@sema-agent/core 7.9.2 → 7.11.0

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -1,13 +1,13 @@
 import { isSyntheticApiErrorMessage } from "../../internal/harness.js";
 import { createHash } from "node:crypto";
-import { deploymentSubagentTierModel, forkGovernanceDenial } from "../../agents/subagent.js";
+import { childThinkingSeat, deploymentSubagentThinking, deploymentSubagentTierModel, forkGovernanceDenial } from "../../agents/subagent.js";
 import { CROSS_SESSION_CLASSIFIER_RULE } from "../../agents/cross-session-envelope.js";
 import { createRunWorkflowTool } from "../../orchestration/run-workflow-tool.js";
 import { isSelfOrchestrationActive } from "../../orchestration/workflow-script-runner.js";
 import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { thinkingOffExpressible } from "../../brain/reasoning.js";
 import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
-import { AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "../auto-mode-defaults.js";
+import { AUTO_MODE_CLASSIFIER_MAX_TOKENS, AUTO_MODE_CLASSIFIER_THINKING_ALLOWANCE_TOKENS } from "../auto-mode-defaults.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
 import { createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
@@ -17,9 +17,20 @@ import { resolveTaskModel } from "../roles.js";
 import { brainToRuntime } from "../runtime.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { emitTrace } from "../trace.js";
-import { defineTool, isDefineToolProduct } from "../tools.js";
+import { defineTool, isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
 import { derivedRouteFallsBack } from "./derived-route-fallback.js";
 import { REPORT_FINDINGS_TOOL_NAME, createReportBlockedTool, createReportFindingsTool } from "./synthetic-tools.js";
+function classifierReplyText(reply) {
+    return reply.content
+        .filter((c) => c.type === "text")
+        .map((c) => c.text)
+        .join("");
+}
+function classifierReplyEmptyAtCap(reply) {
+    if (classifierReplyText(reply) !== "")
+        return false;
+    return reply.stopReason === "length" || (reply.stopReason === "error" && reply.errorKind === "length_empty");
+}
 import { RosterBuilder, callerMountSource } from "../tool-roster.js";
 function assembleParentCaptureState(o, i, ctl, ancestors) {
     const build = (optedOut, indeterminate) => ({
@@ -72,9 +83,8 @@ export async function prepareCapsAndWorkflow(input) {
         roster.mount(mounted, { source: callerMountSource(mounted), mountedBy: "scenario" });
     }
     function mountCallerTool(t) {
-        if (isDefineToolProduct(t)) {
-            return maybeOffload(t, t);
-        }
+        if (isDefineToolProduct(t))
+            return maybeOffload(rebindDefineToolCtx(t, enrichSpecToolCtx), t);
         return maybeOffload(defineTool({
             ...t,
             execute: (args, ctx) => t.execute(args, enrichSpecToolCtx(ctx)),
@@ -170,7 +180,10 @@ export async function prepareCapsAndWorkflow(input) {
         autoModeDecider = createAutoModeDecider({
             ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
             ...(am.failureThreshold !== undefined ? { failureThreshold: am.failureThreshold } : {}),
-            ...(am.onBreakerOpen !== undefined ? { onBreakerOpen: am.onBreakerOpen } : {}),
+            onBreakerOpen: (info) => {
+                internals?.autoModeBreakerLedger?.record(sessionId, { openedAtMs: Date.now(), lastCause: info.lastCause, failures: info.consecutiveFailures, runId });
+                am.onBreakerOpen?.(info);
+            },
             onClassified: (info) => emitTrace(deps.tracer, () => ({
                 kind: "auto_mode.classified",
                 version: 1,
@@ -188,17 +201,18 @@ export async function prepareCapsAndWorkflow(input) {
                     (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
                 const userPrompt = renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
                 const classifierAuth = await spec.getApiKeyAndHeaders?.(classifierModel);
-                const response = await classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
+                const request = (cap) => classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
                     signal,
                     reasoning: "off",
-                    ...classifierCap,
+                    ...cap,
                     ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
                     ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
                 });
-                return response.content
-                    .filter((c) => c.type === "text")
-                    .map((c) => c.text)
-                    .join("");
+                let response = await request(classifierCap);
+                if (classifierCap.maxTokens !== undefined && classifierReplyEmptyAtCap(response)) {
+                    response = await request({ maxTokens: classifierCap.maxTokens + AUTO_MODE_CLASSIFIER_THINKING_ALLOWANCE_TOKENS });
+                }
+                return classifierReplyText(response);
             },
         });
         if (am.persistArming === true)
@@ -246,6 +260,13 @@ export async function prepareCapsAndWorkflow(input) {
             parentModel: () => deploymentSubagentTierModel(runnerSelf.agentCatalog) ?? harnessRef.current?.getModel(),
             ...(spec.getApiKeyAndHeaders !== undefined ? { parentGetApiKeyAndHeaders: spec.getApiKeyAndHeaders } : {}),
             ...(frozenOnAsk !== undefined ? { parentOnAsk: frozenOnAsk } : {}),
+            ...(spec.durableApproval !== undefined ? { parentDurableApproval: { ...spec.durableApproval } } : {}),
+            ...(internals?.workflowParkedResume !== undefined
+                ? { parkedResume: (resumeFromRunId) => {
+                        const mine = internals.workflowParkedResume.filter((d) => d.runId === resumeFromRunId).map(({ runId: _r, ...rest }) => rest);
+                        return mine.length > 0 ? mine : undefined;
+                    } }
+                : {}),
             principal: spec.principal,
             oneShot: spec.oneShot,
             ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
@@ -258,7 +279,7 @@ export async function prepareCapsAndWorkflow(input) {
             autoModeReview: () => (autoModeDecider !== undefined ? { decider: autoModeDecider } : undefined),
             workflowDepth: internals?.workflowDepth,
             parentCwd: taskRootFinal,
-            parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
+            parentThinking: () => childThinkingSeat(undefined, deploymentSubagentThinking(runnerSelf.agentCatalog?.roles), harnessRef.current?.getThinkingLevel() ?? thinking).thinking,
             parentReadFace: () => carrierReadFace(),
             parentReadDenyPatterns: () => {
                 const readDenyAdditionsNormalized = input.readDenyAdditionsNormalized();

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -49,8 +49,9 @@ export interface PrepareGateStationsInput {
      *  first-party tool's declared effect (never overrides a scanned one); the plan-mode deny reads it per call. */
     toolEffects: Map<string, ToolEffect>;
     /** borrowed-readonly — the deployment seats these stations read, as a Pick over the SAME `deps` object (receiver
-     *  preserved for `deps.onError?.()`): the write-protection table and its data root, the tracer, the error face. */
-    deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "tracer" | "onError">;
+     *  preserved for `deps.onError?.()`): the write-protection table and its data root, the tracer, the error face, and
+     *  the notice sink (#648: the gate's unresolvable-ask exit delivers `delegation.ask_unresolvable` through it). */
+    deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "tracer" | "onError" | "onNotice">;
     /** borrowed-mutable — the protocol-tools phase's arming belt. Writer here: `armed` ← the registration predicate, the
      *  one write; the refresh seam reads it. */
     toolCallGateArmedRef: {

package/dist/core/runner/prepare-gate-stations.js

@@ -5,6 +5,8 @@ import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
 import { screenGateOutcome } from "../gate-outcome.js";
 import { directDeny } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
 import { createWriteProtectionCheck } from "../write-protect.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
 import { toolCallFaceOf } from "../tool-roster.js";
@@ -120,6 +122,7 @@ export function prepareGateStations(input) {
                         shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
                         ...(autoModeDecider ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}) } } : {}),
                         onHeadlessDenialLimit: stopForDenialLimit,
+                        onAskUnresolvable: (info) => deliverEngineNotice(deps.onNotice, askUnresolvableNotice({ sessionId, ...info })),
                         ...(permissionRuleLane
                             ? {
                                 persistedRules: {
@@ -136,6 +139,15 @@ export function prepareGateStations(input) {
                                 },
                             }
                             : {}),
+                        onReadOnlyAllowed: (info) => emitTrace(deps.tracer, () => ({
+                            kind: "permission.read_only_allowed",
+                            version: 1,
+                            taskId: hostTaskId,
+                            toolName: info.toolName,
+                            toolCallId: info.toolCallId,
+                            command: info.command,
+                            ts: Date.now(),
+                        })),
                         ...(permissionRuleOrgLane
                             ? {
                                 orgRules: {

package/dist/core/runner/prepare-policy-chain.js

@@ -252,6 +252,7 @@ export async function preparePolicyChain(input) {
         sessionId,
         root: taskRootFinal,
         liveCwd: () => handsCwdRef?.current,
+        home: executionEnv.homeDir,
         questionToolMounted,
         questionToolName: ASK_USER_QUESTION_TOOL_NAME,
         onRevisionDefect: (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }),
@@ -299,7 +300,7 @@ export async function preparePolicyChain(input) {
                 return { action: "allow", updatedInput: editArgs };
             if (judged.kind === "deny")
                 return judged.result;
-            const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere, origin: editOrigin } = judged;
+            const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
             re = editAsk;
             const rr = await resolveAsk({
                 toolName: creq.toolName,
@@ -311,7 +312,7 @@ export async function preparePolicyChain(input) {
                 ...riskAxesOf(creq.toolName),
                 ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 ...(re.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: re.persistedRuleShadowed } : {}),
-                ...inheritedAskCarry(editOrigin, editFallback, isLiveApproverSeat(onAskOf), ancestorTracker),
+                ...inheritedAskCarry(judged, isLiveApproverSeat(onAskOf), ancestorTracker),
                 ruleEvidence: inheritedAskEvidence,
             }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
             settleDenialLimitFallback({ fallback: editFallback, mintedHere: editMintedHere, tracker: ancestorTracker, resolved: rr, headless: headlessDenyAtRecheck, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
@@ -372,7 +373,7 @@ export async function preparePolicyChain(input) {
                         return { action: "allow" };
                     if (judged.kind === "deny")
                         return judged.result;
-                    const { ask: inheritedAsk, fallback, mintedHere, origin: inheritedOrigin } = judged;
+                    const { ask: inheritedAsk, fallback, mintedHere } = judged;
                     if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return { action: "allow" };
@@ -389,7 +390,7 @@ export async function preparePolicyChain(input) {
                         ...riskAxesOf(creq.toolName),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
-                        ...inheritedAskCarry(inheritedOrigin, fallback, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+                        ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                         ruleEvidence: inheritedAskEvidence,
                     }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
                     const askWaitMs = Math.max(0, now() - askT0);
@@ -452,7 +453,7 @@ export async function preparePolicyChain(input) {
                         return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
                     if (judged.kind === "deny")
                         return judged.result;
-                    const { ask: inheritedAsk, fallback, mintedHere, origin: inheritedOrigin } = judged;
+                    const { ask: inheritedAsk, fallback, mintedHere } = judged;
                     if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
@@ -468,7 +469,7 @@ export async function preparePolicyChain(input) {
                         ...riskAxesOf(creq.toolName),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
-                        ...inheritedAskCarry(inheritedOrigin, fallback, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+                        ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                         ruleEvidence: inheritedAskEvidence,
                     }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
                     const askWaitMs = Math.max(0, now() - askT0);

package/dist/core/runner/prepare-task.js

@@ -634,7 +634,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             session,
             tools: [...harnessTools],
             model,
-            thinkingLevel: thinking ?? "off",
+            thinkingLevel: thinking,
             systemPrompt: systemPromptSeat.current,
             ...(systemBlocks ? { systemBlocks } : {}),
             getApiKeyAndHeaders: spec.getApiKeyAndHeaders,

package/dist/core/runner/prepare-turn-wiring.js

@@ -26,7 +26,7 @@ export function prepareTurnWiring(input) {
         layoutGroups: (systemBlocks ?? [{ groupId: "body", cacheControlBoundary: true }]).map((b) => ({ groupId: b.groupId, cacheControlBoundary: b.cacheControlBoundary })),
         stableSystemText: systemPromptSeat.current,
         toolWire: toolsToFingerprintInputs(harnessTools),
-        thinkingLevel: (thinking ?? "off"),
+        thinkingLevel: thinking ?? null,
         maxTokens: model.maxTokens,
         hasOutputSchema: spec.outputSchema !== undefined,
         sessionId,

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -46,7 +46,7 @@ export interface PrepareWiringManifestInput {
     deps: RunnerDeps;
     /** borrowed-readonly — the trusted spawn-side channel: `questionFaceStripped`, `isDelegatedChild`, `onTaskNotification`,
      *  `peerSelfRef`, `explicitAgentName` (the drain), `insideFork` / `agentName` / `parentToolCallId` (the identity). */
-    internals: Pick<RunInternals, "questionFaceStripped" | "isDelegatedChild" | "onTaskNotification" | "peerSelfRef" | "explicitAgentName" | "insideFork" | "agentName" | "parentToolCallId"> | undefined;
+    internals: Pick<RunInternals, "questionFaceStripped" | "isDelegatedChild" | "onTaskNotification" | "peerSelfRef" | "explicitAgentName" | "insideFork" | "agentName" | "parentToolCallId" | "autoModeBreakerLedger"> | undefined;
     /** borrowed-readonly — the resume leg, or undefined (the manifest's leg derivation reads presence only). */
     resume: Pick<PrepareResume, "seed"> | undefined;
     /** borrowed-readonly — the acquired session id. */

package/dist/core/runner/prepare-wiring-manifest.js

@@ -199,7 +199,14 @@ export function prepareWiringManifest(input) {
         memoryAdmissionWired: deps.memoryScopeAdmission !== undefined,
         retentionPolicyWired: deps.retentionPolicy !== undefined,
         ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
-        autoMode: { armed: autoModeArmReason === "armed", reason: autoModeArmReason },
+        autoMode: {
+            armed: autoModeArmReason === "armed",
+            reason: autoModeArmReason,
+            ...(() => {
+                const trip = internals?.autoModeBreakerLedger?.lastTrip(sessionId);
+                return trip !== undefined ? { breaker: trip } : {};
+            })(),
+        },
         mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses),
         tools: toolRoster,
     });

package/dist/core/runner/runtask.d.ts

@@ -1,9 +1,10 @@
 import { type Model } from "../../internal/llm.js";
 import { type CheckpointToken, type ResumeOutcome } from "../checkpoint-store.js";
 import { type TaskOutcome } from "../task-outcome.js";
+import { type SwappableDeps } from "../swappable-deps.js";
 import { type SideQuerySpec, type SideQueryResult } from "../side-query.js";
 import type { SessionStore } from "../session.js";
-import type { AgentDefinition, ModelRef, ModelRoles, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
+import type { AgentDefinition, ModelRoles, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
 import type { ResumeRun, ResumeTaskConfig, RunInternals, RunnerSelfSeat } from "./contracts.js";
 export type { ResumeTaskConfig } from "./contracts.js";
 /**
@@ -20,6 +21,9 @@ export declare class Runner implements RunnerSelfSeat {
      *  authority: a durable resume's checkpoint seed wins on its leg, and a miss (cross-process,
      *  evicted) falls back to the transcript-replay rung. See {@link SessionReadFileStates}. */
     private readonly sessionReadStates;
+    /** #616 — the per-session breaker read face's record (see {@link RunInternals.autoModeBreakerLedger}). Runner-lived:
+     *  a trip in one leg is what the session's next leg reports. */
+    private readonly autoModeBreakerLedger;
     /** task notifications born BETWEEN turns (run torn down / harness already idle), parked
      *  per session and drained into the session's next run at its first boundary. Runner-lived (outlives any
      *  single run, like the registry handles that produce into it); bounded + drop-disclosing, see
@@ -57,7 +61,7 @@ export declare class Runner implements RunnerSelfSeat {
     private readonly locallyClaimedTokens;
     private static readonly PARENT_CONSTRAINT_REGISTRY_CAP;
     /** The lanes' LIVE view of `deps` ({@link RunnerDepsSeat}): a getter, never a captured object, because
-     *  `swapModels` replaces the object and a rung reading after its own await must see the replacement. */
+     *  `swapDeps` replaces the object and a rung reading after its own await must see the replacement. */
     private readonly depsSeat;
     constructor(deps: RunnerDeps);
     /** design/73 §1 v1 — fire `RunnerDeps.onTaskOutcome` through the single swallow-guarded chokepoint
@@ -88,38 +92,35 @@ export declare class Runner implements RunnerSelfSeat {
     /** Acquire the lock for a sessionId; returns a release fn. New (undefined) sessions need no lock. */
     private acquireSessionLock;
     /**
-     * Hot-swap the model catalog (and optionally the tier bindings) without restarting the process or
-     * rebuilding the Runner — the deployment seat that makes "switching models" a zero-restart
-     * operation, and the ONLY sanctioned generation change.
+     * Hot-swap the deployment seats a running Runner may change without a restart — the ONE door for every
+     * hot-swappable seat ({@link SWAPPABLE_DEP_SEATS}: the model catalog generation `models` + its `tiers`
+     * bindings, and the deployment's read-face declaration `readFace`), and the ONLY sanctioned way to
+     * change any of them after construction. It replaces the former `swapModels` verb (retired, no alias):
+     * one verb per seat restated the same laws with a list of verbs as the only record of what is swappable.
      *
-     * (Precisely: the constructor runs {@link expandTiers} once and keeps a private expanded copy **only
-     * when `RunnerDeps.tiers` is configured** — that is the arm where mutating the shared table after
-     * construction provably never took effect. A tiers-less deployment's Runner holds the caller's own
-     * `models` object BY REFERENCE, so mutating it after construction does leak through; that is an
-     * accident of the expansion being a no-op, not a contract, and this verb is still the supported way
-     * to change a generation — it is what validates, announces, and computes the pairing disclosure.)
-     *
-     * Semantics:
-     * - **Atomic**: the candidate catalog is tier-expanded and validated FIRST (an illegal tier
-     *   binding throws exactly like the constructor's boot error) — on any throw the current
-     *   generation stays in force, untouched.
-     * - **In-flight tasks keep their generation** (natural snapshot): a running task resolved its
-     *   `Model` object at prepare time and holds that reference; the swap changes what FUTURE
-     *   prepares (and auto-sourced agents' string refs — {@link agentCatalog} copies per read)
-     *   resolve. Same-name redirects therefore never re-route or re-price a task mid-run; the
-     *   divergence window is exactly the in-flight tasks' lifetime, by design.
-     * - `tiers` omitted ⇒ the current tier bindings are kept (and re-applied over the new models);
-     *   explicitly passed (including `undefined`) ⇒ replaced.
-     * - Success is announced via `config.models_swapped` (models/tiers counts — key material only,
-     *   never the catalog itself). A swap may additionally emit the advisory
-     *   `route.base_url_changed_key_unchanged` notice (deliberately conservative — see its entry in
-     *   the notice directory) for same-name entries whose URL moved while the Model-visible
-     *   credential fingerprint did not.
+     * The laws, stated once (see the vocabulary module for the seat-by-seat meaning):
+     * - **Screened first, written once — atomic.** The candidate is screened whole
+     *   ({@link screenSwappableDeps}: the key set is the closed one, at least one seat, `tiers` rides with
+     *   `models`, each seat's own value gate — `readFace` through the very `assertReadFaceValue` every
+     *   prepare door applies) and the catalog is tier-expanded on the candidate (an illegal binding throws
+     *   exactly like the constructor's boot error) BEFORE the deps object is replaced. On any throw the
+     *   current deps stay in force, byte-identical.
+     * - **In-flight legs keep their snapshot.** A running task read `this.deps` at its prepare and holds
+     *   that object: its `Model`, its resolved read face, everything. The swap changes what FUTURE prepares
+     *   (and auto-sourced agents' string refs — {@link agentCatalog} copies per read) resolve. Same-name
+     *   redirects never re-route or re-price a task mid-run; a read-face change never re-fences a mounted
+     *   band; the divergence window is exactly the in-flight legs' lifetime, by design.
+     * - **Presence is the instruction.** A key present on the candidate is replaced (an explicit
+     *   `undefined` clears an optional seat: `tiers: undefined` ⇒ no bindings, `readFace: undefined` ⇒ the
+     *   engine default); a key absent is kept. `tiers` omitted beside `models` ⇒ the current bindings are
+     *   re-applied over the new catalog.
+     * - **Announced per seat.** `config.models_swapped` (models/tiers counts — key material only, never the
+     *   catalog itself; plus the advisory `route.base_url_changed_key_unchanged` for same-name entries
+     *   whose URL moved while the Model-visible credential fingerprint did not) and
+     *   `config.read_face_swapped` (`{ from, to, occurrenceId }`, the seat's previous and new value, `null`
+     *   = no declaration) — the table {@link SWAP_SEAT_NOTICE} binds every seat to its line.
      */
-    swapModels(next: {
-        models: Record<string, Model>;
-        tiers?: Record<string, ModelRef>;
-    }): void;
+    swapDeps(next: SwappableDeps): void;
     /** one-shot brain-routed utility query (see {@link runSideQuery} for the full contract):
      *  preserves system/multi-turn messages/tool DEFINITIONS, routes through the deployment's brain with
      *  the same model resolution as tasks, returns real usage/model. No session, no tool execution, no

package/dist/core/runner/runtask.js

@@ -23,6 +23,8 @@ import { resolveReasoning } from "../../brain/reasoning.js";
 import { adjudicateDerivedRoute, authCarrierFingerprint, fallbackToPrimaryNotice, normalizeBaseUrl, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { runWithBrainTelemetry, runWithReasoningWireFacts, runWithStatusSink } from "../../brain/status-sink.js";
 import { expandTiers, resolveModel, resolveTaskModel } from "../roles.js";
+import { screenSwappableDeps } from "../swappable-deps.js";
+import { AutoModeBreakerLedger } from "../auto-mode.js";
 import { runSideQuery } from "../side-query.js";
 import { generatePromptSuggestions } from "./prompt-suggestions.js";
 import { PushQueue } from "../push-queue.js";
@@ -82,6 +84,7 @@ export class Runner {
     sessions;
     sessionLocks = new Map();
     sessionReadStates = new SessionReadFileStates();
+    autoModeBreakerLedger = new AutoModeBreakerLedger();
     pendingSessionNotifications = new PendingSessionNotifications();
     parentConstraintRegistry = new Map();
     suspendedEnvReaps = new Map();
@@ -213,41 +216,67 @@ export class Runner {
             });
         };
     }
-    swapModels(next) {
-        if (next.models === null || typeof next.models !== "object" || Array.isArray(next.models)) {
-            throw new Error(`swapModels: models must be a plain Record<string, Model> (got ${next.models === null ? "null" : Array.isArray(next.models) ? "array" : typeof next.models}) — the current generation stays in force`);
-        }
-        const tiers = Object.hasOwn(next, "tiers") ? next.tiers : this.deps.tiers;
-        const expanded = tiers && Object.keys(tiers).length > 0 ? expandTiers({ ...next.models }, tiers) : { ...next.models };
+    swapDeps(next) {
+        const screened = screenSwappableDeps(next);
+        const { seats, candidate } = screened;
+        const catalogSwap = seats.includes("models");
+        let expanded;
+        let tiers;
         const movedEntries = [];
-        for (const [name, nextModel] of Object.entries(expanded ?? {})) {
-            const prior = this.deps.models?.[name];
-            if (!prior)
-                continue;
-            const from = normalizeBaseUrl(prior.baseUrl);
-            const to = normalizeBaseUrl(nextModel.baseUrl);
-            if (from !== to && authCarrierFingerprint(prior.headers) === authCarrierFingerprint(nextModel.headers)) {
-                movedEntries.push({ modelId: name, from, to });
-            }
-        }
-        this.deps = { ...this.deps, models: expanded, ...(tiers !== undefined ? { tiers } : {}) };
-        if (tiers === undefined)
-            delete this.deps.tiers;
-        deliverEngineNotice(this.deps.onNotice, {
-            code: "config.models_swapped",
-            message: `model catalog swapped: ${Object.keys(next.models).length} model(s), ${tiers ? Object.keys(tiers).length : 0} tier binding(s); in-flight tasks finish on their resolved models, new tasks resolve against the new catalog`,
-            detail: { models: Object.keys(next.models).length, tiers: tiers ? Object.keys(tiers).length : 0, occurrenceId: uuidv7() },
-        });
-        if (movedEntries.length > 0) {
-            const RENDER_CAP = 8;
-            const rendered = movedEntries.slice(0, RENDER_CAP);
+        if (catalogSwap) {
+            const models = candidate.models;
+            tiers = Object.hasOwn(candidate, "tiers") ? candidate.tiers : this.deps.tiers;
+            expanded = tiers && Object.keys(tiers).length > 0 ? expandTiers({ ...models }, tiers) : { ...models };
+            for (const [name, nextModel] of Object.entries(expanded ?? {})) {
+                const prior = this.deps.models?.[name];
+                if (!prior)
+                    continue;
+                const from = normalizeBaseUrl(prior.baseUrl);
+                const to = normalizeBaseUrl(nextModel.baseUrl);
+                if (from !== to && authCarrierFingerprint(prior.headers) === authCarrierFingerprint(nextModel.headers)) {
+                    movedEntries.push({ modelId: name, from, to });
+                }
+            }
+        }
+        const faceSwap = seats.includes("readFace");
+        const priorFace = this.deps.readFace;
+        const written = {
+            ...this.deps,
+            ...(expanded !== undefined ? { models: expanded } : {}),
+            ...(catalogSwap && tiers !== undefined ? { tiers } : {}),
+            ...(faceSwap && candidate.readFace !== undefined ? { readFace: candidate.readFace } : {}),
+        };
+        if (catalogSwap && tiers === undefined)
+            delete written.tiers;
+        if (faceSwap && candidate.readFace === undefined)
+            delete written.readFace;
+        this.deps = written;
+        if (catalogSwap) {
+            const modelCount = Object.keys(candidate.models).length;
+            deliverEngineNotice(this.deps.onNotice, {
+                code: "config.models_swapped",
+                message: `model catalog swapped: ${modelCount} model(s), ${tiers ? Object.keys(tiers).length : 0} tier binding(s); in-flight tasks finish on their resolved models, new tasks resolve against the new catalog`,
+                detail: { models: modelCount, tiers: tiers ? Object.keys(tiers).length : 0, occurrenceId: uuidv7() },
+            });
+            if (movedEntries.length > 0) {
+                const RENDER_CAP = 8;
+                const rendered = movedEntries.slice(0, RENDER_CAP);
+                deliverEngineNotice(this.deps.onNotice, {
+                    code: "route.base_url_changed_key_unchanged",
+                    message: `model catalog swap moved ${movedEntries.length} entry/entries to a new baseUrl while the Model-visible credential half stayed unchanged: ` +
+                        rendered.map((e) => `"${e.modelId}" ${e.from || "(config root)"} → ${e.to || "(config root)"}`).join("; ") +
+                        (movedEntries.length > rendered.length ? `; +${movedEntries.length - rendered.length} more` : "") +
+                        " — if the provider changed (not just its domain), update the credential reference in the same step",
+                    detail: { entries: rendered, total: movedEntries.length, occurrenceId: uuidv7() },
+                });
+            }
+        }
+        if (faceSwap) {
+            const to = candidate.readFace ?? null;
             deliverEngineNotice(this.deps.onNotice, {
-                code: "route.base_url_changed_key_unchanged",
-                message: `model catalog swap moved ${movedEntries.length} entry/entries to a new baseUrl while the Model-visible credential half stayed unchanged: ` +
-                    rendered.map((e) => `"${e.modelId}" ${e.from || "(config root)"} → ${e.to || "(config root)"}`).join("; ") +
-                    (movedEntries.length > rendered.length ? `; +${movedEntries.length - rendered.length} more` : "") +
-                    " — if the provider changed (not just its domain), update the credential reference in the same step",
-                detail: { entries: rendered, total: movedEntries.length, occurrenceId: uuidv7() },
+                code: "config.read_face_swapped",
+                message: `deployment read face swapped: ${priorFace ?? "(no declaration)"} → ${to ?? "(no declaration)"}; in-flight legs keep the face they prepared under, new legs resolve against the new declaration`,
+                detail: { from: priorFace ?? null, to, occurrenceId: uuidv7() },
             });
         }
     }
@@ -962,6 +991,7 @@ export class Runner {
             peerInboundChainRef,
             detachHub,
             sessionReadStates: this.sessionReadStates,
+            autoModeBreakerLedger: this.autoModeBreakerLedger,
             onTaskNotification: (notification, opts) => {
                 try {
                     upstreamTaskNotification?.(notification, opts);

package/dist/core/runner-deps.d.ts

@@ -400,6 +400,11 @@ export interface RunnerDeps {
      * may not. Beside a read-only (verifier) mount this seat's "open" silently CLAMPS to roots (a
      * deployment default cannot override a load-bearing containment wall) — TaskSpec.readFace's own
      * "open" there is the genuine per-task contradiction, and that one still refuses loudly (#123).
+     *
+     * A LIVE seat: `Runner.swapDeps({ readFace })` replaces it without a restart (the same natural
+     * snapshot the model catalog has — a leg reads the seat at its prepare and keeps that reading; every
+     * later prepare reads the new declaration; announced as `config.read_face_swapped`). A host whose
+     * declaration arrives late (a governance source read after boot) swaps it in rather than restarting.
      */
     readFace?: import("../tools/fs/read-face.js").ReadFace;
     /**
@@ -686,10 +691,12 @@ export interface RunnerDeps {
         timeoutMs?: number;
         /** Consecutive-failure threshold opening the one-way session breaker (default 3). */
         failureThreshold?: number;
-        /** Fired ONCE when the session breaker opens (the "退回非 auto" alarm — surface it to the operator). */
+        /** Fired ONCE when the session breaker opens (the "退回非 auto" alarm — surface it to the operator). The engine
+         *  records the trip on the session's breaker read face (`WiringManifest.autoMode.breaker`, #616) BEFORE calling
+         *  this hook, so a deployment that wires nothing here still gets the read face. */
         onBreakerOpen?: (info: {
             consecutiveFailures: number;
-            lastCause: string;
+            lastCause: import("./auto-mode.js").AutoModeBreakerCause;
         }) => void;
         /**
          * The classifier DENIAL LIMIT (CC 2.1.250 `FO`/`AKe`): a run whose classifier keeps blocking falls

package/dist/core/shell-lexer.d.ts

@@ -9,10 +9,20 @@ export interface ShellWord {
      *  yield zero, one or several words. */
     readonly expands: false | "one" | "many";
 }
+/** One redirection of a segment, as read: the operator and its operand word (a heredoc's operand is its
+ *  delimiter; the IO number or `{name}` before the operator is folded into the operator's meaning and not
+ *  kept). The tightening reader never reads these — a rule speaks about program runs; the read-only
+ *  reader does (an output redirection is a write). */
+export interface ShellRedirection {
+    readonly op: string;
+    readonly target: ShellWord;
+}
 /** One program run the lexer found, after keyword stripping. */
 export interface ShellSegment {
     /** The run as SPELLED (a leading keyword removed): the first candidate a rule is compared against. */
     readonly argv: readonly ShellWord[];
+    /** The segment's redirections in source order (see {@link ShellRedirection}); empty when it has none. */
+    readonly redirections: readonly ShellRedirection[];
     /** The deeper candidates, one per peeled layer (leading assignments, then each wrapper of the table):
      *  `sudo -u root rm -r x` ⇒ `[[rm, -r, x]]`. Empty when nothing peeled. */
     readonly peeled: readonly (readonly ShellWord[])[];
@@ -34,6 +44,14 @@ export interface ShellCommandShape {
     /** A subshell, group, control-structure keyword or dropped empty piece bounded the segments: the
      *  connector list is not one flat chain a compound rule could spell. */
     readonly grouped: boolean;
+    /** A `&` connector anywhere — between two segments or after the last one (`ls &`): some segment runs in the
+     *  background, past any approval-time reading of the line. The connector list alone cannot say so for a
+     *  trailing `&` (a connector rides BETWEEN segments). */
+    readonly backgrounded: boolean;
+    /** A redirection on a piece that runs NO program (`> x` alone, `[ -f a ] > x`, a keyword's own redirection):
+     *  such a piece is dropped from `segments` (the tightening reader asks about program runs, and it runs
+     *  none) — but the shell still opens the target, so a reader that asks about EFFECTS must refuse the line. */
+    readonly strayRedirection: boolean;
 }
 export { SHELL_WRAPPER_TABLE, type ShellWrapperName } from "./shell-wrapper-table.js";
 /** Longer than this and the command is not read at all (one unreadable segment): every pass is linear,