@sema-agent/sdk 8.8.0 → 9.0.0

package/openapi.yaml

@@ -2511,6 +2511,13 @@ paths:
             approve carried no `answer` (the ONLY pre-claim rejection left on that leg; the retired codes
             `decide.parked_answer_unsupported` / `decide.parked_question_unsupported` are gone — an answer HAS
             a hookpoint now and a parked question CAN be approved, with an answer). SDK → DecideUnsupportedError.
+            PARKED **WORKFLOW-CHILD** variant (server >= 7.69.0, S-185):
+            `decide.workflow_remember_unsupported` — `remember:"session"` is REFUSED on that lane, fail-closed,
+            BEFORE anything is delivered (zero side effects; re-issue without `remember`). The repo-wide rule for
+            granting an exemption is "the engine COMMITTED this decision", and that lane's 200 does not carry the
+            proof (the child's binding / updatedInput / answer checks run later, inside the workflow's own
+            resume), so an exemption granted here could outlive a decision the engine then rejects. The body
+            carries `runId` (the WORKFLOW run) and NO `taskId`. SDK → DecideUnsupportedError, `.runId`.
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
@@ -2545,6 +2552,18 @@ paths:
             `gate_not_plan_review` (§4c) → SDK `GateNotToolApprovalError`. Client action: route by the row's
             `gateKind` — `plan_review` → `POST /v1/assistant/tasks/{taskId}/plan_review`, `resource_limit` →
             `POST /v1/assistant/tasks/{taskId}/resume`. Retrying the same body never succeeds.
+            SEVENTH group (server >= 7.69.0 / S-185, the PARKED WORKFLOW-CHILD lane): `decide.workflow_host_unknown`
+            and `decide.workflow_host_not_parked`. The pending belongs to a workflow child that parked on an
+            approval gate, and the deployment could not hand the decision to that workflow's HOST session (the
+            engine's only deployment-facing channel for a parked workflow ordinal is a resume of the host, which
+            then re-invokes `Workflow({resumeFromRunId})`). Both bodies carry `runId` (the WORKFLOW run) and NO
+            `taskId`. NOTHING was consumed: the child's checkpoint stays PENDING and the card is still listable
+            and re-decidable. `_host_not_parked` = the host is not currently parked awaiting this run (it may
+            have been interrupted, taking an already-delivered decision with it — the decision is not persisted
+            anywhere) → retry once it parks again, or resume that `runId` yourself. `_host_unknown` = the run
+            carries no originating session at all (a directly started `runWorkflow`, not a Workflow tool call) →
+            NO retry value, a person resumes that `runId`. SDK → DecideWorkflowHostError (`.errorCode` splits the
+            two recovery verbs, `.runId` is the handle).
             SIXTH group (A-075.10, TIME-BASED retry-later pair): `resume.usage_window_exhausted` (#449 G1,
             core 5.60.1 — the deployment governance window on this run's ledger key is full; NOTHING was
             consumed or unpinned, the SAME token with the SAME decision redeems once the window slides) and
@@ -7431,6 +7450,107 @@ components:
           items: { type: string }
           description: 'E7 (SHIPPED) — the /effort picker default set (minimal/low/medium/high); present ONLY for a reasoning model.'
         atMentionable: { type: boolean, description: '#233/A-002.8 (SHIPPED) — @model mention allowlist verdict; present ONLY when the deployment configured an at-mention allowlist. Absent = no allowlist verdict, NOT "not mentionable" — do not narrow absence to false.' }
+        routePairing:
+          $ref: '#/components/schemas/RoutePairingStatus'
+          description: >-
+            #345 (server >=7.45, core 5.57.0 `routePairingStatus`) — this row's key<->URL pairing posture.
+            🔴 ALWAYS PRESENT on a >=7.45 worker: when the verdict cannot be reached the value is the WORD
+            `unknown`, not a missing key ("this worker does not adjudicate" and "this row could not be
+            adjudicated" must stay distinguishable on the wire). Declared here 2026-09-10 alongside `compat`:
+            this schema is CLOSED, and the key has been minted unconditionally since 7.45 — so every real
+            /v1/models response has been structurally rejected by a strict validator for the whole time (same
+            class as `hasBidiControls` on InboxRow). Optional here because the SDK's supported server floor is
+            3.0.0; the discriminant is the PEER'S VERSION, not this key's presence.
+        compat:
+          $ref: '#/components/schemas/ModelCompat'
+          description: >-
+            S-188 (server >=7.69.0, settings-schema >=1.10.0) — this row's wire-compatibility declaration for the
+            openai-completions lane. ABSENT = this model declared nothing; see ModelCompat for the two causes of
+            absence and why absence must NOT be rendered as "the operator did not write one".
+
+    ModelCompat:
+      # 新(8.9.0 / S-188):`ModelInfo.compat` 的形 = core `OpenAICompletionsCompat` 的逐字镜像。
+      # 词表在服务端**已判过**(src/model-compat.ts 的 readModelCompat:整只判形,任一键不合即整只丢),
+      # 所以这里写闭集 enum 是**如实**的,不是本仓自己加的一道门 —— 消费方不必再验一遍。
+      type: object
+      description: >
+        One model row's wire-compatibility declaration for the **openai-completions** lane (core
+        `OpenAICompletionsCompat`, mirrored key-for-key; server >= 7.69.0 / S-188). It says how THIS gateway takes
+        the thinking parameter and what the max-tokens field is called — no URL, no credential.
+        🔴 ABSENT has TWO indistinguishable causes: (a) the model genuinely declared nothing (the engine infers
+        from baseUrl / model id), or (b) the operator wrote one and the server DROPPED IT WHOLE (shape / word /
+        unknown key), logging a named warning and falling back to the engine's inference. So a panel must NOT
+        render "no compat" as "the operator did not configure one".
+        🔴 WHOLE-OR-NOTHING: the server refuses a partially valid declaration rather than keeping the good keys
+        (half a face on the wire is worse than none), so on the wire this object is always complete-and-legal or
+        entirely absent.
+        🔴 An EMPTY object never reaches the wire: the server's single mint point folds "all keys empty" (an
+        empty `reasoningEffortLevels` counts as unset) into "do not mint the key". `compat: {}` is therefore an
+        unrecognisable byte, not "declared but says nothing" — hence minProperties: 1.
+      additionalProperties: false
+      minProperties: 1
+      properties:
+        supportsReasoningEffort: { type: boolean, description: 'Does this endpoint accept `reasoning_effort` at all. Absent => the engine auto-detects from the URL.' }
+        reasoningEffortLevels:
+          type: array
+          minItems: 1
+          items: { $ref: '#/components/schemas/ModelThinkingLevel' }
+          description: >-
+            The effort tiers THIS endpoint really accepts (a subset of the six-rung ladder). Absent => the
+            engine's conservative default (minimal|low|medium|high), so a higher requested tier clamps DOWN
+            instead of 422-ing. Never empty on the wire (an empty declaration is folded into absence server-side).
+        maxTokensField:
+          type: string
+          enum: [max_tokens, max_completion_tokens]
+          description: 'Which field carries max tokens on this lane. Absent => inferred from the model id.'
+        requiresReasoningContentOnAssistantMessages: { type: boolean, description: 'Whether every replayed assistant message must carry an empty `reasoning_content` when reasoning is on.' }
+        thinkingFormat:
+          $ref: '#/components/schemas/ModelThinkingFormat'
+          description: 'How this gateway takes the thinking on/off parameter. Absent => the engine infers (default `openai`, i.e. `reasoning_effort`).'
+
+    ModelThinkingLevel:
+      # 六档思考梯(core ThinkingLevel)。CLOSED:server 铸 Model 那一刻逐词判成员,出集词让整只 compat 被丢。
+      type: string
+      enum: [minimal, low, medium, high, xhigh, max]
+      description: >-
+        One rung of the six-rung thinking ladder (core `ThinkingLevel`). CLOSED — the server judges membership
+        when it mints the Model, and an out-of-set word makes it drop the WHOLE `compat` declaration, so a word
+        outside this set cannot reach the wire. (`off` is NOT a rung: it means "no model-level default" and
+        belongs to a different knob.)
+
+    ModelThinkingFormat:
+      # thinkingFormat 七词闭集(core OpenAICompletionsCompat["thinkingFormat"])。同上,server 已判成员。
+      type: string
+      enum: [openai, openrouter, deepseek, together, zai, qwen, qwen-chat-template]
+      description: >-
+        The spelling this gateway takes the thinking parameter in (core
+        `OpenAICompletionsCompat.thinkingFormat`). CLOSED, judged server-side before it reaches the wire.
+        `openai` = `reasoning_effort` · `openrouter` = `reasoning:{effort}` · `deepseek` = `thinking:{type}` plus
+        `reasoning_effort` · `together` = `reasoning:{enabled}` plus `reasoning_effort` · `zai` / `qwen` =
+        top-level `enable_thinking` · `qwen-chat-template` = `chat_template_kwargs.enable_thinking` — the ONLY
+        spelling that can turn thinking OFF on a think-by-default vLLM/Qwen gateway.
+
+    RoutePairingStatus:
+      # #345 core RoutePairingStatus(`ok:${RoutePairingPosture}` | `broken:*` 两词 | unknown)。
+      # 🔴 **真开集,刻意不写 enum**:开/闭按**产方是否真判成员**定(8.4.0 拆 `CheckpointGate` 顶层 enum /
+      # 把 `AskOrigin` 改真开集的同一条判据)。core 的 `routePairingStatus` 把 `verdict.posture` **直接内插**
+      # 进 `ok:${…}`,server 的铸点与 core 的这只函数**全路径没有一处运行期成员判定** —— 一只自带
+      # `adjudicateRoute` 的 brain 供什么词就上什么词。写一条会执法的 enum = 假闭集,会把一台合法 worker
+      # 的真响应判违约。已知七词写在 description 里(消费端 switch 认已知词 + 一条 default 臂)。
+      type: string
+      x-open-enum: true
+      description: >-
+        A model row's key<->URL pairing posture (core `RoutePairingStatus`; server >= 7.45). OPEN on read —
+        the seven words below are today's set, branch on the known ones and keep a `default` arm. NON-SECRET — no
+        URL, no credential.
+        `ok:per-model` this model has its own credential · `ok:paired` deployment credential, and the model's URL
+        is on the deployment's declared root · `ok:unpinned` deployment credential but the deployment declared no
+        root, so the pairing is UNVERIFIABLE · `ok:keyless` no credential anywhere (a local unauthenticated
+        gateway) · `broken:credential_mismatch` / `broken:credential_missing` a real request WILL be refused by
+        the engine (flag it red) · `unknown` could not be adjudicated — render "unknown", NEVER "good" or "bad".
+        The verdict's frame of reference is the gateway root as of BRAIN CONSTRUCTION, so a live re-pointing of
+        the deployment root only shows up after a restart (both this reading and the real request judge from the
+        same snapshot).
 
     ElicitResponse:
       type: object
@@ -7633,8 +7753,25 @@ components:
       additionalProperties: false
       properties:
         label: { type: string, description: 'display label (redacted — LLM-authored).' }
-        status: { type: string, description: 'lifecycle status (the input vocabulary the display derivation reads).' }
-        displayStatus: { type: string, description: 'core deriveAgentDisplayStatus: running|queued|done|failed|interrupted — the canonical glyph vocabulary, one source of truth shared with the shell.' }
+        status:
+          type: string
+          description: >-
+            Lifecycle status — core `WorkflowItemStatus` passed through verbatim (running|completed|failed|parked;
+            OPEN on read, the vocabulary's owner is core). 🔴 `parked` (server >= 7.69.0 / core 7.10.0 #642) is an
+            AGENT-ROW word only: this ordinal durably paused at an approval gate and the whole run suspended on it
+            (a phase or group never parks — a parked agent ends the run, so the RUN-level status vocabulary does
+            not have this word). The row's redemption key (`parkedCheckpointToken`) is a resume CAPABILITY and is
+            NEVER projected onto the wire — it appears nowhere in this document by design.
+        displayStatus:
+          type: string
+          description: >-
+            core `deriveAgentDisplayStatus`: running|queued|done|failed|interrupted|parked — the canonical glyph
+            vocabulary, one source of truth shared with the shell. 🔴 `parked` is the SIXTH arm (core 7.10.0
+            #642, server >= 7.69.0): a durable approval gate is holding this agent. Before it existed a parked
+            agent fell through to another word, i.e. a card waiting on a human rendered as a glyph that asks for
+            no action. ALWAYS PRESENT — the server derives it with that pure function on every row. Open on read
+            (the vocabulary's owner is core), but the function has no default arm, so a word outside this set
+            means core grew the table.
         taskStatus: { type: string, description: 'the underlying task''s terminal TaskStatus (open vocabulary; core enum verbatim).' }
         callKey: { type: string, description: 'the stable deterministic identity of this ctx.agent call (resume-journal key).' }
         groupId: { type: string, description: 'the nesting ctx.workflow sub-group this agent ran under; absent = top-level.' }
@@ -7681,7 +7818,7 @@ components:
       additionalProperties: false
       properties:
         title: { type: string, description: 'phase title (redacted — LLM-authored).' }
-        status: { type: string, description: 'core WorkflowItemStatus, plus "pending" for a meta-preregistered phase not yet adopted.' }
+        status: { type: string, description: 'core WorkflowItemStatus (running|completed|failed; `parked` is an agent-row word only), plus "pending" for a meta-preregistered phase not yet adopted.' }
         startedAt: { type: integer, description: 'adoption time for a pre-registered phase (0 while still pending).' }
         endedAt: { type: integer }
         durationMs: { type: integer, description: 'endedAt − startedAt; absent until the phase ends.' }
@@ -7699,7 +7836,7 @@ components:
       properties:
         groupId: { type: string }
         parentGroupId: { type: string, description: 'absent = top-level (a child of the implicit root).' }
-        status: { type: string, description: 'core WorkflowItemStatus (running/completed/failed).' }
+        status: { type: string, description: 'core WorkflowItemStatus (running|completed|failed; a group never parks — `parked` is an agent-row word only).' }
         startedAt: { type: integer }
         endedAt: { type: integer }
         durationMs: { type: integer, description: 'endedAt − startedAt; absent until the group ends.' }
@@ -7925,13 +8062,31 @@ components:
         resultChars: { type: integer, description: 'server >=7.9.0 (A-002.6): the ORIGINAL result length in characters; present only alongside resultTruncated.' }
         tokens: { type: integer, description: 'present only when the result carried stats.' }
         turns: { type: integer, description: 'present only when the result carried stats.' }
+        parked:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.69.0 / core 7.10.0 #642 — this ordinal is PARKED on a durable approval gate, waiting for a
+            decision. 🔴 NEVER minted as `false`: the park arm and the result arm carry the SAME payload (a
+            TaskResult whose terminal cause is `paused`), and the read face adds exactly this one bit, so an
+            ordinary row is simply ABSENT. Branch on `parked === true`, never on `!parked`. `status` is NOT
+            rewritten by this layer — it is that TaskResult's persisted plane status (`suspended` on a human
+            gate). 🔴 The oversize-stub arm (WorkflowJournalEntryTruncated) structurally CANNOT carry this key —
+            see its note; absence there is not an assertion.
 
     WorkflowJournalEntryTruncated:
       # 新(census 批2 四段):the truncated arm (workflows.ts) — an honest stub for a row whose
       # stored TaskResult exceeded the per-row 64KiB gate (SQL stores) or byte length (file/in-memory
       # fallback): the server never pulls the oversized payload into process memory.
       type: object
-      description: A journal row too large to project — an honest "too big to show" stub, never a silent 2000-char truncation of the real result.
+      description: >-
+        A journal row too large to project — an honest "too big to show" stub, never a silent 2000-char
+        truncation of the real result.
+        🔴 DELIBERATELY carries NO `parked` (server 7.69.0, one mint point shared by all three arms): a stub by
+        definition carries no payload-derived key — the SQL paging leg never pulled the payload back when the row
+        is over the bound, so it structurally cannot answer that bit, and minting it only on the file/in-memory
+        leg would fork the wire shape by backend. To decide "is this ordinal parked", read the `parked` of a
+        NON-stub row, or `agents[].status === "parked"` on GET /v1/workflows/:id. Absence here is NOT an assertion.
       required: [callKey, ordinal, truncated, resultBytes]
       additionalProperties: false
       properties:
@@ -8431,6 +8586,21 @@ components:
         is guaranteed by all four shapes; discriminate: `idempotent` -> replay; `decision` without `sessionId` ->
         parked receipt; `sessionId` + `bindingEnforced` (+ `status`) -> task-level acceptance / terminal.
         `taskId` rides `getActiveTaskId` on the terminal leg (omitted when there is no active row).
+        🔴 A FIFTH PROVENANCE, not a fifth key set (server >= 7.69.0 / S-185 — the PARKED WORKFLOW-CHILD lane):
+        when the pending belongs to a workflow child, the success body is byte-identically the TASK-LEVEL
+        ACCEPTANCE shape, but it is a wake of the workflow's **HOST session** — `taskId` is the host's FRESHLY
+        MINTED run id, not the child's. Two readings a consumer MUST get right:
+        (1) 🔴 the 200 is a **DELIVERY acceptance**, NOT "the gate is resolved". The child's checkpoint stays
+        PENDING until the workflow engine itself resolves it, so the card can still be on `/v1/approvals` right
+        after the 200 — NEVER remove the card from a UI on the strength of this 200; poll the HOST run
+        (`GET /v1/runs/{taskId}`) for progress instead. The background-redemption lane's 200 and the task-level
+        lane's 200 DO mean the engine committed the decision — one sentence ("approved and in effect") cannot be
+        used for both lanes.
+        (2) delivery can still be LOST: if the host run is interrupted before it re-invokes `Workflow`, the
+        decision goes with that invocation (it is not persisted anywhere) and a retry answers 409
+        `decide.workflow_host_not_parked`. Because the card was pending throughout, nothing is forged and the
+        approval can be re-decided once the host parks again.
+        The durable approval-queue projection is UNCHANGED — no key marks the workflow origin on any read face.
       required: []
       additionalProperties: false
       properties:
@@ -8697,6 +8867,12 @@ components:
         this spec over-declared decide bindings that never appeared on inbox wire at all. Four client repos were
         structurally zero-consumers, so server 3.4.0 narrowed the wire and this schema follows. For the tool face
         and decide bindings use /v1/approvals (PendingCheckpoint); for task attribution use /v1/assistant/tasks.
+        🔴 STILL CLOSED (sdk 8.9.0). Four keys the server had been minting onto this row went undeclared until
+        now — `requiresRealApproval` / `denialLimitFallback` / `origin` (server >= 7.57.0) and
+        `classifierUnavailable` (server >= 7.69.0) — so a strict validator rejected every row that carried one
+        and a generated client could not read them at all. They are declared below rather than tolerated: this
+        row stays closed, which is the whole point of the shape (an undeclared key is drift, and drift should be
+        loud).
       type: object
       required: [sessionId, scope, objective, input]
       additionalProperties: false
@@ -8723,11 +8899,47 @@ components:
             the /v1/approvals row's — the reading of absence does not). Absence = "not detected", never
             "confirmed clean". Declared here because this schema is CLOSED — without the key a strict validator
             rejects every >=7.53 inbox row that carries it.
+        requiresRealApproval:
+          type: boolean
+          enum: [true]
+          description: >-
+            server >= 7.57.0 (core 7.4.0 #557), ADDITIVE, present ONLY when true: this parked ask demanded REAL
+            HUMAN judgment — an inbox can say "only a person can clear this" without decoding the gate kind.
+            🔴 NEVER minted as `false` (the OMIT contract this row's other flags follow); absence is "not marked",
+            never "confirmed clearable without a person". The value comes WHOLE from core (`summarizeCheckpoint`
+            projects the park row's own bit) — the server neither recomputes nor redacts it.
+        denialLimitFallback:
+          $ref: '#/components/schemas/DenialLimitFallback'
+          description: >-
+            server >= 7.57.0 (core 7.4.0 #557), ADDITIVE — this parked ask IS the auto-mode classifier's
+            DENIAL-LIMIT fallback, carrying the counts that tripped the bound. 🔴 On a PARKED row
+            `autoDenyAfterMs` is ALWAYS `0` and a consumer MUST NOT start a countdown from it: the window is a
+            fact of the ask's ROUTE, armed only at a hand-out to a LIVE approver, and nothing counts down on the
+            parked lane (a park's expiry is the row's own `deadline`/ttl). Render the counts and the limit; there
+            is no countdown to render here. Core screens the four members before writing the row, so a
+            half-shaped value reads as ABSENT rather than reaching a consumer as a malformed card.
+        origin:
+          $ref: '#/components/schemas/AskOrigin'
+          description: >-
+            server >= 7.57.0 (core 7.5.0), ADDITIVE — WHICH AUTHORITY raised this parked ask, the same word the
+            synchronous card renders by (engine-stamped at the gate, never a policy's claim). Core writes it onto
+            the row ONLY when it is a member of the set, so an out-of-set word is not expected on THIS face — but
+            the vocabulary's owner is still core and it has grown before, so read it the same way as everywhere
+            else: branch known words, keep a `default` arm, and treat an unknown one as "unknown origin", never
+            as "no origin". A row minted before the bit existed reads absent (unreported), not "no authority".
         objective: { type: ['string', 'null'], description: 'task objective, null if unavailable.' }
         input:
           description: >
             REDACTED tool-args preview for display (null on gates without one, e.g. plan_review). Untyped by
             design (per-tool shape). The raw `toolInput` is deliberately NOT on this row.
+        classifierUnavailable:
+          $ref: '#/components/schemas/ClassifierUnavailable'
+          description: >-
+            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE — WHY this PARKED ask reached a human. The inbox is the
+            TRIAGE face, so `breaker_open` matters most here: it forecasts an approval storm rather than a
+            one-off question. The value comes WHOLE from core (`summarizeCheckpoint` echoes it only when the
+            cause is a member of the engine's set), so the server neither recomputes nor re-screens it. See
+            ClassifierUnavailable for the open-`cause` rule and the three shapes absence covers.
 
     InboxList:
       type: object
@@ -9389,6 +9601,14 @@ components:
         activeTaskId:
           type: string
           description: On a 409 — the task currently holding the session lock (see the Conflict response note).
+        runId:
+          type: string
+          description: >-
+            server >= 7.69.0 (S-185) — on the three `decide.workflow_*` codes ONLY: the WORKFLOW run's id. It is
+            the RECOVERY HANDLE (wait for the host session to park and re-decide, or resume that run directly).
+            🔴 NOT interchangeable with `taskId`: the workflow-child park lane mints no taskId at all (this
+            decision never landed on any run, so minting one would be a lie), and the other two decide lanes
+            mint no runId. Branch by `errorCode`, never fall back from one handle to the other.
 
     # ── Streaming event taxonomy (the UX 命脉). Each SSE `data:` line is one JSON-serialized AgentEvent. ──
     # TWO vocabularies (the pinned wire contract Drift 3). ⚠️ The two lines below are the SHAPE-DEFINING
@@ -10341,33 +10561,7 @@ components:
             🔴 The engine''s `error` free text is DELIBERATELY NOT PROJECTED (it is remote-author text, and core
             already owns the single redaction mint point for it). The actionable cause is `errorCode`.
             A row missing `name` or `status` is dropped individually — the other servers'' rows still ship.
-          items:
-            type: object
-            additionalProperties: false
-            required: [name, status]
-            properties:
-              name: { type: string, description: 'The declared server name.' }
-              status: { type: string, description: 'Three-word engine set (connected / failed / …). Open on read.' }
-              source: { type: string, description: 'The declarer''s own layer label, echoed verbatim by core (single-line, length-capped).' }
-              toolCount: { type: integer, description: 'Tools mounted. ABSENT rather than 0 — a minted 0 would read as "connected with no tools".' }
-              errorCode:
-                type: string
-                description: >
-                  core >= 7.6.0 — the `McpFailureKind` word (`connect_refused` / `connection_failed` /
-                  `connection_closed` / `http_status` / `not_mcp_response` / `spawn_failed` / `timeout` /
-                  `protocol` / `invalid_config` / `unknown`). The retired 7.5.0 spellings — `network` and the
-                  `http_<status>` encoding — are GONE; an HTTP status now rides `httpStatus`.
-                  Deliberately NOT enumerated here: the vocabulary''s single owner is the engine, and mirroring
-                  it would swallow a newly minted word as a violation. Switch with a `default` arm.
-              delivered:
-                allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
-                description: 'core >= 7.6.0 (S6-B) — did the request reach that server. Read WITH `errorCode`.'
-              httpStatus:
-                type: integer
-                description: >
-                  core >= 7.6.0 (S6-B) — the status the endpoint answered with; rides ONLY with
-                  `errorCode === "http_status"` (401/403 = re-authorize, 5xx = that end is down). ABSENT rather
-                  than 0.
+          items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
         governance:
           type: object
           additionalProperties: false
@@ -10502,6 +10696,28 @@ components:
         message varies with the memoryProvenance mode — matching on message text WILL break). `code` is an OPEN
         set (the server whitelist grows with core's code register): render a known code specially, fall back to
         `message` for an unknown one — never drop the frame.
+        🔴 This list is NOT the full register and is not meant to become one (server 7.69.0's whitelist holds 21
+        codes): `code` is OPEN, and only the codes with an EXTRA rendering rule are written out here.
+        `mcp.injection_dropped` (server >= 7.68.0) — one entry of the CALLER'S OWN request-leg MCP injection was
+        not mounted; `{sessionId, server, reason, field?}`, `reason` a four-word set (`malformed_entry` /
+        `name_reserved_by_deployment` / `gate_closed` / `over_cap`). The recovery verb is on the USER's side
+        (rename it, fix that key, drop a few servers) — without this notice all they see is "my .mcp.json seems
+        to do nothing". Minted at ASSEMBLY time, so `detail` structurally has NO runId; the join key is the
+        `server` name. ⚠️ The DELIVERY surface changed at server 7.69.0: 7.68.0 delivered it on the two FRESH
+        legs only, and 7.69.0 delivers it on the RESUME family too (all four resume legs share one
+        spec-resolver, which now passes the notice seat). Consequence for consumers that assert on ledger
+        CONTENTS: a resume leg's ledger MAY now carry one extra `engine_notice` row it did not before — assert
+        "may appear", never an exact row count or order (and consume idempotently: reconnect replay shows it again).
+        `delegation.ask_unresolvable` (server >= 7.69.0 / core 7.10.0 #648) — an `ask` reached a FINAL DENY with
+        NOBODY having ruled on it: the approver consulted for the call answered `unavailable` and no durable park
+        caught it afterwards. The deny itself is unchanged (`tool_end.gate.settlement.kind:"approver_unavailable"`
+        — that sentence IS the tool result); this code is the half the person watching notices could not see.
+        `{sessionId, toolName, toolCallId, settlementKind, parkLaneExisted}`; `toolCallId` joins to the
+        `tool_approval` card frame, `settlementKind` is passed through verbatim (the vocabulary's owner is core).
+        Deduplicated ONCE PER TOOL CALL. 🔴 `parkLaneExisted` is a DISCRIMINANT, not a count: `true` = a park lane
+        was armed but declined/failed (check the store, check authorisation), `false` = there was no lane at all
+        (wire one up). The two recovery verbs differ, so a consumer MUST render them apart — NEVER fold them into
+        one "nobody approved it".
         Starter whitelist (server 7.36): `memory.session_polluted` `{reason, sessionId?}` ·
         `memory.harvest_quarantined` `{count, moved, escalated, reason?}` — `moved` and `escalated` MUST NOT be
         subtracted from each other (an in-place tombstone counts as both) · `memory.delegation_static_mark_waived`
@@ -11178,6 +11394,12 @@ components:
     #    分两段:server ≤7.4.0 默认 OFF,≥7.5.0 默认 ON(BREAKING,见 server CHANGELOG)。──
     # 与上面的 ToolApprovalFrame 是**并行加帧,不替换**:开关打开时同一只 ask 出两帧(先 tool_approval,
     # 后 approval_request),两帧同带 `approvalId` ⇒ 消费端按它去重、优先渲染新帧。
+        classifierUnavailable:
+          $ref: '#/components/schemas/ClassifierUnavailable'
+          description: >-
+            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE, present only when the classifier was consulted and
+            could not run — WHY this ask reached a human. See ClassifierUnavailable for the open-`cause` rule and
+            the three shapes absence covers.
     ApprovalRequestFrame:
       type: object
       description: >
@@ -11310,6 +11532,12 @@ components:
         # 但本 schema 此前只在帧上公示过。长 description 的单一真源在 ToolApprovalFrame 的同名键。
         ruleOffersAbsence: { $ref: '#/components/schemas/RuleOffersAbsence' }
         denialLimitFallback: { $ref: '#/components/schemas/DenialLimitFallback' }
+        classifierUnavailable:
+          $ref: '#/components/schemas/ClassifierUnavailable'
+          description: >-
+            server >= 7.69.0 (core 7.10.0 #616), ADDITIVE — WHY this ask reached a human. Frame and card carry
+            the SAME value (one narrow-read function server-side). See ClassifierUnavailable for the open-`cause`
+            rule and the three shapes absence covers.
 
     RuleSuggestion:
       type: object
@@ -11333,6 +11561,30 @@ components:
         command: { type: string, maxLength: 512, description: 'The command pattern inside the rule, for a shell that would rather not re-parse `rule`.' }
 
     # ─── S-139(sdk 8.3.0):对 server 7.60.0 整体重对账带进来的四张型面 ───────────────────────
+    ClassifierUnavailable:
+      # 8.9.0:三面(tool_approval 帧 / ApprovalCard / InboxRow)同形同值 ⇒ 具名单源,内联三份会各自漂。
+      type: object
+      description: >-
+        WHY this ask reached a human (server >= 7.69.0, core 7.10.0 #616): the auto-mode classifier was consulted
+        and could not run. Carried on all THREE faces with the same value — the live `tool_approval` frame, the
+        `ApprovalCard` (`card_json` / `approval_request`), and the `GET /v1/assistant/inbox` row. Under the auto
+        mode most calls are answered by the classifier, so the ones that DO reach a person are often exactly the
+        ones it could not answer — and the causes want different handling (the gateway is broken / it is too slow
+        / the breaker is OPEN, i.e. every following ask will arrive too). The inbox is the TRIAGE face, which is
+        where `breaker_open` is worth the most: it forecasts an approval storm, not a one-off question.
+        🔴 `cause` is an OPEN string and is deliberately NOT enumerated here. The vocabulary's single owner is the
+        engine (today: `error` / `timeout` / `breaker_open`); mirroring it would swallow a newly minted word as a
+        violation — the same rule as `AskOrigin` and the MCP `errorCode`. Switch on the known words and KEEP A
+        DEFAULT ARM.
+        🔴 ABSENCE IS NOT AN ASSERTION. It covers three shapes at once: the classifier ANSWERED (this ask is one
+        it ruled should go to a person) · this ask was not ELIGIBLE for the classifier · this deployment wired no
+        classifier at all. Never read absence as any claim about classifier health, and never as "the classifier
+        is fine". (`parse_error` does not set this bit, per the engine's contract.)
+      additionalProperties: false
+      required: [cause]
+      properties:
+        cause: { type: string, description: 'The engine''s cause word. OPEN — branch known words, default arm for the rest.' }
+
     AskOrigin:
       type: string
       x-open-enum: true
@@ -11410,8 +11662,13 @@ components:
         waits for a person) is for RENDERING THE COUNTDOWN ONLY. Never start a second timer from it: the window
         is executed by the ENGINE, and two overlapping windows are worse than the original defect and silent.
         🔴 ABSENCE IS NOT AN ASSERTION — the vast majority of asks are not fallback cards.
-        ⚠️ The durable (parked) leg does NOT carry this key today; the card's copy rides `card_json`, which is
-        a different leg from the parked row's `pendingAction`.
+        ⚠️ TWO LEGS CARRY IT, and they differ in ONE member. The live/card leg (`ToolApprovalFrame` /
+        `ApprovalCard` / `card_json`) can carry a NON-ZERO `autoDenyAfterMs`; the DURABLE leg — the parked row,
+        projected onto `InboxRow` since server >= 7.57.0 (core's park twin of the same member) — always carries
+        `0` there, because nothing counts down on a parked lane (see InboxRow.denialLimitFallback).
+        (Corrected 2026-09-10 against core's checkpoint-summary type and the server's inbox projection: this
+        sentence used to read "the durable (parked) leg does NOT carry this key today", which stopped being
+        true when the park twin landed.)
       properties:
         consecutive: { type: integer, description: 'Consecutive refusals at the moment the limit tripped.' }
         total: { type: integer, description: 'Cumulative refusals at the moment the limit tripped.' }
@@ -12997,12 +13254,18 @@ components:
         core's assembly self-evidence manifest (core >=5.14.0 `WiringManifest`). TWO HALVES, ONE shape (a
         consumer must line the two faces up, so they are not split into separate types) — but which keys
         belong to which half is DETERMINATE, not "usually": `leg`, `ask.effective` and `configFingerprint`
-        are EFFECTIVE-half only (the live `wiring_manifest` event) — as are the three per-leg sections the
-        event schema declares (`modelGate`, `autoMode`, `mcp`), which describe what THIS leg did and have no
-        static counterpart — and the STATIC half
+        are EFFECTIVE-half only (the live `wiring_manifest` event) — as are the four per-leg sections
+        `modelGate`, `autoMode`, `mcp` and `tools`, which describe what THIS leg did and have no static
+        counterpart — and the STATIC half
         (GET /v1/diagnostics/wiring) NEVER mints them; every other section, plus `governance`, is always
         present on the static half. Fields stay optional because core may add or drop sections and that
         must not hard-break a client — read by half, and never wait on a key the half never sends.
+        🔴 EVERY section is declared HERE, each saying which half mints it (sdk 8.9.0). Before that, `tools`
+        was declared while its three effective-half siblings were not, and `permissionRules` — which the
+        engine mints UNCONDITIONALLY, i.e. on BOTH halves — was missing altogether, so a generated client
+        reading GET /v1/diagnostics/wiring could not see it at all. "Two halves, one shape" is the stated
+        doctrine of this schema; omitting a section because one half does not mint it contradicts it and
+        splits consumers into two groups reading two different manifests.
         🔴 `governance` and `configFingerprint` appear ONLY on an operator-scoped face. A tenant stream
         gets neither — and NOT just the section: core hashes the WHOLE manifest unsalted and governance is
         four booleans, so the fingerprint alone would let a tenant brute-force sixteen combinations against
@@ -13073,6 +13336,85 @@ components:
           description: >
             server >= 7.66.0 (design/388 B-4) — the leg's whole tool roster. EFFECTIVE half only (the diagnostics
             endpoint's static half never carries it); absent as a whole when core's typebox check rejects it.
+        permissionRules:
+          type: object
+          description: >
+            core >= 5.18.0 (design/179) / >= 5.23.0 (design/182 §7/§9), server >= 7.6.0 — is a PERSISTED
+            PERMISSION RULE store wired, how far does a "don't ask again" travel, and is an org governance layer
+            armed over that lane. 🔴 BOTH HALVES: the engine mints this section unconditionally, so it rides the
+            static `GET /v1/diagnostics/wiring` face too — read it before offering a "don't ask again"
+            affordance. `false` is a REAL reading ("no rule lane on this worker"), never "too old to know"; only
+            the whole key being absent means "never sent it". TENANT-visible (deliberately outside the
+            operator-only `governance` section). Full per-key contract: see Event_wiring_manifest.permissionRules.
+          properties:
+            storeWired: { type: boolean }
+            syncWired: { type: boolean }
+            orgGoverned: { type: boolean }
+        mcp:
+          type: array
+          description: >
+            core >= 7.5.0 (#562) / >= 7.6.0 (S6-B), server >= 7.60 — one row per MCP server THIS leg declared.
+            EFFECTIVE half only. 🔴 An empty array is NOT absence (`[]` = "this leg declared no servers").
+            Full per-key contract: see Event_wiring_manifest.mcp.
+          items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
+        modelGate:
+          type: object
+          description: >
+            core >= 7.3.x (design/385 片2b), server >= 7.58 — which tools the tool-MODEL gate removed from THIS
+            session and how to get them back. EFFECTIVE half only; ALL-OR-NOTHING (absent = nothing was gated,
+            never an empty section). Full contract: see Event_wiring_manifest.modelGate.
+          required: [class, removed, restore]
+          properties:
+            class: { type: string }
+            removed: { type: array, items: { type: string } }
+            restore: { type: string }
+        autoMode:
+          type: object
+          description: >
+            core >= 7.3.1 (#529), server >= 7.59 — did AUTO mode arm on THIS leg, and if not which arm it stopped
+            at. EFFECTIVE half only. 🔴 `reason` is core's closed word list passed through VERBATIM (branch known
+            words, keep a default arm); ABSENCE IS NOT "not applicable" — never fold it to `armed: false`. The
+            server projects exactly these two keys (core's `breaker` sub-fact is NOT projected onto the wire).
+            Full contract: see Event_wiring_manifest.autoMode.
+          required: [armed, reason]
+          properties:
+            armed: { type: boolean }
+            reason: { type: string }
+    WiringManifestMcpEntry:
+      # 8.9.0:从 `Event_wiring_manifest.mcp.items` 的内联形**提取**为具名 schema —— 同一份行形现在被
+      # 两处引用(live 帧与 `WiringManifest` 的静态/两半形),内联会立刻变成两份会各自漂的镜像。
+      type: object
+      description: >
+        One row of a leg's MCP wiring manifest: did that declared server connect, if not which failure class,
+        and how many tools it mounted. A row missing `name` or `status` is dropped INDIVIDUALLY — the other
+        servers' rows still ship. 🔴 The engine's `error` free text is DELIBERATELY NOT PROJECTED (remote-author
+        text; core owns the single redaction mint point). The actionable cause is `errorCode`.
+      additionalProperties: false
+      required: [name, status]
+      properties:
+        name: { type: string, description: 'The declared server name.' }
+        status: { type: string, description: 'Three-word engine set (connected / failed / …). Open on read.' }
+        source: { type: string, description: 'The declarer''s own layer label, echoed verbatim by core (single-line, length-capped).' }
+        toolCount: { type: integer, description: 'Tools mounted. ABSENT rather than 0 — a minted 0 would read as "connected with no tools".' }
+        errorCode:
+          type: string
+          description: >
+            core >= 7.6.0 — the `McpFailureKind` word (`connect_refused` / `connection_failed` /
+            `connection_closed` / `http_status` / `not_mcp_response` / `spawn_failed` / `timeout` /
+            `protocol` / `invalid_config` / `unknown`). The retired 7.5.0 spellings — `network` and the
+            `http_<status>` encoding — are GONE; an HTTP status now rides `httpStatus`.
+            Deliberately NOT enumerated here: the vocabulary's single owner is the engine, and mirroring
+            it would swallow a newly minted word as a violation. Switch with a `default` arm.
+        delivered:
+          allOf: [{ $ref: '#/components/schemas/McpDelivered' }]
+          description: 'core >= 7.6.0 (S6-B) — did the request reach that server. Read WITH `errorCode`.'
+        httpStatus:
+          type: integer
+          description: >
+            core >= 7.6.0 (S6-B) — the status the endpoint answered with; rides ONLY with
+            `errorCode === "http_status"` (401/403 = re-authorize, 5xx = that end is down). ABSENT rather
+            than 0.
+
     ServerWiringGates:
       type: object
       description: >

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/sdk",
-  "version": "8.8.0",
+  "version": "9.0.0",
   "description": "Typed, zero-runtime-dependency SDK for the Sema agent fleet usage plane. The shared substrate for all doors (CC/Codex MCP façade + web). Server-side only — tokens never enter the browser.",
   "type": "module",
   "license": "BUSL-1.1",