@sensigo/realm 0.41.0 → 0.43.0

package/dist/workflow/step-key-registry.js

@@ -0,0 +1,1217 @@
+/** Strips block and line comments, then collapses every whitespace run to a single space. Run on
+ *  BOTH the real source and the registry's own pattern before matching, so a pattern can be
+ *  written as a readable one-line slice of code that may itself span or sit beside comments in
+ *  the file. The single-char lookback on `//` keeps a `https://…` literal from being truncated as
+ *  if it opened a line comment.
+ *
+ *  Deliberately a manual, single left-to-right scan rather than the equivalent lazy-regex pair
+ *  (`/\/\*[\s\S]*?\*\//g` + a lookback-guarded `//` strip) that a first draft of this file
+ *  shipped: CodeQL flagged that pair as a genuine polynomial-time DoS — a run of unterminated
+ *  `/*` occurrences (no closing `*\/` anywhere after them) forces a full failed scan-to-end for
+ *  EACH occurrence, which is quadratic in the number of occurrences. The scan below still does at
+ *  most one `indexOf` per comment opener, but a failed `indexOf` (no closer anywhere in the rest
+ *  of the string) ends the whole pass immediately — linear, not quadratic, in the worst case. */
+export function normalizeSource(text) {
+    let out = '';
+    const n = text.length;
+    let i = 0;
+    // Once a single `indexOf('*/', k)` call returns -1, no `/*` found at any LATER position can
+    // ever close either — its search range is a strict suffix of the one that already failed. This
+    // flag turns that monotonicity into a hard cap of ONE failed full-length scan for the entire
+    // call, however many unclosed `/*` occurrences follow — without it, a string built from many
+    // `/*` openers and no closer anywhere would cost one failed O(remaining-length) scan PER
+    // opener, which is exactly the quadratic shape CodeQL flagged in the lazy-regex draft this
+    // replaced.
+    let noMoreBlockClosersAhead = false;
+    while (i < n) {
+        const ch = text[i];
+        const nextCh = i + 1 < n ? text[i + 1] : '';
+        if (!noMoreBlockClosersAhead && ch === '/' && nextCh === '*') {
+            const close = text.indexOf('*/', i + 2);
+            if (close === -1) {
+                // No closer anywhere ahead — the original regex would fail to match here too, leaving
+                // this `/*` as literal text. Emit it as-is and continue scanning normally; the flag
+                // above stops this branch from ever paying for another full scan.
+                noMoreBlockClosersAhead = true;
+                out += ch;
+                i += 1;
+            }
+            else {
+                out += ' ';
+                i = close + 2;
+            }
+            continue;
+        }
+        if (ch === '/' && nextCh === '/') {
+            const prevCh = i === 0 ? '' : text[i - 1];
+            if (prevCh === ':' || prevCh === '"' || prevCh === "'") {
+                out += ch;
+                i += 1;
+                continue;
+            }
+            const newlineAt = text.indexOf('\n', i);
+            i = newlineAt === -1 ? n : newlineAt; // the newline itself, if any, is left for the next pass
+            continue;
+        }
+        out += ch;
+        i += 1;
+    }
+    return out.replace(/\s+/g, ' ');
+}
+/** Exact non-overlapping occurrence count of `pattern` inside `source`, both normalized first. */
+export function countWitnessMatches(source, pattern) {
+    const hay = normalizeSource(source);
+    const needle = normalizeSource(pattern).trim();
+    if (needle.length === 0)
+        return 0;
+    let count = 0;
+    let i = hay.indexOf(needle);
+    while (i !== -1) {
+        count += 1;
+        i = hay.indexOf(needle, i + needle.length);
+    }
+    return count;
+}
+// File-path shorthands, repo-root-relative — the convention purge-guard.test.ts already
+// established for a cross-package source-text read: each conformance runner resolves these from
+// its own package location, never from cwd.
+const EL = 'packages/core/src/engine/execution-loop.ts';
+const ELIG = 'packages/core/src/engine/eligibility.ts';
+const SETTLE = 'packages/core/src/engine/settlement.ts';
+const CL = 'packages/core/src/engine/claim-liveness.ts';
+const YL = 'packages/core/src/workflow/yaml-loader.ts';
+const RA = 'packages/cli/src/agent/run-agent.ts';
+const RECLAIM = 'packages/cli/src/commands/reclaim.ts';
+const GEN = 'packages/mcp-server/src/protocol/generator.ts';
+// #517 (the drive-flip): every minted prohibition's `by[]` carries this ONE witness — the mint
+// walk's own error-construction shape in yaml-loader.ts, exact-count 1. The per-key hand-written
+// firing conditions these cells used to cite, and the two kind-prohibition loops, are DELETED by
+// the flip; the mint is now the single enforcement mechanism, so this one shared witness is the
+// truthful successor (a corruption of the walk reds every minted cell's witness check at once —
+// by design). Except-bearing and `blocked_transitive` cells keep their own live, hand-written
+// witnesses below.
+export const MINT_WITNESS_PATTERN = "errors.push( withKeyLine( stepName, key, `Step '${stepName}': ${renderRegistryProhibition(key, kind, cell)}`,";
+const MINT = { file: YL, pattern: MINT_WITNESS_PATTERN };
+// ——— message_data: the invariant tails of the shipped bespoke messages (see header) ———
+const MSG_ON_OUTCOME = "'on_outcome' is only valid on execution: finalizer steps — it selects which finalizers run " +
+    'for a given outcome, and only finalizers are selected that way, so here it would decide ' +
+    'nothing. Move it to the finalizer that should react to the outcome, or remove it.';
+const MSG_ABORT_UNLESS = "'abort_unless' is only valid on execution: guard steps — it is the condition list a guard " +
+    'evaluates before letting the run continue, and only guard steps are evaluated that way, so ' +
+    'here it would gate nothing. Put the check on a guard step, or remove it.';
+const MSG_ABORT_MESSAGE = "'abort_message' is only valid on execution: guard steps — it is the text reported when a " +
+    'guard aborts the run, and nothing but a guard reads it, so here it would never be read. ' +
+    'Move it to the guard that performs the abort, or remove it.';
+const MSG_AGENT_PROFILE = "'agent_profile' is only valid on execution: agent steps — its content is resolved into the " +
+    'model prompt, and only an agent step makes a model request, so here it would reach no ' +
+    'model. Move it to the agent step whose prompt it should shape, or remove it.';
+const MSG_LLM_TIMEOUT = "'llm_timeout_seconds' is only valid on execution: agent steps — it bounds one model " +
+    'request, and no other kind makes one, so here it would bound nothing. Move it to the agent ' +
+    "step whose request it should bound, or remove it. An auto step's dispatch is bounded by " +
+    "'timeout_seconds', and a finalizer's handler by its own 'timeout_seconds'.";
+const MSG_IDEMPOTENT = "'idempotent' is only valid on execution: auto steps — it gates 'retry.on_timeout' and " +
+    'reclaim eligibility, and both act on auto dispatch, so here it would gate nothing. Remove ' +
+    'it, or move the work to an auto step if you need either.';
+const MSG_TIMEOUT_ON_AGENT = "'timeout_seconds' is not valid on execution: agent steps — the engine never enforces it " +
+    'there (agent dispatch is never wrapped in a timeout), so the step would LOOK time-bounded ' +
+    "while nothing enforced the bound. In realm's own drive the model request is bounded by " +
+    "'llm_timeout_seconds' (or --llm-timeout) and tool calls by 'tool_timeout'.";
+const MSG_PRECONDITIONS_GUARD = "'preconditions' is not valid on execution: guard steps — the engine never evaluates it " +
+    "there (a guard's execution evaluates only 'abort_unless'), so the run would LOOK guarded " +
+    "while the declared check never ran. Move the condition into 'abort_unless'. Whether guards " +
+    'gain a live condition surface is an open design question (issue #366) — if admitted later, ' +
+    'existing workflows are unaffected.';
+const MSG_TOOL_TIMEOUT = "'tool_timeout' requires 'tools' (a declared, non-empty list) — without tool calls there is " +
+    'nothing for it to bound, so the step would carry a bound with nothing to bind. In ' +
+    "realm's own drive each tool call is capped at tool_timeout seconds (default 30); declare " +
+    'at least one tool or remove the key.';
+// ——— surviving hand-written by-witnesses (#517): only the except-bearing trust×finalizer
+// value-conditional check and the blocked_transitive tool_timeout companion check keep live
+// per-key firing conditions in the loader; every other prohibition is minted (MINT, above) ———
+const BY_TOOL_TIMEOUT = {
+    file: YL,
+    pattern: "if (step['tool_timeout'] !== undefined && toolsMissing) {",
+};
+const BY_TRUST_FINALIZER = {
+    file: YL,
+    pattern: "if (step['trust'] !== undefined && step['trust'] !== 'auto') {",
+};
+// ——— recurring consumed witnesses (shared across more than one cell, and — new in #517 — also
+// referenced as a CONSUMED_HOME.site: the message's factual citation IS the tested witness) ———
+const W_WHEN_ELIG = {
+    file: ELIG,
+    pattern: 'if (!evaluateWhen(step.when, evidenceByStep, run.params)) continue;',
+    count: 2, // DAG eligibility's own check + the guard-selection walk share the same evaluator call
+};
+const W_DEPENDS_ON = {
+    file: ELIG,
+    pattern: 'const deps = step.depends_on ?? [];',
+    count: 3, // trigger-rule satisfaction, the skip-propagation pass, and the skip-cascade walk
+};
+const W_TRIGGER_RULE = {
+    file: ELIG,
+    pattern: "const rule: TriggerRule = step.trigger_rule ?? 'all_success';",
+    count: 2, // trigger-rule satisfaction and skip-propagation resolve it the same way
+};
+// Deliberately the Step-2a READ shape, never the checkPreconditions CALL text: the #369
+// call-site walker (yaml-loader.test.ts) counts every non-test line carrying that call text —
+// comments included, since it is line-based — so spelling the call itself here would register as
+// a second call site and red that unrelated walker (witness-collision class, header above). This
+// read shape is the same consumption evidence without the collision.
+const W_PRECONDITIONS = {
+    file: EL,
+    pattern: 'if (stepDef?.preconditions !== undefined && stepDef.preconditions.length > 0) {',
+};
+const W_GATE_MINT_TRUST = {
+    file: EL,
+    // single-sourced via isGateTrust (was two hand-copied literals, the drift the
+    // TRUST_LEVELS/GATE_TRUST_LEVELS vocabulary exists to close).
+    pattern: 'if (isGateTrust(stepDef!.trust)) {',
+};
+// The engine's fail-closed backstop: a step whose trust value is neither absent nor a
+// recognized member is refused at dispatch, pre-claim — this is what closes the un-gate hole
+// W_GATE_MINT_TRUST alone left open (an unrecognized value used to fall through the mint
+// untouched and run un-gated; now it never reaches the mint at all).
+const W_TRUST_VALUE_REFUSAL = {
+    file: EL,
+    pattern: "classifyStepTrust(stepDef?.execution, stepDef?.trust) === 'refuse'",
+};
+const W_GATE_CHOICES = {
+    file: EL,
+    pattern: "stepDef!.gate?.choices ?? stepDef!.input_schema?.properties?.['choice']?.enum;",
+};
+const W_INPUT_SCHEMA_2B = {
+    file: EL,
+    pattern: 'validateInputSchema(effectiveInput, stepDef.input_schema, options.command);',
+};
+const W_DESCRIPTION_GEN = { file: GEN, pattern: 'description: step.description,' };
+const W_TOOLS_PATH = {
+    file: RA,
+    pattern: 'if (stepDef.tools && stepDef.tools.length > 0 && mcpClient) {',
+};
+const W_PROMPT_NEXTACTION = {
+    file: EL,
+    pattern: 'step.prompt !== undefined ? renderTemplate(step.prompt, context) : undefined;',
+};
+const W_ADAPTER_DISPATCH = {
+    file: EL,
+    pattern: "if (stepDef?.execution === 'auto' && stepDef.uses_service !== undefined) {",
+};
+const W_SERVICE_METHOD_READ = {
+    file: EL,
+    pattern: "const method = stepDef.service_method ?? 'fetch';",
+};
+const W_OPERATION_READ = {
+    file: EL,
+    pattern: 'const operation = stepDef.operation ?? options.command;',
+};
+const W_INPUT_MAP_RESOLVE = {
+    file: EL,
+    pattern: 'const adapterParams = resolveInputMap(stepDef.input_map, options, pendingRun);',
+};
+const W_HANDLER_AUTO_DISPATCH = {
+    file: EL,
+    pattern: "} else if (stepDef?.execution === 'auto' && stepDef.handler !== undefined) {",
+};
+const W_OUTPUT_SCHEMA_READ = {
+    file: EL,
+    pattern: "stepDef?.execution === 'agent' && stepDef.output_schema !== undefined",
+};
+const W_TRACE_SCHEMA_READ = {
+    file: EL,
+    pattern: 'if (stepDef.trace_schema !== undefined) {',
+};
+const W_TRACE_MODE_READ = {
+    file: EL,
+    pattern: "const mode = stepDef.trace_validation_mode ?? 'warn';",
+};
+const W_RETRY_READ = { file: EL, pattern: 'const retryConfig = stepDef?.retry;' };
+const W_VALIDATION_EXHAUSTION_READ = {
+    file: EL,
+    pattern: 'stepDef.validation_exhaustion?.threshold ?? DEFAULT_VALIDATION_EXHAUSTION_THRESHOLD;',
+};
+const W_STRUCTURED_OUTPUT_READ = {
+    file: EL,
+    pattern: '...(stepDef?.structured_output !== undefined',
+    count: 3, // the attempt disclosure is minted at all three seal shapes (census lane 2)
+};
+const W_TIMEOUT_ENFORCE = {
+    file: EL,
+    pattern: 'const enforceTimeout = stepDef !== undefined && shouldEnforceTimeout(stepDef);',
+};
+/** #517 rung 2: file-shorthand → the operator phrase a consequence clause names it by. TOTAL over
+ *  every file this registry cites as a witness (conformance-checked below — a missing entry is a
+ *  red cell, not a silent fallback). Operator words, never file basenames (D7-5). */
+export const SURFACE_NAME = {
+    [EL]: "the engine's execution loop",
+    [ELIG]: 'step eligibility',
+    [SETTLE]: 'finalizer selection',
+    [CL]: 'claim liveness',
+    [YL]: 'the workflow loader',
+    [RA]: "realm's own drive",
+    [RECLAIM]: 'the reclaim command',
+    [GEN]: 'the protocol briefing',
+};
+/** The minted text for one refused kind: the per-kind arm when one exists for it, else the
+ *  shared default. */
+export function homeText(text, kind) {
+    if (typeof text === 'string')
+        return text;
+    return text[kind] ?? text.default;
+}
+/** Every DISTINCT string a `PerKindText` can mint, across all kinds — what the truth cells
+ *  assert over (strictly stronger than asserting only the `default` arm). */
+export function homeTextVariants(text) {
+    if (typeof text === 'string')
+        return [text];
+    return [...new Set(Object.values(text))];
+}
+export const CONSUMED_HOME = {
+    depends_on: {
+        kinds: ['auto', 'agent', 'guard'],
+        mechanism: 'step eligibility reads it to gate when a DAG step becomes runnable, and a finalizer is ' +
+            "selected by 'on_outcome' at settlement, never through the DAG, so here it would order " +
+            'nothing.',
+        site: W_DEPENDS_ON,
+        // #417 wording defect: 'Sequence' overclaimed depends_on's own job — depends_on only ORDERS
+        // (a precondition on WHEN a step becomes eligible); 'on_outcome' is what actually SELECTS
+        // which finalizers run for a given outcome. 'Trigger' names the device that does the job.
+        remedy: "Trigger the finalizer with 'on_outcome' instead, or remove it.",
+    },
+    trigger_rule: {
+        kinds: ['auto', 'agent'],
+        // #417 wording defect (falsity): a guard's OWN cell is gated by trigger_rule identically to
+        // a DAG step — the loader forbids the DECLARATION, not the mechanism; "would gate nothing"
+        // and "only auto/agent steps are gated that way" were both false for the guard population.
+        mechanism: {
+            default: 'step eligibility reads it to decide how dependency outcomes gate a DAG step, and a ' +
+                "finalizer is selected by 'on_outcome' at settlement, never through the DAG, so here " +
+                'it would gate nothing.',
+            guard: 'step eligibility reads it on a guard exactly as on a DAG step, so it would silently ' +
+                'change when the guard runs and when it is skipped; a guard is deliberately gated by ' +
+                'the plain success of its dependencies.',
+        },
+        site: W_TRIGGER_RULE,
+        remedy: {
+            default: "Trigger the finalizer with 'on_outcome' instead, or remove it.",
+            // issue #366 tracks widening guards to a configurable trigger rule — the in-tree
+            // precedent for a re-admission clause on a per-kind remedy arm.
+            guard: 'Move it to the auto or agent step it should gate, or remove it — a guard itself ' +
+                "always gates on 'all_success' (issue #366 tracks widening guards).",
+        },
+    },
+    when: {
+        kinds: ['auto', 'agent', 'guard'],
+        mechanism: 'step eligibility evaluates it before a step may run, and a finalizer is selected by the ' +
+            "run's outcome at settlement, never by eligibility, so here it would route nothing.",
+        site: W_WHEN_ELIG,
+        // issue #360 tracks a mint-time 'when' evaluation for finalizers (routing a cleanup step on
+        // which dependency failed) — the re-admission clause the four-clause policy asks for where a
+        // genuine widening is on the board. Today's honest remedy: the failure context 'when' would
+        // have carried is already reachable inside the handler.
+        remedy: "Route the finalizer with 'on_outcome' instead, or remove it. 'on_outcome' matches run " +
+            'outcomes only — a condition (run params, step evidence) branches inside the handler, ' +
+            "whose context carries run_params and resources['$settlement'].<step>.failed (issue " +
+            "#360 tracks widening finalizers with a mint-time 'when').",
+    },
+    uses_service: {
+        kinds: ['auto'],
+        mechanism: "the engine's execution loop routes a step's work through the named service adapter only " +
+            'on the auto dispatch path, so here it would dispatch nothing.',
+        site: W_ADAPTER_DISPATCH,
+        remedy: {
+            default: 'Move it to an auto step, or remove it.',
+            // #417 wording defect (overclaim): "move it to an auto step" implies EVERY auto step
+            // reaches the adapter path; a finalizer's own home for the same service call is its
+            // handler, not a DAG relocation.
+            finalizer: "Do the service call inside the finalizer's 'handler' instead (a finalizer runs " +
+                'handler-only), or remove it.',
+        },
+    },
+    service_method: {
+        kinds: ['auto'],
+        // #417 wording defect (falsity): named the SIBLING key's axis — service_method picks the
+        // adapter METHOD, not the operation (that's `operation`, below) — and the "auto dispatch
+        // path" overclaimed scope: only a step that dispatches through 'uses_service' reads it.
+        mechanism: "the engine's execution loop reads it to pick the adapter method on the uses_service " +
+            'adapter dispatch path, so here it would pick nothing.',
+        site: W_SERVICE_METHOD_READ,
+        remedy: "Move it to an auto step that dispatches through 'uses_service', or remove it.",
+    },
+    operation: {
+        kinds: ['auto'],
+        // #417 wording defect (overclaim): "the auto dispatch path" implied every auto step reads
+        // it; only the 'uses_service' adapter arm does.
+        mechanism: "the engine's execution loop reads it as the adapter operation name on the uses_service " +
+            'adapter dispatch path, so here it would name nothing.',
+        site: W_OPERATION_READ,
+        remedy: "Move it to an auto step that dispatches through 'uses_service', or remove it.",
+    },
+    input_map: {
+        kinds: ['auto'],
+        mechanism: {
+            // #417 wording defect (overclaim + underclaim): "on the auto path" implied every auto
+            // step resolves it; only the two dispatch arms (uses_service, handler) do.
+            default: "the engine's execution loop resolves it into dispatch parameters when an auto step " +
+                "dispatches through 'uses_service' or a handler, so here it would map nothing.",
+            // #417 wording defect (falsity, probe-executed): a finalizer's drain shares the SAME
+            // handler-dispatch code path that resolves input_map on auto — "would map nothing" is
+            // false; it would map something the finalizer's contract never wanted. Refused outright,
+            // not left to a true-but-misleading inertness claim.
+            finalizer: "the engine's execution loop resolves it into dispatch parameters at handler dispatch " +
+                '— the finalizer drain shares that dispatch — so it is refused here outright rather ' +
+                "than trusted to be inert: a finalizer's handler takes no mapped input, and run data " +
+                'reaches it through its context instead.',
+        },
+        site: W_INPUT_MAP_RESOLVE,
+        remedy: {
+            default: "Move it to an auto step that dispatches through 'uses_service' or a handler, or " +
+                'remove it.',
+            finalizer: "Move it to an auto step that dispatches through 'uses_service' or a handler, or " +
+                "remove it — a finalizer's handler already receives run params and step evidence " +
+                "through its context, and static values through 'config'.",
+        },
+    },
+    handler: {
+        kinds: ['auto', 'agent', 'finalizer'],
+        // #417 wording defect (falsity, agent conjunct): the agent path never DISPATCHES through
+        // `handler` — the NextAction only ADVERTISES it as the tool name for the model to call; the
+        // auto conjunct also overclaimed (an auto step declaring BOTH uses_service and handler
+        // dispatches through the adapter arm first — the handler arm is shadowed, tracked #511).
+        mechanism: "the engine's execution loop dispatches work through it on auto steps that do not also " +
+            "declare 'uses_service' and on finalizer steps, on an agent step the NextAction only " +
+            "names it as the tool for the agent to call, and a guard's execution evaluates only " +
+            "'abort_unless', so here it would run nothing.",
+        site: W_HANDLER_AUTO_DISPATCH,
+        // single string, NOT per-kind: handler's only GENERIC-prohibited mint is ×guard (auto/agent/
+        // finalizer are all `consumed`), so one remedy suffices — no per-kind fork is needed here.
+        remedy: "Move it to an auto step without 'uses_service' or to a finalizer step, or remove it.",
+    },
+    input_schema: {
+        kinds: ['auto', 'agent'],
+        mechanism: "the engine's execution loop validates a step's effective input against it at execution " +
+            "time, and a guard's execution evaluates only 'abort_unless', so here it would validate " +
+            'nothing.',
+        site: W_INPUT_SCHEMA_2B,
+        remedy: 'Move it to an auto or agent step whose input it should check, or remove it.',
+    },
+    output_schema: {
+        kinds: ['agent'],
+        mechanism: "the engine's execution loop validates an agent step's submitted output against it, and " +
+            'only agent steps submit output that way, so here it would validate nothing.',
+        site: W_OUTPUT_SCHEMA_READ,
+        remedy: 'Move it to an agent step whose output it should check, or remove it.',
+    },
+    trace_schema: {
+        kinds: ['agent'],
+        // #417 wording defect (minor): "appended trace" presupposed a trace already exists to
+        // append to — the schema validates the step's whole canonical trace, appended or not.
+        mechanism: "the engine's execution loop validates an agent step's canonical trace against it, and " +
+            'only agent steps carry a validated trace, so here it would validate nothing.',
+        site: W_TRACE_SCHEMA_READ,
+        remedy: 'Move it to an agent step whose trace it should check, or remove it.',
+    },
+    trace_validation_mode: {
+        kinds: ['agent'],
+        mechanism: "the engine's execution loop reads it to choose warn-or-enforce for 'trace_schema' " +
+            'validation, which only agent steps carry, so here it would choose nothing.',
+        site: W_TRACE_MODE_READ,
+        remedy: 'Move it to an agent step whose trace validation it should set, or remove it.',
+    },
+    trust: {
+        kinds: ['auto', 'agent'],
+        // #417 wording defect (falsity): the human gate does NOT open "before the step runs" — it
+        // opens on the step's PRODUCED output, after the work (and any side effects) already ran.
+        mechanism: "the engine's execution loop reads it to mint a human gate on the step's produced output " +
+            'before it settles, and a guard is never gated that way, so here it would gate nothing.',
+        site: W_GATE_MINT_TRUST,
+        // #417 wording defect (overclaim): "the auto or agent step that needs the gate" implied
+        // every trust value opens one — only the two human-gate literals do; any other declared
+        // value is refused outright at load or dispatch, never silently left un-gated (see the
+        // registry's own trust×auto/trust×agent cells for the refusal witness).
+        //
+        // #508 correction (item 6): D2 §8's fix here was never actually shipped — only the comment
+        // above changed, the string did not — and "move it to the auto or agent step" is advice
+        // that DOES NOT WORK for the dominant measured wrong value, the service-trust literal
+        // (`engine_delivered`): auto/agent refuse it too (L1, yaml-loader.ts), so relocating it
+        // fixes nothing. Lead with what IS accepted, so a reader with that value learns immediately
+        // that moving it will not help.
+        remedy: "'trust' accepts 'auto', 'human_confirmed', or 'human_reviewed' — only the latter two " +
+            'open a gate, and only on an auto or agent step. If you meant to gate an auto/agent ' +
+            'step, move it there; if the value is something else (a typo, or a service-level ' +
+            "'trust:' declared on the wrong step), remove it instead — an auto/agent step refuses " +
+            'anything outside that set too.',
+    },
+    timeout_seconds: {
+        kinds: ['auto', 'finalizer'],
+        mechanism: "the engine's execution loop enforces it as the time-bound on auto dispatch and on a " +
+            "finalizer's drain, and a guard's evaluation is never time-bounded, so here it would " +
+            'bound nothing.',
+        site: W_TIMEOUT_ENFORCE,
+        remedy: 'Move it to an auto or finalizer step it should bound, or remove it.',
+    },
+    retry: {
+        kinds: ['auto'],
+        // #417 wording defect (overclaim, board #26): "only auto attempts are retried that way"
+        // implied auto is the retry mechanism's OWN exclusivity boundary — but an embedder-supplied
+        // dispatcher on another kind could retry through the identical loop; the true boundary is
+        // structural: a finalizer never REACHES the dispatch loop at all (it runs on the seal-time
+        // drain, which never reads this key), so re-grounded on that mechanism instead.
+        mechanism: "the engine's execution loop reads it to re-attempt failed dispatch, and a finalizer " +
+            'never reaches that dispatch loop — it runs on the seal-time drain, which never reads ' +
+            'this key — so here it would retry nothing.',
+        site: W_RETRY_READ,
+        remedy: 'Move it to an auto step whose attempts it should govern, or remove it.',
+    },
+    validation_exhaustion: {
+        kinds: ['agent'],
+        // #417 wording defect (overclaim): "schema rejections" without qualification undercounted
+        // the counted class — both input- and output-schema rejections count against the threshold.
+        mechanism: "the engine's execution loop counts an agent step's input- and output-schema rejections " +
+            'against its threshold, and only agent submissions are counted that way, so here it ' +
+            'would count nothing.',
+        site: W_VALIDATION_EXHAUSTION_READ,
+        remedy: 'Move it to an agent step whose rejections it should bound, or remove it.',
+    },
+    tools: {
+        kinds: ['agent'],
+        mechanism: "in realm's own drive it is the tool list offered to the model on an agent step, and " +
+            'only agent steps make model requests, so here it would offer nothing.',
+        site: W_TOOLS_PATH,
+        remedy: 'Move it to an agent step that should call the tools, or remove it.',
+    },
+    structured_output: {
+        kinds: ['agent'],
+        // #417 wording defect (board #32, verb weakened per D8-6): the OLD text presented the
+        // engine's EVIDENCE RECORDING as the key's consumption home and let 'constrain' pivot on
+        // that recording as if it did the constraining. The engine never enforces the strict shape
+        // on the wire — it only records the mode it asked for. 'asks the model for schema-
+        // constrained output' names the real mechanism; recording stays a separate, accurate clause.
+        mechanism: "in realm's own drive it asks the model for schema-constrained output, and the engine's " +
+            'execution loop records that strict-output mode on the attempt evidence — only agent ' +
+            'steps make model requests, so here it would constrain nothing.',
+        site: W_STRUCTURED_OUTPUT_READ,
+        remedy: 'Move it to an agent step whose output it should constrain, or remove it.',
+    },
+};
+/** #517: the TRUE prohibited set per kind — every key whose cell on `mode` is `prohibited`
+ *  WITHOUT an `except` arm (the except cell, today exactly trust×finalizer, keeps its
+ *  value-conditional hand-written check and is deliberately absent). The loader's exported
+ *  `GUARD_PROHIBITED_STEP_KEYS` / `FINALIZER_PROHIBITED_STEP_KEYS` are computed from this — one
+ *  source, no membership drift possible. */
+export function prohibitedKeysFor(mode) {
+    return Object.keys(STEP_KEY_REGISTRY).filter((key) => {
+        const cell = STEP_KEY_REGISTRY[key][mode];
+        return cell.c === 'prohibited' && cell.except === undefined;
+    });
+}
+/** #517: the kinds a key is actually CONSUMED on — the derived valid-kind set behind an
+ *  'only_valid' front clause (and truth cell 1's comparator for consumed_home.kinds). */
+export function consumedKindsFor(key) {
+    const modes = ['auto', 'agent', 'guard', 'finalizer'];
+    return modes.filter((mode) => STEP_KEY_REGISTRY[key][mode].c === 'consumed');
+}
+/**
+ * Real program defects on a key×kind surface that cannot be expressed as a cell arm — the key
+ * itself IS consumed (or the arm is otherwise fully accounted for); the defect lives in an
+ * adjacent mechanism. Recorded here so the #417 program's fate-line contract covers them from
+ * the registry itself, not just from the PR body. Via-hygiene-checked exactly like a tracked
+ * citation inside a cell.
+ */
+export const TRACKED_RESIDUALS = [
+    {
+        issue: '#515',
+        desc: 'handler×finalizer: capability preflight excludes finalizer handlers entirely — an ' +
+            'unregistered finalizer handler is caught only at drain time, as a pending-forever ' +
+            'liveness gap. The key itself is consumed and required; the gap is in when the ' +
+            'requirement gets checked.',
+    },
+    {
+        issue: '#519',
+        desc: 'the whole-registry loader-bypass class: a WorkflowDefinition that reaches the engine ' +
+            'without going through this loader (a store-injected definition) satisfies none of these ' +
+            'prohibitions at all — a registry-driven runtime mirror at the engine boundary is its ' +
+            'own, separate design arc.',
+    },
+];
+export const STEP_KEY_REGISTRY = {
+    description: {
+        auto: {
+            c: 'consumed',
+            where: [
+                { file: EL, pattern: "human_readable: `Execute step '${stepName}': ${step.description}`," },
+            ],
+        },
+        agent: {
+            c: 'consumed',
+            where: [{ file: RA, pattern: 'const prompt = nextAction?.prompt ?? stepDef.description;' }],
+        },
+        guard: {
+            c: 'consumed',
+            where: [W_DESCRIPTION_GEN],
+            when: {
+                desc: 'disclosure-only: required on every kind, surfaced in the protocol briefing, but no engine-execution path ever reads it for a guard',
+                witness: W_DESCRIPTION_GEN,
+            },
+        },
+        finalizer: {
+            c: 'consumed',
+            where: [W_DESCRIPTION_GEN],
+            when: {
+                desc: 'disclosure-only, same as ×guard',
+                witness: W_DESCRIPTION_GEN,
+            },
+        },
+    },
+    execution: {
+        auto: {
+            c: 'consumed',
+            where: [W_ADAPTER_DISPATCH],
+        },
+        agent: {
+            c: 'consumed',
+            where: [{ file: EL, pattern: "definition.steps[name]?.execution === 'agent' ||" }],
+        },
+        guard: {
+            c: 'consumed',
+            where: [{ file: ELIG, pattern: "if (step.execution !== 'guard') continue;" }],
+        },
+        finalizer: {
+            c: 'consumed',
+            where: [{ file: SETTLE, pattern: "if (step.execution !== 'finalizer') continue;" }],
+        },
+    },
+    depends_on: {
+        auto: { c: 'consumed', where: [W_DEPENDS_ON] },
+        agent: { c: 'consumed', where: [W_DEPENDS_ON] },
+        guard: { c: 'consumed', where: [W_DEPENDS_ON] },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+    },
+    trigger_rule: {
+        auto: { c: 'consumed', where: [W_TRIGGER_RULE] },
+        agent: { c: 'consumed', where: [W_TRIGGER_RULE] },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+    },
+    when: {
+        auto: { c: 'consumed', where: [W_WHEN_ELIG] },
+        agent: { c: 'consumed', where: [W_WHEN_ELIG] },
+        guard: {
+            c: 'consumed',
+            where: [W_WHEN_ELIG],
+            when: {
+                desc: "guard selection evaluates when before executeGuardStep ever runs — 'guards evaluate only abort_unless' is true of execution, false of eligibility (census lane-1 contradiction 2)",
+                witness: {
+                    file: ELIG,
+                    pattern: 'const evidenceByStep = buildEvidenceByStep(run); if (!evaluateWhen(step.when, evidenceByStep, run.params)) continue;',
+                },
+            },
+        },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+    },
+    abort_unless: {
+        auto: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_ABORT_UNLESS },
+        agent: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_ABORT_UNLESS },
+        guard: {
+            c: 'consumed',
+            where: [
+                {
+                    file: EL,
+                    pattern: 'const conditions = Array.isArray(stepDef.abort_unless) ? stepDef.abort_unless : [stepDef.abort_unless!];',
+                },
+            ],
+        },
+        finalizer: {
+            c: 'prohibited',
+            by: [MINT],
+            line: 'key',
+            message_data: MSG_ABORT_UNLESS,
+        },
+    },
+    abort_message: {
+        auto: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_ABORT_MESSAGE },
+        agent: {
+            c: 'prohibited',
+            by: [MINT],
+            line: 'key',
+            message_data: MSG_ABORT_MESSAGE,
+        },
+        guard: {
+            c: 'consumed',
+            where: [
+                {
+                    file: EL,
+                    pattern: '...(stepDef.abort_message !== undefined ? { abort_message: stepDef.abort_message } : {}),',
+                    count: 2, // both guard-abort output branches carry the disclosure (census lane-1 correction)
+                },
+                {
+                    file: EL,
+                    pattern: "error: stepDef.abort_message ?? `Guard step '${stepName}' aborted the run.`,",
+                },
+            ],
+        },
+        finalizer: {
+            c: 'prohibited',
+            by: [MINT],
+            line: 'key',
+            message_data: MSG_ABORT_MESSAGE,
+        },
+    },
+    on_outcome: {
+        auto: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_ON_OUTCOME },
+        agent: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_ON_OUTCOME },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_ON_OUTCOME },
+        finalizer: {
+            c: 'consumed',
+            where: [{ file: SETTLE, pattern: 'const raw = stepDef.on_outcome;' }],
+        },
+    },
+    idempotent: {
+        auto: {
+            c: 'consumed',
+            where: [
+                { file: EL, pattern: 'stepDef!.idempotent === true &&' },
+                { file: RECLAIM, pattern: 'if (stepDef?.idempotent !== true) return false;' },
+            ],
+            inert_subpop: [
+                {
+                    desc: 'on the auto step of a finalizer-bearing workflow: the reclaim half is inert (a claim with no deadline is never selected by reclaim --all); the retry.on_timeout gate half stays live',
+                    via: { kind: 'advisory', code: 'IDEMPOTENT_INERT_IN_FINALIZER' },
+                },
+            ],
+        },
+        agent: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_IDEMPOTENT },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_IDEMPOTENT },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_IDEMPOTENT },
+    },
+    uses_service: {
+        auto: {
+            c: 'consumed',
+            where: [W_ADAPTER_DISPATCH],
+        },
+        agent: { c: 'inert', via: { kind: 'tracked', issue: '#511' } },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+    },
+    service_method: {
+        auto: {
+            c: 'consumed',
+            where: [W_SERVICE_METHOD_READ],
+            when: {
+                desc: 'dispatch-arm-keyed: read only on the uses_service adapter dispatch path',
+                witness: W_ADAPTER_DISPATCH,
+            },
+            inert_subpop: [
+                {
+                    desc: 'declared without uses_service: the adapter dispatch path never runs, so this is never read',
+                    via: {
+                        kind: 'waived',
+                        reason: 'a dispatch-arm companion field, meaningful only beside uses_service — the dead-config policing call for the whole dispatch family is #511 territory and undecided',
+                    },
+                },
+            ],
+        },
+        agent: { c: 'inert', via: { kind: 'tracked', issue: '#511' } },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+    },
+    operation: {
+        auto: {
+            c: 'consumed',
+            where: [W_OPERATION_READ],
+            when: {
+                desc: 'dispatch-arm-keyed: read only on the uses_service adapter dispatch path',
+                witness: W_ADAPTER_DISPATCH,
+            },
+            inert_subpop: [
+                {
+                    desc: 'declared without uses_service: never read',
+                    via: {
+                        kind: 'waived',
+                        reason: 'dispatch-arm companion, same family as service_method — #511 territory and undecided',
+                    },
+                },
+            ],
+        },
+        agent: { c: 'inert', via: { kind: 'tracked', issue: '#511' } },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+    },
+    input_map: {
+        auto: {
+            c: 'consumed',
+            where: [W_INPUT_MAP_RESOLVE],
+            when: {
+                desc: 'dispatch-arm-keyed: resolved on the adapter path, and delivered to handlers via the resolved params',
+                witness: W_ADAPTER_DISPATCH,
+            },
+            inert_subpop: [
+                {
+                    desc: 'declared with neither uses_service nor handler: a bare auto step dispatches nothing, so nothing consumes it',
+                    via: {
+                        kind: 'waived',
+                        reason: 'dispatch-arm companion, same family call as service_method/operation',
+                    },
+                },
+            ],
+        },
+        agent: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+    },
+    handler: {
+        auto: {
+            c: 'consumed',
+            where: [W_HANDLER_AUTO_DISPATCH],
+            inert_subpop: [
+                {
+                    desc: 'shadowed when uses_service is also declared: dispatch precedence tries the adapter arm first, and no both-declared check exists to flag it',
+                    via: { kind: 'tracked', issue: '#511' },
+                },
+            ],
+        },
+        agent: {
+            c: 'consumed',
+            where: [
+                {
+                    file: EL,
+                    pattern: 'step.handler !== undefined ? { tool: step.handler, params: {}, call_with: {} }',
+                },
+            ],
+            when: {
+                desc: 'handler-bearing agent step: the NextAction names the handler as the tool to call, and this arm OUTRANKS the plain execute_step instruction — semantics are under #516, but the read itself is real (D4-2)',
+                witness: {
+                    file: EL,
+                    pattern: 'step.handler !== undefined ? { tool: step.handler, params: {}, call_with: {} }',
+                },
+            },
+        },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+        finalizer: {
+            c: 'consumed',
+            where: [{ file: EL, pattern: 'const handlerName = stepDef?.handler;' }],
+            when: {
+                desc: 'REQUIRED (handler-only in v1) — drained via callHandler, never through executeStep',
+                witness: { file: EL, pattern: 'const handlerName = stepDef?.handler;' },
+            },
+        },
+    },
+    config: {
+        auto: {
+            c: 'consumed',
+            where: [{ file: EL, pattern: '...(stepDef.config ?? {}),' }],
+            inert_subpop: [
+                {
+                    desc: 'declared with neither uses_service nor handler: never delivered to anything',
+                    via: {
+                        kind: 'waived',
+                        reason: 'dispatch-arm companion, same family call as service_method/operation/input_map',
+                    },
+                },
+            ],
+        },
+        agent: { c: 'inert', via: { kind: 'tracked', issue: '#511' } },
+        guard: { c: 'inert', via: { kind: 'tracked', issue: '#511' } },
+        finalizer: {
+            c: 'consumed',
+            where: [{ file: EL, pattern: 'config: stepDef.config ?? {},' }],
+            when: {
+                desc: 'delivered to the finalizer handler via callHandler context — genuinely consumed on this kind, deliberately NOT part of the #511 dispatch-family tracking (census lane 2)',
+                witness: { file: EL, pattern: 'config: stepDef.config ?? {},' },
+            },
+        },
+    },
+    input_schema: {
+        auto: {
+            c: 'consumed',
+            where: [W_INPUT_SCHEMA_2B],
+            when: {
+                desc: 'Step 2b validates the effective input against it with no kind conjunct at all; also the gate-choice fallback source on gate-trusted steps',
+                witness: W_INPUT_SCHEMA_2B,
+            },
+        },
+        agent: { c: 'consumed', where: [W_INPUT_SCHEMA_2B] },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+        finalizer: { c: 'inert', via: { kind: 'tracked', issue: '#512' } },
+    },
+    output_schema: {
+        auto: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+        agent: {
+            c: 'consumed',
+            where: [W_OUTPUT_SCHEMA_READ],
+        },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+    },
+    trace_schema: {
+        auto: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+        agent: {
+            c: 'consumed',
+            where: [W_TRACE_SCHEMA_READ],
+        },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+    },
+    trace_validation_mode: {
+        auto: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+        agent: {
+            c: 'consumed',
+            where: [W_TRACE_MODE_READ],
+            inert_subpop: [
+                {
+                    desc: 'declared without trace_schema: the only read sits inside the trace_schema branch and is never reached — silently ignored, with no dead-config advisory today despite two in-file precedents for that shape',
+                    via: { kind: 'tracked', issue: '#514' },
+                },
+            ],
+        },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+    },
+    preconditions: {
+        auto: { c: 'consumed', where: [W_PRECONDITIONS] },
+        agent: { c: 'consumed', where: [W_PRECONDITIONS] },
+        guard: {
+            c: 'prohibited',
+            by: [MINT],
+            line: 'key',
+            message_data: MSG_PRECONDITIONS_GUARD,
+        },
+        finalizer: { c: 'inert', via: { kind: 'tracked', issue: '#509' } },
+    },
+    trust: {
+        auto: {
+            c: 'consumed',
+            where: [W_GATE_MINT_TRUST, W_TRUST_VALUE_REFUSAL],
+        },
+        agent: {
+            c: 'consumed',
+            where: [W_GATE_MINT_TRUST, W_TRUST_VALUE_REFUSAL],
+        },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+        finalizer: {
+            c: 'prohibited',
+            by: [BY_TRUST_FINALIZER],
+            line: 'step',
+            except: {
+                desc: "the literal 'auto' is accepted and unread on a finalizer — redundant, harmless (D4-1)",
+                via: {
+                    kind: 'waived',
+                    reason: "'auto' is the only lawful trust literal on a finalizer, so refusing it would refuse a truthful no-op declaration",
+                },
+            },
+        },
+    },
+    timeout_seconds: {
+        auto: {
+            c: 'consumed',
+            where: [
+                W_TIMEOUT_ENFORCE,
+                {
+                    file: CL,
+                    pattern: 'const perAttemptSec = step.timeout_seconds ?? DEFAULT_EXECUTION_TIMEOUT_SECONDS;',
+                },
+            ],
+            when: {
+                desc: "shouldEnforceTimeout is the auto-only predicate — the reason #402's prohibition on agent steps is a hard 'not valid', while the same key stays consumed on finalizers (drain + lease, below)",
+                witness: { file: CL, pattern: "return step.execution === 'auto';" },
+            },
+        },
+        agent: {
+            c: 'prohibited',
+            by: [MINT],
+            line: 'key',
+            message_data: MSG_TIMEOUT_ON_AGENT,
+        },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+        finalizer: {
+            c: 'consumed',
+            where: [
+                {
+                    file: EL,
+                    pattern: 'const timeoutMs = (step.timeout_seconds ?? DRAIN_CEILING_SECONDS) * 1000;',
+                },
+                {
+                    file: EL,
+                    pattern: 'const leaseSeconds = stepDef.timeout_seconds ?? DRAIN_CEILING_SECONDS;',
+                },
+            ],
+        },
+    },
+    retry: {
+        auto: {
+            c: 'consumed',
+            where: [W_RETRY_READ],
+        },
+        agent: { c: 'inert', via: { kind: 'advisory', code: 'RETRY_INERT_NON_AUTO' } },
+        guard: { c: 'inert', via: { kind: 'advisory', code: 'RETRY_INERT_NON_AUTO' } },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+    },
+    validation_exhaustion: {
+        auto: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+        agent: {
+            c: 'consumed',
+            where: [W_VALIDATION_EXHAUSTION_READ],
+        },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+    },
+    instructions: {
+        auto: {
+            c: 'consumed',
+            where: [
+                {
+                    file: EL,
+                    pattern: 'stepDef!.instructions !== undefined ? renderTemplate(stepDef!.instructions, {',
+                },
+            ],
+            when: {
+                desc: 'gate-path: rendered into the gate envelope for gated autos; the same value is also protocol-surfaced for every step regardless of kind',
+                witness: W_GATE_MINT_TRUST,
+            },
+        },
+        agent: {
+            c: 'consumed',
+            where: [{ file: GEN, pattern: 'protocolStep.instructions = step.instructions;' }],
+            when: {
+                desc: "disclosure-only in realm's own drive — run-agent builds the model task from prompt ?? description and never feeds instructions to the model at all (a cross-drive asymmetry vs. an external MCP agent, which does see it; census lane-1 contradiction 4)",
+                witness: { file: GEN, pattern: 'protocolStep.instructions = step.instructions;' },
+            },
+        },
+        guard: { c: 'inert', via: { kind: 'tracked', issue: '#513' } },
+        finalizer: { c: 'inert', via: { kind: 'tracked', issue: '#513' } },
+    },
+    prompt: {
+        auto: {
+            c: 'consumed',
+            where: [W_PROMPT_NEXTACTION],
+            when: {
+                desc: 'handler-bearing or gated autos only — a gateless, handler-less auto never reads it',
+                witness: W_PROMPT_NEXTACTION,
+            },
+            inert_subpop: [
+                {
+                    desc: 'gateless, handler-less auto: never read anywhere',
+                    via: {
+                        kind: 'waived',
+                        reason: 'this sub-population is exactly the complement of the two documented read paths — surface-conditional by design',
+                    },
+                },
+            ],
+        },
+        agent: { c: 'consumed', where: [W_PROMPT_NEXTACTION] },
+        guard: { c: 'inert', via: { kind: 'tracked', issue: '#513' } },
+        finalizer: { c: 'inert', via: { kind: 'tracked', issue: '#513' } },
+    },
+    display: {
+        auto: {
+            c: 'consumed',
+            where: [
+                {
+                    file: RA,
+                    pattern: '(gateStepDef?.display !== undefined ? renderDisplay(gateStepDef.display, gate.preview)',
+                },
+            ],
+            when: {
+                desc: "gate-trusted only — rendered on the gate surface; the run-completion result render is agent-only (see this PR's JSDoc truth fix on StepDefinition.display)",
+                witness: {
+                    file: RA,
+                    pattern: '(gateStepDef?.display !== undefined ? renderDisplay(gateStepDef.display, gate.preview)',
+                },
+            },
+            inert_subpop: [
+                {
+                    desc: 'gateless auto: never read by anything',
+                    via: {
+                        kind: 'waived',
+                        reason: 'documented-inert after the JSDoc truth fix — the type doc no longer promises run-completion rendering for a non-agent step (D4-3)',
+                    },
+                },
+            ],
+        },
+        agent: {
+            c: 'consumed',
+            where: [
+                {
+                    file: RA,
+                    pattern: 'stepDef?.display !== undefined ? renderDisplay(stepDef.display, lastAgentEvidence.output_summary)',
+                },
+            ],
+        },
+        guard: { c: 'inert', via: { kind: 'tracked', issue: '#513' } },
+        finalizer: { c: 'inert', via: { kind: 'tracked', issue: '#513' } },
+    },
+    use_template: {
+        auto: {
+            c: 'na',
+            reason: 'resolved away before any step validation runs: the template resolver REPLACES the entry entirely, so it is never present in a WorkflowDefinition returned to any caller (census lane 1)',
+        },
+        agent: { c: 'na', reason: 'resolved away pre-validation (see ×auto)' },
+        guard: { c: 'na', reason: 'resolved away pre-validation (see ×auto)' },
+        finalizer: { c: 'na', reason: 'resolved away pre-validation (see ×auto)' },
+    },
+    gate: {
+        auto: {
+            c: 'consumed',
+            where: [W_GATE_CHOICES],
+            when: {
+                desc: 'gate-trusted only: the mint reads the gate config exactly once — every later enactment read sees only the already-FROZEN PendingGate',
+                witness: W_GATE_MINT_TRUST,
+            },
+            inert_subpop: [
+                {
+                    desc: 'without gate trust: fully validated at load time (#291/#433) and never minted',
+                    // issue #524: was `waived` quoting the loader's own header comment — not a witness,
+                    // and nothing pinned the text (mutating it left the registry suite 205/205 green). The
+                    // loader now emits ONE advisory naming the true cause on this exact population.
+                    via: { kind: 'advisory', code: 'DEAD_GATE_CONFIG' },
+                },
+            ],
+        },
+        agent: {
+            c: 'consumed',
+            where: [W_GATE_CHOICES],
+            when: {
+                desc: 'gate-trusted only, the same mint site',
+                witness: W_GATE_MINT_TRUST,
+            },
+            inert_subpop: [
+                {
+                    desc: 'without gate trust: validated, never minted',
+                    via: { kind: 'advisory', code: 'DEAD_GATE_CONFIG' }, // issue #524, see ×auto
+                },
+            ],
+        },
+        // issue #524: was `tracked #512` (a gate×guard/finalizer PROHIBITION is #512's own proposal,
+        // still open) — until #512 ships, the loader's #524 block advisory covers this population
+        // too (guard/finalizer never reach the gate mint at all, Step 5b `execution-loop.ts`), so it
+        // is `advisory`, not merely `tracked`, today. This pair is #512's red-first once it lands.
+        guard: { c: 'inert', via: { kind: 'advisory', code: 'DEAD_GATE_CONFIG' } },
+        finalizer: { c: 'inert', via: { kind: 'advisory', code: 'DEAD_GATE_CONFIG' } },
+    },
+    agent_profile: {
+        auto: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_AGENT_PROFILE },
+        agent: {
+            c: 'consumed',
+            where: [
+                { file: EL, pattern: 'const profile = stepDef?.agent_profile;' },
+                {
+                    file: RA,
+                    pattern: 'stepDef.agent_profile !== undefined ? definition.resolved_profiles?.[stepDef.agent_profile]?.content : undefined;',
+                },
+            ],
+        },
+        guard: {
+            c: 'prohibited',
+            by: [MINT],
+            line: 'key',
+            message_data: MSG_AGENT_PROFILE,
+        },
+        finalizer: {
+            c: 'prohibited',
+            by: [MINT],
+            line: 'key',
+            message_data: MSG_AGENT_PROFILE,
+        },
+    },
+    tools: {
+        auto: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+        agent: {
+            c: 'consumed',
+            where: [W_TOOLS_PATH],
+            inert_subpop: [
+                {
+                    desc: 'tools: [] is treated as toolless — it loads with zero tools diagnostics, is runtime-toolless, and in turn inerts the tool-budget keys below',
+                    via: { kind: 'tracked', issue: '#510' },
+                },
+            ],
+        },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'not_valid' },
+    },
+    max_tool_calls: {
+        auto: { c: 'inert', via: { kind: 'tracked', issue: '#510' } },
+        agent: {
+            c: 'consumed',
+            where: [{ file: RA, pattern: 'maxToolCalls: stepDef.max_tool_calls ?? 20,' }],
+            when: { desc: 'tools-path only', witness: W_TOOLS_PATH },
+            inert_subpop: [
+                {
+                    desc: 'tools-less agent step: consumption sits behind the tools-path gate — a bound with nothing to bind',
+                    via: { kind: 'tracked', issue: '#510' },
+                },
+            ],
+        },
+        guard: { c: 'inert', via: { kind: 'tracked', issue: '#510' } },
+        finalizer: { c: 'inert', via: { kind: 'tracked', issue: '#510' } },
+    },
+    max_fan_out: {
+        auto: { c: 'inert', via: { kind: 'tracked', issue: '#510' } },
+        agent: {
+            c: 'consumed',
+            where: [{ file: RA, pattern: 'const maxFanOut = stepDef.max_fan_out;' }],
+            when: { desc: 'tools-path only', witness: W_TOOLS_PATH },
+            inert_subpop: [
+                {
+                    desc: 'tools-less agent step: never read',
+                    via: { kind: 'tracked', issue: '#510' },
+                },
+            ],
+        },
+        guard: { c: 'inert', via: { kind: 'tracked', issue: '#510' } },
+        finalizer: { c: 'inert', via: { kind: 'tracked', issue: '#510' } },
+    },
+    tool_timeout: {
+        auto: {
+            c: 'blocked_transitive',
+            via: 'tools',
+            by: [BY_TOOL_TIMEOUT],
+            message_data: MSG_TOOL_TIMEOUT,
+        },
+        agent: {
+            c: 'consumed',
+            where: [{ file: RA, pattern: 'toolTimeoutMs: (stepDef.tool_timeout ?? 30) * 1000,' }],
+            when: { desc: 'non-empty tools declared', witness: W_TOOLS_PATH },
+        },
+        guard: {
+            c: 'blocked_transitive',
+            via: 'tools',
+            by: [BY_TOOL_TIMEOUT],
+            message_data: MSG_TOOL_TIMEOUT,
+        },
+        finalizer: {
+            c: 'blocked_transitive',
+            via: 'tools',
+            by: [BY_TOOL_TIMEOUT],
+            message_data: MSG_TOOL_TIMEOUT,
+        },
+    },
+    structured_output: {
+        auto: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+        agent: {
+            c: 'consumed',
+            where: [W_STRUCTURED_OUTPUT_READ],
+        },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+        finalizer: { c: 'prohibited', by: [MINT], line: 'key', front: 'only_valid' },
+    },
+    llm_timeout_seconds: {
+        auto: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_LLM_TIMEOUT },
+        agent: {
+            c: 'consumed',
+            where: [
+                {
+                    file: RA,
+                    pattern: '(stepDef.llm_timeout_seconds ?? fallbackLlmTimeoutSeconds) * 1000,',
+                },
+            ],
+        },
+        guard: { c: 'prohibited', by: [MINT], line: 'key', message_data: MSG_LLM_TIMEOUT },
+        finalizer: {
+            c: 'prohibited',
+            by: [MINT],
+            line: 'key',
+            message_data: MSG_LLM_TIMEOUT,
+        },
+    },
+};
+//# sourceMappingURL=step-key-registry.js.map