@sema-agent/sdk 11.2.1 → 12.0.0

package/openapi.yaml

@@ -2322,6 +2322,106 @@ paths:
         '422': { $ref: '#/components/responses/UnprocessableEntity' }
         '501': { $ref: '#/components/responses/NotImplemented' }
 
+  /v1/sessions/{sessionId}/background:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+      - in: path
+        name: sessionId
+        required: true
+        schema: { type: string }
+    get:
+      tags: [sessions]
+      operationId: sessionsBackgroundList
+      x-status: live             # S-745 (server 7.102.0; core 7.32.0 #1107); SDK sessions.background.
+      summary: The session's background tasks (the exit sheet's "keeps running / will stop" material).
+      description: >
+        S-745 (server >= 7.102.0; core 7.32.0 #1107; contract §16 "embedded-shape contract"; mint
+        `src/http/routes/background.ts`). 200 `{ rows }` — each row is core `TaskRegistry.list()`'s row projected
+        KEY BY KEY by an explicit whitelist (`task_id` renamed `id`; `toolUseId` / `updatedAt` deliberately
+        stripped). Only THIS session's rows: the access tuple is the session's own `{owner: sid, sessionId: sid,
+        scope}` and visibility is core's fail-closed `canAccess` (the session's session-resident shells, the run row
+        whose task id is the session id, workflows this session started, background agents rooted at this
+        session). `retained` rides ONLY when true (core's retain predicate: env / task lane / row mark) — present =
+        "keeps running" on the exit sheet; absent = an `includeRetained:false` stop WILL stop it. `description` is
+        the model's description, falling back to the launch command text (content family: redacted, cut at 500
+        chars). At most 500 rows (core `list()`'s own cap). 🔴 IN-PROCESS: only rows on THIS replica.
+        Zero model work: not billable, not refused by drain. Gates (same family as `mcp/reconnect`): 501
+        `capability.session_ownership_required` (no `sessionStorage.ownerOf`) · 404 `not_found.session` — unknown
+        session AND someone else's session answer the SAME code and SAME message (no existence oracle); an EXPLICIT
+        operator may read any session · 400 `request.path_malformed`. Probe with `capabilities.background.listFace`;
+        ABSENT key = an older server, where this path is 404 `not_found.route` (same status, different code).
+      responses:
+        '200':
+          description: The session's background rows (read the row schema for the `retained` / `status` readings).
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/SessionBackgroundList' }
+        '400': { $ref: '#/components/responses/BadRequest' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '404': { $ref: '#/components/responses/NotFound' }
+        '501': { $ref: '#/components/responses/NotImplemented' }
+
+  /v1/sessions/{sessionId}/background/stop:
+    parameters:
+      - $ref: '#/components/parameters/PrincipalHeader'
+      - in: path
+        name: sessionId
+        required: true
+        schema: { type: string }
+    post:
+      tags: [sessions]
+      operationId: sessionsBackgroundStop
+      x-status: live             # S-745 (server 7.102.0; core 7.32.0 #1107); SDK sessions.backgroundStop.
+      summary: Stop the session's background tasks — soft, then one grace, then a synchronous hard kill; receipts are complete before 200.
+      description: >
+        S-745 (server >= 7.102.0; contract §16; mint `src/http/routes/background.ts`). The SAME session-level
+        convergence function as the `DELETE /v1/sessions/{sessionId}` cascade: SOFT (core's session anchor SIGTERMs
+        and settles the session's background agents / workflows; every still-running shell row the hard face will
+        revisit gets a per-row soft stop — with `includeRetained:true` the retained live services receive SIGTERM
+        here too) → GRACE (the hard face waits until every row it will revisit is past "its soft-stop instant +
+        `HOST_BG_KILL_GRACE_MS`", default 1000 ms; nothing to wait for ⇒ no wait) → HARD (core
+        `killAllBackgroundShellsNow` — a synchronous process-group SIGKILL; a shell ignoring SIGTERM does not
+        survive it). 🔴 THE RECEIPTS ARE COMPLETE BEFORE THE 200: with background rows the answer is one grace
+        slower — budget the shell's exit wait in seconds.
+        Body `{ includeRetained }` is REQUIRED with NO default (core's rule: the caller states which kind of stop
+        this is): `true` = also stop the explicitly retained live services (the shell's "Exit and stop tasks");
+        `false` = keep them (they come back as `retained_skipped`; `sema kill`'s session-level reap). The body
+        gate is STRICT — absent / non-boolean / an extra key ⇒ 400 `request.body_shape`.
+        Receipts carry SHELL rows only (`background_bash` / `monitor`); `outcome` is core's four words passed
+        through VERBATIM — `killed` (a live process group was reaped now) · `already_gone` (already exited, or
+        already hard-killed — incl. exiting within the grace) · `retained_skipped` (kept by
+        `includeRetained:false`) · `no_pgid` (NO synchronous hard kill landed: remote / sandbox lanes have no
+        host-local process group — e2b / k8s·kata / local-docker / ssh / device / adb always answer it — or win32 /
+        a refused signal; core already sent an ordinary kill ⇒ "MAY STILL BE RUNNING", neither a failure nor ever
+        "stopped").
+        🔴 CREDENTIAL-GATED (server >= 7.102.0 as released): on a worker with no service credential
+        (`SERVICE_AUTH_TOKEN(S)`) and without `ALLOW_UNAUTHED_WRITES`, this path answers 503
+        `auth.service_token_required` BEFORE routing (same code and sentence as every other mutating door) — the
+        principal header is self-asserted there, and stopping background processes is irreversible.
+        `capabilities.background.exitFaces` does NOT include "credentials ready" (the same family gap as the
+        `memoryCompliance` row) — branch on that code. Other gates as the list path: 501
+        `capability.session_ownership_required` · 404 `not_found.session` (unknown and foreign sessions alike) · 400
+        `request.path_malformed`; this path is rate-limited (429). NOT called by run cancel (Esc): session-resident
+        background shells live across turns (CC parity). A delegated helper's shells hang on the helper's own
+        session and are out of this door's reach. Probe with `capabilities.background.exitFaces`.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/SessionBackgroundStopRequest' }
+      responses:
+        '200':
+          description: The receipts (shell rows only). Read `no_pgid` as "may still be running".
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/SessionBackgroundStopResult' }
+        '400': { $ref: '#/components/responses/BadRequest' }
+        '401': { $ref: '#/components/responses/Unauthorized' }
+        '404': { $ref: '#/components/responses/NotFound' }
+        '429': { $ref: '#/components/responses/RateLimited' }
+        '501': { $ref: '#/components/responses/NotImplemented' }
+        '503': { $ref: '#/components/responses/Unauthorized' } # `auth.service_token_required` — the credential-gated write door (no service credential and no ALLOW_UNAUTHED_WRITES), before routing.
+
   /v1/sessions/{sessionId}/memory-status:
     parameters:
       - $ref: '#/components/parameters/PrincipalHeader'
@@ -3031,6 +3131,15 @@ paths:
             (REOPENED) and re-appears on `/v1/approvals`. SDK → ParkedResumeStartupError. Client action:
             re-fetch the pending list and decide again, fixing what was rejected. (Before 5.12.0 this shape
             collapsed into the 409 `decide.revive_rejected`.)
+            🔴 core 7.32.0 (#1110) ADDS A CAUSE (server >= 7.102.0; contract appendix A.1, MIGRATION 7.102.0): an
+            `approve` on a child parked on an INHERITED tool (a tool family the child inherits from the scenario
+            layer — the task tools, WebFetch …) whose redemption cannot hand over the inherited seat ⇒ core refuses
+            BEFORE consuming the approval: the approval stays PENDING and a `deny` still settles it. From server 7.102.0
+            a ONE-LEVEL row (its root session = the parent session, and that root session STILL belongs to this card's
+            tenant) is redeemed with the seat re-resolved from the root session, so it no longer lands here; a DEEPER
+            (grandchild) row, or one whose root session was deleted / changed owner, still does (core #1112 pending) —
+            render it as "this card can only be denied / wait for a server upgrade". Not a regression: 7.31.x children
+            never had those tools.
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
@@ -3808,6 +3917,32 @@ paths:
                     substitution), the command bytes were unreadable, or this ask belongs to one of the seven
                     families that never get offers — so do NOT diagnose the deployment's rule lane from one
                     frame or from that one refusal.
+                settledBy:
+                  type: string
+                  enum: [policy]
+                  description: >-
+                    server #1016 (>= 7.93.3, core 7.26.2), ADDITIVE — the SETTLEMENT SOURCE of this answer.
+                    `"policy"` is a MACHINE REFUSAL, NEVER THE USER'S WORDS: the deployment's own policy answered
+                    this card, not a person. ABSENT = today's shape (read as a person's answer).
+
+                    Same word, same source and the same three-question rationale as the durable leg's key
+                    (`POST /v1/approvals/{sessionId}/decide`, ApprovalDecision.settledBy) — see that schema for
+                    the full account. `decision:"deny"` ONLY: an allow-family decision carrying this key is a
+                    contradiction, refused BEFORE THE DECISION (400 `request.body_shape`, the same sentence as
+                    the durable leg) rather than after — the engine's refusal cannot travel back up this HTTP
+                    leg, and by then this door's own side effects (the session allow-all grant, a persisted
+                    rule, a DECIDED row that replays as a plain approval) have already landed. Because the
+                    refusal precedes the decision, the ask is NOT settled: the card is still open and the same
+                    `approvalId` can be answered again. The PARKED late-acceptance arm reads the same key.
+
+                    SHAPE, not word: a non-string is a 400. A word core does NOT know travels UNTOUCHED — this
+                    door still answers 200 (its 200 only ever meant "your answer was delivered") and the ENGINE
+                    refuses it fail-closed, settling as `approver_contract`, NEVER as `policy_refused`: a
+                    misspelled word must not be rendered as "the deployment's policy refused".
+
+                    No capability bit: an older server ignores unknown keys and answers 200, so the refusal is
+                    still read as a person's there. Judge by server version, or read back whether
+                    `tool_end.gate.settlement.kind` ever shows `policy_refused`.
                 note:
                   type: string
                   maxLength: 2048
@@ -3828,6 +3963,23 @@ paths:
                     NOT strict (hand-written parser, unknown keys are ignored), so an older server answers 200 and
                     records nothing. Bit absent = old server, do not offer the field. Bit present ⇒ read the
                     per-call truth from the ack's `noteRecorded`.
+                readRootGrant:
+                  type: string
+                  minLength: 1
+                  description: >-
+                    S-720 (server >= 7.102.0 / core 7.32.0 #1093), ADDITIVE — "Yes, and add directory": the frame's
+                    `readRootCandidate.dir` sent back BYTE FOR BYTE (a STRING — never normalised, cut or composed; not an
+                    object). Beside `allow` it also adds that directory to THIS RUN's read directories (read faces only).
+                    🔴 `decision:"allow"` ONLY — on `allow_session` / `deny` the server refuses BEFORE the decision with 400
+                    `request.body_shape` (the card stays open; answer the same `approvalId` again). SHAPE gate: a non-empty
+                    string of at most core's `READ_ROOT_CANDIDATE_DIR_MAX`, else the same 400 (an over-long value is refused
+                    whole, never cut — a cut directory is another directory). The server judges SHAPE, never VALUE: whether
+                    it equals the card's string is the ENGINE's call, and the verdict arrives only as an `engine_notice` —
+                    `approval.read_root_granted` (the run's read roots really widened) or `approval.read_root_grant_rejected`
+                    (nothing changed; the decision stands). The 200 never says which. Reach: THIS RUN only (the ask row has no
+                    such column, so replay / failover / durable resume do not carry it) and THIS DOOR only (the durable
+                    `/decide` and the in-stream `…/asks/{askId}/decision` doors do not read it). An older server ignores the
+                    unknown key and answers 200 with a plain allow (no capability bit yet) — trust the notice.
       responses:
         '200':
           description: Ack (`decision` echoed).
@@ -6532,15 +6684,27 @@ components:
         rewindFiles:
           type: boolean
           description: >
-            CC Rewind parity (E18). On a NORMAL turn ⇒ CAPTURE a working-tree snapshot at turn end (per-turn, by leaf;
-            required so later rewinds have something to restore). On a resumeAt turn ⇒ RESTORE the tree to resumeAt's
-            snapshot ("both"). Needs a fileSnapshotStore wired (capabilities.rewindFiles).
+            RETIRED SPELLING (the whole-tree snapshot epoch; S-15 / design/381, server >= 7.52 — note corrected in sdk
+            11.4.0, the same stale-note family as `rewindFilesTo`, board [8437] U3). Server `src/http/wire-types.ts`: still
+            accepted on the wire — its capture sense (true, no resumeAt) is a tolerated no-op with a deprecation disclosure;
+            its restore sense (true + resumeAt) is core's TYPED migration rejection naming `restoreFiles` (restore semantics
+            really changed: whole tree ⇒ tracked set; the server never remaps it silently). Send `restoreFiles` (probe
+            `capabilities.restoreFiles`); this key stays declared only for <= 7.51 servers.
         rewindFilesTo:
           type: string
           description: >
-            CC Rewind "code"-only (core 1.166.0 TaskSpec.rewindFilesTo). Restore the working tree to this user-message
-            entryId's snapshot WITHOUT forking the conversation (no setLeafId). Use instead of resumeAt+rewindFiles when
-            the user wants only files reverted. Target = a user-message SessionTreeEntry.id.
+            CC Rewind "code"-only (core 1.166.0 TaskSpec.rewindFilesTo; server "R8"). Converge the files this session
+            edited (the TRACKED set) to the history boundary at a prior USER message WITHOUT forking the conversation (the
+            session leaf is untouched — only the files move). Use instead of resumeAt+restoreFiles when the user wants only
+            files reverted. 🔴 The value is a HANDLE, not an entry id (corrected in sdk 11.4.0, board [8437] U3): the SAME
+            kind of handle as `resumeAt`, resolved through the SAME anchor store — typically the `taskId` from that turn's
+            202 receipt (the server keys the user-message anchor by the run's taskId). Server `src/boot/resolve-spec.ts:686-697`:
+            `resumeAnchorStore.resolve(sessionId, handle, principal)` → entry id; unknown handle ⇒ 404
+            `rewind_files_to.unknown_event`; no session ⇒ 422 `rewind_files_to.no_session`; no anchor store / no getLeafId ⇒
+            501. ⚠️ The 501 is NOT the capability's whole predicate: `capabilities.rewindFilesTo` also requires the
+            file-history store (capture face); without it the server does not 501 — core refuses in the run with
+            `rewind.store_unconfigured` — so probe the bit first. Honored ONLY when `resumeAt` is absent. One-shot at submit
+            (resume legs strip it, server >= 7.72.0).
         restoreFiles:
           type: boolean
           description: >-
@@ -7931,6 +8095,40 @@ components:
             not inside the HMAC payload, so accepting it unsigned would be tamperable); 501 without an exemption
             store. On the parked-background-agent leg the grant lands on the child's ROOT/HOST session (the whole
             session tree shares it). The 200 body echoes `rememberApplied` when a store is wired.
+        settledBy:
+          type: string
+          enum: [policy]
+          description: >-
+            server #1016 (>= 7.93.3, core 7.26.2), ADDITIVE — WHO made this decision. `"policy"` is a MACHINE
+            REFUSAL, NEVER THE USER''S WORDS: the deployment''s own policy answered this card (a headless lane —
+            CI, a background batch, a shell refusing by a standing deployment posture). ABSENT = today''s shape
+            (`person`), so an unrevised caller is byte-for-byte unchanged.
+
+            WHY IT EXISTS: without the word, a policy refusal is byte-identical to "a person pressed No", and the
+            model reads "the user doesn''t want to proceed; STOP and wait for the user to tell you how to proceed"
+            — a sentence about a person, in a run where none is coming. With it the engine mints a POLICY sentence
+            instead, this request''s `reason` travels as the POLICY''s words (not as the user''s guidance), and the
+            settlement is recorded as `policy_refused` (`who.party: "none"`).
+
+            CONSTRAINTS: `decision:"deny"` only — only a person approves an action that EXECUTES, so
+            `{decision:"approve", settledBy:"policy"}` is a contradiction, refused by the SERVER before the
+            decision (400 `request.field_conflict`, the SAME SENTENCE as the live door) with the engine''s own
+            pre-CAS refusal (`checkpoint.invalid_outcome`) behind it as depth; the server does NOT silently drop
+            the key. It is therefore MUTUALLY EXCLUSIVE with `remember` (which is approve-only) — one body
+            cannot carry both. The vocabulary''s owner is still core: the server accepts the KEY and relays the
+            VALUE verbatim, so a word core does not know is refused by the engine, never by a server-side
+            second judge of the vocabulary.
+            REFUSED on a direct-door worker (400 `settled_by_not_in_proof` — not inside the HMAC payload, same
+            rule as `remember` / `updatedInput` / `checkpointToken`); a non-direct-door deployment is unchanged.
+
+            SHAPE, not word: a non-string is 400 `request.field_invalid` (same family as `reason must be a
+            string`). A word core does NOT know travels UNTOUCHED and is refused BY THE ENGINE pre-CAS:
+            409 + `errorCode: "resume_outcome_invalid"` + `field: "hostDecision"` + `retriable: true`, and the
+            card STAYS PENDING (re-decide the same coordinates with a corrected body). NOTE this family no
+            longer answers `approval_binding_mismatch`: from server 7.93.3 the `policy_ask` gate splits
+            `invalid_outcome` by `field`, and the non-binding seats (`hostDecision`, `approver`) answer
+            `resume_outcome_invalid` — "you approved the wrong action" is a sentence about a different fault.
+            The binding seats and the field-absent shape are byte-for-byte unchanged.
 
     ApprovalRow:
       type: object
@@ -8127,7 +8325,16 @@ components:
             with no explicit allowlist); ABSENT = an older server (degrade to not teaching, not validating).
         resumeAt: { type: boolean, description: "E18 resume-at-message anchors are resolvable." }
         rewindFiles: { type: boolean, description: "E19 working-tree snapshot/restore is wired." }
-        rewindFilesTo: { type: boolean, description: "Restore to a SPECIFIC entry id (not just the latest snapshot)." }
+        rewindFilesTo:
+          type: boolean
+          description: >-
+            Code-only rewind (`TaskRequest.rewindFilesTo`) is wired — mint `routes/capabilities.ts:839` =
+            `Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId)`: it needs the
+            file-history store (to restore) AND the anchor map (to resolve the target HANDLE). Corrected in sdk 11.4.0
+            (board [8437] U3): the store is the FILE-HISTORY store (not the pre-S-15 whole-tree snapshot store), and since
+            server 7.97.0 (S-589) that seat is the CAPTURE face = backend AND the `FILE_HISTORY_CAPTURE` knob — a deployment
+            that turns capture off reports this bit false together with `rewindFiles` / `restoreFiles` / `sessionSync`
+            (and `fileHistoryCapture: "off"`).
         restoreFiles:
           type: boolean
           description: >-
@@ -8691,6 +8898,70 @@ components:
           properties:
             provider: { type: string, description: 'host | e2b | k8s | ssh | adb | local-docker | device — typed from the server''s RemoteExecProvider; `REMOTE_EXEC` unset ⇒ `host`.' }
             toolsOnThisHost: { type: boolean, description: 'The tools run on the process that answered this request (server-absolute paths mean something to the model''s tools).' }
+        taskWriteFaceOpen:
+          type: boolean
+          description: >
+            server >= 7.95.0 (S-591; value meaning refined at 7.96.0 / S-613; mint `routes/capabilities.ts:653` =
+            `taskWriteFaceRefusal(deps.config) === undefined && autonomyOverrides(deps.config.autonomy).writeFace !== "roots"`)
+            — DISCLOSURE BIT OF THE WRITE-CONTAINMENT FACE: does this deployment honour the task-level "open the write
+            fence" declaration (`permissionMode:"bypassPermissions"` ⇒ `TaskSpec.writeFace:"open"`, writes outside the
+            workspace roots)? `false` has two forms: (1) the hosted-posture gate refuses ⇒ sending that mode gets
+            `422 request.host_posture_refused`; (2) the deployment runs `AUTONOMY=read-only|plan` ⇒ the request is
+            accepted but the write face is clamped back to roots — the declaration silently does nothing. Three states
+            are folded into one bit on purpose: the caller has exactly one decision (send that key or not); tier and
+            evidence live in the refusal body and the operator's `GET /v1/diagnostics/wiring`. It speaks ONLY for the
+            write-containment cell — the other two columns of `bypassPermissions` are unaffected.
+            ABSENT = an older worker (<= 7.94) ⇒ read as `true` (contract appendix B.1: nothing refused it back then).
+        taskApproverPosture:
+          type: boolean
+          description: >
+            server >= 7.95.0 (S-591 leg ③; mint `routes/capabilities.ts:659` = `taskApproverPostureHonored(deps.config)`,
+            the SAME predicate as the real consumer) — DISCLOSURE BIT OF `approverPosture`: does this deployment honour
+            the submit body's host-posture statement ("this run's approval cards are auto-answered by the host
+            itself")? `false` ⇒ the key is IGNORED (the request is still 202-accepted; the server logs
+            `task_approver_posture_ignored`) — deliberately NOT refused: the resume legs replay the persisted body
+            verbatim and the caller cannot remove it, so a refusal would brick a parked task forever. Same reach as
+            the hosted-gate half of `taskWriteFaceOpen` (hosted posture ⇒ both false); `AUTONOMY=read-only|plan`
+            only clears `taskWriteFaceOpen`, never this bit.
+            ABSENT = an older worker (<= 7.94) ⇒ read as `true` (contract appendix B.1: it passed through back then).
+        fileHistoryCapture:
+          type: string
+          enum: ['off', on-always]
+          description: >
+            server >= 7.97.0 (S-589; mint `routes/capabilities.ts:847` = `fileHistoryCaptureOf(deps.fileHistoryStore)`,
+            closed word set owned by the server's `src/file-history-capture.ts` `FILE_HISTORY_CAPTURE_WORD_SET`) —
+            CAN FILE-HISTORY CAPTURE BE TURNED OFF. Derived from the ASSEMBLY RESULT (capture face = backend AND the
+            `FILE_HISTORY_CAPTURE` deployment knob), NOT an echo of the knob — a deployment without the backend is
+            `off` too; the SAME judgement as `rewindFiles` / `restoreFiles` / `rewindFilesTo` / `sessionSync`.
+            `off` = this deployment captures no first-touch snapshots and has no rewind / restore / code-only rewind /
+            session-sync ⇒ render neither a "turn capture off" switch nor a rewind entry. `on-always` = capturing, and
+            it CANNOT be turned off per session (core's first-touch capture is process-wide) ⇒ render one read-only true
+            sentence, never a switch that cannot switch.
+            🔴 A third word `on-optional` ("this session may skip capture") is DELIBERATELY UNDECLARED by the server (it
+            waits for a per-session no-capture seat in core); when it lands it is an additive server change and this
+            enum grows with it. Keep a default arm (unknown word ⇒ treat as unknown, render no switch). Turning capture
+            off does NOT delete what was already captured.
+            ABSENT = an older worker (<= 7.96) ⇒ fall back to `rewindFiles` (`true` ⇒ `on-always`, `false` ⇒ `off`).
+        background:
+          type: object
+          additionalProperties: true
+          description: >
+            server >= 7.102.0 (S-745 / core 7.32.0 #1107; mint `routes/capabilities.ts:308` = `{ listFace:
+            sessionBackgroundFacesAvailable(deps), exitFaces: sessionBackgroundFacesAvailable(deps) }`) — presence of the
+            session background-task doors: `listFace` = `GET /v1/sessions/{sessionId}/background`, `exitFaces` =
+            `POST /v1/sessions/{sessionId}/background/stop` (contract §16). Both bits use the SAME predicate as the two
+            doors' 501 (the session-ownership face `sessionStorage.ownerOf`), so "says yes but 501s" is structurally
+            impossible; without it both bits are explicitly `false` and both doors answer 501
+            `capability.session_ownership_required`. ENDPOINT-GATE FORM: `false` ⇒ do not call. True only promises the
+            endpoint — not that this replica holds any background row of that session (the registry is in-process).
+            ⚠️ `exitFaces` does NOT cover "credentials ready": on a worker with no service credential and without
+            `ALLOW_UNAUTHED_WRITES` the bit is true while the stop door answers 503 `auth.service_token_required` —
+            branch on that code (the same family gap as `memoryCompliance`). ABSENT = an older server (both doors 404)
+            ⇒ the shell's exit dialog offers only "Stay / Exit", never "Exit and stop tasks".
+          required: [listFace, exitFaces]
+          properties:
+            listFace: { type: boolean }
+            exitFaces: { type: boolean }
     WriteProtectionCapability:
       type: object
       additionalProperties: false
@@ -10746,6 +11017,13 @@ components:
         sessionId: { type: string }
         requiresRealApproval: { type: boolean, enum: [true] }
         governanceForced: { type: boolean, enum: [true] }
+        mandated: { type: boolean, enum: [true], description: 'server >= 7.101.0 (T4①): the mandated bit, same layer and shape as the two flags above (present only when true); the SAME value as `frame.mandated` (read once when the entry is minted).' }
+        mandate:
+          allOf: [{ $ref: '#/components/schemas/PersistedRuleMandate' }]
+          description: 'server >= 7.102.0 (S-721): which word the mandated bit stands on — same layer and shape as `mandated`, the SAME value as `frame.mandate`. Absence never names a word.'
+        origin:
+          allOf: [{ $ref: '#/components/schemas/AskOrigin' }]
+          description: 'server >= 7.102.0 (S-755 / cli L-695): WHO raised this ask, read once together with `frame.origin` when the entry is minted. The durable `pending[]` rows of the same response carry it top-level too — one reading for both row families. OPEN set (see AskOrigin).'
         fromSubagent: { type: boolean, enum: [true], description: 'The ask originates from a delegated subagent.' }
         originTaskId: { type: string, description: 'S-52 C2 (server ≥7.52, A-075.87): the delegated child taskId (= the child''s core runSourceTaskId, uuid) — correlates this live ask to the child run row. Minted by the SAME conditional spread as `fromSubagent`: the two keys are always both present or both absent (三键恒等亲证在案).' }
         contentKind: { type: string, description: 'S-62 (server >= 7.6x): content-question kind — `content_ask` when the gated tool is AskUserQuestion (the SAME word as the two durable read faces and core''s summarize face). Absent = an ordinary tool ask. Display/triage only; it NEVER takes part in decision routing.' }
@@ -11054,6 +11332,27 @@ components:
             presence may differ between the two legs for one ask. Derived from hot-reloadable governance knobs —
             long subscribers follow the stream's re-emitted frames. Absence ≠ "not governance-forced"; it means
             "no governance-origin evidence". Never written as false.
+        # ── park-row facts (server `src/approval-card.ts` `ParkRowFacts` — the five facts core mints on the parked
+        #    `PendingAction.tool_approval` arm, projected by `parkRowFacts`, the SAME projection on both stores and on the
+        #    `/stream` `pending` frame). DISPLAY / TRIAGE projection, never a permission input; each present only when
+        #    true / a word. sdk 11.4.0 declares all five (the first three were already on the wire since 7.100.0 / 7.101.0).
+        requiresRealApproval:
+          type: boolean
+          enum: [true]
+          description: 'server >= 7.100.0 (S-700): this parked ask can only be cleared by a REAL HUMAN (core park-row twin seat, strict `=== true`). Absent = not marked, never "clearable without a person".'
+        mandated:
+          type: boolean
+          enum: [true]
+          description: 'server >= 7.101.0 (S-663 part 2 / core 7.31.0 #1079): the durable twin of the mandated bit (no rule can clear this ask). Independent of `requiresRealApproval` (which implies it) and `ruleOffersAbsence` — projected bit by bit, never inferred.'
+        mandate:
+          allOf: [{ $ref: '#/components/schemas/PersistedRuleMandate' }]
+          description: 'server >= 7.102.0 (S-721): which word the mandated bit stands on — the park-row twin seat read through `readClosedWordSeat(…, "mandate")` (core `isPersistedRuleMandate`); an out-of-set word reads as absent. Answers the same as the inbox row for the same row.'
+        origin:
+          allOf: [{ $ref: '#/components/schemas/AskOrigin' }]
+          description: 'server >= 7.102.0 (S-755 / cli L-695 / C-R111): WHO raised this ask — the park-row twin seat `PendingAction.tool_approval.origin` read through `readClosedWordSeat(…, "origin")` (core `isAskOrigin`). Same word as the live card frame and the inbox row. Absent = an old row (parked before core 7.5.0) or an out-of-set word — NOT "policy".'
+        ruleOffersAbsence:
+          allOf: [{ $ref: '#/components/schemas/RuleOffersAbsence' }]
+          description: 'server >= 7.100.0 (S-700): WHY the park row offers no rule — the same narrow read and closed three-word set as the live card frame and `card_json`.'
         hasBidiControls:
           type: boolean
           enum: [true]
@@ -11160,6 +11459,20 @@ components:
             🔴 NEVER minted as `false` (the OMIT contract this row's other flags follow); absence is "not marked",
             never "confirmed clearable without a person". The value comes WHOLE from core (`summarizeCheckpoint`
             projects the park row's own bit) — the server neither recomputes nor redacts it.
+        mandated:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.101.0 (S-663 part 2 / core 7.31.0 #1079), ADDITIVE, present ONLY when true: the durable twin of
+            the mandated bit (core `summarizeCheckpoint` screens the park row's `PendingAction.tool_approval.mandated`
+            to a literal `true`; the server mints the key on strict `=== true`). Declared in sdk 11.4.0 — this schema is
+            CLOSED, so before that a strict validator rejected every row that carried it.
+        mandate:
+          allOf: [{ $ref: '#/components/schemas/PersistedRuleMandate' }]
+          description: >-
+            server >= 7.102.0 (S-721 / core 7.32.0 #1092): which word the mandated bit stands on (core
+            `CheckpointSummary.mandate`, already screened by core's `isPersistedRuleMandate`; the server does not screen
+            twice). Answers the same as the operator queue row for the same park row.
         denialLimitFallback:
           $ref: '#/components/schemas/DenialLimitFallback'
           description: >-
@@ -11789,6 +12102,73 @@ components:
             budgetMs: { type: integer }
             error: { type: string }
 
+    SessionBackgroundRow:
+      type: object
+      description: >
+        One row of `GET /v1/sessions/{sessionId}/background` (S-745, server >= 7.102.0; mint
+        `src/http/routes/background.ts` `SessionBackgroundRow`) = core `TaskRegistry.list()`'s row projected key by
+        key (`task_id` renamed `id`; `toolUseId` / `updatedAt` stripped). The three word sets are OWNED BY CORE
+        (7.32.1 `SemaTaskType` / `SemaTaskStatus`), transcribed verbatim. 🔴 IN-PROCESS: only rows on this replica.
+        Response projection: declared key by key AND open (additive keys between SDK releases must not make a legal
+        row unreadable — the LivePendingRow ruling).
+      additionalProperties: true
+      required: [id, type, status, createdAt, sessionScoped]
+      properties:
+        id: { type: string, description: 'core `task_id` (renamed). A receipt''s `id` is the same value.' }
+        description: { type: string, description: 'The model''s description, falling back to the launch command text (core keeps no separate raw command). Content family: redacted, cut at 500 characters. UNTRUSTED for display.' }
+        type: { type: string, enum: [background_bash, workflow, background_agent, monitor], description: 'core `SemaTaskType`.' }
+        status: { type: string, enum: [pending, running, parked, completed, failed, killed, cancelled], description: 'core `SemaTaskStatus` (`parked` = a background agent suspended on a pending approval — neither live nor terminal).' }
+        createdAt: { type: integer, description: 'Registration time (epoch ms).' }
+        sessionScoped: { type: boolean, description: '`true` = session-resident (lives across turns); `false` = run-scoped.' }
+        retained:
+          type: boolean
+          enum: [true]
+          description: >-
+            core's retain predicate (env declaration / task lane / row mark — any ⇒ kept) — present ONLY when true,
+            never minted as false, and only ever on a shell row (`background_bash` / `monitor`; core `list()` row
+            doc). Present = "keeps running" on the exit sheet; absent = an `includeRetained:false` stop WILL stop it.
+    SessionBackgroundList:
+      type: object
+      description: '`GET /v1/sessions/{sessionId}/background` 200 body (contract §16). An idle session answers `{ rows: [] }`.'
+      additionalProperties: true
+      required: [rows]
+      properties:
+        rows:
+          type: array
+          items: { $ref: '#/components/schemas/SessionBackgroundRow' }
+    SessionBackgroundStopRequest:
+      type: object
+      description: >
+        `POST /v1/sessions/{sessionId}/background/stop` body — server `StopBodySchema = z.object({ includeRetained:
+        z.boolean() }).strict()`: EXACTLY this key, REQUIRED, NO default. `true` = also stop explicitly retained live
+        services ("Exit and stop tasks"); `false` = keep them (`retained_skipped`). Absent / non-boolean / an extra
+        key ⇒ 400 `request.body_shape`.
+      additionalProperties: false
+      required: [includeRetained]
+      properties:
+        includeRetained: { type: boolean }
+    SessionBackgroundReceipt:
+      type: object
+      description: >
+        One receipt of the stop door — SHELL rows only (`background_bash` / `monitor`). `outcome` = core 7.32.1
+        `BackgroundShellHardKillReceipt.outcome` (`BackgroundHardKillOutcome` ∪ `retained_skipped`), passed through
+        VERBATIM: `killed` / `already_gone` (both = "this row is reaped") · `retained_skipped` (kept, process alive) ·
+        `no_pgid` (no synchronous hard kill landed — MAY STILL BE RUNNING; never render it as stopped).
+      additionalProperties: true
+      required: [id, outcome]
+      properties:
+        id: { type: string, description: 'The row id (core taskId).' }
+        outcome: { type: string, enum: [killed, already_gone, retained_skipped, no_pgid] }
+    SessionBackgroundStopResult:
+      type: object
+      description: '`POST /v1/sessions/{sessionId}/background/stop` 200 body. The receipts are COMPLETE before the 200 (soft → grace → hard is awaited).'
+      additionalProperties: true
+      required: [receipts]
+      properties:
+        receipts:
+          type: array
+          items: { $ref: '#/components/schemas/SessionBackgroundReceipt' }
+
     # ── 2c session-sync (P1d) — the cloud-as-a-SYNC-PEER schemas ──────────────────────────────────────────────
     SyncEntry:
       type: object
@@ -12479,12 +12859,18 @@ components:
         the ROUTING question "nobody reachable" and no park took the ask) · `approver_error` (it threw) ·
         `approver_contract` (it answered outside its contract) · `presentation_failed` (args/edit could not be
         safely presented or adopted) · `blanket_allow_refused` (a blanket `onAsk:"allow"` met a
-        `requiresRealApproval` ask) · `task_aborted` (the wait''s abort signal ended it).
+        `requiresRealApproval` ask) · `policy_refused` (server >= 7.93.3 / core 7.26.2, #1016 — THE
+        DEPLOYMENT''S OWN POLICY refused: the approval channel reported that a MACHINE, not a person, ended
+        this wait. Distinct from `human_refused` because the party differs and the model is told a different
+        thing — a person''s "no" is the user''s direction, a policy''s is a capability of this run; distinct
+        from `no_approver` because a channel WAS wired and answered. This family carries NO `note` seat: the
+        note seat belongs to the two human words, whose ABSENCE is a control-flow fact) · `task_aborted`
+        (the wait''s abort signal ended it).
       required: [kind, who, when]
       properties:
         kind:
           type: string
-          enum: [no_approver, approver_unavailable, approver_error, approver_contract, presentation_failed, blanket_allow_refused, task_aborted]
+          enum: [no_approver, approver_unavailable, approver_error, approver_contract, presentation_failed, blanket_allow_refused, policy_refused, task_aborted]
         who:
           type: object
           additionalProperties: false
@@ -13585,6 +13971,17 @@ components:
         spec-resolver, which now passes the notice seat). Consequence for consumers that assert on ledger
         CONTENTS: a resume leg's ledger MAY now carry one extra `engine_notice` row it did not before — assert
         "may appear", never an exact row count or order (and consume idempotently: reconnect replay shows it again).
+        `approval.read_root_granted` / `approval.read_root_grant_rejected` (server >= 7.102.0 / S-720 / core 7.32.0
+        #1093) — the ENGINE's verdict on a `readRootGrant` answer (POST /v1/tool-approvals/{id}/respond), at most one
+        frame per answered ask. GRANTED = this run's read directories really include it now (core: the ONLY evidence the
+        run widened; read faces only, this run only) — `{dir, covers?, root, toolName, toolCallId, sessionId, runId,
+        taskId?}`, `root` = the canonical spelling the engine holds. REJECTED = nothing changed and the decision stands
+        (say so plainly) — `{reason, offered?, requested?, toolName, toolCallId, sessionId, runId, taskId?}`, `reason` one of
+        core's eight words (`on_refusal` / `not_a_string` / `no_candidate` / `mismatch` / `unresolvable` /
+        `resolves_elsewhere` / `admits_artifact_store` — the directory contains, lies inside or is the local artifact
+        store; unreachable on a server 7.102.0 deployment, which wires no artifact host — / `no_read_roots`), passed
+        through verbatim by the server (echo-only, not enumerated) — read it as an OPEN set. `toolCallId` joins to the
+        `tool_approval` frame.
         `delegation.ask_unresolvable` (server >= 7.69.0 / core 7.10.0 #648) — an `ask` reached a FINAL DENY with
         NOBODY having ruled on it: the approver consulted for the call answered `unavailable` and no durable park
         caught it afterwards. The deny itself is unchanged (`tool_end.gate.settlement.kind:"approver_unavailable"`
@@ -14258,8 +14655,18 @@ components:
           description: >
             (server >= 7.93.0, core 7.26.0 #997) This card was MANDATED — a read-station / rule-lane forced ask (a rule can
             never clear it; an approver's yes cannot release a deny-listed read). Present only when true, literal `true`;
-            absent = an ordinary ask. The durable parked row carries no twin bit: read `ruleOffersAbsence: "mandated"` there
-            (the same fact on the durable face).
+            absent = an ordinary ask. ⚠️ CORRECTED (sdk 11.4.0): the durable parked row DOES carry a twin bit since core
+            7.31.0 #1079 (`PendingAction.tool_approval.mandated`), projected since server 7.101.0 onto the operator queue
+            row / the `/stream` `pending` frame / the inbox row (S-663 part 2) and the `livePending` row top level (T4①)
+            — four faces, one bit. `card_json` does not carry it (`ApprovalCardSchema` is `.strict()`).
+        mandate:
+          allOf: [{ $ref: '#/components/schemas/PersistedRuleMandate' }]
+          description: >-
+            server >= 7.102.0 (S-721 / core 7.32.0 #1092), "tool_approval" only, ADDITIVE — which word the `mandated`
+            bit stands on (server `src/tool-approval.ts:841`, read through `readClosedWordSeat(req, "mandate")` =
+            core's `isPersistedRuleMandate` screen). Present only when the WHOLE cause of `mandated:true` is that one
+            word; absence never names a word and is not "not mandated". Same value on the `livePending` row, the
+            operator queue row and the inbox row; NOT on `card_json` / `approval_request`.
         denialLimitFallback: { $ref: '#/components/schemas/DenialLimitFallback' }
         parked:
           type: boolean
@@ -14561,6 +14968,13 @@ components:
 
         The SAME type is the `origin` member of `GateOutcome` on `tool_end` — one vocabulary, two faces.
 
+        server >= 7.102.0 (S-755 / cli L-695 / C-R111): the word now also rides the `livePending` row top level
+        (read once with the frame's) and the operator queue row (`GET /v1/approvals` `pending[]` + the `/stream`
+        `pending` frame — the park-row twin seat, screened by core's `isAskOrigin`), besides the frame and the inbox
+        row — five faces, one word. `card_json` / the `approval_request` frame still do not carry it (the card is
+        `.strict()`). The eleven known words are exported at runtime as the SDK's `ASK_ORIGINS` (core 7.32.1
+        `ASK_ORIGINS`, verbatim and in order) — known words, NOT an enforcement table.
+
     RuleOffersAbsence:
       type: string
       enum: [mandated, shadowed, lane_cannot_speak]
@@ -14578,6 +14992,26 @@ components:
         server-side narrow read, so both faces carry identical values; a word outside the set is treated as
         malformed and the key is not minted at all (the server never passes an unknown word through).
 
+    PersistedRuleMandate:
+      type: string
+      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, write_protection_unresolved]
+      description: >
+        WHICH WORD a mandated ask stands on (server >= 7.102.0 / S-721 / core 7.32.0 #1092) — core's
+        `PERSISTED_RULE_MANDATES` six words, transcribed verbatim and in order (core 7.32.1
+        `dist/core/ask-origin.d.ts:349`; the vocabulary's owner is core). Rides FOUR faces with one value: the
+        `tool_approval` frame, the `livePending` row top level, the operator queue row (`GET /v1/approvals`
+        `pending[]` + the `/v1/approvals/stream` `pending` frame) and the inbox row. NOT on `card_json` / the
+        `approval_request` frame (live or reconnect replay — `ApprovalCardSchema` is `.strict()`), same as `mandated`.
+        🔴 A TRUE CLOSED SET, deliberately unlike `AskOrigin`: on every face the server screens it through core's
+        `isPersistedRuleMandate` (`approval-card.ts` `readClosedWordSeat`; the inbox face is screened by core's own
+        `summarizeCheckpoint`) and an out-of-set word reads as ABSENT, never on the wire.
+        🔴 ABSENCE NEVER NAMES A WORD and is NOT "not mandated": another door (governance / hook / ancestor) or more
+        than one reason ⇒ absent; whether the ask is mandated is `mandated`. For an ENGINE-MINTED value, present ⇒
+        `mandated` is true (core: present ⇔ that word is the bit's WHOLE reason); the converse does not hold. ⚠️ On the
+        durable faces (queue row / inbox row) the server projects the two seats INDEPENDENTLY (it does not bind `mandate`
+        to `mandated`, `approval-card.ts` `readClosedWordSeat`), so a hand-edited or generation-skewed row may carry one
+        without the other — read `mandated` for the bit, never infer it from this word. Echo-only — the server never
+        branches on the word.
     DenialLimitKind:
       type: string
       enum: [consecutive, total]
@@ -15133,14 +15567,15 @@ components:
       type: object
       description: >
         Decision-maker identity assertion (design/171 §5.1; the cross-repo source of truth is
-        `@sema-agent/registry-core` ActorAssertionWire — the SDK holds a value copy).
+        `@sema-agent/settings-schema` ActorAssertionWire — the SDK holds a value copy; the package was named
+        `@sema-agent/registry-core` before 1.0.0).
 
         NORMATIVE, not a style note: an ACTOR NEVER PARTICIPATES IN THE PERMISSION DECISION — authority always
         belongs to the principal; this shape exists only for audit/echo/presentation. `id` is ALWAYS server-minted
         (= the verified principal; an auth-off deployment mints the `"_"` sentinel), and a wire requester may
         submit ONLY `label`.
       required: [id]
-      additionalProperties: false   # registry-core's ActorAssertionWire is .strict()
+      additionalProperties: false   # settings-schema's ActorAssertionWire is .strict()
       properties:
         id: { type: string, minLength: 1, maxLength: 256, description: 'Server-minted principal ("_" sentinel when auth is off). Never submittable by the requester.' }
         label: { type: string, maxLength: 256, description: 'Unverified display text — the ONLY field a requester may submit (server redacts + bounds it). UNTRUSTED.' }
@@ -15151,7 +15586,7 @@ components:
           description: >
             Audit axis for which authorization path accepted the decision: `owner` (row owner) or `operator`
             (explicit operator seat). CLOSED — verbatim-equal to the owning schema
-            (registry-core ActorAssertionWire). Widening it here without widening the owner is copy drift.
+            (settings-schema ActorAssertionWire). Widening it here without widening the owner is copy drift.
 
     AskDecisionBody:
       type: object
@@ -15800,6 +16235,20 @@ components:
             SAME projection as the `GET /v1/approvals` row (`projectPendingForWire`), declared here explicitly so
             a stream consumer sees it typed instead of through the open index signature. Present ONLY when true;
             absence = "not detected", never "confirmed clean" (see PendingCheckpoint.hasBidiControls).
+        # sdk 11.4.0 (che-OV adversarial review [low] F5): the `pending` frame spreads the PendingCheckpoint row and the
+        # `live_pending` frame (server >= 7.87.0) spreads the LivePendingRow — so the rows' park-row facts / mandate bit /
+        # origin word ride these frames with the same names and values. Declared for the same reason as hasBidiControls.
+        requiresRealApproval: { type: boolean, enum: [true], description: '`pending` / `live_pending` frames — see PendingCheckpoint / LivePendingRow.requiresRealApproval.' }
+        mandated: { type: boolean, enum: [true], description: '`pending` / `live_pending` frames (server >= 7.101.0) — see the row schemas.' }
+        mandate:
+          allOf: [{ $ref: '#/components/schemas/PersistedRuleMandate' }]
+          description: '`pending` / `live_pending` frames (server >= 7.102.0 / S-721) — see PendingCheckpoint.mandate / LivePendingRow.mandate.'
+        origin:
+          allOf: [{ $ref: '#/components/schemas/AskOrigin' }]
+          description: '`pending` / `live_pending` frames (server >= 7.102.0 / S-755) — see PendingCheckpoint.origin / LivePendingRow.origin. OPEN set.'
+        ruleOffersAbsence:
+          allOf: [{ $ref: '#/components/schemas/RuleOffersAbsence' }]
+          description: '`pending` frames only (server >= 7.100.0 / S-700) — see PendingCheckpoint.ruleOffersAbsence.'
 
     ParkedDecideAccepted:
       type: object