@sema-agent/sdk 9.3.0 → 9.5.0

package/openapi.yaml

@@ -2670,15 +2670,19 @@ paths:
             — the workflow run's record carries no readable `parks[]` list (the ENGINE's own park-ownership
             ledger, and the single source this lane joins the caller's checkpoint against). A record written by
             an engine older than 7.17.0 does not carry the key at all, or one entry is damaged and the whole list
-            cannot be read; a RESUME of that run is refused by the engine for the identical reason
-            (`workflow.park_truth_unreadable` / `parks_unreadable`, or `workflow.park_binding_broken`), so the
+            cannot be read; the redemption keys this lane would need are therefore not on the record, so the
             decision is STRUCTURALLY UNDELIVERABLE and this lane refuses loudly rather than answer a 200 nothing
             could redeem. Body carries `runId` (the WORKFLOW run) and NO `taskId` (same two-field shape as the
             SEVENTH group). SDK → `DecideWorkflowParksUnreadableError` (a `DecideError` subclass, NOT a
             `DecideWorkflowHostError` — see its class doc for why). 🔴 RECOVERY IS THE OPPOSITE of the SEVENTH
-            group: there is no retry, no waiting for the host to park again, and no resuming this run at all —
-            it cannot be resumed by this engine. The card stays PENDING (nothing is forged); the only recovery
-            action is to START A NEW RUN. ⚰️ This code REPLACES the 7.71.0 code `decide.workflow_park_identity_lost`
+            group: not a retry of this decide and not waiting for the host to park again — RESUME THE RUN
+            (`runId`). Whether that resume is ADMITTED is the engine's answer, not this lane's: admission weighs
+            the record, the journal and the record's own parked agent rows together and proves each candidate, so
+            a caller must neither pre-filter recovery candidates on this code nor promise the user it will work.
+            🔴 CORRECTED at server 7.78.0 / core 7.18.0: this text used to say the engine refuses to resume such a
+            record and the only recovery was to start a NEW run — core 7.18.0 falsified that, and the old advice
+            abandoned recoverable runs. Once admission completes the engine writes `parks` onto the record, and
+            the next decide takes the ordinary arm. The card stays PENDING throughout (nothing is forged). ⚰️ This code REPLACES the 7.71.0 code `decide.workflow_park_identity_lost`
             (retired at this same 7.75.0 — a store size-degrade step stopped keeping a SECOND copy of a parked
             row's recovery identity once `parks[]` became the engine's single source, so the state that old code
             named is now structurally unreachable). That retired code was NEVER modeled by this SDK (it went
@@ -8151,6 +8155,80 @@ components:
           type: array
           description: 'The nested ctx.workflow group tree (roots only — children nest recursively). Empty when the script used no nesting.'
           items: { $ref: '#/components/schemas/WorkflowGroupNode' }
+        parks:
+          type: array
+          description: >
+            core 7.17.0 (#652) / server >= 7.74.0 — the engine's own PARK RESPONSIBILITY table for this run
+            (detail face only; the list row has no such key).
+            🔴 `undefined` AND `[]` ARE TWO DIFFERENT THINGS: the WHOLE KEY ABSENT means an OLDER ENGINE wrote
+            this record (or the store's projection stripped it), so THIS FIELD ALONE cannot prove whether parks
+            exist; `parks: []` is a POSITIVE FACT — "this run has no park". Never fold one into the other; the
+            reading is `"parks" in run`.
+            🔴 THIS KEY DECIDES NOTHING ABOUT WHETHER THE RUN CAN BE RESUMED — in EITHER direction. Resume
+            admission is the ENGINE's: it weighs the record's `parks` (when present), the journal's `parked`
+            entries and the record's own `status:"parked"` agent rows together, proves each candidate against the
+            checkpoint store, and has refusal arms this read face cannot see. A consumer must not drop a run from
+            its recovery candidates because this key is absent (that abandons recoverable runs), and must not
+            promise recovery because it is present.
+            ⚠️ This description deliberately does NOT restate the admission algorithm: a mirror of someone else's
+            rule goes stale (this very text asserted "absent => the engine refuses to resume, start a new run"
+            between server 7.75.0 and 7.78.0, which core 7.18.0 falsified). The ONE bit that IS decisive on this
+            face is `resumeAdmissionIncomplete`.
+            ⚠️ The `/decide` lane does still refuse such a record (the keys it must join against are derived in
+            the admission pass and cannot be read off the record); its recovery verb is RESUME THIS RUN, not
+            "start a new one". Two lanes, two predicates — never infer one from the other.
+            🔴 KEYS ONLY — not a pending count and not a status (core's words): entries are replaced by
+            `callKey` and are NEVER removed when a decision lands, so a listed token may already be resolved /
+            expired / reaped. Never read `parks.length` as "how many approvals are waiting" (that is
+            `GET /v1/approvals`).
+            🔴 The redemption TOKEN is deliberately NOT projected: one GET would silently promote read access
+            to decide access. `/decide` takes the token from the checkpoint row itself.
+          items: { $ref: '#/components/schemas/WorkflowRunPark' }
+        resumeAdmissionIncomplete:
+          type: boolean
+          enum: [true]
+          description: >
+            core 7.18.0 (#755) / server >= 7.78.0 — this RESUME record's admission did not complete.
+            🔴 NEVER-FALSE: core DELETES the key the moment admission completes and never writes `false`, so the
+            only reading is presence. ABSENT = admission completed, OR this is not a resume at all (the normal
+            case) — absence asserts nothing.
+            🔴 PRESENT => IT IS NOT A RESUME BASE: the engine refuses it whole (`admission_incomplete`) and
+            derives no candidate from it. A face rendering resume candidates MUST carry this bit — dropping it
+            turns a REFUSED record back into an admissible one (core's words; the projection obligation is
+            word-for-word the same rank as `parks`). It does NOT fold into the absence of `parks`, which has
+            its own two meanings (above).
+
+    WorkflowRunPark:
+      # sdk 9.5.0:具名行形(同 `WiringManifestMcpEntry` 的裁定),并且**封闭** —— 服务端逐键挑出这四位,
+      # 多出来的键意味着有人在别处手拼了第二份形(凭据位就是这样漏出去的)。
+      type: object
+      additionalProperties: false
+      description: >
+        One row of `WorkflowRun.parks` — the engine's park responsibility table, EXACTLY four keys because the
+        server picks them key by key rather than spreading core's row.
+        🔴 THE REDEMPTION TOKEN IS STRUCTURALLY ABSENT from this shape: core's row carries one (its own note
+        says never log / never URL), and the read face leaves it in the store. So "I can read the park row"
+        never means "I can decide it".
+      required: [callKey, sessionId, originRunId]
+      properties:
+        callKey: { type: string, description: "Which call this park belongs to — joins `agents[].callKey`." }
+        sessionId: { type: string, description: 'The parked CHILD session the host routes by.' }
+        originRunId:
+          type: string
+          description: >
+            Which run this park was MADE on. On an inherited entry it is NOT this run's id; and while
+            `originUnconfirmed` is present it says which run the material BELONGS TO, not where it was seen.
+        originUnconfirmed:
+          type: boolean
+          enum: [true]
+          description: >
+            core 7.18.0 (#757) / server >= 7.78.0 — NO journal has yet read or written a `parked` entry for this
+            token.
+            🔴 It PAIRS with `originRunId`: while present, that coordinate is UNCONFIRMED — core's contract,
+            verbatim, "a consumer must not read it as confirmed". Projecting the coordinate and dropping this
+            bit renders an unconfirmed coordinate as a confirmed one.
+            🔴 NEVER-FALSE: upstream DELETES the key at confirmation and never writes `false`, so absence =
+            confirmed, and rows written before 7.78.0 read identically (a true additive).
 
     # ── B4 命名化(2026-07-31):以下 10 个 component 与 SDK resources/* 的同名导出类型 1:1;内容为
     #    原端点内联 schema 的字节级搬运(零语义变更),使用点换 $ref。census 封闭注随迁。
@@ -8849,13 +8927,16 @@ components:
         🔴 A SIXTH PROVENANCE (server >= 7.75.0 / S-252, same lane): a 409 `decide.workflow_parks_unreadable`
         instead of the 200 above means the run record's `parks[]` — the engine's OWN park-ownership ledger,
         and the only source this lane can join the caller's checkpoint against — cannot be read at all (an
-        engine older than 7.17.0 never wrote the key, or one entry is damaged). A resume of that run is refused
-        by the engine for the identical reason, so this lane refuses too rather than accept a decision it could
-        never actually deliver. This is NOT the same failure as `decide.workflow_host_not_parked`: recovery is
-        the OPPOSITE — there is no retry and no waiting for a park, because this run cannot be resumed at all.
-        The card stays pending; the only recovery action is to start a NEW run. SDK → a dedicated
-        `DecideWorkflowParksUnreadableError` (NOT `DecideWorkflowHostError` — folding the two together would
-        make "retry via `.runId`" look like valid advice for a run this engine can never touch again). This
+        engine older than 7.17.0 never wrote the key, or one entry is damaged). The redemption keys this lane
+        needs are not on such a record, so it refuses rather than accept a decision it could never deliver.
+        This is NOT the same failure as `decide.workflow_host_not_parked`: recovery is neither a retry nor
+        waiting for a park — it is RESUMING the run named by `runId`, and whether that resume is admitted is the
+        engine's answer, not this lane's. 🔴 CORRECTED at server 7.78.0 / core 7.18.0: this text used to say the
+        engine refuses to resume such a record and that the only recovery was a NEW run — core 7.18.0 falsified
+        that (admission does not decide on the record's `parks` key alone), and the old advice abandoned
+        recoverable runs. SDK → a dedicated `DecideWorkflowParksUnreadableError` (NOT
+        `DecideWorkflowHostError` — folding the two together would make "retry this decide" look like valid
+        advice, when the action is to resume the run instead). This
         code REPLACES the 7.71.0 code `decide.workflow_park_identity_lost`, retired at this same 7.75.0 and
         never modeled by any released version of this SDK.
         The durable approval-queue projection is UNCHANGED — no key marks the workflow origin on any read face.
@@ -9566,7 +9647,11 @@ components:
       description: >
         `GET /v1/sessions/:id/mcp` envelope. `asOf` = THIS materialization moment (ISO). `degraded:true` (servers
         empty) ⇒ materialize timed out/failed (NOT "no MCP"). No MCP configured ⇒ `servers:[]` without `degraded`.
+        server >= 7.77.0 adds the OPTIONAL top-level key `lastLegMcp` (see its own description) — zero new
+        capability bit, read it as absent-by-default.
       # 封闭(census 批2 第三段,2026-07-30):三个铸造臂(`routes/sessions.ts` 的空面板 / 超时 degraded / 正常)键集并集恰是这 3 键;degraded 只在超时臂铸。
+      # sdk 9.4.0:第 4 键 `lastLegMcp`(server ≥7.77.0)—— 同一个铸造点上按调用方裁的可选顶层键,不在
+      # 面板那张短 TTL 单飞缓存里(缓存键=场景×principal,与会话无关)。
       required: [asOf, servers]
       additionalProperties: false
       properties:
@@ -9575,6 +9660,46 @@ components:
           type: array
           items: { $ref: '#/components/schemas/McpServerStatus' }
         degraded: { type: boolean }
+        lastLegMcp:
+          type: object
+          description: >
+            server >= 7.77.0 — WHAT THIS SESSION ACTUALLY MOUNTED LAST TIME: the `mcp` section of the LAST
+            `wiring_manifest` in the ledger of this session's most recent run. `servers` above answers "what
+            does this worker's DEFAULT SCENARIO give you"; this answers "what did my last run get". The two
+            may LEGITIMATELY differ (request-level MCP injection, a non-default scenario, a server that was
+            down for that leg) — 🔴 this is NOT a merge and NOT a reconciliation: the server does not infer a
+            difference, mints no `divergent` verdict key, and `servers[]` is unchanged to the byte. Judging the
+            difference belongs to the consumer and to people.
+            🔴 ABSENT ⇒ THE KEY IS NOT PRESENT (never `null`), and every reachable cause is INDISTINGUISHABLE
+            on the wire — the only read is `"lastLegMcp" in panel`: this session has not run a leg yet / that
+            leg's ledger rows are outside the retention window / that leg never pushed a `wiring_manifest`
+            (engines <= 7.8) / that frame carried no roster section / this deployment has no runs ledger / the
+            ledger read failed or timed out (the panel still answers 200 — an additive optional key must not
+            give an existing read face a new way to fall over) / the leg has an owner who is not the caller and
+            the caller is not an explicit operator (the key is withheld; the panel is NOT 404'd).
+            ⚠️ `"mcp": []` is NOT absence — a present empty array means "that leg declared no servers".
+            🔴 FRESHNESS: the panel body rides a short-TTL single-flight cache keyed by scenario x principal
+            (session-independent); this key is DELIBERATELY OUTSIDE it, so within one response `asOf` may come
+            from the cache while this key was read just now — both timestamps are honest about their own half.
+          additionalProperties: false
+          required: [runId, at, mcp]
+          properties:
+            runId:
+              type: string
+              description: >
+                That leg's run id (the anchor for GET /v1/runs/{id}/events; same reading as the session list
+                face's `lastRunId` — both always point at the same row).
+            at:
+              type: string
+              description: "The LEDGER timestamp (ISO) of that `wiring_manifest` event — NOT the panel's `asOf`."
+            mcp:
+              type: array
+              description: >
+                Verbatim that event's `data.mcp` — the SAME shape as `Event_wiring_manifest.mcp` down to the
+                byte (zero new shape: one payload, a second wire). Rows missing `name`/`status` were already
+                dropped individually at projection time, and the engine's free-text `error` was already
+                stripped there.
+              items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
 
     SessionMemoryStatus:
       type: object
@@ -9881,8 +10006,11 @@ components:
             `workflow_host_unknown`, `workflow_host_not_parked`, and — server >= 7.75.0 / S-252 —
             `workflow_parks_unreadable`): the WORKFLOW run's id. On the first three it is the RECOVERY HANDLE
             (wait for the host session to park and re-decide, or resume that run directly); on
-            `workflow_parks_unreadable` it names a run that CANNOT be resumed at all — the handle is for
-            identifying which run to abandon in favor of a new one, not for retrying it.
+            `workflow_parks_unreadable` it is ALSO a recovery handle but for a DIFFERENT verb — resume that run
+            (admission is where the engine settles its park set), do not re-issue this decide against it; whether
+            that resume is admitted is the engine's answer, not this code's.
+            🔴 CORRECTED at server 7.78.0 / core 7.18.0: this text used to call it a run that cannot be resumed
+            at all, to be abandoned in favour of a new one — that was true of core < 7.18.0 only.
             🔴 NOT interchangeable with `taskId`: the workflow-child park lane mints no taskId at all (this
             decision never landed on any run, so minting one would be a lie), and the other two decide lanes
             mint no runId. Branch by `errorCode`, never fall back from one handle to the other.
@@ -9965,6 +10093,15 @@ components:
         #   (server `routes/tasks.ts` mint points x this union), which now runs on every build.
         - $ref: '#/components/schemas/Event_text_end'
         - $ref: '#/components/schemas/Event_tool_roster_delta'
+        # sdk 9.4.0: `reasoning_end` — the REASONING twin of `text_end`, BYTE-IDENTICAL in shape (both are
+        #   `allOf: [SegmentEndFields]`, one wire concept, one shape). SERVER-MINTED (server >= 7.77.0): the
+        #   engine emits only `reasoning_delta`, so this frame's presence tracks the SERVER version, not core's.
+        - $ref: '#/components/schemas/Event_reasoning_end'
+        # sdk 9.5.0: the two frames core 7.18.0 added and server 7.78.0 forwards — `tool_disclosure` (#786,
+        #   the leg's DEFERRAL CENSUS, all three legs) and `tool_progress` (#741, a still-running call's
+        #   liveness tick, LIVE ONLY — never on the durable replay).
+        - $ref: '#/components/schemas/Event_tool_disclosure'
+        - $ref: '#/components/schemas/Event_tool_progress'
       discriminator:
         propertyName: type
         mapping:
@@ -10010,6 +10147,9 @@ components:
           approval_revoke: '#/components/schemas/Event_approval_revoke'
           text_end: '#/components/schemas/Event_text_end'
           tool_roster_delta: '#/components/schemas/Event_tool_roster_delta'
+          reasoning_end: '#/components/schemas/Event_reasoning_end'
+          tool_disclosure: '#/components/schemas/Event_tool_disclosure'
+          tool_progress: '#/components/schemas/Event_tool_progress'
 
     # design/99 §E2 (SHIPPED, core TaskEventIdentity) — additive per-event identity on every CONTENT event (NOT on
     # the lifecycle arms turn_end/compacted/suspended/done/failed). eventId = uuidv7 dedup/resume handle (the durable
@@ -10120,6 +10260,35 @@ components:
         parentToolCallId: { type: string }
         sourceTaskId: { type: string }
         bgAgentId: { type: string }
+    Event_reasoning_end:
+      type: object
+      description: >
+        LIVE stream only (server >= 7.77.0) — the END-OF-SEGMENT signal for one REASONING segment, the twin of
+        `text_end`. 🔴 SERVER-MINTED: core emits only `reasoning_delta`, so this frame's presence tracks the
+        SERVER version, not core's. `content` is the segment's AUTHORITATIVE full text (the whole segment's
+        deltas, through the SAME redactor as the durable leg) — and that is the reason the frame exists: a
+        per-chunk `reasoning_delta` cannot see a credential that straddles two chunks, only the whole segment
+        can. CONSUME IT BY REPLACING the deltas accumulated for that identity stream, not as a mere boundary
+        signal; `reasoning_delta` itself is byte-for-byte unchanged.
+        🔴 EMPTY SEGMENTS ARE NOT SENT (empty or all-whitespace): absence means "this segment has no
+        replacement text", never "the segment has not ended" — a blank authoritative segment would make a
+        consumer wipe what it already rendered.
+        🔴 Segments are accounted PER IDENTITY STREAM (parentToolCallId / sourceTaskId / bgAgentId): on one SSE
+        connection concurrent sub-agents interleave, so another stream's frame is NOT your boundary.
+        🔴 The durable leg does not append it (the batched `reasoning` row carries the same final text, byte for
+        byte), so GET /v1/runs/{id}/events never replays it.
+        Shape is IDENTICAL to Event_text_end (one wire concept, one shape — the server mints both through one
+        `segmentEndFields`); the only difference between the two frames is the empty-segment predicate.
+      allOf: [{ $ref: '#/components/schemas/EventIdentity' }]
+      additionalProperties: false   # 封闭 + identity 本地镜像:见 Event_reasoning 处的长注
+      required: [type, content]
+      properties:
+        type: { const: reasoning_end }
+        content: { type: string }
+        eventId: { type: string }
+        parentToolCallId: { type: string }
+        sourceTaskId: { type: string }
+        bgAgentId: { type: string }
     Event_tool_start:
       type: object
       allOf: [{ $ref: '#/components/schemas/EventIdentity' }]
@@ -10283,12 +10452,25 @@ components:
           required: [kind]
           properties:
             kind: { const: allowed }
+            classifier:
+              allOf: [{ $ref: '#/components/schemas/GateClassifierAttribution' }]
+              description: >
+                server >= 7.78.0 (core 7.18.0 #742) — the classification's model attribution. It rides BOTH arms
+                (a classification ends either way, allow or deny), which is why this key is mirrored on the deny
+                arm below. Full reading in `GateClassifierAttribution`.
         - type: object
           additionalProperties: false
           required: [kind, deniedBy]
           properties:
             kind: { const: denied }
             deniedBy: { $ref: '#/components/schemas/DeniedBy' }
+            classifier:
+              allOf: [{ $ref: '#/components/schemas/GateClassifierAttribution' }]
+              description: >
+                server >= 7.78.0 (core 7.18.0 #742) — the same member as on the allow arm, same shape, same
+                reading (see `GateClassifierAttribution`). Orthogonal to the sibling `cause`: `cause` says WHAT
+                SHAPE this deny was, this key says WHICH MODEL decided — an inherited chain carries a `cause`
+                with no attribution seat, so the two can appear apart.
             cause:
               type: string
               description: >-
@@ -10302,6 +10484,52 @@ components:
                 — branch the two known words and keep a default arm. Absent = this deny was not a classifier-fault
                 shape (policy / person / rule refused); never read absence as "classifier healthy".
 
+    GateClassifierAttribution:
+      # sdk 9.5.0:具名 —— 同一份形挂在 `GateDisposition` 的两只臂上,内联会立刻是两份会各自漂的镜像。
+      type: object
+      additionalProperties: false
+      description: >
+        WHICH MODEL decided one auto-mode classification (core 7.18.0 #742 `AutoModeClassifierRound`,
+        server >= 7.78.0): the rung it was FOR, the rung that ANSWERED, and — only when the ladder actually
+        MOVED — where it left, where it landed and why.
+        🔴 ABSENT READS **UNKNOWN**, NEVER "the seat answered" (core's words). "The seat answered" is this
+        member PRESENT with `fallback` ABSENT — the two are distinguishable on the wire. The three causes of
+        the member being absent are NOT distinguishable from the record: no classification happened; one ran on
+        a decider given no candidate ladder (it can name no model); or one ran on an ANCESTOR's inherited
+        chain, which carries the FORM but has no attribution seat yet.
+        🔴 NOT PERSISTED into the durable row (same as core): it is an observation of HOW this gate pass was
+        decided, not a terminal fact. It appears on `tool_end.gate` and on the two raw replay legs.
+        🔴 A record failing core's invariant I6 is withheld WHOLE by the server, so every attribution that
+        reaches a consumer has two non-empty model ids, `fallback.to === modelUsed`, and a cause inside the
+        closed set.
+      required: [modelRequested, modelUsed]
+      properties:
+        modelRequested: { type: string, description: "The ladder's FIRST rung — the seat this classification was for." }
+        modelUsed:
+          type: string
+          description: >
+            The rung whose answer the gate ACTED ON; where no candidate ruled, the last rung ATTEMPTED (stated,
+            never implied by absence).
+        fallback:
+          type: object
+          additionalProperties: false
+          required: [from, to, cause]
+          description: >
+            Present EXACTLY when the ladder MOVED to reach `modelUsed`; ABSENT = the first rung answered
+            ("the seat answered"). This is the one place on this shape where an absence IS an assertion.
+          properties:
+            from: { type: string, description: 'The rung it left.' }
+            to: { type: string, description: 'The rung it arrived at — ALWAYS equal to `modelUsed` (core invariant I6).' }
+            cause:
+              type: string
+              enum: [error, timeout, parse_error]
+              description: >
+                Why the ladder moved: `error` (that rung threw / rejected), `timeout` (the round-trip cap),
+                `parse_error` (it answered outside the verdict contract).
+                🔴 TRULY CLOSED here, unlike most engine words on this wire: core's I6 screen calls an
+                out-of-set cause a record DEFECT and the server withholds a defective record whole, so an
+                unknown word reaches a consumer as an ABSENT `gate`, never as a strange value.
+
     GateOutcome:
       type: object
       additionalProperties: false
@@ -10881,6 +11109,27 @@ components:
             already owns the single redaction mint point for it). The actionable cause is `errorCode`.
             A row missing `name` or `status` is dropped individually — the other servers'' rows still ship.
           items: { $ref: '#/components/schemas/WiringManifestMcpEntry' }
+        hooks:
+          type: array
+          description: >
+            core 7.18.0 (#789), server >= 7.78.0 — TENANT-visible: the hook seats THIS leg wired, one row per
+            family, in core's declaration order. EFFECTIVE half only.
+            🔴 PRESENT IFF at least one seat is wired — core NEVER emits an empty array, so "the key is here"
+            means non-empty. 🔴 ABSENCE READS "this leg wired no hook RECORD of its own", NOT "no hook runs":
+            a delegated child with no local record can still be screened (and refused) by an ANCESTOR's
+            `preToolUse` through the gate's constraint fold, which this face deliberately does not call a hook
+            of this leg. A row missing `family` or `owner` is dropped INDIVIDUALLY (same rule as `mcp[]`); all
+            rows dropped => the key is absent. 🔴 EXCLUDED from `configFingerprint` (the record is a per-task
+            seat), so two legs with the same fingerprint and different `hooks[]` are NOT in contradiction.
+          items: { $ref: '#/components/schemas/WiringManifestHookEntry' }
+        lsp:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestLspSeam' }]
+          description: >
+            core 7.18.0 (#789), server >= 7.78.0 — TENANT-visible: the LSP code-intelligence seam. EFFECTIVE
+            half only. PRESENT IFF a manager seat resolved (`spec.lspManager ?? deps.lspManager`); a deployment
+            that wires none reports nothing at all. The server never invents `mounted: false` when it cannot
+            read the bit — the whole section goes absent instead (a minted false would read as "really not
+            mounted").
         governance:
           type: object
           additionalProperties: false
@@ -10930,6 +11179,104 @@ components:
         parentToolCallId: { type: string }
         sourceTaskId: { type: string }
         bgAgentId: { type: string }
+    Event_tool_disclosure:
+      type: object
+      description: >
+        This leg's DEFERRAL CENSUS (server >= 7.78.0, core 7.18.0 #786): which mounted tools ship today as
+        NAME-ONLY placeholders, which ones the model has activated, and which policy decided it.
+        🔴 A DIFFERENT QUESTION FROM THE ROSTER: `wiring_manifest.tools` says WHICH TOOLS CAN BE CALLED; this
+        frame says WHETHER ONE MUST BE FETCHED FIRST. A deferred name is ON the roster.
+        🔴 ALL THREE LEGS (live SSE + durable ledger + resume replay), same as `tool_roster_delta`. The leg-start
+        census is the FIRST frame after `wiring_manifest`; every later frame means the census CHANGED (an
+        activation landed).
+        🔴 WHOLE SNAPSHOT: `deferred` and `activated` are both complete — replace your copy, never merge.
+        🔴 ABSENCE READINGS, three of them: (a) the WHOLE FRAME absent = "this leg deferred NOTHING" (a leg with
+        an empty deferred set emits no frame at all) — NOT "this build has no such face" and NOT "unknown";
+        (b) `thresholdPercent` absent = under `always` / `never` NO THRESHOLD WAS EVER CONSULTED — never read it
+        as "the default percent"; (c) a RESUME leg's FIRST census may carry a non-empty `activated` (the engine
+        reseeded it) — never read that as "this leg activated them".
+        🔴 Half a census never reaches the wire: the server drops the WHOLE frame when any of the three required
+        members is unreadable (half a table would read as "these are the only deferred ones").
+      additionalProperties: false   # 封闭 + identity 本地镜像:见 Event_reasoning 处的长注
+      required: [type, policy, deferred, activated]
+      properties:
+        type: { const: tool_disclosure }
+        policy:
+          type: string
+          description: >
+            Which arm of `RunnerDeps.toolSearch` decided this (`always` / `never` / `auto` today). READ AS OPEN:
+            the server passes it through verbatim and does not enumerate, so a new word must pass through your
+            default arm.
+        thresholdPercent:
+          type: number
+          description: >
+            Under `auto`: the percent of the window the candidate set had to reach. ABSENT under `always` /
+            `never` because no threshold was consulted — NEVER substitute a default.
+            🔴 A FINITE NUMBER, NOT AN INTEGER: the engine's seat accepts any finite percent in [0, 100]
+            (`{mode:"auto", thresholdPercent: 12.5}` is a legal deployment) and the server forwards it through
+            a finite-number guard, verbatim. Typing it `integer` here would make a spec-validating consumer
+            REJECT a legal frame, and the symptom ("this build has no census") is indistinguishable from the
+            frame being absent. The range is NOT constrained here either: the seat enforces [0, 100] at parse
+            time, the server re-derives nothing, and a bound this face does not enforce would be a second
+            screen that can only disagree with the first.
+        deferred:
+          type: array
+          items: { type: string }
+          description: 'Every name-only placeholder on this leg (frozen at prepare, sorted). WHOLE snapshot.'
+        activated:
+          type: array
+          items: { type: string }
+          description: >
+            The deferred names ACTIVE right now (the engine's state, not a record of commits; sorted, always a
+            subset of `deferred`). WHOLE snapshot.
+        # identity:两键 —— server 的 `identityFields` 只在这条臂上铸 eventId/parentToolCallId(本帧不在
+        # live 腿那张四键白名单上),同 Event_compaction_outcome 的处置。
+        eventId: { type: string }
+        parentToolCallId: { type: string }
+    Event_tool_progress:
+      type: object
+      description: >
+        A LIVENESS TICK for a tool call that is STILL RUNNING (server >= 7.78.0, core 7.18.0 #741), minted
+        between that call's `tool_start` and `tool_end` under the same ordering law as every other content
+        frame; a child's ticks reach a parent under the same opt-in as those two
+        (`TaskSpec.forwardSubagentEvents`).
+        🔴 LIVE ONLY — NOT PERSISTED, NOT REPLAYED (core's `tool_progress.ephemeral`, same family as
+        `task_progress` / `status`): `GET /v1/runs/{id}/events` has no such arm and a reconnect back-fills
+        nothing. The DURABLE fact about how long a call took is `tool_end` — core states explicitly that
+        `elapsedTimeSeconds` does NOT equal the `tool_end` duration (this clock starts when the call ENTERS
+        EXECUTION, earlier than a shell command's spawn).
+        🔴 THE FRAME'S ABSENCE IS NEVER EVIDENCE (core's `tool_progress.cadence`): at most one frame per second
+        per call, and a call that finishes INSIDE one interval emits NONE. Never expect one per `tool_start`,
+        and never use its presence to decide whether a call ran.
+        🔴 `output` / `totalLines` / `totalBytes` RIDE OR STAY AWAY TOGETHER: present = "output has been
+        observed", absent = "not one byte has been observed" (`sleep 3`; or an execution environment that does
+        not stream — a buffered remote `exec` never invokes the output callbacks) — NEVER "unchanged since the
+        last frame". The server projects the counters only when `output` itself is readable, so a counter never
+        arrives without the text it counts.
+      additionalProperties: false   # 封闭 + identity 本地镜像:见 Event_reasoning 处的长注
+      required: [type, toolCallId, toolName]
+      properties:
+        type: { const: tool_progress }
+        toolCallId: { type: string, description: "The still-running call's id — joins its own `tool_start`/`tool_end`. The server drops the whole frame without it." }
+        toolName: { type: string, description: 'The running tool name (the `tool_start` value verbatim).' }
+        elapsedTimeSeconds:
+          type: integer
+          description: >
+            Whole seconds this call has been running: floored, monotonic across its frames, ONE ORIGIN per call
+            stamped by the mint. It does NOT equal the `tool_end` duration. ABSENT (rather than 0) when the
+            server's finite-number guard could not read it — "the clock was unreadable" is not "zero seconds".
+        output:
+          type: string
+          description: >
+            The TAIL of what the command has written so far (stdout and stderr interleaved in arrival order),
+            capped by the mint to a few trailing lines — a live pane, never a log.
+            🔴 UNTRUSTED RAW, exactly like `tool_end.output`: the server has passed it through the SAME
+            redactor, a consumer MAY bound it further before display, and it must NEVER be re-fed to a model
+            (it is a moving, truncated window; the model already holds the full result).
+        totalLines: { type: integer, description: 'Newlines observed so far (>= the tail''s own line count — the tail is only a window). Rides iff `output` does.' }
+        totalBytes: { type: integer, description: 'Bytes observed BEFORE the tail cap, so it keeps growing after `output` stops being able to. Rides iff `output` does.' }
+        eventId: { type: string }
+        parentToolCallId: { type: string }
     ToolRosterDelta:
       type: object
       description: >
@@ -12868,12 +13215,40 @@ components:
         usedTokens: { type: integer }
         windowTokens: { type: integer, description: 'autocompact 窗,不是模型上下文大小。' }
         compactAtTokens: { type: integer }
+        sections:
+          type: array
+          description: >
+            core 7.18.0 (#790), server >= 7.78.0 — WHAT THIS LEG'S SYSTEM PROMPT IS MADE OF: one row per
+            rendered pack section.
+            🔴 NOT THE SAME COORDINATE SYSTEM AS `usedTokens` — NEVER SUBTRACT (core's contract, verbatim):
+            `sections[].tokens` is a PREPARE-time estimate of the SYSTEM PROMPT from rendered character counts,
+            while `usedTokens` is the engine's triggering input over the WHOLE conversation. So: never subtract
+            the section sum from `usedTokens`, never compare one section against `compactAtTokens`, and never
+            read a cross-frame change as "it grew" — the values FREEZE at prepare and every boundary on this leg
+            re-reports the same set verbatim. The sum MAY exceed `usedTokens` (two quantities, not one ledger).
+            🔴 THE WHOLE KEY ABSENT = this leg assembled NO section IR (some providers replace the prompt
+            wholesale and hand back an opaque block) — NOT "every section weighs zero". An element missing
+            `id`/`tokens` is dropped individually; all dropped => the key is absent.
+          items: { $ref: '#/components/schemas/ContextUsageSection' }
         # LIVE 腿(routes/tasks.ts)在这条臂上挂 identity;durable 腿不挂。同 turn_end 的处置:
         # 本地可选声明,不 allOf(不把 identity 承诺进契约面)。
         eventId: { type: string }
         parentToolCallId: { type: string }
         sourceTaskId: { type: string }
         bgAgentId: { type: string }
+    ContextUsageSection:
+      # sdk 9.5.0:具名而非内联 —— 与 `WiringManifestMcpEntry` 同一条裁定(一份行形,多处引用)。
+      type: object
+      description: >
+        One rendered section of this leg's SYSTEM PROMPT (core 7.18.0 #790). `id` shares ONE vocabulary with
+        `prompt.assembled`'s `sections[].id`, so the two faces join. See `Event_context_usage.sections` for the
+        do-not-subtract rule — it is the load-bearing half of this shape's contract.
+      additionalProperties: false
+      required: [id, tokens]
+      properties:
+        id: { type: string, description: "The section id — same vocabulary as `prompt.assembled`'s `sections[].id`." }
+        tokens: { type: integer, description: 'PREPARE-time estimate of this section, in ITS OWN coordinate system (see the parent key).' }
+        kind: { type: string, description: 'The semantic slot; ABSENT when the manifest entry declared none (not "no semantics").' }
     Event_compaction_outcome:
       type: object
       description: >
@@ -13776,6 +14151,66 @@ components:
           properties:
             armed: { type: boolean }
             reason: { type: string }
+        hooks:
+          type: array
+          description: >
+            core 7.18.0 (#789), server >= 7.78.0 — the hook seats THIS leg wired, one row per family.
+            EFFECTIVE half only (the diagnostics endpoint's static half never carries it). Present iff at least
+            one seat is wired; absence means "no hook RECORD of this leg", never "no hook runs".
+            Full per-key contract: see Event_wiring_manifest.hooks.
+          items: { $ref: '#/components/schemas/WiringManifestHookEntry' }
+        lsp:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestLspSeam' }]
+          description: >
+            core 7.18.0 (#789), server >= 7.78.0 — the LSP seam. EFFECTIVE half only; present iff a manager
+            seat resolved. `mounted` and `lane` are INDEPENDENT facts — never fold them into one.
+            Full per-key contract: see Event_wiring_manifest.lsp.
+    WiringManifestHookEntry:
+      # sdk 9.5.0:与 `WiringManifestMcpEntry` 同一条裁定 —— 同一份行形被 live 帧与静态诊断面两处引用,
+      # 内联就是两份会各自漂的镜像,所以一开始就具名。
+      type: object
+      description: >
+        One row of a leg's HOOK seat manifest (core 7.18.0 #789): which family, where the seat came from, and
+        whether the `preToolUse` row was DECLARED observational.
+      additionalProperties: false
+      required: [family, owner]
+      properties:
+        family:
+          type: string
+          description: >
+            The hook family. core's closed vocabulary today (`preToolUse` / `postToolUse` / `userPromptSubmit` /
+            `stop` / `postToolUseFailure` / `postToolBatch` / `preCompact` / `postCompact` / `stopFailure` /
+            `permissionDenied`) but READ AS OPEN: the server passes it through verbatim and does not enumerate,
+            so a newly minted family must pass through your default arm.
+        owner:
+          type: string
+          description: "Where the seat came from — core's `SeamProvenance` (`spec` / `deps`). Closed today, read as open."
+        observational:
+          type: boolean
+          enum: [true]
+          description: >
+            Only on the `preToolUse` row, and only when the deployment DECLARED the face observational: it still
+            runs on every call but is not folded into a delegated child's inherited constraints.
+            🔴 NEVER-FALSE — core's words: "Absence means 'not declared', never 'declared false'".
+    WiringManifestLspSeam:
+      # sdk 9.5.0:同上 —— live 帧与静态面共用一份段形。
+      type: object
+      description: >
+        A leg's LSP code-intelligence seam (core 7.18.0 #789). 🔴 THE TWO BITS ARE INDEPENDENT AND MUST NOT BE
+        READ AS ONE: `mounted` is the ROSTER fact (a wired manager whose `LSP` tool was excluded reports
+        `false`), while `lane` arms on the manager / the hands / the opt-out and NOT on the mount — so
+        `{mounted: false, lane: "diagnostics"}` is a REAL, REACHABLE state, not bad data.
+      additionalProperties: false
+      required: [mounted]
+      properties:
+        mounted:
+          type: boolean
+          description: 'Is the LSP tool on this leg''s roster. Required — when the server cannot read it the WHOLE section is absent (it never mints a false).'
+        lane:
+          type: string
+          description: >
+            Which lanes are live — core's closed three (`tool` / `diagnostics` / `tool_and_diagnostics`), read as
+            open. ABSENT = neither lane is live (not "unknown").
     WiringManifestMcpEntry:
       # 8.9.0:从 `Event_wiring_manifest.mcp.items` 的内联形**提取**为具名 schema —— 同一份行形现在被
       # 两处引用(live 帧与 `WiringManifest` 的静态/两半形),内联会立刻变成两份会各自漂的镜像。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/sdk",
-  "version": "9.3.0",
+  "version": "9.5.0",
   "description": "Typed, zero-runtime-dependency SDK for the Sema agent fleet usage plane. The shared substrate for all doors (CC/Codex MCP façade + web). Server-side only — tokens never enter the browser.",
   "type": "module",
   "license": "BUSL-1.1",