@sema-agent/core/wire-changes/core@7.17.6.json

Stateless, task-oriented AI agent core

{
  "repo": "core",
  "version": "7.17.6",
  "from": "3dfd4ff66bfd1c6ea217fa251d2f28df79052f87",
  "to": "adb5afdddf8b01be7b9b8a8394251eea7fe2ee19",
  "added": [],
  "removed": [],
  "changed": [],
  "narrowed": [
    {
      "id": "F1",
      "source": "behaviorFlips.summary",
      "text": "Narrowing — the execute-time canonical recheck now answers for a GLOB's expansion (#775; B-109; test [7201]): the full Bash face hands the boundary's `undecidedPaths` (the operands the shell will expand) to the same expander the `bash_readonly` face already used, so a pattern that expands to a target outside the roots is refused before spawn; an expansion that cannot be established (uncompilable segment, >256 directories, >8192 names, an unreadable directory) is refused too."
    },
    {
      "id": "F2",
      "source": "behaviorFlips.summary",
      "text": "Narrowing — a `..` taken AFTER a symlink is judged where the kernel takes it (#770; B-110; test [7203]): the lexical walk folds `..` for its containment verdict as before, but the recheck now receives the operand's UNFOLDED spelling and resolves it segment by segment (realpath the prefix, THEN take the parent), so `<link>/../x` is refused when the link's target parent is outside every read root."
    },
    {
      "id": "F3",
      "source": "behaviorFlips.summary",
      "text": "Narrowing — `sed`'s SCRIPT SLOT is judged as an argument-as-program (#769; test [7180] candidate 7): a sed script that names a file or runs a command (`r`/`R`/`w`/`W`/`e` commands, `s///w FILE`, `s///e`) or a script the walk cannot see (`-f FILE`/`--file=`) refuses the command whole (mandated), under the same rule as shell re-entry and argv re-entry."
    },
    {
      "id": "F5",
      "source": "behaviorFlips.summary",
      "text": "Narrowing — the execute-time read boundary asks what an environment DECLARES, not what interface it implements (#782; B-115; test [7214]): the canonical recheck is skipped only when the environment declares `capabilities.isolation: true` (the sandbox is the boundary, C-R37 γ); a lane that implements the remote interface but declares no isolation (server `REMOTE_EXEC=host`, SSH hosts) now runs the recheck like an in-process env."
    }
  ],
  "closedSetMembers": [],
  "typeKeys": [
    {
      "type": "CompoundReadonlyVerdict",
      "at": [
        "src/tools/fs/bash-readonly-classifier.ts:644"
      ],
      "added": [
        "checkedSpellings",
        "outOfRootSpellings",
        "undecidedSpellings"
      ],
      "removed": [],
      "breaking": false,
      "criteriaCovered": false
    }
  ],
  "declarationMoves": [],
  "mintMoves": [],
  "criteriaObserves": [
    {
      "kind": "typeMember",
      "name": "AskRequest.ruleOffersAbsence",
      "assertions": [
        "G1.a",
        "G2.a",
        "G3.a",
        "G5.a"
      ]
    },
    {
      "kind": "typeMember",
      "name": "HarvestReport.rejections",
      "assertions": [
        "G4.a"
      ]
    }
  ],
  "consumersHint": {
    "cli": [
      "CompoundReadonlyVerdict"
    ],
    "server": [
      "CompoundReadonlyVerdict"
    ],
    "sdk": [],
    "note": "scanned cli@60ea7972 server@940568c6 sdk@6910789 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
  },
  "breakingCount": 0,
  "breakingItems": []
}