@sema-agent/core/dist/core/runner/memory-capture-optout.js

Stateless, task-oriented AI agent core

export function adjudicateCaptureOptOut(input) {
    const { posture, entitlement, subject } = input;
    const what = subject === "standing-record" ? "continuing a session whose one-way capture opt-out record stands" : "the session memory-capture opt-out declaration";
    if (posture === "capture-required") {
        return {
            allowed: false,
            code: "memory.capture_optout_denied",
            detail: `${what} is refused: this deployment declares memoryCapturePolicy "capture-required" (forced retention, resolver-independent). ` +
                (subject === "standing-record"
                    ? `The standing record keeps its zero-capture promise — the session is refused rather than run out of policy; start a new session without the opt-out.`
                    : `Remove the memory.capture declaration and resubmit.`),
        };
    }
    if (posture === "governed") {
        if (entitlement.value === true)
            return { allowed: true };
        return {
            allowed: false,
            code: "memory.capture_optout_denied",
            detail: entitlement.value === false
                ? `${what} is refused: the entitlement resolver answered allowMemoryOptOut=false for this principal (governed posture — the deployment requires capture for it).`
                : `${what} is refused: memoryCapturePolicy "governed" requires an explicit per-principal allowMemoryOptOut verdict and none was resolvable (${entitlement.faulted ? "resolver fault" : "verdict absent"}) — fail-closed by the deployment's own declaration (a retention-required principal must not acquire an opt-out through an outage window).`,
        };
    }
    if (entitlement.value === false) {
        return {
            allowed: false,
            code: "memory.capture_optout_denied",
            detail: `${what} is refused: the entitlement resolver answered allowMemoryOptOut=false for this principal.`,
        };
    }
    if (entitlement.faulted) {
        return {
            allowed: true,
            faultDisclosure: `the runtime-caps resolve faulted while adjudicating a memory-capture opt-out; under the "open" posture the opt-out takes effect anyway ` +
                `(privacy-side irreversibility wins the fault arm — an explicit allowMemoryOptOut=false is the only denial). Repair the resolver if denial was intended.`,
        };
    }
    return { allowed: true };
}
export function captureOptOutDeniedError(detail) {
    const e = new Error(`memory capture opt-out denied: ${detail}`);
    e.code = "memory.capture_optout_denied";
    return e;
}
export function captureOptOutUnpersistedError(sessionId, ingress) {
    const e = new Error(`memory capture opt-out could not be durably recorded for session ${sessionId} (control-plane write failed) — ` +
        (ingress === "declaration"
            ? `refusing to run under an opt-out that would silently stop holding at the next resume. Nothing ran and nothing was captured.`
            : `the opt-out request is REJECTED and not applied: the run continues with memory capture still ON. Nothing was recorded, so an identical retry fails the same way.`));
    e.code = "memory.capture_optout_unpersisted";
    return e;
}