@sema-agent/core 5.12.0 → 5.14.0

package/dist/core/runner/prepare-task.js

@@ -12,6 +12,8 @@ import { primaryActivityArg } from "../arg-summary.js";
 import { materializeMcpTools } from "../mcp.js";
 import { materializeA2aTools } from "../a2a.js";
 import { Type } from "typebox";
+import { Value } from "typebox/value";
+import { uuidv7 } from "../../engine/session/uuid.js";
 import { brainToRuntime } from "../runtime.js";
 import { StoredSession, isSessionConflict, hasSessionFork } from "../session.js";
 import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents/subagent.js";
@@ -24,7 +26,7 @@ import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentList
 import { inlineUntrusted } from "../untrusted-text.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
-import { cloneObserverInput, formatHookFeedback, runToolGate } from "../hooks.js";
+import { cloneObserverInput, createHookEnvCapabilities, formatHookFeedback, runToolGate } from "../hooks.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -38,6 +40,10 @@ import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, S
 import { compileOutputSchema } from "./strict-output-schema.js";
 import { TOOL_SEARCH_NAME, buildDeferredRegistry, classifyDeferred, extractDiscoveredToolNames, createPlaceholderTool, createToolSearchTool, } from "./tool-disclosure.js";
 import { composeMemoryBlock } from "../memory.js";
+import { preflightLockedConfig } from "../locked-config.js";
+import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies } from "../compliance.js";
+import { assertRetentionCapability } from "../retention.js";
+import { foldAdmissionFreeze } from "../memory-admission.js";
 import { prepareMemory } from "./prepare-memory.js";
 import { defaultPromptProvider, buildEnvironmentContext, buildGitSnapshot, formatLocalDate, isValidTimeZone, PROJECT_CONTEXT_FRAMING } from "../../prompts/default.js";
 import { assemblePrompt } from "../../prompt-assembly/assemble.js";
@@ -60,7 +66,7 @@ import { createMonitorTool } from "../../tools/monitor.js";
 import { createWorktreeTools } from "../../tools/worktree.js";
 import { applyCompactionToReadFileState, bashReversibilityProbe, createHandsToolkit, isReadDedupStubResult, seedReadFileStateFromContext, seedReadFileStateFromTranscript, HAND_TOOL_EFFECTS, pdfModelCapabilitiesOf } from "../../tools/fs/index.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
-import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool } from "../ask-question.js";
+import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool, classifyQuestionOutcome, isLiveQuestionFace, validateAskQuestions, } from "../ask-question.js";
 import { createSchedulerTools } from "../../tools/scheduler-tools.js";
 import { createPresentPlanTool, createEnterPlanModeTool, PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
 import { isSelfOrchestrationActive, selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
@@ -69,8 +75,9 @@ import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-
 import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
-import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, remainingBudgetMicroUsd, } from "../checkpoint-store.js";
+import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, remainingBudgetMicroUsd, resolveCheckpointStore, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
+import { countElicitOptIns, deriveAskEffective, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
 const RECONCILE_MAX_RETRIES = 3;
 const DEFAULT_MAX_SUSPENDS = 5;
@@ -173,11 +180,7 @@ export const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
 export function checkpointScopeOf(spec) {
     return spec.durableApproval?.scope || spec.principal || DEFAULT_IRREVERSIBLE_SCOPE;
 }
-export function resolveCheckpointStore(spec, deps) {
-    if (spec.checkpointStore === null)
-        return undefined;
-    return spec.checkpointStore ?? deps.checkpointStore;
-}
+export { resolveCheckpointStore } from "../checkpoint-store.js";
 export function isFableFamilyModelId(id) {
     const tail = id.toLowerCase().split("/").pop() ?? "";
     return /^claude-fable-\d/.test(tail) || /^claude-mythos-5(?!\d)/.test(tail);
@@ -337,6 +340,64 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         e.code = "config.empty_objective";
         throw e;
     }
+    const lockedPreflight = preflightLockedConfig(spec, deps);
+    assertRetentionCapability({
+        policy: deps.retentionPolicy,
+        locked: lockedPreflight.lockedKeys.has("retentionPolicy"),
+        stores: [
+            { name: "sessionStore", store: sessions },
+            { name: "checkpointStore", store: resolveCheckpointStore(spec, deps) },
+            { name: "toolResultStore", store: deps.toolResultStore },
+        ],
+    });
+    const resolvedInteractionPosture = spec.interactionPosture ?? internals?.parentInteractionPosture ?? deps.interactionPosture;
+    {
+        const interactionPosture = resolvedInteractionPosture;
+        const discloseInteractionPostureRefusal = (err) => {
+            try {
+                deps.onError?.(err, { phase: "config", sessionId: spec.sessionId ?? "(pre-session)", classification: "interaction-posture-refused" });
+            }
+            catch {
+            }
+        };
+        if (interactionPosture !== undefined && interactionPosture !== "interactive" && interactionPosture !== "headless") {
+            const e = new Error(`interactionPosture ${JSON.stringify(interactionPosture)} is not a recognized posture ("interactive" | "headless") — ` +
+                `an unevaluable declaration is refused loudly, never folded to either posture.`);
+            e.code = "config.interaction_posture";
+            discloseInteractionPostureRefusal(e);
+            throw e;
+        }
+        if (interactionPosture === "interactive") {
+            const askDoor = resolveAskSeamForm(spec, deps);
+            const humanReachable = deriveAskEffective(askDoor.form, "unresolved") === "human_reachable";
+            const questionDoor = resolveQuestionSeam(spec, deps);
+            const strippedByEngine = internals?.questionFaceStripped === true;
+            if (spec.interactiveTools === false) {
+                const e = new Error(`interaction posture "interactive" declared together with interactiveTools: false — the hard-headless ` +
+                    `clamp removes the AskUserQuestion mount, so no content question can ever reach the human this posture ` +
+                    `promises. Drop one of the two declarations.`);
+                e.code = "config.interaction_posture";
+                discloseInteractionPostureRefusal(e);
+                throw e;
+            }
+            if (!humanReachable || !(questionDoor.wired || strippedByEngine)) {
+                const missing = [];
+                if (!humanReachable) {
+                    missing.push(askDoor.form === "absent"
+                        ? "no onAsk approver is wired (spec.onAsk ?? deps.onAsk is absent — asks would auto-deny or park)"
+                        : `the resolved onAsk seat is the blanket policy "${askDoor.form}" (${askDoor.provenance ?? "?"}) — a policy setting is not a reachable human`);
+                }
+                if (!questionDoor.wired && !strippedByEngine) {
+                    missing.push("no content-question channel (spec.onQuestion ?? deps.onQuestion is absent, and this leg is not an engine-stripped background lane)");
+                }
+                const e = new Error(`interaction posture "interactive" declared, but this assembly cannot reach a human: ${missing.join("; ")}. ` +
+                    `Wire the missing seam(s), or drop the posture declaration (absent = no check).`);
+                e.code = "config.interaction_posture";
+                discloseInteractionPostureRefusal(e);
+                throw e;
+            }
+        }
+    }
     resolveTaskLimits(spec.limits);
     if (spec.resourceSuspend !== undefined) {
         const rsus = spec.resourceSuspend;
@@ -378,6 +439,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const egressTools = new Set();
     const irreversibleTools = new Set();
     const irreversibilityTier = new Map();
+    const axisExplicitNegatives = new Map();
     const reversibilityProbes = new Map();
     let shellGatedBash = false;
     let shellGatedMonitor = false;
@@ -940,9 +1002,35 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ? liveShellGate
                     : seedShellGate;
         const inheritedParentConstraints = liveInheritedGate?.parentConstraints;
+        const liveAdmittedOrg = liveInheritedGate?.admittedOrgScopes;
+        const seedAdmittedOrg = seedInheritedGate?.admittedOrgScopes;
+        const inheritedAdmittedOrgScopes = liveAdmittedOrg === undefined ? seedAdmittedOrg : seedAdmittedOrg === undefined ? liveAdmittedOrg : liveAdmittedOrg.filter((s) => seedAdmittedOrg.includes(s));
+        const inheritedOrgGoverned = liveInheritedGate?.orgAdmissionGoverned === true || seedInheritedGate?.orgAdmissionGoverned === true;
+        const checkpointOwnOrgVerdict = resume?.seed.inheritedGate?.ownAdmittedOrgScopes !== undefined
+            ? { scopes: resume.seed.inheritedGate.ownAdmittedOrgScopes, writeScope: resume.seed.inheritedGate.ownAdmittedOrgWriteScope ?? null }
+            : undefined;
+        const refOwnOrgVerdict = internals?.ownOrgAdmissionRef?.current;
+        const priorOwnOrgVerdict = checkpointOwnOrgVerdict === undefined
+            ? refOwnOrgVerdict
+            : refOwnOrgVerdict === undefined
+                ? checkpointOwnOrgVerdict
+                : {
+                    scopes: checkpointOwnOrgVerdict.scopes.filter((sc) => refOwnOrgVerdict.scopes.includes(sc)),
+                    writeScope: checkpointOwnOrgVerdict.writeScope !== null && checkpointOwnOrgVerdict.writeScope === refOwnOrgVerdict.writeScope
+                        ? checkpointOwnOrgVerdict.writeScope
+                        : null,
+                };
+        const orgGovernedProvenance = deps.memoryScopeAdmission !== undefined ||
+            (deps.deploymentMemoryScopes !== undefined && deps.deploymentMemoryScopes.length > 0) ||
+            deps.compliancePostureResolver !== undefined ||
+            inheritedOrgGoverned ||
+            priorOwnOrgVerdict !== undefined;
         const specShellGate = spec.shellGate ?? "off";
         const effectiveShellGate = inheritedShellGate !== undefined && shellGateRank[inheritedShellGate] > shellGateRank[specShellGate] ? inheritedShellGate : specShellGate;
         const ownSessionRulesRef = {};
+        const memoryAdmittedOrgScopesRef = { current: [] };
+        const ownOrgVerdictRef = { current: undefined };
+        const orgAdmissionCheckpointState = () => inheritedAdmittedOrgScopes !== undefined || ownOrgVerdictRef.current !== undefined || orgGovernedProvenance;
         const frozenOnAsk = spec.onAsk ?? deps.onAsk;
         const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
         const inheritedGateForChildren = () => {
@@ -950,7 +1038,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(inheritedAncestorRules ?? []),
                 ...(ownSessionRulesRef.current !== undefined ? [ownSessionRulesRef.current] : []),
             ];
-            const ownCallerPolicy = spec.toolPolicy ?? deps.toolPolicy;
+            const ownCallerPolicy = lockedPreflight.toolPolicy;
             const durableMandate = runtimeCaps?.forceDurableGate === true || (spec.durableApproval !== undefined && frozenOnAsk === undefined);
             const parentConstraints = [
                 ...(inheritedParentConstraints ?? []),
@@ -968,6 +1056,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(ancestorRules.length > 0 ? { ancestorRules } : {}),
                 ...(effectiveShellGate !== "off" ? { shellGate: effectiveShellGate } : {}),
                 ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
+                admittedOrgScopes: memoryAdmittedOrgScopesRef.current,
+                ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
             };
         };
         let agentForkDenial;
@@ -1024,6 +1114,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 : {}),
             sessionId,
             ...(spec.backgroundScope !== undefined ? { backgroundScope: spec.backgroundScope } : {}),
+            ...(resolvedInteractionPosture !== undefined ? { interactionPosture: resolvedInteractionPosture } : {}),
             ...(deps.onBackgroundChildEvent ? { onBackgroundChildEvent: deps.onBackgroundChildEvent } : {}),
             ...(internals?.onTaskNotification ? { onTaskNotification: internals.onTaskNotification } : {}),
             ...(forwardEvent ? { forwardEvent } : {}),
@@ -1072,6 +1163,39 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 runtimeCaps = { allowWorkflows: false, allowFork: false };
             }
         }
+        let complianceDenies = new Set();
+        let complianceDegraded = false;
+        if (deps.compliancePostureResolver) {
+            try {
+                const posture = (await deps.compliancePostureResolver(spec.principal)) ?? undefined;
+                if (posture !== undefined)
+                    complianceDenies = resolveComplianceDenies(posture);
+            }
+            catch (err) {
+                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
+                complianceDenies = new Set(COMPLIANCE_CAPABILITIES);
+                complianceDegraded = true;
+            }
+            const complianceRefuse = (capability, requested) => {
+                const e = new Error(`${requested} is denied for this principal by the compliance posture (capability "${capability}"` +
+                    `${complianceDegraded ? "; the posture resolver is currently failing, so every managed capability is denied fail-closed" : ""}) — ` +
+                    `the task is refused rather than silently narrowed.`);
+                e.code = complianceDegraded ? "config.compliance_required" : "config.compliance_denied";
+                throw e;
+            };
+            if (complianceDenies.has("mcp_servers") && lockedPreflight.mcp?.length) {
+                complianceRefuse("mcp_servers", "TaskSpec.mcp (MCP server materialization)");
+            }
+            if (complianceDenies.has("workflows") && spec.selfOrchestration === true) {
+                complianceRefuse("workflows", "TaskSpec.selfOrchestration (workflow self-orchestration)");
+            }
+            if (complianceDenies.has("web_fetch")) {
+                const webTool = (spec.tools ?? []).find((t) => t.name === WEB_FETCH_TOOL_NAME || (t.aliases ?? []).includes(WEB_FETCH_TOOL_NAME));
+                if (webTool !== undefined) {
+                    complianceRefuse("web_fetch", `TaskSpec.tools["${webTool.name}"] (the WebFetch tool face)`);
+                }
+            }
+        }
         agentForkDenial = forkGovernanceDenial(spec.enableFork, runtimeCaps?.allowFork);
         observersActive = runtimeCaps?.allowObservers === true;
         if (runtimeCaps?.autoMode === true && deps.autoMode !== undefined) {
@@ -1144,6 +1268,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(spec.getApiKeyAndHeaders !== undefined ? { parentGetApiKeyAndHeaders: spec.getApiKeyAndHeaders } : {}),
                 principal: spec.principal,
                 oneShot: spec.oneShot,
+                ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
+                autoModeReview: () => (autoModeDecider !== undefined ? { decider: autoModeDecider } : undefined),
                 workflowDepth: internals?.workflowDepth,
                 parentCwd: taskRootPath,
                 parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
@@ -1220,8 +1346,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             tools.push(createOutputTool(outputRef, spec.outputSchema, compiled.strict ? compiled.modelSchema : undefined));
         }
-        mcp = spec.mcp?.length
-            ? await materializeMcpTools(spec.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer)
+        mcp = lockedPreflight.mcp?.length
+            ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer)
             : { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], dispose: async () => { } };
         for (const w of mcp.warnings)
             deps.onError?.(w, { phase: "mcp", sessionId });
@@ -1241,7 +1367,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         tools.push(...mcp.tools.map((t) => remoteToolOffload(t)));
         const rebuildHarnessToolsRef = {};
         const toolCallGateArmedRef = { armed: false };
-        if (spec.mcp?.length) {
+        if (lockedPreflight.mcp?.length) {
             tools.push({
                 name: "RefreshMcpTools",
                 label: "RefreshMcpTools",
@@ -1316,6 +1442,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     irreversibilityTier.set(axis.name, "always");
                     irreversibleTools.add(axis.name);
                 }
+                if (axis.irreversibility === "never") {
+                    axisExplicitNegatives.set(axis.name, { ...axisExplicitNegatives.get(axis.name), irreversible: false });
+                }
+                if (axis.egress === false) {
+                    axisExplicitNegatives.set(axis.name, { ...axisExplicitNegatives.get(axis.name), egress: false });
+                }
                 if (axis.egress) {
                     if (axis.effect !== undefined && axis.effect !== "write") {
                         const e = new Error(`${protocolLabel} tool "${axis.name}" resolves to egress:true with effect:"${axis.effect}" — an egress tool (external write) must have effect:"write". Clear egress (toolAxes egress:false) if it is a pure read, or set effect:"write".`);
@@ -1471,6 +1603,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             tools.push(...band.map((t) => firstPartyOffload(t)));
             const shellGate = effectiveShellGate;
+            if (shellGate === "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
+                deps.onError?.(new Error(`shell gate doctrine is "off" while a real writable shell (Bash) is mounted — no shell safety-axis ` +
+                    `fold applies to this run (commands are adjudicated by the ordinary policy/hook chain only). ` +
+                    `Set spec.shellGate to "classify" or "always" if this deployment expects doctrine-gated shell behavior.`), { phase: "config", sessionId, classification: "shell-gate-off" });
+            }
             if (shellGate !== "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
                 shellGatedBash = !egressTools.has("Bash") && !irreversibilityTier.has("Bash");
                 irreversibilityTier.set("Bash", shellGate === "always" ? "always" : "maybe");
@@ -1591,10 +1728,79 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (offloadStore)
             tools.push(createReadToolResultTool(offloadStore));
         const onQuestion = frozenOnQuestion;
+        const liveQuestionFace = isLiveQuestionFace(onQuestion) ? onQuestion : undefined;
+        const contentAskBindings = new Map();
+        const CONTENT_ASK_BINDING_CAP = 32;
+        const contentAskRoutable = (toolCallId) => liveQuestionFace !== undefined &&
+            mountedQuestionTool !== undefined &&
+            tools.includes(mountedQuestionTool) &&
+            runtimeCaps?.forceDurableGate !== true &&
+            !inheritedUnavailableAsks.has(toolCallId);
+        const lateStrandedAnswers = [];
+        const discloseStrandedAnswers = (records, why) => {
+            if (records.length === 0)
+                return;
+            try {
+                deps.onError?.(new Error(`AskUserQuestion: ${records.length} question(s) were answered by a person but the call never ` +
+                    `executed to collect the answer (${records.map((r) => `${r.toolCallId} [delivery ${r.deliveryId}]`).join(", ")}) — ${why}. The answer(s) were NOT ` +
+                    `delivered to the model and are gone with this leg; re-ask if the decision is still needed.`), { phase: "degraded", sessionId, classification: "unconsumed-human-answer" });
+            }
+            catch {
+            }
+        };
+        const settleContentAskBindings = () => {
+            const stranded = [];
+            for (const [callId, bound] of contentAskBindings) {
+                if (bound.kind === "answered")
+                    stranded.push({ deliveryId: bound.deliveryId, toolCallId: callId });
+            }
+            contentAskBindings.clear();
+            discloseStrandedAnswers(stranded, "the leg ended first (abort, batch teardown, or a loop failure)");
+            const byDelivery = new Map();
+            for (const r of [...stranded, ...lateStrandedAnswers])
+                byDelivery.set(r.deliveryId, r);
+            return [...byDelivery.values()];
+        };
         const durableQuestionFace = resolveCheckpointStore(spec, deps) !== undefined &&
             (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true);
-        if (spec.interactiveTools === true || (spec.interactiveTools !== false && (onQuestion !== undefined || durableQuestionFace)))
-            tools.push(createAskUserQuestionTool(onQuestion, { principal: spec.principal, sourceTaskId: sessionId }));
+        const mountedQuestionFace = liveQuestionFace !== undefined
+            ? async (req, signal) => {
+                const bound = contentAskBindings.get(req.toolCallId);
+                if (bound !== undefined) {
+                    if (bound.questionsHash === boundInputHashOf(req.questions)) {
+                        contentAskBindings.delete(req.toolCallId);
+                        if (bound.kind === "answered")
+                            return bound.answer;
+                        throw bound.error;
+                    }
+                    contentAskBindings.delete(req.toolCallId);
+                }
+                return liveQuestionFace(req, signal);
+            }
+            : onQuestion;
+        const questionToolMounted = spec.interactiveTools === true || (spec.interactiveTools !== false && (onQuestion !== undefined || durableQuestionFace));
+        let mountedQuestionTool;
+        if (questionToolMounted)
+            tools.push((mountedQuestionTool =
+                createAskUserQuestionTool(mountedQuestionFace, { principal: spec.principal, sourceTaskId: sessionId }, {
+                    ...(resume?.redeemedContentAskCallId !== undefined
+                        ? {
+                            redeemedApprovalCallId: resume.redeemedContentAskCallId,
+                            ...(resume.redeemedContentAskQuestionsHash !== undefined ? { redeemedApprovalQuestionsHash: resume.redeemedContentAskQuestionsHash } : {}),
+                        }
+                        : {}),
+                    ...(resolvedInteractionPosture !== undefined ? { posture: resolvedInteractionPosture } : {}),
+                    ...(spec.interactiveQuestionFallback === true ? { interactiveFallback: true } : {}),
+                    onSyntheticContinuation: ({ questionId, reason }) => {
+                        deps.onError?.(new Error(`AskUserQuestion ${questionId}: no human answer was obtainable (` +
+                            (reason === "seam_absent"
+                                ? "no onQuestion seam is wired"
+                                : reason === "declined_unavailable"
+                                    ? "the wired question channel reported nobody was reachable"
+                                    : "the wired question channel failed") +
+                            `) — the model was instructed to self-answer and the run CONTINUES (warning, not a failure).`), { phase: "degraded", sessionId, classification: "no-human-autoanswered" });
+                    },
+                })));
         if (spec.handsReadOnly !== true) {
             const sessionScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
             tools.push(...createSchedulerTools(executionEnv, {
@@ -1632,7 +1838,34 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     .catch(() => undefined);
             }
             : undefined;
-        const { memoryEngineSession, memoryBlock: memoryBlockFromEngine, seedFiles: memorySeedFiles } = await prepareMemory({ spec, deps, sessionId, taskRootPath, memoryWriteGateRef });
+        const { memoryEngineSession, memoryBlock: memoryBlockFromEngine, seedFiles: memorySeedFiles, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, } = await prepareMemory({
+            spec,
+            deps,
+            sessionId,
+            taskRootPath,
+            memoryWriteGateRef,
+            admissionCtx: {
+                orgMemoryDenied: complianceDenies.has("org_memory_mount"),
+                complianceDegraded,
+                parentAdmittedOrgScopes: foldAdmissionFreeze({
+                    delegated: internals?.isDelegatedChild === true ||
+                        internals?.inheritedGate !== undefined ||
+                        (resume?.seed.inheritedGate !== undefined &&
+                            (resume.seed.inheritedGate.ancestorRules !== undefined ||
+                                resume.seed.inheritedGate.shellGate !== undefined ||
+                                resume.seed.inheritedGate.admittedOrgScopes !== undefined ||
+                                resume.seed.inheritedGate.requiresParentConstraint)),
+                    inherited: inheritedAdmittedOrgScopes,
+                }),
+                priorOwnVerdict: priorOwnOrgVerdict,
+                governedProvenance: orgGovernedProvenance,
+            },
+        });
+        memoryAdmittedOrgScopesRef.current = memoryAdmittedOrgScopes;
+        ownOrgVerdictRef.current = memoryOwnOrgVerdict ?? priorOwnOrgVerdict;
+        if (internals?.ownOrgAdmissionRef !== undefined && ownOrgVerdictRef.current !== undefined) {
+            internals.ownOrgAdmissionRef.current = ownOrgVerdictRef.current;
+        }
         let memoryBlock = memoryBlockFromEngine;
         if (memorySeedFiles?.length && seedContextFiles) {
             try {
@@ -1737,7 +1970,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         { entries: [], seedAnnounced: true }
                     : undefined;
         const provider = spec.promptProvider ?? deps.promptProvider ?? defaultPromptProvider;
-        const promptPolicyEnabled = Boolean(spec.toolPolicy ?? deps.toolPolicy);
+        const promptPolicyEnabled = Boolean(lockedPreflight.toolPolicy);
         const promptHooks = spec.hooks ?? deps.hooks;
         const promptHooksEnabled = Boolean(promptHooks?.preToolUse || promptHooks?.postToolUse);
         const failClosedReason = selfOrchestrationFailClosedReason(spec, deps);
@@ -2029,6 +2262,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             model,
             deferNames: (toolFaceSnapshot.defer ?? []).filter((n) => tools.some((t) => t.name === n)),
             alwaysLoadNames: [
+                ASK_USER_QUESTION_TOOL_NAME,
                 ...(toolFaceSnapshot.alwaysLoad ?? []),
                 ...mcp.tools
                     .filter((t) => t.mcpAlwaysLoad === true && !(toolFaceSnapshot.defer ?? []).includes(t.name))
@@ -2328,7 +2562,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }));
             },
             ...(spec.streamingToolExecution === true ? { streamingToolExecution: true } : {}),
-            followUpMode: "all",
             env: executionEnv,
             session,
             tools: harnessTools,
@@ -2368,7 +2601,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const policy = spec.toolPolicy ?? deps.toolPolicy;
+        const policy = lockedPreflight.toolPolicy;
         const auditPolicyNames = (auditee) => {
             const nameGroups = toolPolicyNameSets(auditee);
             if (nameGroups.length > 0) {
@@ -2456,7 +2689,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         for (const layer of narrowingLayers)
             auditPolicyNames(layer);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
-        const basePolicyForResumeEdit = spec.toolPolicy ?? deps.toolPolicy;
+        const basePolicyForResumeEdit = lockedPreflight.toolPolicy;
         const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
         const sharedFirstDecision = new Map();
         const SHARED_FIRST_DECISION_CAP = 256;
@@ -2511,6 +2744,15 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ? { sourceAgentName: internals?.explicitAgentName ?? internals?.agentName }
                 : {}),
         });
+        const riskAxesOf = (toolName) => {
+            const tier = irreversibilityTier.get(toolName);
+            const negatives = axisExplicitNegatives.get(toolName);
+            const irreversible = tier === "always" || tier === "maybe" ? true : tier === "never" ? false : negatives?.irreversible;
+            const egress = egressTools.has(toolName) ? true : negatives?.egress;
+            if (irreversible === undefined && egress === undefined)
+                return {};
+            return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
+        };
         const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal) => {
             let editArgs = edit;
             for (let round = 0;; round++) {
@@ -2543,6 +2785,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     args: editArgs,
                     message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                     ...askSourceIdentity(),
+                    ...riskAxesOf(creq.toolName),
                     ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 }, onAskOf, csignal ?? abortController.signal);
                 if (rr.action !== "allow")
@@ -2567,8 +2810,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         return first;
                     if (first.action === "allow")
                         return { action: "allow" };
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME)
+                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
                         return first;
+                    }
                     if (pc.durableMandate === true) {
                         if (resolveCheckpointStore(spec, deps) !== undefined &&
                             (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
@@ -2589,6 +2833,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         args: presentedArgs,
                         message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
+                        ...riskAxesOf(creq.toolName),
                         ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     }, pc.onAsk, csignal ?? abortController.signal);
                     const askWaitMs = Math.max(0, now() - askT0);
@@ -2623,8 +2868,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                     if (decision.action !== "ask")
                         return decision;
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME)
+                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
                         return decision;
+                    }
                     if (pc.durableMandate === true) {
                         if (resolveCheckpointStore(spec, deps) !== undefined &&
                             (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
@@ -2645,6 +2891,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         args: presentedArgs,
                         message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
+                        ...riskAxesOf(creq.toolName),
                         ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     }, pc.onAsk, csignal ?? abortController.signal);
                     const askWaitMs = Math.max(0, now() - askT0);
@@ -2830,6 +3077,42 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             };
         })();
         const platformSuspendArmed = durableSuspendInfraReady && (envLifetimeSuspendAt !== undefined || usageGovernance !== undefined);
+        const checkpointStore = resolveCheckpointStore(spec, deps);
+        const durableApproval = spec.durableApproval ??
+            (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
+        const wiringQuestionSeam = resolveQuestionSeam(spec, deps);
+        const wiringQuestionStripped = internals?.questionFaceStripped === true;
+        const wiringAskSeam = resolveAskSeamForm(spec, deps);
+        const wiringManifest = deriveWiringManifest({
+            half: "effective",
+            leg: resume !== undefined ? "resume" : internals?.isDelegatedChild === true ? "child" : "root",
+            askForm: wiringAskSeam.form,
+            ...(wiringAskSeam.provenance !== undefined ? { askProvenance: wiringAskSeam.provenance } : {}),
+            questionWired: wiringQuestionSeam.wired,
+            ...(wiringQuestionSeam.provenance !== undefined ? { questionProvenance: wiringQuestionSeam.provenance } : {}),
+            ...(wiringQuestionStripped ? { questionStrippedByEngine: true } : {}),
+            ...(resolvedInteractionPosture !== undefined ? { interactionPosture: resolvedInteractionPosture } : {}),
+            ...(spec.interactiveTools === true && !wiringQuestionSeam.wired && !durableQuestionFace && !wiringQuestionStripped
+                ? { interactiveToolsWithoutDeliveryFace: true }
+                : {}),
+            elicitSeamWired: resolveElicitSeam(deps),
+            elicitServersOptedIn: countElicitOptIns(spec),
+            parkCapable: checkpointStore !== undefined,
+            parkDurableApprovalOptIn: spec.durableApproval !== undefined,
+            parkForceDurableGate: runtimeCaps?.forceDurableGate === true,
+            parkSafetyVocabularyArmed: irreversibleTools.size > 0 || egressTools.size > 0,
+            ...(checkpointStore !== undefined ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
+            sessionDurability: resolveDeclaredDurability(sessions, "sessionStore"),
+            backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
+            hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
+            lockedConfigWired: deps.lockedConfig !== undefined,
+            complianceWired: deps.compliancePostureResolver !== undefined,
+            memoryAdmissionWired: deps.memoryScopeAdmission !== undefined,
+            retentionPolicyWired: deps.retentionPolicy !== undefined,
+        });
+        const parkLaneArmed = wiringManifest.parkLane.effective === true;
+        const hookContextConsumerWired = hooks?.preToolUse !== undefined || hooks?.postToolUse !== undefined || hooks?.postToolUseFailure !== undefined;
+        const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
         if (effectivePolicy || hooks?.preToolUse || egressTools.size > 0 || irreversibleTools.size > 0 || resourceSuspendEligible || platformSuspendArmed || spec.enablePlanMode === true) {
             const adjudicate = effectivePolicy
                 ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot }, abortController.signal)), abortController.signal, () => ({
@@ -2911,6 +3194,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     })(),
                     message: decision.message ?? `approval required for "${req.toolName}"`,
                     ...askSourceIdentity(),
+                    ...riskAxesOf(req.toolName),
                     ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 }, onAsk, abortController.signal);
                 const waitMs = Math.max(0, now() - t0);
@@ -2950,9 +3234,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 catch {
                 }
             };
-            const checkpointStore = resolveCheckpointStore(spec, deps);
-            const durableApproval = spec.durableApproval ??
-                (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
             const inFlightSpendMicroUsd = () => {
                 const own = liveSpendRef.get?.().costMicroUsd ?? 0;
                 const seededNested = resume?.seed.nestedStats.costMicroUsd;
@@ -2991,13 +3272,24 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     return live.length > 0 ? live : undefined;
                 })(),
                 pendingSteer: undefined,
+                pendingSteerQueue: undefined,
                 inheritedGate: (() => {
                     const requiresParentConstraint = (inheritedParentConstraints?.length ?? 0) > 0 || seedInheritedGate?.requiresParentConstraint === true;
                     const parentConstraintCount = (inheritedParentConstraints?.length ?? 0) > 0 ? inheritedParentConstraints.length : seedInheritedGate?.parentConstraintCount;
-                    return inheritedAncestorRules !== undefined || inheritedShellGate !== undefined || requiresParentConstraint
+                    return inheritedAncestorRules !== undefined ||
+                        inheritedShellGate !== undefined ||
+                        inheritedAdmittedOrgScopes !== undefined ||
+                        ownOrgVerdictRef.current !== undefined ||
+                        orgGovernedProvenance ||
+                        requiresParentConstraint
                         ? {
                             ...(inheritedAncestorRules !== undefined ? { ancestorRules: structuredClone(inheritedAncestorRules) } : {}),
                             ...(inheritedShellGate !== undefined ? { shellGate: inheritedShellGate } : {}),
+                            ...(inheritedAdmittedOrgScopes !== undefined ? { admittedOrgScopes: [...inheritedAdmittedOrgScopes] } : {}),
+                            ...(ownOrgVerdictRef.current !== undefined
+                                ? { ownAdmittedOrgScopes: [...ownOrgVerdictRef.current.scopes], ownAdmittedOrgWriteScope: ownOrgVerdictRef.current.writeScope }
+                                : {}),
+                            ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
                             requiresParentConstraint,
                             ...(requiresParentConstraint && parentConstraintCount !== undefined ? { parentConstraintCount } : {}),
                         }
@@ -3112,7 +3404,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 const mintedAt = Date.now();
                 const cp = {
                     token,
-                    version: resourceLedgerOut.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
+                    version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : resourceLedgerOut.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
                     scope,
                     sessionId,
                     leafId,
@@ -3194,7 +3486,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const mintedAt = Date.now();
                     const cp = {
                         token,
-                        version: reviewLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                        version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : reviewLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                         scope,
                         sessionId,
                         leafId,
@@ -3228,13 +3520,92 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     return true;
                 }
                 : undefined;
-            const suspendAsk = checkpointStore && (durableApproval || irreversibleTools.size > 0 || egressTools.size > 0)
-                ? async (req, postHookArgs, safety, approverUnavailable) => {
-                    if (safety === undefined &&
-                        onAsk !== undefined &&
+            const resolveContentAsk = async (req) => {
+                if (!contentAskRoutable(req.toolCallId) || liveQuestionFace === undefined || mountedQuestionTool === undefined) {
+                    return { kind: "unavailable", parkDeclined: false };
+                }
+                const deliveryId = uuidv7();
+                const bindOutcome = (entry, questionsHash) => {
+                    if (contentAskBindings.size >= CONTENT_ASK_BINDING_CAP && !contentAskBindings.has(req.toolCallId))
+                        return;
+                    contentAskBindings.set(req.toolCallId, { ...entry, questionsHash, deliveryId });
+                };
+                const refuseBeforeDelivery = (code, presentedInput) => ({
+                    kind: "delivery_failure",
+                    code,
+                    ...(presentedInput !== undefined ? { presentedInput } : {}),
+                });
+                let retained;
+                let presented;
+                try {
+                    retained = structuredClone(req.args);
+                    presented = structuredClone(retained.questions);
+                }
+                catch {
+                    return refuseBeforeDelivery("question.malformed_request");
+                }
+                const retainedQuestionsHash = boundInputHashOf(retained.questions);
+                if (!Value.Check(mountedQuestionTool.parameters, retained) || validateAskQuestions(presented) !== undefined) {
+                    return refuseBeforeDelivery("question.malformed_request", retained);
+                }
+                if (contentAskBindings.size >= CONTENT_ASK_BINDING_CAP && !contentAskBindings.has(req.toolCallId)) {
+                    return { kind: "unavailable", parkDeclined: true };
+                }
+                if (abortController.signal.aborted) {
+                    return { kind: "delivery_failure", code: "question.aborted", presentedInput: retained };
+                }
+                try {
+                    const facePromise = (async () => liveQuestionFace({
+                        toolCallId: req.toolCallId,
+                        questions: presented,
+                        ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                        sourceTaskId: sessionId,
+                        boundInputHash: boundInputHashOf(retained),
+                        deliveryId,
+                    }, abortController.signal))();
+                    const settlement = await raceAbort(facePromise.then((outcome) => ({ tag: "outcome", outcome }), (error) => ({ tag: "threw", error })), abortController.signal, () => ({ tag: "aborted" }));
+                    if (settlement.tag === "aborted") {
+                        void facePromise.then((late) => {
+                            if (classifyQuestionOutcome(late).shape !== "answered")
+                                return;
+                            lateStrandedAnswers.push({ deliveryId, toolCallId: req.toolCallId });
+                            discloseStrandedAnswers([{ deliveryId, toolCallId: req.toolCallId }], "the task had already ended when the answer arrived");
+                        }, () => undefined).catch(() => undefined);
+                    }
+                    if (settlement.tag === "outcome") {
+                        const outcome = settlement.outcome;
+                        const reading = classifyQuestionOutcome(outcome);
+                        if (reading.shape === "contradictory") {
+                            bindOutcome({ kind: "failed", error: new Error("the question channel returned a contradictory outcome (an unavailable answer)") }, retainedQuestionsHash);
+                            return { kind: "delivery_failure", code: "question.human_channel_failed", presentedInput: retained };
+                        }
+                        if (reading.shape === "unavailable")
+                            return { kind: "unavailable", parkDeclined: true, presentedInput: retained };
+                        const answerSnapshot = reading.answer;
+                        bindOutcome({ kind: "answered", answer: answerSnapshot }, retainedQuestionsHash);
+                        return { kind: "answered", presentedInput: retained };
+                    }
+                    const error = settlement.tag === "threw"
+                        ? settlement.error
+                        : Object.assign(new Error("the task ended while this question was still out"), { name: "AbortError" });
+                    bindOutcome({ kind: "failed", error }, retainedQuestionsHash);
+                    return {
+                        kind: "delivery_failure",
+                        code: settlement.tag === "aborted" || abortController.signal.aborted ? "question.aborted" : "question.human_channel_failed",
+                        presentedInput: retained,
+                    };
+                }
+                catch (err) {
+                    bindOutcome({ kind: "failed", error: err }, retainedQuestionsHash);
+                    return { kind: "delivery_failure", code: "question.human_channel_failed", presentedInput: retained };
+                }
+            };
+            const suspendAsk = parkLaneArmed && checkpointStore !== undefined
+                ? async (req, postHookArgs, safety, liveFaceUnavailable) => {
+                    const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : onAsk !== undefined;
+                    if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
-                        approverUnavailable !== true &&
-                        req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+                        liveFaceUnavailable !== true &&
                         !inheritedUnavailableAsks.has(req.toolCallId)) {
                         return undefined;
                     }
@@ -3320,7 +3691,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const mintedAt = Date.now();
                         cp = {
                             token,
-                            version: approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                            version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                             scope,
                             sessionId,
                             leafId,
@@ -3381,11 +3752,28 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (eff !== undefined && !toolEffects.has(t.name))
                     toolEffects.set(t.name, eff);
             }
-            toolCallGateArmedRef.armed = effectivePolicy !== undefined || hooks?.preToolUse !== undefined || egressTools.size > 0 || irreversibleTools.size > 0 || spec.enablePlanMode === true;
+            toolCallGateArmedRef.armed =
+                effectivePolicy !== undefined ||
+                    hooks?.preToolUse !== undefined ||
+                    egressTools.size > 0 ||
+                    irreversibleTools.size > 0 ||
+                    spec.enablePlanMode === true ||
+                    complianceDenies.has("web_fetch");
             if (toolCallGateArmedRef.armed) {
                 harness.on("tool_call", async (e) => {
                     blockedToolCalls.delete(e.toolCallId);
                     inheritedAskGrants.delete(e.toolCallId);
+                    {
+                        const complianceDeny = complianceCallDenial(complianceDenies, e.toolName);
+                        if (complianceDeny !== undefined) {
+                            if (blockedTracked)
+                                blockedToolCalls.add(e.toolCallId);
+                            if (notifyPermissionDenied) {
+                                await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, source: "safety" });
+                            }
+                            return { block: true, reason: formatHookFeedback(complianceDeny), preToolContext: [] };
+                        }
+                    }
                     if (planModeRef.active && (toolEffects.get(e.toolName) ?? "write") !== "read") {
                         if (blockedTracked)
                             blockedToolCalls.add(e.toolCallId);
@@ -3406,9 +3794,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: spec.taskId ?? sessionId, site: f.site, message: f.error.message, ts: Date.now() })),
                             event: e,
                             preToolUse: hooks?.preToolUse,
+                            ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
                             adjudicate,
                             resolveAsk: resolveAskBound,
                             suspendAsk,
+                            resolveContentAsk,
                             egress: egressTools.has(e.toolName),
                             irreversibility: irreversibilityTier.get(e.toolName),
                             reversibilityProbe: reversibilityProbes.get(e.toolName),
@@ -3461,7 +3851,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
                             content: e.content.map((c) => ({ ...c })),
                             details: clonedDetails,
-                        }, { toolCallId: e.toolCallId, toolName: e.toolName });
+                        }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}) });
                         if (patch?.additionalContext) {
                             content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext) }];
                             changed = true;
@@ -3469,7 +3859,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 }
                 else if (hooks?.postToolUse) {
-                    const patch = await hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName });
+                    const patch = await hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}) });
                     if (patch?.updatedOutput) {
                         content = patch.updatedOutput;
                         changed = true;
@@ -3718,7 +4108,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             : undefined;
         overheadState.promptChars = systemPrompt.length;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, cacheBreakDetector, cacheFingerprint, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;