ctx.forwardEvent ?? d.forwardEvent) } : {}),

package/dist/orchestration/workflow-observe.d.ts

@@ -56,7 +56,7 @@ export declare function listWorkflowRuns(store: WorkflowRunStore, scope: string,
  */
 export declare function getWorkflowRun(store: WorkflowRunStore, id: string, scope: string): Promise<WorkflowRun | null>;
 /** design/99 MF-W display status. */
-export type AgentDisplayStatus = "queued" | "running" | "done" | "failed" | "interrupted";
+export type AgentDisplayStatus = "queued" | "running" | "done" | "failed" | "interrupted" | "parked";
 /**
  * design/99 MF-W (design-review DoR ⑤+⑥): the SHARED, anti-drift projection of a workflow agent's record-level
  * status → a CC-style display status, derived PURELY from the persisted record (the agent's `status` + `startedAt`

package/dist/orchestration/workflow-observe.js

@@ -66,6 +66,8 @@ export function deriveAgentDisplayStatus(agent, runStatus) {
         return "done";
     if (agent.status === "failed")
         return "failed";
+    if (agent.status === "parked")
+        return "parked";
     if (runStatus !== "running")
         return "interrupted";
     return agent.startedAt === undefined ? "queued" : "running";