@sema-agent/client-core 0.91.0 → 0.93.0

package/dist/hitl/parkResolver.js

@@ -1,6 +1,6 @@
-import { putOwnKey } from '../ownKey.js';
+import { putOwnKey, readOwnDataValue } from '../ownKey.js';
 import { DecideTransportRetryExhaustedError, HitlBridge, HitlSafetyError, NO_QUESTION_OVERLAY_REASON, findPendingForTask, isNoDecisionSurfaceReason, readDecideCurrentPending, readWireErrorCode, } from './hitlBridge.js';
-import { CHECKPOINT_UNSUPPORTED_VERSION, PARKED_RESUME_STARTUP_FAILED, RESUME_POLICY_FOLD_CODE, isDecideParkMovedCode, refusalSaysStillPending } from '../engineErrorCodes.js';
+import { ASK_GONE, CHECKPOINT_UNSUPPORTED_VERSION, DECIDE_WORKFLOW_PARK_FORKED, DECIDE_WORKFLOW_PARKS_UNREADABLE, PARKED_RESUME_STARTUP_FAILED, RESUME_POLICY_FOLD_CODE, isDecideParkMovedCode, refusalSaysStillPending } from '../engineErrorCodes.js';
 import { publishQuestionFrame, registerLocalQuestionResponder, hasQuestionOverlay, } from '../liveQuestionStore.js';
 import { hostLog } from '../host.js';
 import { surfaceFsApprovalAndDecide } from './toolApprovalWire.js';
@@ -58,10 +58,16 @@ function alreadyResolvedFailureVerdict(outcome) {
         return false;
     if ('errorCode' in outcome && isDecideParkMovedCode(outcome.errorCode))
         return true;
+    if ('errorCode' in outcome && outcome.errorCode === ASK_GONE)
+        return true;
     return isAlreadyResolvedGateReason(outcome.reason);
 }
 export function isGateStandingErrorCode(code, retriable) {
-    return code === RESUME_POLICY_FOLD_CODE || code === 'corrupt' || (code === CHECKPOINT_UNSUPPORTED_VERSION && retriable === true);
+    return (code === RESUME_POLICY_FOLD_CODE ||
+        code === 'corrupt' ||
+        (code === CHECKPOINT_UNSUPPORTED_VERSION && retriable === true) ||
+        code === DECIDE_WORKFLOW_PARKS_UNREADABLE ||
+        code === DECIDE_WORKFLOW_PARK_FORKED);
 }
 export function isCodeClassifiedGateFailure(code, retriable) {
     return isGateStandingErrorCode(code, retriable) || code === PARKED_RESUME_STARTUP_FAILED;
@@ -190,10 +196,18 @@ function isFetchStepNoPending(outcome) {
 async function surfaceParkGate(park, ctx, gatedCallId, onPresented) {
     const { deps, led, taskId } = ctx;
     if (park.gate === 'fs') {
+        let decidedByReading;
+        try {
+            decidedByReading = readOwnDataValue(deps.approvalLane, 'approvalDecidedBy');
+        }
+        catch {
+            decidedByReading = undefined;
+        }
         const outcome = await surfaceFsApprovalAndDecide({
             client: deps.client,
             ...(onPresented ? { onPresented } : {}),
             ...(deps.onDecideOperation ? { onDecideOperation: deps.onDecideOperation } : {}),
+            ...(decidedByReading !== undefined ? { approvalDecidedBy: decidedByReading } : {}),
         }, taskId, argsByCallOf(led), ctx.signal, gatedCallId);
         const outcomeDenied = 'denied' in outcome ? outcome.denied : undefined;
         if (outcome.kind === 'decided' && outcomeDenied === true && outcome.gatedCallId) {
@@ -208,6 +222,12 @@ async function surfaceParkGate(park, ctx, gatedCallId, onPresented) {
     }
     return surfaceGateAndDecide(deps, taskId, argsByCallOf(led), ctx.signal, gatedCallId, onPresented);
 }
+function decidedIdentityCandidate(led, park) {
+    const id = park.gatedCallId;
+    if (id !== undefined)
+        return id;
+    return led.lastFsOrShellGatedCallId();
+}
 export async function resolvePark(park, ctx) {
     const { led, taskId } = ctx;
     let outcome;
@@ -243,7 +263,7 @@ export async function resolvePark(park, ctx) {
     }
     else {
         if (park.gate === 'fs')
-            candidateGatedCallId = led.lastFsOrShellGatedCallId();
+            candidateGatedCallId = decidedIdentityCandidate(led, park);
         outcome = await surfaceParkGate(park, ctx, park.gatedCallId, witness);
     }
     const alreadyDecidedById = outcome.kind === 'failed' &&

package/dist/hitl/persistedRulesWire.d.ts

@@ -50,6 +50,9 @@ export type RulesFailure = {
 } | {
     kind: 'forbidden';
     message: string;
+} | {
+    kind: 'operators-unconfigured';
+    message: string;
 } | {
     kind: 'body-shape';
     message: string;
@@ -100,7 +103,7 @@ export type PersistedRuleWriteBehavior = (typeof PERSISTED_RULE_WRITE_BEHAVIORS)
 export type PersistedRuleWriteRequest = RuleWriteRequest;
 export type PersistedRuleWriteWireResult = RuleWriteResult;
 export type PersistedRuleLiveness = RemovalLiveness;
-export declare const PERSISTED_RULE_WRITE_REFUSAL_CAUSES: readonly ["unwritable_behavior", "unreadable_identity", "unusable_principal", "client_too_old", "field_refused", "body_shape", "operator_only", "store_absent", "lane_too_old", "route_absent", "not_committed"];
+export declare const PERSISTED_RULE_WRITE_REFUSAL_CAUSES: readonly ["unwritable_behavior", "unreadable_identity", "unusable_principal", "client_too_old", "field_refused", "body_shape", "operator_only", "operators_unconfigured", "store_absent", "lane_too_old", "route_absent", "not_committed"];
 export type PersistedRuleWriteRefusalCause = (typeof PERSISTED_RULE_WRITE_REFUSAL_CAUSES)[number];
 export declare const PERSISTED_RULE_WRITE_UNKNOWN_REASONS: readonly ["indeterminate", "malformed_result", "identity_mismatch", "unattributed_method_refusal", "unclassified"];
 export type PersistedRuleWriteUnknownReason = (typeof PERSISTED_RULE_WRITE_UNKNOWN_REASONS)[number];

package/dist/hitl/persistedRulesWire.js

@@ -1,5 +1,7 @@
 import { engineCapTrue } from '../engineCapsCache.js';
+import { CORE_RULE_BEHAVIORS } from '../generated/engineFactTables.js';
 import { wireFailureShapeOf } from '../wireFailureShape.js';
+import { CAPABILITY_OPERATOR_PRINCIPALS_REQUIRED } from '../engineErrorCodes.js';
 import { hostLog } from '../host.js';
 import { observedPermissionRulesWrite, permissionRulesWriteAvailable } from '../permissionRulesWriteCapability.js';
 import { readToolApprovalRespondAck } from './toolApprovalWire.js';
@@ -7,7 +9,7 @@ export function persistedRulesLaneAvailable(baseUrl) {
     return engineCapTrue(baseUrl, 'permissionRules');
 }
 export function persistedRulesGovernanceAvailable(baseUrl) {
-    return engineCapTrue(baseUrl, 'permissionRulesRevoke') && engineCapTrue(baseUrl, 'permissionRules');
+    return engineCapTrue(baseUrl, 'permissionRules');
 }
 export function persistedRulesWriteAvailable(baseUrl) {
     return permissionRulesWriteAvailable(observedPermissionRulesWrite(baseUrl ?? ''));
@@ -66,6 +68,8 @@ export function classifyRulesFailure(e) {
         return { kind: 'too-many-candidates', message };
     if (status === 403 && errorCode === 'auth.operator_only')
         return { kind: 'forbidden', message };
+    if (errorCode === CAPABILITY_OPERATOR_PRINCIPALS_REQUIRED)
+        return { kind: 'operators-unconfigured', message };
     if (status === 405) {
         return errorCode === 'method_not_allowed'
             ? { kind: 'method-unsupported', message }
@@ -73,7 +77,7 @@ export function classifyRulesFailure(e) {
     }
     return { kind: 'error', message };
 }
-export const PERSISTED_RULE_BEHAVIORS = Object.freeze(['deny', 'ask', 'allow']);
+export const PERSISTED_RULE_BEHAVIORS = CORE_RULE_BEHAVIORS;
 const BEHAVIOR_SET = new Set(PERSISTED_RULE_BEHAVIORS);
 function rowStr(row, key) {
     if (typeof row !== 'object' || row === null || Array.isArray(row))
@@ -84,6 +88,10 @@ function rowStr(row, key) {
 function persistedRuleIdentityRowReadable(row) {
     return rowStr(row, 'rule') !== undefined && rowStr(row, 'scope') !== undefined;
 }
+function persistedRuleIdentityRowWhy(row) {
+    const bad = ['rule', 'scope'].filter((k) => rowStr(row, k) === undefined);
+    return `${bad.join(' and ')} ${bad.length === 1 ? 'is' : 'are'} missing or not a non-empty string`;
+}
 export function persistedRuleBehaviorOf(rule) {
     const b = rowStr(rule, 'behavior');
     return b !== undefined && BEHAVIOR_SET.has(b) ? b : undefined;
@@ -144,16 +152,22 @@ export async function listAllPersistedRules(facade, params = {}, opts) {
                 }
                 return { ok: false, failure };
             }
-            if (typeof res !== 'object' ||
-                res === null ||
-                !Array.isArray(res.rules) ||
-                typeof res.rev !== 'number' ||
-                !Number.isFinite(res.rev)) {
+            const pageProblems = [];
+            if (typeof res !== 'object' || res === null) {
+                pageProblems.push('the page is not an object');
+            }
+            else {
+                if (!Array.isArray(res.rules))
+                    pageProblems.push('rules is missing or not an array');
+                if (typeof res.rev !== 'number' || !Number.isFinite(res.rev))
+                    pageProblems.push('rev is missing or not a finite number');
+            }
+            if (pageProblems.length > 0) {
                 return {
                     ok: false,
                     failure: {
                         kind: 'error',
-                        message: 'rule list page was malformed (missing/ill-typed rules array or rev on a 2xx) — refusing to certify it as a complete governance list',
+                        message: `rule list page was malformed (${pageProblems.join('; ')}) on a 2xx — refusing to certify it as a complete governance list`,
                     },
                 };
             }
@@ -172,7 +186,7 @@ export async function listAllPersistedRules(facade, params = {}, opts) {
                         ok: false,
                         failure: {
                             kind: 'error',
-                            message: 'rule list page carried a malformed rule row (missing/ill-typed rule or scope) — refusing to present a list that hides or garbles live rules',
+                            message: `rule list page carried a malformed rule row (${persistedRuleIdentityRowWhy(r)}) — refusing to present a list that hides or garbles live rules`,
                         },
                     };
                 }
@@ -221,6 +235,7 @@ export const PERSISTED_RULE_WRITE_REFUSAL_CAUSES = Object.freeze([
     'field_refused',
     'body_shape',
     'operator_only',
+    'operators_unconfigured',
     'store_absent',
     'lane_too_old',
     'route_absent',
@@ -242,6 +257,8 @@ function writeOutcomeFromFailure(failure) {
             return { status: 'refused', cause: 'body_shape', message };
         case 'forbidden':
             return { status: 'refused', cause: 'operator_only', message };
+        case 'operators-unconfigured':
+            return { status: 'refused', cause: 'operators_unconfigured', message };
         case 'lane-unavailable':
             return { status: 'refused', cause: 'store_absent', message };
         case 'method-unsupported':
@@ -341,24 +358,26 @@ export async function writePersistedRule(facade, input, opts) {
     catch (e) {
         return writeOutcomeFromFailure(classifyRulesFailure(e));
     }
-    const malformed = () => ({
+    const malformed = (what) => ({
         status: 'unknown',
         why: 'malformed_result',
-        message: 'the rule write answered 2xx with a body this client cannot read (status, rev, liveness or the written row) — refusing to certify it as a standing rule; re-list the rules to reconcile',
+        message: `the rule write answered 2xx with a body this client cannot read (${what}) — refusing to certify it as a standing rule; re-list the rules to reconcile`,
     });
     if (res === null || typeof res !== 'object' || Array.isArray(res))
-        return malformed();
+        return malformed('the body is not an object');
     const snap = certificationSnapshot(res);
     if (snap === null)
-        return malformed();
+        return malformed('a field of the body is an inherited or accessor property, or threw when read');
     const { status, rev, hasLiveness, liveness, hasRow, row } = snap;
-    if ((status !== 'persisted' && status !== 'no-op') || typeof rev !== 'number' || !Number.isFinite(rev))
-        return malformed();
+    const statusOk = status === 'persisted' || status === 'no-op';
+    const revOk = typeof rev === 'number' && Number.isFinite(rev);
+    if (!statusOk || !revOk)
+        return malformed([...(statusOk ? [] : ['status is not persisted or no-op']), ...(revOk ? [] : ['rev is not a finite number'])].join('; '));
     const wrote = status === 'persisted' ? 'persisted' : 'no_op';
     if (hasLiveness) {
         if (liveness === 'no') {
             if (hasRow)
-                return malformed();
+                return malformed('liveness and the written row contradict each other');
             return {
                 status: 'revoked',
                 wrote,
@@ -368,7 +387,7 @@ export async function writePersistedRule(facade, input, opts) {
         }
         if (liveness === 'unknown') {
             if (hasRow)
-                return malformed();
+                return malformed('liveness and the written row contradict each other');
             return {
                 status: 'unverified',
                 wrote,
@@ -377,10 +396,10 @@ export async function writePersistedRule(facade, input, opts) {
             };
         }
         if (liveness !== 'yes')
-            return malformed();
+            return malformed('liveness is not one of yes, no or unknown');
     }
     if (!persistedRuleIdentityRowReadable(row))
-        return malformed();
+        return malformed(`the written row is unreadable (${persistedRuleIdentityRowWhy(row)})`);
     const landed = row;
     if (landed.behavior !== behavior || landed.rule !== rule || landed.scope !== scope) {
         return {

package/dist/hitl/planReviewWire.d.ts

@@ -6,8 +6,6 @@ export declare const PLAN_REVIEW_APPROVE_LABEL = "Yes, approve and run the plan"
 export declare const PLAN_REVIEW_REJECT_LABEL = "No, reject it (keep planning)";
 export declare const PLAN_REVIEW_APPROVE_AUTO_LABEL = "Yes, and auto-accept edits";
 export declare const PLAN_REVIEW_APPROVE_MANUAL_LABEL = "Yes, and manually approve edits";
-export declare const PLAN_REVIEW_MODE_AFTER_MIN_ENGINE: readonly [number, number, number];
-export declare function versionSupportsPlanReviewModeAfter(v: string | undefined): 'supported' | 'unsupported' | 'unknown';
 export declare function planReviewDecisionFromAnswer(answer: QuestionAnswer | null | undefined, shownLabels?: readonly string[]): 'approve' | 'reject' | 'dismissed';
 export type PlanReviewChoice = {
     decision: 'approve';

package/dist/hitl/planReviewWire.js

@@ -7,9 +7,8 @@ import { enqueuePlanReviewOutcome } from '../notifications.js';
 import { corruptStoredRowContent, corruptStoredRowWhere } from '../wireErrorTriage.js';
 import { decideFailureNote } from '../decideFailureNote.js';
 import { checkpointUnsupportedVersionContent, checkpointUnsupportedVersionFromError } from '../resumeRefusalCopy.js';
-import { REQUEST_FIELD_CONFLICT } from '../engineErrorCodes.js';
+import { REQUEST_FIELD_CONFLICT, isUnavailableFaceCode } from '../engineErrorCodes.js';
 import { denyReasonForWire, isPlanReviewModeAfter } from './hitlBridge.js';
-import { engineCapString } from '../engineCapsCache.js';
 import { planReviewQuestionId, REOPEN_ID_TAIL, taskIdFromPlanReviewQuestionId } from './gateIdentity.js';
 import { notePlanReviewAnswered, notePlanReviewAnsweredFor, planReviewArmedKeyFor, registerArmedGateFor, waitForGateArmedFor, wasGateArmedFor, } from './armedGateRegistry.js';
 import { createSessionSlot, DEFAULT_SESSION_KEY } from '../sessionSlot.js';
@@ -20,20 +19,6 @@ export const PLAN_REVIEW_APPROVE_LABEL = 'Yes, approve and run the plan';
 export const PLAN_REVIEW_REJECT_LABEL = 'No, reject it (keep planning)';
 export const PLAN_REVIEW_APPROVE_AUTO_LABEL = 'Yes, and auto-accept edits';
 export const PLAN_REVIEW_APPROVE_MANUAL_LABEL = 'Yes, and manually approve edits';
-export const PLAN_REVIEW_MODE_AFTER_MIN_ENGINE = Object.freeze([7, 86, 0]);
-export function versionSupportsPlanReviewModeAfter(v) {
-    const mm = v ? /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(v) : null;
-    if (!mm)
-        return 'unknown';
-    const got = [Number(mm[1]), Number(mm[2]), Number(mm[3])];
-    for (let i = 0; i < 3; i++) {
-        const g = got[i];
-        const need = PLAN_REVIEW_MODE_AFTER_MIN_ENGINE[i];
-        if (g !== need)
-            return g > need ? 'supported' : 'unsupported';
-    }
-    return 'supported';
-}
 const APPROVE_LABEL = PLAN_REVIEW_APPROVE_LABEL;
 const REJECT_LABEL = PLAN_REVIEW_REJECT_LABEL;
 const LEGACY_TWO_CHOICE_LABELS = Object.freeze([PLAN_REVIEW_APPROVE_LABEL, PLAN_REVIEW_REJECT_LABEL]);
@@ -266,9 +251,7 @@ export function armPlanReviewApproval(result, sessionKey, opts) {
         }
         armedPlanReviewTaskIds.add(taskId);
         armedTaskId = taskId;
-        const capsBaseUrl = wire !== undefined ? wire.capsBaseUrl : engineWireTarget()?.baseUrl;
-        const offerModeAfter = opts?.submittedInPlanMode === true &&
-            versionSupportsPlanReviewModeAfter(engineCapString(capsBaseUrl, 'version')) === 'supported';
+        const offerModeAfter = opts?.submittedInPlanMode === true;
         if (offerModeAfter)
             offerModeAfterByTask.set(taskId, true);
         else
@@ -648,7 +631,7 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
                 else if (typeof status === 'number') {
                     const msg = e instanceof Error ? e.message : String(e);
                     hostLog('debug', `planReviewWire: ${decision} → ${status} ${msg.slice(0, 200)}`);
-                    effect = status >= 400 && status < 500 ? 'not_applied' : 'unconfirmed';
+                    effect = (status >= 400 && status < 500) || (typeof refusedCode === 'string' && isUnavailableFaceCode(refusedCode)) ? 'not_applied' : 'unconfirmed';
                     outcome = `${`The plan_review decision failed: HTTP ${status} ${msg}`.trim()}${decideFailureNote(e)}`;
                 }
                 else if (noAnswer === 'time-limit' || noAnswer === 'deadline') {

package/dist/hitl/replayedApproval.d.ts

@@ -0,0 +1,21 @@
+import { type ApprovalsListEnvelope, type CrashConvergedRow } from './crashConverged.js';
+export type ReplayedApprovalDisposition = {
+    readonly kind: 'live';
+    readonly basis: 'live_leg' | 'preamble' | 'pending_list';
+} | {
+    readonly kind: 'decided';
+    readonly cause?: CrashConvergedRow['cause'];
+} | {
+    readonly kind: 'unknown';
+    readonly why: 'unreadable_frame' | 'no_approval_id' | 'not_read' | 'list_unreadable' | 'list_not_reported' | 'list_incomplete';
+};
+export interface ReplayPendingBasis {
+    readonly preamble?: ReadonlySet<string>;
+    readonly approvals?: {
+        readonly read: 'ok';
+        readonly body: ApprovalsListEnvelope;
+    } | {
+        readonly read: 'failed';
+    };
+}
+export declare function replayedApprovalDisposition(frame: object, basis: ReplayPendingBasis): ReplayedApprovalDisposition;

package/dist/hitl/replayedApproval.js

@@ -0,0 +1,89 @@
+import { hasLedgerPositionKey } from './gateLedger.js';
+import { readLivePendingRows } from './livePendingAsk.js';
+import { projectCrashConverged } from './crashConverged.js';
+const live = (basis) => Object.freeze({ kind: 'live', basis });
+const unknown = (why) => Object.freeze({ kind: 'unknown', why });
+const decided = (cause) => Object.freeze(cause !== undefined ? { kind: 'decided', cause } : { kind: 'decided' });
+function approvalIdOf(frame) {
+    const v = frame.approvalId;
+    return typeof v === 'string' && v !== '' ? v : undefined;
+}
+function crashConvergedCauseOf(body, approvalId) {
+    const projection = projectCrashConverged(body);
+    if (projection === undefined)
+        return undefined;
+    for (const row of [...projection.resumeSafe, ...projection.needsHuman]) {
+        if (row.approvalId === approvalId)
+            return row.cause;
+    }
+    return undefined;
+}
+export function replayedApprovalDisposition(frame, basis) {
+    let approvalId;
+    try {
+        if (typeof frame !== 'object' || frame === null)
+            return unknown('unreadable_frame');
+        if (!hasLedgerPositionKey(frame))
+            return live('live_leg');
+        approvalId = approvalIdOf(frame);
+    }
+    catch {
+        return unknown('unreadable_frame');
+    }
+    if (approvalId === undefined)
+        return unknown('no_approval_id');
+    let b;
+    let inPreamble = false;
+    try {
+        b = typeof basis === 'object' && basis !== null ? basis : undefined;
+        inPreamble = b?.preamble?.has(approvalId) === true;
+    }
+    catch {
+        inPreamble = false;
+    }
+    if (inPreamble)
+        return live('preamble');
+    let approvals;
+    try {
+        approvals = b?.approvals;
+    }
+    catch {
+        return unknown('not_read');
+    }
+    if (approvals === undefined || approvals === null)
+        return unknown('not_read');
+    let body;
+    try {
+        if (approvals.read !== 'ok')
+            return unknown('list_unreadable');
+        body = approvals.body;
+    }
+    catch {
+        return unknown('list_unreadable');
+    }
+    let reading;
+    try {
+        reading = readLivePendingRows(body);
+    }
+    catch {
+        return unknown('list_unreadable');
+    }
+    if (reading.kind === 'present' && reading.rows.some((r) => r.approvalId === approvalId))
+        return live('pending_list');
+    let cause;
+    try {
+        cause = crashConvergedCauseOf(body, approvalId);
+    }
+    catch {
+        cause = undefined;
+    }
+    if (cause !== undefined)
+        return decided(cause);
+    if (reading.kind === 'not_reported')
+        return unknown('list_not_reported');
+    if (reading.kind === 'malformed')
+        return unknown('list_unreadable');
+    if (reading.dropped > 0)
+        return unknown('list_incomplete');
+    return decided();
+}

package/dist/hitl/sessionPolicyDeliverable.js

@@ -1,5 +1,7 @@
 import { CONFIG_LEGACY_TOOL_NAME, RULES_LEGACY_TOOL_NAME } from '../engineErrorCodes.js';
 import { rosterMountedNames } from './rosterMountedNames.js';
+import { ruleCompileVerdict } from '../ruleCompileVerdict.js';
+import { protocolSegmentOf } from '../protocolSegment.js';
 import { PREFIXES_IN_PROSE, REFUSED_NAME_CLASSES, REFUSED_NAME_FIX, RULES_LEGACY_TOOL_NAME_WRITE_NOTE } from './refusedToolNameProse.js';
 import { CORE_PROTOCOL_PREFIXES, CORE_RETIRED_TOOL_CURRENT_NAMES } from '../generated/toolNameTables.js';
 const COVERING_NAMESPACE_PREFIXES = CORE_PROTOCOL_PREFIXES;
@@ -9,7 +11,7 @@ const WITHHELD_NOTICE = {
     qualified_deny: 'Not written to this session’s rule record: that record holds whole tool names and command names only, and this rule has a part in parentheses it cannot carry — recording just the name could block more than this rule does.',
     peer_wide: 'Not written to this session’s rule record: this rule names a server or agent peer without naming one of its tools, and an engine that matches that record by exact tool name would block none of that peer’s tools.',
     wildcard: 'Not written to this session’s rule record: this rule uses a wildcard (*), and an engine that matches that record by exact tool name would block none of the tools it covers.',
-    not_a_tool_name: 'Not written to this session’s rule record: this entry is not exactly one tool name — it is empty, not text, or has spaces around the name.',
+    not_a_tool_name: 'Not written to this session’s rule record: this entry is not exactly one tool name — it is empty, not text, has spaces around the name, is not a single tool name in rule syntax (for example it contains a backslash or a parenthesis, or is longer than a rule can be), or spells its server or agent peer part in a way the engine never uses when naming tools (for example with a dot or a space), so no tool would ever match it.',
     legacy_tool_name: `Not written to this session’s rule record: unless a tool by exactly this name is available, the engine refuses it — it is a retired tool name, or it contains "__" but does not start with ${PREFIXES_IN_PROSE} — and with it in that record every later run of this session would fail at startup until that entry is removed from the record. ${REFUSED_NAME_FIX}`,
     not_in_roster: 'Not written to this session’s rule record: the tool roster supplied for this check has no tool by exactly this name, as a name or an alias, with letter case counted — it may be misspelled, or name a tool this deployment does not provide — so recorded as it is it would block nothing here.',
 };
@@ -97,7 +99,23 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
             withheld.push({ rule: '', why: 'not_a_tool_name' });
             continue;
         }
-        const why = withheldWhyOf(r) ?? (mounted !== undefined && !mounted.has(r) ? 'not_in_roster' : undefined);
+        let why = withheldWhyOf(r);
+        if (why === undefined) {
+            const grammar = ruleCompileVerdict(r, 'deny');
+            if (grammar === 'unknown')
+                return unreadable();
+            if (grammar === 'refused')
+                why = 'not_a_tool_name';
+        }
+        if (why === undefined && COVERING_NAMESPACE_PREFIXES.some((p) => r.startsWith(p))) {
+            const segment = protocolSegmentOf(r);
+            if (segment.kind === 'empty' || segment.kind === 'unminted')
+                why = 'not_a_tool_name';
+            else if (segment.kind === 'unknown')
+                return unreadable();
+        }
+        if (why === undefined && mounted !== undefined && !mounted.has(r))
+            why = 'not_in_roster';
         if (why === undefined)
             exact.push(r);
         else {

package/dist/hitl/sessionPolicyWire.d.ts

@@ -1,6 +1,8 @@
 import type { SessionPermissionRules, StoredSessionRules } from '@sema-agent/sdk';
 import type { SessionPolicyReading } from '../sessionPolicyCapability.js';
 import type { ToolRosterView } from '../toolRoster.js';
+import { CORE_RULE_TOOL_NAME_VERDICTS } from '../generated/engineFactTables.js';
+export type LegacyToolNameVerdict = Exclude<(typeof CORE_RULE_TOOL_NAME_VERDICTS)[number], 'current'>;
 export interface SessionPolicyFacade {
     getPolicy(sessionId: string, opts?: {
         signal?: AbortSignal;
@@ -43,6 +45,8 @@ export type SessionPolicyFailure = {
     message: string;
     field?: SessionPolicyRemovedEntry['field'];
     name?: string;
+    verdict?: LegacyToolNameVerdict;
+    currentName?: string;
 } | {
     kind: 'unauthorized';
     message: string;
@@ -95,6 +99,8 @@ export type SessionPolicyTightenOutcome = {
     message: string;
     field?: SessionPolicyRemovedEntry['field'];
     name?: string;
+    verdict?: LegacyToolNameVerdict;
+    currentName?: string;
     alreadyInRecord?: boolean;
 } | {
     kind: 'unknown';
@@ -109,6 +115,8 @@ export declare function sessionPolicyReadNotice(outcome: Exclude<SessionPolicyRe
     kind: 'present';
 }> | {
     kind: 'no_target';
+} | {
+    kind: 'not_started';
 }): string;
 export interface SessionPolicyRemovedEntry {
     readonly field: 'toolDeny' | 'toolAllow';
@@ -148,6 +156,8 @@ export type SessionPolicyRemovalOutcome = {
     message: string;
     field?: SessionPolicyRemovedEntry['field'];
     name?: string;
+    verdict?: LegacyToolNameVerdict;
+    currentName?: string;
 };
 export type SessionPolicyRosterRequiredWhy = 'absent' | 'unreadable';
 export declare function removeRefusedSessionRules(facade: SessionPolicyFacade, sessionId: string, roster: ToolRosterView | undefined, opts?: {

package/dist/hitl/sessionPolicyWire.js

@@ -4,6 +4,10 @@ import { isEngineRefusedToolName } from './sessionPolicyDeliverable.js';
 import { RULES_LEGACY_TOOL_NAME_WRITE_NOTE } from './refusedToolNameProse.js';
 import { RULES_LEGACY_TOOL_NAME, isRulesRefusalCode } from '../engineErrorCodes.js';
 import { rosterMountedNames } from './rosterMountedNames.js';
+import { CORE_RULE_TOOL_NAME_VERDICTS } from '../generated/engineFactTables.js';
+function isLegacyToolNameVerdict(v) {
+    return typeof v === 'string' && v !== 'current' && CORE_RULE_TOOL_NAME_VERDICTS.includes(v);
+}
 const RULE_FIELD_PRESENCE = {
     toolAllow: true,
     toolDeny: true,
@@ -14,7 +18,7 @@ const RULE_FIELD_PRESENCE = {
 export const SESSION_POLICY_RULE_FIELDS = Object.freeze(Object.keys(RULE_FIELD_PRESENCE));
 const MAX_RULE_ENTRIES = 10_000;
 export function classifySessionPolicyFailure(e) {
-    const { status, errorCode, message, bodyField, bodyName } = wireFailureShapeOf(e);
+    const { status, errorCode, message, bodyField, bodyName, bodyVerdict, bodyCurrentName } = wireFailureShapeOf(e);
     if (errorCode === undefined || errorCode === '')
         return { kind: 'no-verdict', message };
     if (errorCode === RULES_LEGACY_TOOL_NAME) {
@@ -23,6 +27,8 @@ export function classifySessionPolicyFailure(e) {
             message,
             ...(bodyField === 'toolDeny' || bodyField === 'toolAllow' ? { field: bodyField } : {}),
             ...(bodyName !== undefined && bodyName !== '' ? { name: bodyName } : {}),
+            ...(isLegacyToolNameVerdict(bodyVerdict) ? { verdict: bodyVerdict } : {}),
+            ...(bodyCurrentName !== undefined && bodyCurrentName !== '' ? { currentName: bodyCurrentName } : {}),
         };
     }
     if (isRulesRefusalCode(errorCode) && status !== undefined && status >= 400 && status < 500)
@@ -227,7 +233,7 @@ function unknownFrom(failure, leg) {
     }
 }
 function legacyToolNameOutcome(failure, prior, add) {
-    const { field, name } = failure;
+    const { field, name, verdict, currentName } = failure;
     let alreadyInRecord;
     if (field !== undefined && name !== undefined) {
         const inPrior = Object.hasOwn(prior, field) ? prior[field] : undefined;
@@ -242,6 +248,8 @@ function legacyToolNameOutcome(failure, prior, add) {
         message: failure.message,
         ...(field !== undefined ? { field } : {}),
         ...(name !== undefined ? { name } : {}),
+        ...(verdict !== undefined ? { verdict } : {}),
+        ...(currentName !== undefined ? { currentName } : {}),
         ...(alreadyInRecord !== undefined ? { alreadyInRecord } : {}),
     };
 }
@@ -320,7 +328,7 @@ export function sessionPolicyTightenNotice(outcome) {
                 case 'face_unavailable':
                     return 'This deployment does not keep per-session tool rules, so nothing was written.';
                 case 'session_not_found':
-                    return 'This session is not readable from here — it may not exist, or it may belong to someone else; nothing was written.';
+                    return 'This session is not readable from here — it may not exist, or it may belong to someone else (the engine answers both the same way, so this client cannot tell which); nothing was written.';
                 case 'session_ownerless':
                     return 'This session has no owner, so a rule written for it could never be read back; nothing was written. Attach an identity to the session and try again.';
                 case 'unauthorized':
@@ -346,6 +354,7 @@ export function sessionPolicyTightenNotice(outcome) {
 }
 const READ_NOTICE_GENERIC = 'This session’s rule record could not be shown, so what it holds is not known. Try reading it again.';
 const READ_NOTICE_NO_TARGET = 'There is no engine connection for this session, so its rule record cannot be read and what it holds is not known. Look again once it is connected.';
+const READ_NOTICE_NOT_STARTED = 'This session has not begun on the engine yet — nothing has been sent in it — so it has no rule record to read. Send a first message, then look again.';
 function readFailureSentence(kind) {
     switch (kind) {
         case 'face-unavailable':
@@ -359,7 +368,7 @@ function readFailureSentence(kind) {
         case 'session-ownerless':
             return 'This session has no owner, so it has no rule record to read.';
         case 'session-not-found':
-            return 'This session is not readable from here — it may not exist, or it may belong to someone else — so its rule record cannot be shown. Check that you are connected to the engine and the session you meant, or continue in a new session.';
+            return 'This session is not readable from here — it may not exist, or it may belong to someone else (the engine answers both the same way, so this client cannot tell which) — so its rule record cannot be shown. Check that you are connected to the engine and the session you meant, or continue in a new session.';
         case 'request-rejected':
             return 'The engine rejected the request to read this session’s rule record as malformed, so it could not be read. Sending the same request again will not change that; check which session was asked for.';
         case 'legacy-tool-name':
@@ -401,6 +410,8 @@ export function sessionPolicyReadNotice(outcome) {
             return readMalformedSentence(ownRead(outcome, 'why')) ?? READ_NOTICE_GENERIC;
         if (arm === 'no_target')
             return READ_NOTICE_NO_TARGET;
+        if (arm === 'not_started')
+            return READ_NOTICE_NOT_STARTED;
         return READ_NOTICE_GENERIC;
     }
     catch {
@@ -488,6 +499,8 @@ async function attemptRemoval(facade, sessionId, mounted, opts) {
                     message: failure.message,
                     ...(failure.field !== undefined ? { field: failure.field } : {}),
                     ...(failure.name !== undefined ? { name: failure.name } : {}),
+                    ...(failure.verdict !== undefined ? { verdict: failure.verdict } : {}),
+                    ...(failure.currentName !== undefined ? { currentName: failure.currentName } : {}),
                 },
             };
         }
@@ -559,7 +572,7 @@ export function sessionPolicyRemovalNotice(outcome) {
                 case 'face_unavailable':
                     return 'This deployment does not keep per-session tool rules, so there is no session rule record to remove entries from — nothing was changed.';
                 case 'session_not_found':
-                    return 'This session is not readable from here — it may not exist, or it may belong to someone else; nothing was changed.';
+                    return 'This session is not readable from here — it may not exist, or it may belong to someone else (the engine answers both the same way, so this client cannot tell which); nothing was changed.';
                 case 'session_ownerless':
                     return 'This session has no owner, so it has no session rule record to change; nothing was changed.';
                 case 'unauthorized':
@@ -576,7 +589,7 @@ export function sessionPolicyRemovalNotice(outcome) {
                 case 'store_corrupt':
                     return 'The engine could not establish which version this session’s rules are at and refused to stamp a new one, so nothing was changed. This needs an operator to look at the rule store.';
                 case 'session_not_found':
-                    return 'This session is not writable from here — it may not exist, or it may belong to someone else; nothing was changed.';
+                    return 'This session is not writable from here — it may not exist, or it may belong to someone else (the engine answers both the same way, so this client cannot tell which); nothing was changed.';
                 case 'unauthorized':
                     return 'This call could not present a verifiable identity, so nothing was changed.';
                 default: