@sema-agent/settings-schema 1.2.0 → 1.4.0

package/dist/hooks.js

@@ -2,13 +2,13 @@
  * `hooks` — the CC-parity hooks contract (incl. stop attribution).
  *
  * ONE definition of the FULL hook-event set — 27 CC 2.1.198 events (REF: the `jP` array in
- * claude-cli-2.1.198.pretty.js) + 3 post-198 events the shell already ships (CwdChanged / FileChanged /
- * MessageDisplay). Per the product ruling: the CONTRACT is the full set from day one; the engine
- * hook-runner (service) and the shell light events up in PHASES — adding an event later is pure
- * implementation, never a schema change.
+ * claude-cli-2.1.198.pretty.js) + 4 post-198 events the shell already ships (CwdChanged / FileChanged /
+ * MessageDisplay, and DirectoryAdded from CC 2.1.219). Per the product ruling: the CONTRACT is the full set
+ * from day one; the engine hook-runner (service) and the shell light events up in PHASES — adding an event
+ * later is pure implementation, never a schema change.
  *
  * CONSUMERS
- * - service (sema-server): `TaskRequest.settings.hooks` wire face = `HooksConfig` below; the worker-side
+ * - service (the worker server): `TaskRequest.settings.hooks` wire face = `HooksConfig` below; the worker-side
  *   hook-runner translates matching entries into core `TaskSpec.hooks` in-process callbacks. Single-user
  *   gate first (requirePrincipal semantics, same as MCP injection ).
  * - core (engine): per-event input/output shapes for the engine-owned events; `stoppedBy` on settle.
@@ -55,9 +55,13 @@ export const CC_198_HOOK_EVENTS = [
     "WorktreeRemove",
     "InstructionsLoaded",
 ];
-/** Post-CC-2.1.198 additions the shell already ships (sema superset; CC added them after 198). */
-export const POST_198_HOOK_EVENTS = ["CwdChanged", "FileChanged", "MessageDisplay"];
-/** The full 30-event contract set = CC 198's 27 + the 3 post-198 shell events. */
+/**
+ * Post-CC-2.1.198 additions the shell already ships (sema superset; CC added them after 198).
+ * APPEND-ONLY: new members go at the tail (1.3.0 `DirectoryAdded`, CC 2.1.219 — CC's own tuple places it
+ * between FileChanged and MessageDisplay; the declaration order here is not normative, the enum is a set).
+ */
+export const POST_198_HOOK_EVENTS = ["CwdChanged", "FileChanged", "MessageDisplay", "DirectoryAdded"];
+/** The full 31-event contract set = CC 198's 27 + the 4 post-198 shell events. */
 export const HOOK_EVENTS = [...CC_198_HOOK_EVENTS, ...POST_198_HOOK_EVENTS];
 export const HookEventName = z.enum(HOOK_EVENTS);
 // ── ownership (owner-single) ─────────────────────────────────────────────────────────────────────
@@ -119,6 +123,7 @@ export const HOOK_EVENT_MATCHER_FIELD = {
     CwdChanged: null,
     FileChanged: "file_path", // matched against basename(file_path)
     MessageDisplay: null,
+    DirectoryAdded: null, // the shell's getMatchingHooks switch has no arm for it → every entry matches (CwdChanged family)
 };
 // ── shared enums (CC-verbatim) ─────────────────────────────────────────────────────────────────────────
 export const PermissionBehavior = z.enum(["allow", "deny", "ask"]);
@@ -382,7 +387,18 @@ export const MessageDisplayHookInput = BaseHookInput.extend({
     /** Newly completed lines since the prior flush (final flush may end mid-line / be empty). */
     delta: z.string(),
 });
-/** Any hook input — discriminated on `hook_event_name` (all 30 events). */
+/** How a directory joined the session working set: the `/add-dir` slash command or repo-root registration. */
+export const DIRECTORY_ADDED_SOURCES = ["slash_command", "register_repo_root"];
+/**
+ * Fired after a directory joins the session's working set (CC 2.1.219; agent-types hooks.d.ts:582-586 —
+ * `directory` is the absolute path). Shell-owned; matcher ignored; no hookSpecificOutput arm upstream.
+ */
+export const DirectoryAddedHookInput = BaseHookInput.extend({
+    hook_event_name: z.literal("DirectoryAdded"),
+    directory: z.string(),
+    source: z.enum(DIRECTORY_ADDED_SOURCES),
+});
+/** Any hook input — discriminated on `hook_event_name` (all 31 events). */
 export const HookInput = z.discriminatedUnion("hook_event_name", [
     PreToolUseHookInput,
     PostToolUseHookInput,
@@ -414,6 +430,7 @@ export const HookInput = z.discriminatedUnion("hook_event_name", [
     CwdChangedHookInput,
     FileChangedHookInput,
     MessageDisplayHookInput,
+    DirectoryAddedHookInput,
 ]);
 // ── hook output / decision semantics (CC-verbatim, with the service-receipt design points pinned) ────────
 //
@@ -488,8 +505,13 @@ export const HookSpecificOutput = z.union([
 ]);
 /**
  * Synchronous hook JSON output (stdout of a command hook, CC-verbatim). Exit-code semantics ride
- * alongside: exit 0 = success (stdout parsed as this shape when JSON), exit 2 = BLOCKING error (stderr
- * fed back to the model), any other exit = non-blocking error (stderr shown to the user).
+ * alongside: exit 0 = success (stdout parsed as this shape when JSON); exit 2 = BLOCKING error (stderr is fed
+ * back to the model as the block reason / additionalContext, per event); any other exit, a timeout, a spawn
+ * failure or malformed JSON = NON-BLOCKING failure: the run continues, and the consumer's hook-runner forwards
+ * it as a `hook_non_blocking_failure` notice (a `hook_notice` frame on the task/fleet stream carrying hook name,
+ * event, reason, exit code and the stderr text redacted-then-bounded to 512 chars), so the failure is visible
+ * from the task's point of view instead of only in server logs. There is no separate "shown to the user"
+ * surface: what a user sees is whatever their client renders from that notice frame.
  */
 export const SyncHookOutput = z.object({
     /** Whether the run should continue after the hook (default true). */

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 /**
  * @sema-agent/settings-schema — the public barrel. ONE source of truth for the config contract shared by
- * sema-registry, sema-server, and the TOC desktop/CLI.
+ * the config center, the worker service, and the TOC desktop/CLI.
  */
 export * from "./types.js";
 export * from "./hash.js";

package/dist/index.js

@@ -1,6 +1,6 @@
 /**
  * @sema-agent/settings-schema — the public barrel. ONE source of truth for the config contract shared by
- * sema-registry, sema-server, and the TOC desktop/CLI.
+ * the config center, the worker service, and the TOC desktop/CLI.
  */
 export * from "./types.js";
 export * from "./hash.js";
@@ -14,7 +14,7 @@ export * from "./cross-domain.js"; // pure half only (no fleet placement)
 export * from "./remote-exec.js";
 export * from "./safety-merge-spec.js"; // #14 per-category safety merge-spec (settings resolver authority)
 export * from "./scheduler-store.js"; // R7 self-wake scheduler store CONTRACT (pure: type + parse/serialize + SchedulerStore interface; fs binding in ./node)
-export * from "./hooks.js"; // CC-parity hooks contract (30-event set + owner map + per-event input/output shapes + HooksConfig) & stop attribution (stoppedBy) — pure/browser-safe
+export * from "./hooks.js"; // CC-parity hooks contract (31-event set + owner map + per-event input/output shapes + HooksConfig) & stop attribution (stoppedBy) — pure/browser-safe
 export * from "./fleet.js"; // scheduling/fleet contract (drain protocol · instance discovery · dispatch policy · quota lease · usage report · quota reset event) — CONTROL-PLANE-SCHEDULING-DESIGN, pure/browser-safe
 export * from "./migrate.js"; // 0.5→0.6 migration tools (hosts grandfathering + worker.model→catalog migration PLAN — report/draft only, E1; EXPERT-REDESIGN §2-2/§3), pure/browser-safe
 export * from "./api/auth.js"; // /api/v1/auth/* wire contract (RFC 8628 device flow + rotating refresh + logout + approve) — REGISTRY-REBUILD-DESIGN §2, M1 shipped shapes frozen, pure/browser-safe

package/dist/local-load.d.ts

@@ -28,7 +28,7 @@ export interface LocalConfig {
     requiredEnv: RequiredEnvName[];
     /** 本次读盘的降级/静默告警(0.19.0)。此前本函数**从不**给 store 挂 `onWarning`,于是单机 lane 的
      *  默认形是「没有通道 = 没有声音」:域文档里被剥的键、`config.d/` 里永远不会被读的文件,一律静默
-     *  (sema-server #322 的病形)。空数组 = 本次读盘无告警。 */
+     *  (消费方 #322 的病形)。空数组 = 本次读盘无告警。 */
     warnings: EffectiveReadWarning[];
 }
 /** The ONE canonical local load — the service engine and the client CLI/desktop both call this so they cannot

package/dist/remote-exec.d.ts

@@ -1,16 +1,16 @@
 /**
  * `remoteExec` — the execution-substrate contract (NET-NEW; not part of DOMAIN_SCHEMAS today).
  *
- * Per Clay's decision the exec layer is user-configurable & pluggable. This SCHEMA is a FORWARD-COMPATIBLE
- * SUPERSET: it carries both the backends sema-server already implements today AND the TOC single-machine
- * backends Clay added (the service implements those in PHASES — host + e2b first, local/remote-docker
- * fast-follow). The schema LEADS; runtime support is phased. The discriminator is `provider`:
- *   FLEET (implemented today, sema-server/src/config.ts):
+ * Per the product owner's decision the exec layer is user-configurable & pluggable. This SCHEMA is a
+ * FORWARD-COMPATIBLE SUPERSET: it carries both the backends the worker service already implements today AND the
+ * TOC single-machine backends the product owner added (the service implements those in PHASES — host + e2b first,
+ * local/remote-docker fast-follow). The schema LEADS; runtime support is phased. The discriminator is `provider`:
+ *   FLEET (implemented today, the worker service's config module):
  *   - `e2b`           per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
  *   - `k8s`           per-task Kata pod on our k3s (isolated, NOT suspendable). Self-hosted sandbox lane.
  *   - `ssh`           a real host over SSH (NOT isolated/suspendable). AI-orchestrated batch deploy.
  *   - `adb`           a real device over ADB (NOT isolated/suspendable). On-device APP testing.
- *   TOC single-machine (Clay; service implements in phases — macOS + Linux first):
+ *   TOC single-machine (product-owner scope; service implements in phases — macOS + Linux first):
  *   - `host`          run tools DIRECTLY on this machine, no container (the TOC default, like a local coding
  *                     agent). No isolation. macOS/Linux.
  *   - `local-docker`  containers on THIS machine's docker (isolation for parallel/untrusted fan-out).
@@ -25,7 +25,7 @@
 import { z } from "zod";
 export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodObject<{
     provider: z.ZodLiteral<"host">;
-    /** Working ROOT for the agent's tools; absent = the workspace/cwd. (≡ sema-server's resolved
+    /** Working ROOT for the agent's tools; absent = the workspace/cwd. (≡ the worker service's resolved
      *  `workspaceBase` — the adapter runs each task under `<workdir>/ai-agent-host-<id>`.) */
     workdir: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     /** Optional writable-path allowlist bounding what the host-exec tools may touch (defence for a TOC box). */
@@ -33,7 +33,7 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodO
     /** Shell to spawn (absent = the platform default). */
     shell: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     /** Per-COMMAND timeout (ms) for the host lane — host is long-lived so this bounds a single exec, not the
-     *  task (mirrors e2b/k8s `timeoutMs`; = sema-server's `commandTimeoutMs`). Absent = adapter default. */
+     *  task (mirrors e2b/k8s `timeoutMs`; = the worker service's `commandTimeoutMs`). Absent = adapter default. */
     commandTimeoutMs: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     provider: "host";

package/dist/remote-exec.js

@@ -1,16 +1,16 @@
 /**
  * `remoteExec` — the execution-substrate contract (NET-NEW; not part of DOMAIN_SCHEMAS today).
  *
- * Per Clay's decision the exec layer is user-configurable & pluggable. This SCHEMA is a FORWARD-COMPATIBLE
- * SUPERSET: it carries both the backends sema-server already implements today AND the TOC single-machine
- * backends Clay added (the service implements those in PHASES — host + e2b first, local/remote-docker
- * fast-follow). The schema LEADS; runtime support is phased. The discriminator is `provider`:
- *   FLEET (implemented today, sema-server/src/config.ts):
+ * Per the product owner's decision the exec layer is user-configurable & pluggable. This SCHEMA is a
+ * FORWARD-COMPATIBLE SUPERSET: it carries both the backends the worker service already implements today AND the
+ * TOC single-machine backends the product owner added (the service implements those in PHASES — host + e2b first,
+ * local/remote-docker fast-follow). The schema LEADS; runtime support is phased. The discriminator is `provider`:
+ *   FLEET (implemented today, the worker service's config module):
  *   - `e2b`           per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
  *   - `k8s`           per-task Kata pod on our k3s (isolated, NOT suspendable). Self-hosted sandbox lane.
  *   - `ssh`           a real host over SSH (NOT isolated/suspendable). AI-orchestrated batch deploy.
  *   - `adb`           a real device over ADB (NOT isolated/suspendable). On-device APP testing.
- *   TOC single-machine (Clay; service implements in phases — macOS + Linux first):
+ *   TOC single-machine (product-owner scope; service implements in phases — macOS + Linux first):
  *   - `host`          run tools DIRECTLY on this machine, no container (the TOC default, like a local coding
  *                     agent). No isolation. macOS/Linux.
  *   - `local-docker`  containers on THIS machine's docker (isolation for parallel/untrusted fan-out).
@@ -44,7 +44,7 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
     // ── host: run on THIS machine, no container (TOC default; macOS/Linux). No isolation, no secrets.
     z.object({
         provider: z.literal("host"),
-        /** Working ROOT for the agent's tools; absent = the workspace/cwd. (≡ sema-server's resolved
+        /** Working ROOT for the agent's tools; absent = the workspace/cwd. (≡ the worker service's resolved
          *  `workspaceBase` — the adapter runs each task under `<workdir>/ai-agent-host-<id>`.) */
         workdir: execStr.optional(),
         /** Optional writable-path allowlist bounding what the host-exec tools may touch (defence for a TOC box). */
@@ -52,7 +52,7 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
         /** Shell to spawn (absent = the platform default). */
         shell: execStr.optional(),
         /** Per-COMMAND timeout (ms) for the host lane — host is long-lived so this bounds a single exec, not the
-         *  task (mirrors e2b/k8s `timeoutMs`; = sema-server's `commandTimeoutMs`). Absent = adapter default. */
+         *  task (mirrors e2b/k8s `timeoutMs`; = the worker service's `commandTimeoutMs`). Absent = adapter default. */
         commandTimeoutMs: z.number().int().positive().optional(),
     }),
     // ── local-docker: containers on this machine's docker (isolated; enables parallel fan-out). No secrets

package/dist/safety-merge-spec.d.ts

@@ -14,7 +14,7 @@
  * admitted or rejected as one value under its `minTrust`. A resolver reads this table and has NO per-key
  * special-casing.
  *
- * MEMBER-LEVEL ADMISSION (1.1.0 — the WRITTEN layer of the permission-rule dual-channel ruling, board [5797] ④;
+ * MEMBER-LEVEL ADMISSION (1.1.0 — the WRITTEN layer of the permission-rule dual-channel ruling, [ref] ④;
  * the executing layer is core's `prepareCcImport` door + `RuleAddOrigin`, the resolver/shell halves are cli's):
  *   A category may declare `members`, each with its own admission floor and DIRECTION. Today only `permissions`
  *   does — `allow` / `deny` / `ask`, a CLOSED set ({@link SafetyMergeMember}; an unknown member is a compile error
@@ -39,7 +39,7 @@
  *   requiresRealApproval). Consumers read admission through {@link memberAdmission} / {@link memberMinTrust} /
  *   {@link membersOf} — never through a hardcoded allow/deny/ask table of their own (single source).
  *
- * TRUST ORDERING PRIMITIVES (1.2.0 — board [5796] ordering question → [5805] claim / [5807] consumer statement):
+ * TRUST ORDERING PRIMITIVES (1.2.0 — [ref] ordering question → claim / consumer statement):
  *   The floor words are only meaningful against a LADDER, and that ladder is v2-design §1:29, verbatim:
  *   `MANAGED 6 > GLOBAL 5 > PROJECT 4 > LOCAL 3 > SESSION 2 > TASK 1`. {@link trustRank} publishes exactly those
  *   numbers and {@link isAtLeast} the comparison a resolver makes (`rank(layer) ≥ rank(floor)` ⇒ admitted), so no
@@ -83,16 +83,44 @@ export declare function isAtLeast(layer: MinTrust, minTrust: MinTrust): boolean;
 export declare const MemberDirection: z.ZodEnum<["loosen", "tighten"]>;
 export type MemberDirection = z.infer<typeof MemberDirection>;
 /** One member's admission row. `minTrust` ABSENT ⇒ the category's `minTrust` applies: a row can refine the floor
- *  only by SAYING so; omission never lowers it (fail-closed by construction). */
+ *  only by SAYING so; omission never lowers it (fail-closed by construction).
+ *
+ *  `boolPole` (S-59 件八, codex r3 [high]) — VALUE-DIRECTIONAL admission for a boolean member whose two poles
+ *  point opposite ways (`enabled:true` narrows the sandbox, `enabled:false` opens it): a write EQUAL to
+ *  `boolPole.strict` (strict equality, never truthiness — a string "true" is not the pole) is the tightening
+ *  write and is admitted at `boolPole.minTrust`; ANY other write — the loose pole, a non-boolean, or a
+ *  valueless query — is admitted at the ROW floor. 🔴 Vintage-safety law: a boolPole row's OWN `minTrust`
+ *  must be the LOOSEN floor (the category's), so a consumer that predates this field (its schema strips
+ *  `boolPole`) reads the row as tighten@<loosen-floor> and withholds BOTH poles from low-trust layers —
+ *  fail-closed (it loses only the convenience of low-trust tightening, it can never admit a loosening write).
+ *  Resolution is value-aware: pass the candidate value to {@link memberAdmission} / {@link memberMinTrust}. */
 export declare const MemberAdmission: z.ZodObject<{
     direction: z.ZodEnum<["loosen", "tighten"]>;
     minTrust: z.ZodOptional<z.ZodEnum<["local", "session", "project", "global", "managed", "task"]>>;
+    boolPole: z.ZodOptional<z.ZodObject<{
+        strict: z.ZodBoolean;
+        minTrust: z.ZodEnum<["local", "session", "project", "global", "managed", "task"]>;
+    }, "strip", z.ZodTypeAny, {
+        strict: boolean;
+        minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+    }, {
+        strict: boolean;
+        minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+    }>>;
 }, "strip", z.ZodTypeAny, {
     direction: "loosen" | "tighten";
     minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+    boolPole?: {
+        strict: boolean;
+        minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+    } | undefined;
 }, {
     direction: "loosen" | "tighten";
     minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+    boolPole?: {
+        strict: boolean;
+        minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+    } | undefined;
 }>;
 export type MemberAdmission = z.infer<typeof MemberAdmission>;
 /** The RESOLVED admission a consumer branches on — the category fallback already applied, so `minTrust` is never
@@ -100,6 +128,12 @@ export type MemberAdmission = z.infer<typeof MemberAdmission>;
 export interface ResolvedMemberAdmission {
     readonly direction: MemberDirection;
     readonly minTrust: MinTrust;
+    /** Present iff the row is value-directional; `minTrust` above already reflects the VALUE handed in (row floor
+     *  when no value / not the strict pole). Exposed for presentation faces; enforcement should pass the value. */
+    readonly boolPole?: {
+        readonly strict: boolean;
+        readonly minTrust: MinTrust;
+    };
 }
 /** WHERE the category is enforced (STRENGTH) — MUST stay in lockstep with `EffectiveKey.enforcement` (types.ts).
  *  gate=data-plane engine, server=control-plane/TOB boundary, resolver=merger correctness, client=UI only. */
@@ -202,12 +236,30 @@ export declare const MergeCategorySpec: z.ZodObject<{
     members: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         direction: z.ZodEnum<["loosen", "tighten"]>;
         minTrust: z.ZodOptional<z.ZodEnum<["local", "session", "project", "global", "managed", "task"]>>;
+        boolPole: z.ZodOptional<z.ZodObject<{
+            strict: z.ZodBoolean;
+            minTrust: z.ZodEnum<["local", "session", "project", "global", "managed", "task"]>;
+        }, "strip", z.ZodTypeAny, {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        }, {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        }>>;
     }, "strip", z.ZodTypeAny, {
         direction: "loosen" | "tighten";
         minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+        boolPole?: {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        } | undefined;
     }, {
         direction: "loosen" | "tighten";
         minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+        boolPole?: {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        } | undefined;
     }>>>;
 }, "strip", z.ZodTypeAny, {
     enforcement: "gate" | "server" | "resolver" | "client";
@@ -231,6 +283,10 @@ export declare const MergeCategorySpec: z.ZodObject<{
     members?: Record<string, {
         direction: "loosen" | "tighten";
         minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+        boolPole?: {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        } | undefined;
     }> | undefined;
     coreAxis?: "permissionDecision" | "toolEffect" | "egress" | "irreversibility" | "safetyAxis" | "severity" | "shellGate" | undefined;
 }, {
@@ -255,6 +311,10 @@ export declare const MergeCategorySpec: z.ZodObject<{
     members?: Record<string, {
         direction: "loosen" | "tighten";
         minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+        boolPole?: {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        } | undefined;
     }> | undefined;
     coreAxis?: "permissionDecision" | "toolEffect" | "egress" | "irreversibility" | "safetyAxis" | "severity" | "shellGate" | undefined;
 }>;
@@ -341,6 +401,88 @@ export declare const SAFETY_MERGE_SPEC: {
         readonly fail: "closed";
         readonly seam: "ExecutionEnv (fs+net) + sensitive-path";
         readonly coreAxis: "egress";
+        readonly members: {
+            readonly enabled: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: true;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly allowUnsandboxedCommands: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly autoAllowBashIfSandboxed: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly enableWeakerNestedSandbox: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly enableWeakerNetworkIsolation: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly "network.allowManagedDomainsOnly": {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: true;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly "network.allowAllUnixSockets": {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly "network.allowLocalBinding": {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly "filesystem.allowManagedReadPathsOnly": {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: true;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly "filesystem.denyWrite": {
+                readonly direction: "tighten";
+                readonly minTrust: "local";
+            };
+            readonly "filesystem.denyRead": {
+                readonly direction: "tighten";
+                readonly minTrust: "local";
+            };
+        };
     };
     readonly hooks: {
         readonly mergeShape: "runAll";
@@ -462,12 +604,16 @@ export declare function membersOf<C extends SafetyMergeCategory>(category: C): r
  * Fail-CLOSED and loud on both misuse arms — a category without `members` has no member to name, and a member
  * outside the declared set is a caller bug, not "use the category floor" (that silent arm is exactly what would
  * let a typo admit a bucket under the wrong rule).
+ * Value-aware (codex r3): pass the CANDIDATE VALUE being written for a value-directional (`boolPole`) member —
+ * the strict pole resolves to `boolPole.minTrust`, everything else (loose pole / non-boolean / no value) to the
+ * row floor. Rows without `boolPole` ignore the value entirely.
  * @param categoryLabel only decorates the error message (the spec value carries no name of its own).
  */
-export declare function resolveMemberAdmission(spec: MergeCategorySpec, member: string, categoryLabel?: string): ResolvedMemberAdmission;
+export declare function resolveMemberAdmission(spec: MergeCategorySpec, member: string, categoryLabel?: string, value?: unknown): ResolvedMemberAdmission;
 /** A member's resolved admission (direction + floor, category fallback applied) from the published table.
- *  Unknown category or member ⇒ RangeError (never a fallback). */
-export declare function memberAdmission<C extends SafetyMergeCategory>(category: C, member: SafetyMergeMember<C>): ResolvedMemberAdmission;
+ *  Unknown category or member ⇒ RangeError (never a fallback). Value-aware: pass the candidate value for a
+ *  `boolPole` member (see {@link resolveMemberAdmission}); omitting it answers the fail-closed row floor. */
+export declare function memberAdmission<C extends SafetyMergeCategory>(category: C, member: SafetyMergeMember<C>, value?: unknown): ResolvedMemberAdmission;
 /** A member's admission FLOOR from the published table — the word a resolver compares the layer's trust against
  *  (`isAtLeast(layer, floor)` ⇒ admitted; the ladder is {@link trustRank}). Convenience over {@link memberAdmission}. */
-export declare function memberMinTrust<C extends SafetyMergeCategory>(category: C, member: SafetyMergeMember<C>): MinTrust;
+export declare function memberMinTrust<C extends SafetyMergeCategory>(category: C, member: SafetyMergeMember<C>, value?: unknown): MinTrust;

package/dist/safety-merge-spec.js

@@ -14,7 +14,7 @@
  * admitted or rejected as one value under its `minTrust`. A resolver reads this table and has NO per-key
  * special-casing.
  *
- * MEMBER-LEVEL ADMISSION (1.1.0 — the WRITTEN layer of the permission-rule dual-channel ruling, board [5797] ④;
+ * MEMBER-LEVEL ADMISSION (1.1.0 — the WRITTEN layer of the permission-rule dual-channel ruling, [ref] ④;
  * the executing layer is core's `prepareCcImport` door + `RuleAddOrigin`, the resolver/shell halves are cli's):
  *   A category may declare `members`, each with its own admission floor and DIRECTION. Today only `permissions`
  *   does — `allow` / `deny` / `ask`, a CLOSED set ({@link SafetyMergeMember}; an unknown member is a compile error
@@ -39,7 +39,7 @@
  *   requiresRealApproval). Consumers read admission through {@link memberAdmission} / {@link memberMinTrust} /
  *   {@link membersOf} — never through a hardcoded allow/deny/ask table of their own (single source).
  *
- * TRUST ORDERING PRIMITIVES (1.2.0 — board [5796] ordering question → [5805] claim / [5807] consumer statement):
+ * TRUST ORDERING PRIMITIVES (1.2.0 — [ref] ordering question → claim / consumer statement):
  *   The floor words are only meaningful against a LADDER, and that ladder is v2-design §1:29, verbatim:
  *   `MANAGED 6 > GLOBAL 5 > PROJECT 4 > LOCAL 3 > SESSION 2 > TASK 1`. {@link trustRank} publishes exactly those
  *   numbers and {@link isAtLeast} the comparison a resolver makes (`rank(layer) ≥ rank(floor)` ⇒ admitted), so no
@@ -95,10 +95,21 @@ export function isAtLeast(layer, minTrust) {
  *  contract. */
 export const MemberDirection = z.enum(["loosen", "tighten"]);
 /** One member's admission row. `minTrust` ABSENT ⇒ the category's `minTrust` applies: a row can refine the floor
- *  only by SAYING so; omission never lowers it (fail-closed by construction). */
+ *  only by SAYING so; omission never lowers it (fail-closed by construction).
+ *
+ *  `boolPole` (S-59 件八, codex r3 [high]) — VALUE-DIRECTIONAL admission for a boolean member whose two poles
+ *  point opposite ways (`enabled:true` narrows the sandbox, `enabled:false` opens it): a write EQUAL to
+ *  `boolPole.strict` (strict equality, never truthiness — a string "true" is not the pole) is the tightening
+ *  write and is admitted at `boolPole.minTrust`; ANY other write — the loose pole, a non-boolean, or a
+ *  valueless query — is admitted at the ROW floor. 🔴 Vintage-safety law: a boolPole row's OWN `minTrust`
+ *  must be the LOOSEN floor (the category's), so a consumer that predates this field (its schema strips
+ *  `boolPole`) reads the row as tighten@<loosen-floor> and withholds BOTH poles from low-trust layers —
+ *  fail-closed (it loses only the convenience of low-trust tightening, it can never admit a loosening write).
+ *  Resolution is value-aware: pass the candidate value to {@link memberAdmission} / {@link memberMinTrust}. */
 export const MemberAdmission = z.object({
     direction: MemberDirection,
     minTrust: MinTrust.optional(),
+    boolPole: z.object({ strict: z.boolean(), minTrust: MinTrust }).optional(),
 });
 /** WHERE the category is enforced (STRENGTH) — MUST stay in lockstep with `EffectiveKey.enforcement` (types.ts).
  *  gate=data-plane engine, server=control-plane/TOB boundary, resolver=merger correctness, client=UI only. */
@@ -157,7 +168,56 @@ export const SAFETY_MERGE_SPEC = {
     handsReadOnly: { mergeShape: "replace", minTrust: "global", tighten: { rule: "boolStricter", strict: true }, enforcement: "gate", fail: "closed", seam: "handsReadOnly" },
     shellGate: { mergeShape: "replace", minTrust: "global", tighten: { rule: "enumRank", order: ["off", "classify", "always"] }, enforcement: "gate", fail: "closed", seam: "shellGate", coreAxis: "shellGate" },
     approver: { mergeShape: "replace", minTrust: "global", tighten: { rule: "none" }, enforcement: "gate", fail: "closed", seam: "onAsk (conflict → reject)" },
-    sandboxNetwork: { mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "setNarrower" }, enforcement: "gate", fail: "closed", seam: "ExecutionEnv (fs+net) + sensitive-path", coreAxis: "egress" },
+    // S-59 件八 — member-level admission for the sandbox category (the shell's temporary "which sub-key counts
+    // as tightening" table lifts upstream; its gate keeps only the VALUE-pole half as executing detail).
+    // The members below are the CLOSED SET a low-trust settings layer may still set — restricting needs no trust,
+    // so each is tighten@"local" (the lowest settings-FILE tier, same law as permissions.deny/ask). Direction
+    // evidence, per member, from the shell's sandbox schema `.describe()` texts (its `SandboxSettingsSchema`):
+    //   · enabled                    the sandbox being ON confines commands ⇒ setting `true` tightens (false = loosen pole);
+    //   · allowUnsandboxedCommands   `false` = the unsandboxed escape hatch is refused ⇒ tighten (true = loosen pole);
+    //   · autoAllowBashIfSandboxed   `false` = no auto-allow just for being sandboxed ⇒ tighten;
+    //   · enableWeakerNestedSandbox  `false` = the weaker nested sandbox stays off ⇒ tighten;
+    //   · enableWeakerNetworkIsolation `false` = the "Reduces security" switch stays off ⇒ tighten;
+    //   · network.allowManagedDomainsOnly `true` = only managed-layer domains honoured ⇒ tighten (its CONSUMER
+    //     additionally reads policy settings only — that is the shell schema's own semantics, not admission law);
+    //   · network.allowAllUnixSockets / network.allowLocalBinding `false` = the opening stays shut ⇒ tighten;
+    //   · filesystem.allowManagedReadPathsOnly `true` ⇒ tighten (same managed-only consumer caveat);
+    //   · filesystem.denyWrite / filesystem.denyRead — deny arrays only ever narrow ⇒ tighten in every write.
+    // A boolean member's admission is VALUE-directional and the pole is MODELED (codex r3 [high]): each boolean
+    // row carries `boolPole {strict, minTrust:"local"}` and keeps its ROW floor at the loosen floor "global" —
+    // value-aware consumers admit the strict pole at "local"; pole-blind consumers (whose schema strips boolPole)
+    // read tighten@global and withhold BOTH poles from low-trust layers (fail-closed: convenience lost, never a
+    // loosening write admitted). The two deny arrays narrow in every write, so they are plain tighten@"local".
+    // DELIBERATELY NOT members (⇒ the 1.1.0 header law: an undeclared member stays under the category minTrust
+    // "global" — exactly the consumer's fail-closed withhold arm, so FUTURE sub-keys are withheld by default):
+    //   · the loosen face — network.allowedDomains / network.allowUnixSockets / filesystem.allowWrite /
+    //     filesystem.allowRead (re-allow within denyRead = a loosener) / excludedCommands (named commands escape
+    //     the sandbox) / ignoreViolations / ripgrep (binary override) — widening is a privilege;
+    //   · failIfUnavailable — tightening on the security axis but its consequence is REFUSING TO START: admitted
+    //     low, a cloned repo writing {enabled:true, failIfUnavailable:true} turns a "tighten" key into a
+    //     denial-of-service primitive on any sandbox-less machine. An availability hard-gate is an operator's
+    //     decision ⇒ it rides the loosen floor. ("Tightening is always safe" holds INSIDE this boundary — the
+    //     boundary is written down rather than the sentence deleted.)
+    //   · INDETERMINATE (flagged for the shell to confirm, fail-closed meanwhile): network.httpProxyPort /
+    //     network.socksProxyPort (strictly routing, but they can steer sandboxed traffic to an arbitrary local
+    //     port) and enabledPlatforms (platform-set edits cut both ways) — unlisted ⇒ category floor.
+    sandboxNetwork: {
+        mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "setNarrower" }, enforcement: "gate", fail: "closed",
+        seam: "ExecutionEnv (fs+net) + sensitive-path", coreAxis: "egress",
+        members: {
+            enabled: { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+            allowUnsandboxedCommands: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            autoAllowBashIfSandboxed: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            enableWeakerNestedSandbox: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            enableWeakerNetworkIsolation: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            "network.allowManagedDomainsOnly": { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+            "network.allowAllUnixSockets": { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            "network.allowLocalBinding": { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            "filesystem.allowManagedReadPathsOnly": { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+            "filesystem.denyWrite": { direction: "tighten", minTrust: "local" },
+            "filesystem.denyRead": { direction: "tighten", minTrust: "local" },
+        },
+    },
     hooks: { mergeShape: "runAll", minTrust: "project", tighten: { rule: "none" }, enforcement: "gate", fail: "closed", seam: "hooks (single source or adapter-composed)" },
     mcpServers: { mergeShape: "overrideByName", minTrust: "project", tighten: { rule: "none" }, enforcement: "resolver", fail: "open", seam: "spec.mcp + allowTools" },
     rulesInstructions: { mergeShape: "concat", minTrust: "project", tighten: { rule: "none" }, enforcement: "resolver", fail: "open", seam: "appendSystemPrompt / memory (GLOBAL→PROJECT→SESSION)" },
@@ -191,9 +251,12 @@ export function membersOf(category) {
  * Fail-CLOSED and loud on both misuse arms — a category without `members` has no member to name, and a member
  * outside the declared set is a caller bug, not "use the category floor" (that silent arm is exactly what would
  * let a typo admit a bucket under the wrong rule).
+ * Value-aware (codex r3): pass the CANDIDATE VALUE being written for a value-directional (`boolPole`) member —
+ * the strict pole resolves to `boolPole.minTrust`, everything else (loose pole / non-boolean / no value) to the
+ * row floor. Rows without `boolPole` ignore the value entirely.
  * @param categoryLabel only decorates the error message (the spec value carries no name of its own).
  */
-export function resolveMemberAdmission(spec, member, categoryLabel = "(unnamed category)") {
+export function resolveMemberAdmission(spec, member, categoryLabel = "(unnamed category)", value) {
     if (spec.members === undefined) {
         throw new RangeError(`SAFETY_MERGE_SPEC: category '${categoryLabel}' has no member-level admission — its minTrust applies to the whole key`);
     }
@@ -201,15 +264,21 @@ export function resolveMemberAdmission(spec, member, categoryLabel = "(unnamed c
         throw new RangeError(`SAFETY_MERGE_SPEC: unknown member '${member}' of category '${categoryLabel}' (members: ${Object.keys(spec.members).join(", ")})`);
     }
     const row = spec.members[member];
-    return { direction: row.direction, minTrust: row.minTrust ?? spec.minTrust };
+    const rowFloor = row.minTrust ?? spec.minTrust;
+    if (row.boolPole !== undefined) {
+        const floor = value === row.boolPole.strict ? row.boolPole.minTrust : rowFloor;
+        return { direction: row.direction, minTrust: floor, boolPole: row.boolPole };
+    }
+    return { direction: row.direction, minTrust: rowFloor };
 }
 /** A member's resolved admission (direction + floor, category fallback applied) from the published table.
- *  Unknown category or member ⇒ RangeError (never a fallback). */
-export function memberAdmission(category, member) {
-    return resolveMemberAdmission(categorySpec(category), member, category);
+ *  Unknown category or member ⇒ RangeError (never a fallback). Value-aware: pass the candidate value for a
+ *  `boolPole` member (see {@link resolveMemberAdmission}); omitting it answers the fail-closed row floor. */
+export function memberAdmission(category, member, value) {
+    return resolveMemberAdmission(categorySpec(category), member, category, value);
 }
 /** A member's admission FLOOR from the published table — the word a resolver compares the layer's trust against
  *  (`isAtLeast(layer, floor)` ⇒ admitted; the ladder is {@link trustRank}). Convenience over {@link memberAdmission}. */
-export function memberMinTrust(category, member) {
-    return memberAdmission(category, member).minTrust;
+export function memberMinTrust(category, member, value) {
+    return memberAdmission(category, member, value).minTrust;
 }

package/dist/scheduler-store-node.d.ts

@@ -30,7 +30,7 @@ export type SchedulerStoreMutation = {
     reason: 'aborted';
 };
 /**
- * The ONE cross-process mutation primitive for the shared scheduler store (board [1001]①/[1003]② —
+ * The ONE cross-process mutation primitive for the shared scheduler store ([ref]①/② —
  * server L1-2 + shell 对抗评审 F1 双向合流后的契约层统一原语). Every WRITER (engine backend, resident
  * daemon fire/reap, session reap, sweeps) must go through this instead of hand-rolled
  * load→filter→save — the naked sequence is a lost-update race: two writers load the same base

package/dist/scheduler-store-node.js

@@ -47,7 +47,7 @@ export function fileSchedulerStore(path) {
     };
 }
 /**
- * The ONE cross-process mutation primitive for the shared scheduler store (board [1001]①/[1003]② —
+ * The ONE cross-process mutation primitive for the shared scheduler store ([ref]①/② —
  * server L1-2 + shell 对抗评审 F1 双向合流后的契约层统一原语). Every WRITER (engine backend, resident
  * daemon fire/reap, session reap, sweeps) must go through this instead of hand-rolled
  * load→filter→save — the naked sequence is a lost-update race: two writers load the same base

package/dist/scheduler-store.js

@@ -44,7 +44,7 @@ export function isSchedulerRecord(v) {
  * record must leave a trace reachable by whoever can act on it).
  */
 /**
- * core 5.5.0 durable 键分叉的迁移半场(board [2439]/[2440]/[2444];server 裁 (a) 一次性迁移,拒读侧
+ * core 5.5.0 durable 键分叉的迁移半场([ref];server 裁 (a) 一次性迁移,拒读侧
  * 双键容忍窗)。旧铸键链 `sessionId ?? principal ?? taskId ?? "default"` 让 durable 行的隔离键随会话
  * 走——新会话新 sessionId ⇒ 旧 durable job 永远 not_found。core 5.5.0 起 durable 铸键=
  * `principal ?? "default"`;存量旧键行由**本层**在 parse 时重铸(纯函数,幂等:重写后判据自不满足)。