@sema-agent/core 7.9.2 → 7.10.0

package/dist/core/wiring-manifest.d.ts

@@ -244,10 +244,21 @@ export interface WiringManifest {
      * classifier decider was minted for this leg), and `reason` names the first arm that failed
      * otherwise — see {@link AUTO_MODE_ARM_REASONS}. A serving layer that used to infer the mode from
      * spec shape reads it here instead.
+     *
+     * `breaker` (#616) — the SESSION-level breaker read face: the most recent one-way breaker trip recorded
+     * for this session on this Runner (an EARLIER leg's decider — the latch is a per-run fact and a leg-start
+     * manifest's own decider is closed by construction, which is why there is no `open` boolean here: it
+     * would read `false` on every mint; the reason vocabulary reserves `latch_open` for a mid-leg re-read
+     * face nothing mints today). Present ⇔ a trip was recorded (never tripped, evicted or a standalone
+     * prepare ⇒ absent). `{ openedAtMs, lastCause, failures, runId }` — see
+     * {@link import("./auto-mode.js").AutoModeBreakerTrip}. A per-leg observation like `mcp`, so it is NOT
+     * part of {@link configFingerprint}: legs of one assembly must fingerprint alike whether or not a
+     * classifier was down.
      */
     autoMode?: {
         armed: boolean;
         reason: AutoModeArmReason;
+        breaker?: import("./auto-mode.js").AutoModeBreakerTrip;
     };
     /**
      * EFFECTIVE half only, and ALWAYS present on an engine-minted effective manifest (the `autoMode`
@@ -336,10 +347,13 @@ export interface WiringFacts {
         restore: string;
     };
     /** Effective half only — see {@link WiringManifest.autoMode}; the static half has no leg to arm.
-     *  `armed` must agree with `reason` (`armed ⇔ reason === "armed"`); a contradicting pair is refused. */
+     *  `armed` must agree with `reason` (`armed ⇔ reason === "armed"`); a contradicting pair is refused.
+     *  `breaker` (#616) is the session's most recent recorded trip, or absent; a trip whose cause is outside
+     *  the closed set or whose numbers are not finite is refused. */
     autoMode?: {
         armed: boolean;
         reason: AutoModeArmReason;
+        breaker?: import("./auto-mode.js").AutoModeBreakerTrip;
     };
     /** Effective half only — see {@link WiringManifest.mcp}; the static half materializes nothing.
      *  Copied entry-wise onto the manifest (the caller's array is never aliased). */

package/dist/core/wiring-manifest.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { AUTO_MODE_BREAKER_CAUSES, isAutoModeBreakerCause } from "./auto-mode.js";
 import { canonicalize } from "./canonical-json.js";
 import { resolveCheckpointStore } from "./checkpoint-store.js";
 import { isLiveQuestionFace } from "./ask-question.js";
@@ -71,7 +72,13 @@ function readAutoModeFact(fact) {
     if (!AUTO_MODE_ARM_REASONS.includes(fact.reason) || fact.armed !== (fact.reason === "armed")) {
         throw new Error(`the auto-mode wiring fact is inconsistent (armed=${String(fact.armed)}, reason=${JSON.stringify(fact.reason)}) — armed must hold exactly when reason is "armed", and reason must be one of ${AUTO_MODE_ARM_REASONS.join("|")}`);
     }
-    return { armed: fact.armed, reason: fact.reason };
+    const b = fact.breaker;
+    if (b === undefined)
+        return { armed: fact.armed, reason: fact.reason };
+    if (!isAutoModeBreakerCause(b.lastCause) || !Number.isFinite(b.openedAtMs) || !Number.isInteger(b.failures) || b.failures < 1 || typeof b.runId !== "string" || b.runId === "") {
+        throw new Error(`the auto-mode breaker fact is malformed (${JSON.stringify(b)}) — lastCause must be one of ${AUTO_MODE_BREAKER_CAUSES.join("|")}, openedAtMs finite, failures a positive integer, runId a non-empty string`);
+    }
+    return { armed: fact.armed, reason: fact.reason, breaker: { openedAtMs: b.openedAtMs, lastCause: b.lastCause, failures: b.failures, runId: b.runId } };
 }
 export function deriveWiringManifest(facts) {
     if (facts.half === "static" && facts.leg !== undefined) {
@@ -133,8 +140,9 @@ export function deriveWiringManifest(facts) {
         const { leg: _leg, mcp: _mcp, tools: _tools, ...assembly } = manifest;
         const { provenance: _askSeat, ...askForHash } = assembly.ask;
         const { provenance: _questionSeat, ...questionForHash } = assembly.question;
+        const { breaker: _breaker, ...autoModeForHash } = assembly.autoMode ?? {};
         manifest.configFingerprint = createHash("sha256")
-            .update(canonicalize({ ...assembly, ask: askForHash, question: questionForHash }))
+            .update(canonicalize({ ...assembly, ask: askForHash, question: questionForHash, ...(assembly.autoMode !== undefined ? { autoMode: autoModeForHash } : {}) }))
             .digest("hex")
             .slice(0, 16);
     }

package/dist/core/workflow-journal-store.d.ts

@@ -5,12 +5,31 @@ import type { TaskResult } from "./types.js";
  * longest unchanged PREFIX of these (keyed by the deterministic {@link workflowAgentCallKey}) and runs only the
  * first changed/new call + everything after it live. Same script + same args → 100% cache hit.
  */
-export interface WorkflowJournalEntry {
+export type WorkflowJournalEntry = {
     /** The agent's deterministic call key (`ordinal:specIdentityHash`) — the replay match key. */
     callKey: string;
     /** The agent's TaskResult, replayed verbatim when a resume's call key matches at the same ordinal. */
     result: TaskResult;
-}
+    parked?: never;
+} | {
+    callKey: string;
+    result?: never;
+    /**
+     * #642 — the ordinal's leg is PARKED at a durable approval gate: the child's own paused `TaskResult`
+     * (its `terminal` carries the checkpoint token + gate, its `sessionId` the pinned session). A resume
+     * reaching this ordinal with a matching call key does NOT run the call live (the parked child's
+     * session is pinned under a pending checkpoint; a fresh spawn would duplicate it) — it drives the
+     * parked child's resume when the caller hands it a decision for the token, else re-parks. Deliberately
+     * a DIFFERENT key from `result`: a journal reader from before this entry kind existed finds no
+     * `result.terminal` and refuses the whole resume (`WorkflowJournalIncompatibleError`) instead of
+     * admitting a paused cause it would re-run live — one-way, loud, like every journal schema step.
+     */
+    parked: TaskResult & {
+        terminal: Extract<TaskResult["terminal"], {
+            kind: "paused";
+        }>;
+    };
+};
 /** REF-D5: the resume-claim key triple — ONE shape for the interface pair and every implementation
  *  (it was re-inlined seven times; a key-field rename must red every leg at once). */
 export interface ResumeClaimArgs {

package/dist/core/workflow-journal-store.js

@@ -65,7 +65,7 @@ export class InMemoryWorkflowJournalStore {
         return [...rec.byOrdinal.entries()].sort((a, b) => a[0] - b[0]).map(([, e]) => snapshot(e));
     }
     async append(runId, scope, entry) {
-        if (oversizeJournalResult(JSON.stringify(entry.result)))
+        if (oversizeJournalResult(JSON.stringify(entry.parked !== undefined ? entry.parked : entry.result)))
             return;
         let rec = this.runs.get(runId);
         if (!rec) {

package/dist/engine/execution-env/node-execution-env.d.ts

@@ -79,6 +79,8 @@ export declare function openSpoolPair(base: string): {
 };
 export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCapability, SchedulerCapability {
     cwd: string;
+    /** #644 — this adapter runs on the engine host, so the host's home IS the environment's (`ExecutionEnv.homeDir`). */
+    readonly homeDir: string;
     private shellPath?;
     private shellEnv?;
     private inheritEnv;

package/dist/engine/execution-env/node-execution-env.js

@@ -2,7 +2,7 @@ import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { closeSync, constants, createReadStream, mkdtempSync, openSync, readSync, statSync, truncateSync, unlinkSync } from "node:fs";
 import { access, appendFile, lstat, mkdir, mkdtemp, open, readdir, readFile, readlink, realpath, rename, rm, unlink, writeFile, } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { ExecutionError, err, FileError, ok, toError, } from "../harness/types.js";
@@ -284,6 +284,7 @@ export function openSpoolPair(base) {
 }
 export class NodeExecutionEnv {
     cwd;
+    homeDir = homedir();
     shellPath;
     shellEnv;
     inheritEnv;

package/dist/engine/harness/types.d.ts

@@ -498,6 +498,17 @@ export interface ExecutionEnv extends FileSystem, Shell {
      * SSH env to an organization-managed build host can be non-isolated yet omit this flag.
      */
     readonly externalContentTarget?: boolean;
+    /**
+     * #644 — declared by the ADAPTER: the HOME DIRECTORY of the user this environment runs as, as an absolute
+     * path in the environment's own namespace. The base a `~/`-relative permission rule (`Edit(~/.ssh/**)`)
+     * resolves against for calls executing in this env. Omitted ⇒ the environment declares no home, and every
+     * `~/` deny/ask rule reads UNREADABLE for its calls (a fail-closed ask a person clears), because the only
+     * other candidate — the ENGINE PROCESS's home — is the wrong directory on any leg whose environment is not
+     * the engine host (a remote executor, a sandbox), and guarding the wrong directory silently was the
+     * defect. A local Node environment declares `os.homedir()` (it IS the host). A declared value that is not
+     * an absolute path is refused at prepare (`config.execution_env_home_dir_invalid`), never read as absent.
+     */
+    readonly homeDir?: string;
 }
 /** Base fields shared by append-only session tree entries. */
 export interface SessionTreeEntryBase {

package/dist/index.d.ts

@@ -54,6 +54,7 @@ export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure, type McpFailure, type McpFailureKind, type McpDelivered } from "./core/mcp-failure.js";
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
+export { askUnresolvableNotice, type AskUnresolvableFacts } from "./core/ask-unresolvable-notice.js";
 export { materializeA2aTools, A2aRpcError, type MaterializedA2a, type A2aPeerStatus, type A2aRefreshResult, type A2aToolAxis } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
@@ -166,7 +167,8 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL } from "./core/ask-origin.js";
 export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, type GateDisposition, type GateOutcome, screenGateOutcome } from "./core/gate-outcome.js";
 export { type AskCarry } from "./core/hooks.js";
-export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
+export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps, type SwappableDepSeat, type SwappableDeps } from "./core/swappable-deps.js";
+export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, AUTO_MODE_BREAKER_CAUSES, isAutoModeBreakerCause, AutoModeBreakerLedger, type AutoModeUnavailableCause, type AutoModeBreakerCause, type AutoModeBreakerTrip, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -188,7 +190,7 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReach, type ProgramRunReachOutcome, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReach, type ProgramRunReachOutcome, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBase, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
@@ -228,7 +230,7 @@ export { type ReasoningIntensity, type ReasoningResolution, type ResolvedReasoni
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, type ScenarioId, type CodeReviewMode, type ScenarioProfile, type RunScenarioOptions, type RunScenarioResult, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, type TeacherModePair, type TeacherProfile, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, type OrchestrationMode, type OrchestrationEnv, } from "./scenarios/env.js";
-export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, type WorkflowFanOutSlotError, type WorkflowFanOutOptions, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, type WorkflowHandle, MAX_WORKFLOW_ITEMS, type WorkflowRun, type WorkflowRunStatus, type WorkflowItemStatus, type WorkflowPhase, type WorkflowGroup, type WorkflowAgentRun, type WorkflowAgentHandle, type WorkflowRunStats, type WorkflowEvent, type WorkflowBudget, type WorkflowAgentOptions, type WorkflowRunContext, type WorkflowInternals, type RunWorkflowOptions, type RunWorkflowResult, type WorkflowTimers, } from "./orchestration/workflow.js";
+export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, WorkflowAgentParkedError, WORKFLOW_AGENT_PARKED_ERROR_CODE, type WorkflowParkedResume, type WorkflowFanOutSlotError, type WorkflowFanOutOptions, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, type WorkflowHandle, MAX_WORKFLOW_ITEMS, type WorkflowRun, type WorkflowRunStatus, type WorkflowItemStatus, type WorkflowPhase, type WorkflowGroup, type WorkflowAgentRun, type WorkflowAgentHandle, type WorkflowRunStats, type WorkflowEvent, type WorkflowBudget, type WorkflowAgentOptions, type WorkflowRunContext, type WorkflowInternals, type RunWorkflowOptions, type RunWorkflowResult, type WorkflowTimers, } from "./orchestration/workflow.js";
 export { listWorkflowRuns, getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, type AgentDisplayStatus } from "./orchestration/workflow-observe.js";
 export { runGoal, DECLARE_DONE_TOOL_NAME, type GoalSpec, type GoalResult, type GoalStatus, type GoalBudgetCause, type GoalVerdict, type GoalTurnState, type GoalVerificationKind, } from "./orchestration/goal.js";
 export { emitTaskOutcome, type TaskOutcome } from "./core/task-outcome.js";

package/dist/index.js

@@ -41,6 +41,7 @@ export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure } from "./core/mcp-failure.js";
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice } from "./core/mcp-injection-drop.js";
+export { askUnresolvableNotice } from "./core/ask-unresolvable-notice.js";
 export { materializeA2aTools, A2aRpcError } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, } from "./core/session-policy-store.js";
@@ -140,14 +141,15 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export { ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL } from "./core/ask-origin.js";
 export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, screenGateOutcome } from "./core/gate-outcome.js";
 export {} from "./core/hooks.js";
-export { parseAutoModeResponse, createAutoModeDecider, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
+export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
+export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, AUTO_MODE_BREAKER_CAUSES, isAutoModeBreakerCause, AutoModeBreakerLedger, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, } from "./core/permission-rule-provider.js";
@@ -186,7 +188,7 @@ export { DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf,
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, } from "./scenarios/env.js";
-export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, MAX_WORKFLOW_ITEMS, } from "./orchestration/workflow.js";
+export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, WorkflowAgentParkedError, WORKFLOW_AGENT_PARKED_ERROR_CODE, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, MAX_WORKFLOW_ITEMS, } from "./orchestration/workflow.js";
 export { listWorkflowRuns, getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus } from "./orchestration/workflow-observe.js";
 export { runGoal, DECLARE_DONE_TOOL_NAME, } from "./orchestration/goal.js";
 export { emitTaskOutcome } from "./core/task-outcome.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -307,6 +307,23 @@ export interface RunWorkflowToolDeps {
      *  Absent on both seats ⇒ byte-identical baseline: a child's asks keep the pre-#342 resolution
      *  (`RunnerDeps.onAsk`, else the fail-closed headless auto-deny). */
     parentOnAsk?: import("../core/tool-policy.js").OnAsk;
+    /** #642 — the HOST run's `durableApproval` opt-in (value copy; the Runner mints it from `spec.durableApproval`
+     *  beside `parentOnAsk`, the same seat the delegation tool reads as `ctx.durableApprovalForChildren`). Folded
+     *  into `RunWorkflowOptions.defaultDurableApproval` at execute — ONLY when a `store` is wired (the wa* row's
+     *  durable home; without it the child keeps the pre-#642 lifecycle: its unavailable ask denies fail-closed
+     *  and the `delegation.ask_unresolvable` notice says so). `ctx.durableApprovalForChildren` wins when a
+     *  wrapping path provides it; this dep covers the auto-mounted tool's minimal execute ctx, like `parentOnAsk`.
+     *  Absent on both seats ⇒ byte-identical: a workflow child's ask keeps the host-seat resolution alone. */
+    parentDurableApproval?: {
+        scope: string;
+        ttlMs?: number;
+    };
+    /** #642 — the decisions a host holds for PARKED wa* rows of a prior run, read at execute when the model
+     *  re-invokes with `resumeFromRunId` (a call-time getter over the run id: the decisions arrive on the host's
+     *  trusted run channel, `RunInternals.workflowParkedResume`, and only the ones naming THIS resume's source run
+     *  apply). Threaded into `RunWorkflowOptions.parkedResume`: the resume drives the parked child on with the
+     *  decision instead of re-parking. Never a tool argument — a model cannot decide an approval. */
+    parkedResume?: (resumeFromRunId: string) => ReadonlyArray<import("./workflow.js").WorkflowParkedResume> | undefined;
     /** The HOST run's display sink (its `RunInternals.onForwardEvent` behind the runner's ctx wrapper:
      *  `task_progress` always, plus the children's content events — `text_delta`/`text_end`/
      *  `reasoning_delta`/`tool_start`/`tool_end`, UNTRUSTED-RAW: the consumer must redact — when the HOST spec set

package/dist/orchestration/run-workflow-tool.js

@@ -5,6 +5,7 @@ import { redactSecrets, redactHostLeaks, boundedRedactedSummary } from "../core/
 import { withDelegationProvenance } from "../core/tool-policy.js";
 import { LAUNCH_RECEIPT_OWN_WORDS_CLAUSE, launchReceiptNoQuoteClause } from "../agents/launch-receipt-contract.js";
 import { startWorkflow } from "./workflow.js";
+import { WORKFLOW_AGENT_PARKED_ERROR_CODE } from "./workflow-types.js";
 import { buildWorkflowPrimitives } from "./workflow-primitives.js";
 import { parseWorkflowMeta, splitWorkflowMeta, workflowScriptReadsClockOrRandom } from "./workflow-meta.js";
 import { mergeWorkflowArgs, normalizeStringArg } from "./workflow-script-store.js";
@@ -51,6 +52,7 @@ function workflowUsageBlock(run) {
         agent_count: agents.length,
         agents_done: agents.filter((a) => a.status === "completed").length,
         agents_error: agents.filter((a) => a.status === "failed").length,
+        ...(agents.some((a) => a.status === "parked") ? { agents_parked: agents.filter((a) => a.status === "parked").length } : {}),
         agents_empty_result: agents.filter((a) => a.status === "completed" && (a.output === undefined || a.output === "")).length,
         agents_replayed: agents.filter((a) => a.replayed === true).length,
         ...(run.journalSkips !== undefined && run.journalSkips > 0 ? { journal_skipped: run.journalSkips } : {}),
@@ -76,6 +78,7 @@ function workflowDiagnostics(runId, journalRef, resumeMiss) {
 }
 const SCRIPT_ERROR_CODES = new Set([
     "workflow.script_error",
+    "workflow.parked_call_changed",
     "workflow.nesting",
     "workflow.model_not_allowed",
     "workflow.agent_schema",
@@ -86,6 +89,12 @@ const SCRIPT_ERROR_CODES = new Set([
 function failureSummary(err, runId) {
     const e = err;
     const code = typeof e?.code === "string" ? e.code : undefined;
+    if (code === WORKFLOW_AGENT_PARKED_ERROR_CODE) {
+        const msg = typeof e?.message === "string" ? redactSecrets(e.message) : "";
+        return (`workflow parked (${code}): ${msg.length > 200 ? `${msg.slice(0, 200)}…` : msg} — it did not fail and is not finished` +
+            (runId ? `; per-agent rows via TaskOutput("${runId}") (the parked row reads status "parked")` : "") +
+            `; do not re-issue the same call — once the approval is decided, the deployment resumes this run${runId ? ` (resumeFromRunId: "${runId}")` : ""} and the script continues from the parked call`);
+    }
     const guide = runId
         ? `; per-agent rows via TaskOutput("${runId}"); after fixing, re-invoke with resumeFromRunId: "${runId}" (completed agents replay from the journal)`
         : "";
@@ -465,6 +474,7 @@ export async function createRunWorkflowTool(d) {
                 return structuredError(`workflow script failed to compile: ${err instanceof Error ? err.message : String(err)}`);
             }
             const hostOnAsk = ctx.onAsk ?? d.parentOnAsk;
+            const hostDurableApproval = ctx.durableApprovalForChildren ?? d.parentDurableApproval;
             const runGovernance = hostOnAsk !== undefined && governance.baseline.base.onAsk === undefined
                 ? {
                     ...governance,
@@ -537,6 +547,8 @@ export async function createRunWorkflowTool(d) {
                     })(),
                     ...(d.parentModel !== undefined ? { defaultModel: d.parentModel } : {}),
                     ...(d.parentGetApiKeyAndHeaders !== undefined ? { defaultGetApiKeyAndHeaders: d.parentGetApiKeyAndHeaders } : {}),
+                    ...(hostDurableApproval !== undefined && d.store !== undefined ? { defaultDurableApproval: { ...hostDurableApproval } } : {}),
+                    ...(resumeFromRunId !== undefined && d.parkedResume !== undefined && d.parkedResume(resumeFromRunId) !== undefined ? { parkedResume: d.parkedResume(resumeFromRunId) } : {}),
                     ...(parentCenterArtifactDigest !== undefined ? { parentCenterArtifactDigest } : {}),
                     ...(parentCenterSourceRevision !== undefined ? { parentCenterSourceRevision } : {}),
                     ...((ctx.forwardEvent ?? d.forwardEvent) !== undefined ? { onForwardEvent: (ctx.forwardEvent ?? d.forwardEvent) } : {}),

package/dist/orchestration/workflow-observe.d.ts

@@ -56,7 +56,7 @@ export declare function listWorkflowRuns(store: WorkflowRunStore, scope: string,
  */
 export declare function getWorkflowRun(store: WorkflowRunStore, id: string, scope: string): Promise<WorkflowRun | null>;
 /** design/99 MF-W display status. */
-export type AgentDisplayStatus = "queued" | "running" | "done" | "failed" | "interrupted";
+export type AgentDisplayStatus = "queued" | "running" | "done" | "failed" | "interrupted" | "parked";
 /**
  * design/99 MF-W (design-review DoR ⑤+⑥): the SHARED, anti-drift projection of a workflow agent's record-level
  * status → a CC-style display status, derived PURELY from the persisted record (the agent's `status` + `startedAt`

package/dist/orchestration/workflow-observe.js

@@ -66,6 +66,8 @@ export function deriveAgentDisplayStatus(agent, runStatus) {
         return "done";
     if (agent.status === "failed")
         return "failed";
+    if (agent.status === "parked")
+        return "parked";
     if (runStatus !== "running")
         return "interrupted";
     return agent.startedAt === undefined ? "queued" : "running";

package/dist/orchestration/workflow-types.d.ts

@@ -1,7 +1,9 @@
 import type { TaskResult, TaskStatus, ToolActivity } from "../core/types.js";
 export type WorkflowRunStatus = "running" | "completed" | "failed";
-/** Status of one phase / agent-run within a workflow. */
-export type WorkflowItemStatus = "running" | "completed" | "failed";
+/** Status of one phase / agent-run within a workflow. `"parked"` (#642) is an AGENT row's word only — the
+ *  agent durably paused at an approval gate and the run suspended on it (the row carries the token, see
+ *  {@link WorkflowAgentRun.parkedCheckpointToken}); a phase or group never parks (a parked agent ends the run). */
+export type WorkflowItemStatus = "running" | "completed" | "failed" | "parked";
 export interface WorkflowPhase {
     title: string;
     /** F7/B7 (CC pretty.js:446478): a phase PRE-REGISTERED from `meta.phases` starts as `"pending"` — the plan
@@ -119,6 +121,16 @@ export interface WorkflowAgentRun {
      *  (`fork(sessionId)→runTask`, or `runTask({sessionId})`) instead of a fresh re-run. An opaque id (not
      *  content) → scope-gated via `getWorkflowRun`, no redaction needed. Absent for a stub run that minted none. */
     sessionId?: string;
+    /**
+     * #642 — the durable-approval checkpoint token this agent is PARKED on (`status: "parked"` only): the child
+     * durably paused at an approval gate under the host's forwarded `durableApproval`, the run recorded the
+     * park here and suspended. The mirror of the background agent row's `parkedCheckpointToken`, and the
+     * workflow-origin JOIN a host routes a parked approval by: a checkpoint whose `sourceTaskId` equals this
+     * row's {@link sessionId} is a workflow child's park, and this token is the same row's redemption key —
+     * the checkpoint row itself carries no workflow key. It is the resume CAPABILITY (never log it or put it
+     * in a URL); a durable row is its home exactly as on the background lane. Absent on every other status.
+     */
+    parkedCheckpointToken?: string;
     /**
      * #499 — the ENGINE-minted identity of the task run behind this record (= its `TaskResult.runId`).
      *
@@ -515,6 +527,29 @@ export declare class WorkflowAgentBlockedError extends Error {
     /** Human-readable cause, already bounded + redacted by the engine (classifier text is model output). */
     reason: string);
 }
+/** #642 — the machine code of a run that SUSPENDED on a parked agent (the thrown error's `code`, the run's
+ *  failed terminal). Not a script fault and not a host fault: an approval a person still has to decide. */
+export declare const WORKFLOW_AGENT_PARKED_ERROR_CODE = "workflow.agent_parked";
+/**
+ * #642 — thrown by `ctx.agent` / `ctx.agentStream().result()` when the child durably PAUSED at an approval gate
+ * under the host's forwarded `durableApproval` (the workflow lane's park family, the background delegation's
+ * twin): the wa* row records `status:"parked"` + `parkedCheckpointToken`, the journal records the parked leg at
+ * its ordinal, and the RUN SUSPENDS — every later spawn is refused with this same error and the run's terminal
+ * is this park whatever the script body returns (the team-discussion `teamPause` shape). Nothing after the
+ * parked call runs; the script must not retry it (an identical call parks again). A resume of the run
+ * (`resumeFromRunId`) with the host's decision for the token drives the parked child on and the script
+ * continues from here; without a decision the ordinal re-parks.
+ *
+ * Carries the non-secret `checkpointId` (display/correlation) and the gate kind — never the token (the resume
+ * capability lives on the wa* row, a durable row, exactly as on the background lane).
+ */
+export declare class WorkflowAgentParkedError extends Error {
+    readonly label: string;
+    readonly gateKind: string;
+    readonly checkpointId?: string | undefined;
+    readonly code = "workflow.agent_parked";
+    constructor(label: string, gateKind: string, checkpointId?: string | undefined);
+}
 /** design/98 §D.6 hard cap: thrown by `ctx.agent` once the workflow has spawned `max` agents (a runaway
  *  LLM-authored script is bounded, not trusted — this counts cumulative spawns, so it binds even when the
  *  token budget has room left, or when no budget was set at all). */

package/dist/orchestration/workflow-types.js

@@ -55,6 +55,22 @@ export class WorkflowAgentBlockedError extends Error {
         this.name = "WorkflowAgentBlockedError";
     }
 }
+export const WORKFLOW_AGENT_PARKED_ERROR_CODE = "workflow.agent_parked";
+export class WorkflowAgentParkedError extends Error {
+    label;
+    gateKind;
+    checkpointId;
+    code = WORKFLOW_AGENT_PARKED_ERROR_CODE;
+    constructor(label, gateKind, checkpointId) {
+        super(`workflow agent "${label}" is parked at an approval gate (${gateKind}${checkpointId !== undefined ? `, checkpoint ${checkpointId}` : ""}) — ` +
+            "the workflow is suspended until the approval is decided; nothing after this call runs. Do not re-issue the call: " +
+            "a resume of this run carrying the decision continues from here.");
+        this.label = label;
+        this.gateKind = gateKind;
+        this.checkpointId = checkpointId;
+        this.name = "WorkflowAgentParkedError";
+    }
+}
 export class WorkflowMaxAgentsError extends Error {
     max;
     budgetTotal;

package/dist/orchestration/workflow.d.ts

@@ -1,5 +1,6 @@
 import type { TSchema } from "typebox";
-import type { RunnerSelfSeat } from "../core/runner/contracts.js";
+import type { InheritedGate, RunnerSelfSeat } from "../core/runner/contracts.js";
+import type { CheckpointToken, ResumeOutcome } from "../core/checkpoint-store.js";
 import type { AgentDefinition, TaskEvent, TaskResult, TaskSpec } from "../core/types.js";
 import type { WorkflowRunStore } from "../core/workflow-run-store.js";
 import type { WorkflowJournalStore, ResumeClaimArgs } from "../core/workflow-journal-store.js";
@@ -120,7 +121,9 @@ export declare class WorkflowJournalIncompatibleError extends Error {
     readonly fromRunId: string;
     readonly ordinal: number;
     readonly code = "workflow.journal_incompatible";
-    constructor(fromRunId: string, ordinal: number);
+    constructor(fromRunId: string, ordinal: number, 
+    /** #642: an alternative reason clause (the parked-row cross-check); absent ⇒ the no-terminal-cause wording. */
+    reason?: string);
 }
 /**
  * A TRUSTED, run-scoped internal channel carrying the workflow **nesting depth** across a process boundary
@@ -282,6 +285,18 @@ export interface WorkflowRunContext {
     /** Emit a narrator log line (observability only — not stored on the run). */
     log(message: string): void;
 }
+/**
+ * #642 — one decision a resume carries for a PARKED ordinal of the prior run ({@link RunWorkflowOptions.parkedResume}):
+ * the checkpoint token the wa* row is parked on (the row's `parkedCheckpointToken`, the redemption key), the
+ * caller's decision for it (the same {@link ResumeOutcome} a top-level `runner.resume` takes), and the optional
+ * cross-process re-supply of the checkpoint's opaque parent constraints. The token is matched by string equality
+ * against the journaled parked entry — an entry whose token no decision names re-parks.
+ */
+export interface WorkflowParkedResume {
+    token: CheckpointToken;
+    outcome: ResumeOutcome;
+    inheritedGate?: InheritedGate;
+}
 export interface RunWorkflowOptions {
     /** Trusted caller-supplied run id. Used by the unified task registry so tool-launched workflows expose
      *  `task_id === runId` (`w*`) without making the model choose an id. Omit for the legacy UUID mint path. */
@@ -435,6 +450,30 @@ export interface RunWorkflowOptions {
      *  credential half of model inheritance; scripts can never set it — governance strips it — so
      *  this is always the host's). NOT call identity (auth, not behavior; a function, not data). */
     defaultGetApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
+    /**
+     * #642 — the HOST run's `durableApproval` opt-in (value copy), inherited into every spawned agent whose
+     * fold left the seat unpinned (a deployment baseline that pins `durableApproval` wins; scripts can never set
+     * it — governance strips it). With it a workflow child's plain policy `ask` — an ask the host's approver
+     * answers `unavailable` for, or a durable mandate — PARKS durably instead of denying fail-closed, exactly as
+     * a background delegation child's does under the §7.3 park family: the wa* row records `status:"parked"` +
+     * the token, the run SUSPENDS (the script cannot continue past a parked call), and a resume drives the
+     * parked child on with the caller's decision ({@link parkedResume}). Tighten-only: a park capability,
+     * never a widening — the decision stays with a person. REQUIRES {@link store} (the wa* row's durable home;
+     * refused loudly at entry without it). Threaded by the Workflow tool from the host's trusted seat; a
+     * directly-started workflow passes its own. NOT call identity.
+     */
+    defaultDurableApproval?: TaskSpec["durableApproval"];
+    /**
+     * #642 — the decisions a resume ({@link resumeFromRunId}) carries for PARKED ordinals of the prior run: at
+     * an ordinal whose journal entry is `parked` (a matching call key), the run drives the parked child's own
+     * resume — `runner.resumeStream(token, outcome, …)` on the pinned session, the child's spec rebuilt from
+     * the script call exactly as at spawn — and settles its result at that ordinal, so the script continues past
+     * the call it parked on. A parked ordinal with NO decision here re-parks (the row and the journal say the
+     * same thing again, the run suspends again); it is never run live. `inheritedGate` is the cross-process
+     * re-supply of the checkpoint's opaque parent constraints (the same seat the background lane's drive
+     * takes). TRUSTED: a host-supplied decision, never a script/model argument; requires `resumeFromRunId`.
+     */
+    parkedResume?: ReadonlyArray<WorkflowParkedResume>;
     /** design/148 S1 — the HOST run's adopted center artifact (trusted, threaded by the Workflow tool
      *  from ctx): every spawned agent composes the same closure. */
     parentCenterArtifactDigest?: string;