agentfootprint 9.114.2 → 9.115.1

package/CAPABILITIES.md

@@ -66,6 +66,8 @@ not in this table, search `src/index.ts` for the nearest noun before writing cod
 | minting one of those shapes from a tool that is NOT JavaScript — the canonical note sentences and reserved marker keys as DATA, so a Python/Go/Rust sidecar reads a file instead of regex-scraping `dist/esm` (which a consumer really did) | `canonical-notes.json` at the package root + the `./canonical-notes.json` exports entry, GENERATED from the built barrel by `scripts/gen-canonical-notes.mjs` | `scripts/gen-canonical-notes.mjs` | 9.70.0 |
 | proving a session store really honours the port | `runSessionLifecycleConformance` + `declared` skips (by case name WITH the reason; a declared case still RUNS) + outcomes `'passed'`/`'not-applicable'`/`'declared'`/`'failed'` | `src/hosting/conformance/` | 9.37.0 |
 | deciding who owns a contested session write | `resolveSessionOwner` | `src/hosting/sessionOwnership.ts` | 9.37.0 |
+| a host filing its OWN per-turn artifacts (a story, the person's clicks) where `artifact-get` will look for the same caller — never composing a scope itself; awaited inside the turn, bounded (`turnArtifactsTimeoutMs`, default `TURN_ARTIFACTS_TIMEOUT_MS`), revoked after it (`TurnArtifactsExpiredError`), failures on the stream (`artifacts.hand_over_failed`) | `HostReply.turnArtifacts` + `TurnArtifacts` | `src/hosting/turnArtifacts.ts` | 9.115.0 |
+| refusing a forged cross-site request, DNS rebinding or an oversized session id at the hosting door — before any handler, in every identity mode; the same rule for an app's own routes beside the door | `doorGuard` + `checkSessionId` + `MAX_SESSION_ID_LENGTH` + `CrossSiteOptions` (`allowedOrigins` / `allowedHosts` / `requireJsonContentType` on `httpHost`, `nodeHost` and the hosted-runtime adapters, which default the browser rules OFF on a non-loopback bind; a loopback bind defaults `allowedHosts` to the loopback names) + `AgentHost.onRefusal` (feeds the ingress record) | `src/hosting/doorGuard.ts` | 9.115.0 |
 | making a caller-supplied id safe for a backend | `encodeIdentityField` | `src/memory/identity/encode.ts` | 9.37.0 |
 | scoping a skill's tools so they reach the model only while it is active | `toolsFromActiveSkill` + a no-arg posture (default off) + the stamp `autoActivate: 'currentSkill'` (a default, never an override) | `src/core/agent/toolsFromActiveSkill.ts` | 9.36.0 |
 | subscribing to every event in one domain at once | `DomainWildcard` | `src/events/dispatcher.ts` | 9.4.0 |
@@ -75,6 +77,7 @@ not in this table, search `src/index.ts` for the nearest noun before writing cod
 | a MAP of the domain the model can reason over when a result holds nothing — what each term IS (meaning, unit), how terms RELATE, which SOURCE holds a term (with the author's coverage sentence) and which registered TOOL reads it from there; declared once, validated against the tool registry at build, on the record as one run constant, served as one request-only system piece per call, never a fetch path and never inferred from | `defineOntology` + `.ontology(map)` (`AgentOptions.ontology`) + `AgentState.ontology` + `ontologyPiece` / `ONTOLOGY_INSTRUCTION` (`agentfootprint/ontology`) + `agentfootprint.ontology.served` | `src/ontology/` | 9.106.0 |
 | a value the model USED — in its answer, or as an argument of a later call — that came ONLY from results it had itself declared open, noise or ruled-out (a theorem tower on a set-aside lemma): declared standings joined to the evidence corpus's carriers, no inference, no judge; one row per value per moment through the one writer; served back under `contingent (read off the record):`; cache reads summed on the record beside the input tokens | `ContingentRow` / `ContingentCarrier` + `agentfootprint.findings.contingent` + `findingsInstructionFor` (`FINDINGS_CONTINGENT_LINE`, registered under BOTH `.findings()` and `.namesAndNumbersFromEvidence()`, never one) + `EvidenceCorpus.carriers` / `EvidenceVerdict.grounded` + `AgentState.totalCacheReadTokens` | `src/core/agent/findings/contingent.ts` | 9.110.0 |
 | a model's ruling-out that rests only on "nothing found" — a `ruled-out` standing on a result the dispatch door recorded as an absence (`absent()`, bare or bounded by `coverage()`: status `'absent'`, a `coverageDeclared` row; never a second reading of a return) AND the model was served as one (a result an after-tool rule denied, a ceiling's refusal, a placed ticket or a summary files nothing) — marked by a row BESIDE the model's own, never a rewrite of it, carrying what the SERVED envelope said it did not check and its `try_instead` byte for byte; served back under `unsettled by absence (read off the record):`; no event, no instruction line | `UnsettledByAbsenceRow` + `agent.findings()` / the checkpoint's `findingsLedger` (the fold's `unsettled` map and the rule — `withUnsettledRows` / `unsettledRowOf` — are internal) | `src/core/agent/findings/unsettled.ts` | 9.113.0 |
+| an evaluation platform grading your agent from its OpenTelemetry traces — scores as the GenAI `gen_ai.evaluation.result` event, the conversation (as a digest), declared absence and coverage, the evidence verdict, findings standings and actionable checker accounting as content-free span events, and tool arguments/results only under their own opt-in, after your middleware rules | `otelObservability` options `captureToolContent` / `maxContentChars` / `conversationId` / `checkAccounting` (+ `agentCoreEvaluationSpans`, which turns tool content on) | `src/adapters/observability/otel.ts` | 9.115.0 |
 
 **Maintaining this table:** a new public capability adds a row, in the same
 change that adds the capability. `test/docs/capability-index.test.ts` fails if a