@sema-agent/core 5.21.0 → 5.22.0

package/dist/core/permission-rule-sync.js

@@ -0,0 +1,314 @@
+import { parseAllowRuleText } from "./permission-rule-model.js";
+import { applyTombstones, errText, joinFrontiers, joinRuleStates, normalizePersistedRule, ruleSyncVector, sameScope, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
+export const PERMISSION_RULE_SYNC_PATH = "/v1/permission-rules/sync";
+export const LOCAL_OWNER_UNSYNCABLE_CODE = "permission_rules.local_owner_unsyncable";
+function refuseLocalOwnerSync() {
+    const e = new Error("a local-owner rule bucket cannot sync — syncing is an authenticated act, and this bucket has no cloud home until it is adopted (adoptFilePermissionRuleStore); this is NOT an authentication failure");
+    e.code = LOCAL_OWNER_UNSYNCABLE_CODE;
+    throw e;
+}
+const SYNC_MAX_ATTEMPTS = 8;
+export async function syncPermissionRules(opts) {
+    if (opts.owner !== undefined) {
+        if (opts.owner.kind === "local-owner")
+            refuseLocalOwnerSync();
+        if (opts.owner.principal !== opts.principal) {
+            throw new Error(`contradictory identity: principal "${opts.principal}" and owner principal "${opts.owner.principal}" disagree`);
+        }
+    }
+    if (typeof opts.principal !== "string" || opts.principal === "") {
+        throw new Error("syncPermissionRules requires a verified principal — an unauthenticated deployment has no cloud bucket to sync");
+    }
+    const store = opts.provider.forPrincipal(opts.principal);
+    const writer = writerOf(store);
+    if (writer === undefined) {
+        throw new Error("the resolved permission-rule store has no write face — a sync round cannot land through it");
+    }
+    const raw = await writer.readRaw();
+    const request = {
+        principal: opts.principal,
+        replica: raw.actor,
+        state: { rules: raw.rules, tombstones: raw.tombstones },
+        ...(raw.observedVector !== undefined ? { observedVector: raw.observedVector } : {}),
+    };
+    const rawResponse = await opts.transport(PERMISSION_RULE_SYNC_PATH, request);
+    const response = parseRuleSyncResponse(rawResponse, opts.principal);
+    const warnings = [...response.warnings];
+    const dropped = [];
+    const inboundTombstones = [];
+    let tombstoneWithholding = false;
+    const forgedDot = (d) => d.actor === raw.actor && d.counter > raw.counter;
+    for (const t of response.merged.tombstones) {
+        if (t === undefined) {
+            tombstoneWithholding = true;
+            continue;
+        }
+        const forged = forgedDot(t.deletedBy) ? t.deletedBy : t.removedDots.find(forgedDot);
+        if (forged !== undefined) {
+            dropped.push({ rule: t.rule, scope: t.scope, dot: forged, reason: "own_actor_forged" });
+            tombstoneWithholding = true;
+            continue;
+        }
+        inboundTombstones.push(t);
+    }
+    if (tombstoneWithholding) {
+        warnings.push("the response carried at least one malformed tombstone — every inbound add is withheld this round (legal tombstones land; the adds re-arrive once the peer repairs the tombstone: full-state exchange has no missed-forever window)");
+    }
+    const inboundRules = [];
+    if (!tombstoneWithholding) {
+        for (const r of response.merged.rules) {
+            const n = normalizePersistedRule(r);
+            if ("reject" in n) {
+                for (const a of r.adds)
+                    dropped.push({ rule: r.rule, scope: r.scope, dot: a.dot, reason: n.reject });
+                continue;
+            }
+            const kept = r.adds.filter((a) => {
+                if (a.dot.actor === raw.actor && a.dot.counter > raw.counter) {
+                    dropped.push({ rule: r.rule, scope: r.scope, dot: a.dot, reason: "own_actor_forged" });
+                    return false;
+                }
+                return true;
+            });
+            if (kept.length > 0)
+                inboundRules.push({ ...r, adds: kept });
+        }
+    }
+    const inbound = { rules: inboundRules, tombstones: inboundTombstones };
+    const quarantine = [];
+    const localScreen = screenRuleSyncState({ rules: raw.rules, tombstones: raw.tombstones });
+    for (const rej of localScreen.rejected) {
+        if (rej.reason === "invalid_rule_text" || rej.reason === "metadata_mismatch") {
+            quarantine.push({ rule: rej.rule, scope: rej.scope, dots: [rej.dot], reason: rej.reason });
+            dropped.push(rej);
+        }
+    }
+    const localDots = new Set(raw.rules.flatMap((r) => r.adds.map((a) => JSON.stringify([a.dot.actor, a.dot.counter]))));
+    for (const d of response.dropped) {
+        if (localDots.has(JSON.stringify([d.dot.actor, d.dot.counter]))) {
+            const reason = d.reason === "below_gc_frontier" ? "below_gc_frontier" : "server_rejected";
+            quarantine.push({ rule: d.rule, scope: d.scope, dots: [d.dot], reason });
+            dropped.push({ rule: d.rule, scope: d.scope, dot: d.dot, reason });
+        }
+        else {
+            warnings.push(`the server dropped an inbound-side record (${d.rule}, dot ${d.dot.actor}#${d.dot.counter}): ${d.reason}`);
+        }
+    }
+    const clean = !tombstoneWithholding;
+    let current = raw;
+    for (let attempt = 0; attempt < SYNC_MAX_ATTEMPTS; attempt++) {
+        const preLive = applyTombstones(current.rules, current.tombstones);
+        const prospective = joinRuleStates({ rules: current.rules, tombstones: current.tombstones }, inbound);
+        const delta = {
+            kind: "sync-join",
+            inbound,
+            ...(response.gcFrontier !== undefined ? { gcFrontier: response.gcFrontier } : {}),
+            ...(clean ? { observedVector: joinFrontiers(current.observedVector ?? {}, ruleSyncVector(prospective)) } : {}),
+            ...(quarantine.length > 0 ? { quarantine } : {}),
+        };
+        let res;
+        try {
+            res = await writer.apply(delta, { expectedRev: current.rev });
+        }
+        catch (err) {
+            return {
+                ok: false,
+                pushed: { addDots: raw.rules.reduce((n, r) => n + r.adds.length, 0), tombstones: raw.tombstones.length },
+                landed: { newAdds: 0, newTombstones: 0 },
+                resurrected: [],
+                dropped,
+                rev: current.rev,
+                warnings: [...warnings, `the store refused the sync landing: ${errText(err)} — nothing landed, the local state is unchanged`],
+            };
+        }
+        if ("conflict" in res) {
+            current = await writer.readRaw();
+            continue;
+        }
+        const landedRaw = await writer.readRaw();
+        const postLive = applyTombstones(landedRaw.rules, landedRaw.tombstones);
+        const resurrected = [];
+        for (const r of postLive) {
+            const pre = preLive.find((p) => p.rule === r.rule && sameScope(p.scope, r.scope));
+            if (pre !== undefined)
+                continue;
+            const hadAdds = current.rules.some((p) => p.rule === r.rule && sameScope(p.scope, r.scope));
+            const covered = current.tombstones.some((t) => t.rule === r.rule && sameScope(t.scope, r.scope));
+            if (hadAdds && covered) {
+                const preRuleDots = new Set(current.rules.filter((p) => p.rule === r.rule && sameScope(p.scope, r.scope)).flatMap((p) => p.adds.map((a) => JSON.stringify([a.dot.actor, a.dot.counter]))));
+                const by = r.adds.find((a) => !preRuleDots.has(JSON.stringify([a.dot.actor, a.dot.counter]))) ?? r.adds[0];
+                if (by !== undefined)
+                    resurrected.push({ rule: r.rule, scope: r.scope, byDot: by.dot });
+            }
+        }
+        const dotKeyOf = (d) => JSON.stringify([d.actor, d.counter]);
+        const preDots = new Set(current.rules.flatMap((r) => r.adds.map((a) => dotKeyOf(a.dot))));
+        const newAdds = landedRaw.rules.flatMap((r) => r.adds).filter((a) => !preDots.has(dotKeyOf(a.dot))).length;
+        const tombKeyOf = (t) => JSON.stringify([t.rule, t.scope.kind === "global" ? null : t.scope.root, dotKeyOf(t.deletedBy)]);
+        const preTombs = new Set(current.tombstones.map(tombKeyOf));
+        const newTombstones = landedRaw.tombstones.filter((t) => !preTombs.has(tombKeyOf(t))).length;
+        const landedReport = res.sync;
+        for (const d of landedReport?.droppedInbound ?? []) {
+            if (!dropped.some((x) => x.dot.actor === d.dot.actor && x.dot.counter === d.dot.counter && x.reason === d.reason))
+                dropped.push(d);
+        }
+        for (const q of landedReport?.quarantined ?? []) {
+            if (!dropped.some((x) => x.dot.actor === q.dot.actor && x.dot.counter === q.dot.counter && x.reason === q.reason))
+                dropped.push(q);
+        }
+        return {
+            ok: dropped.length === 0 && warnings.length === 0,
+            pushed: { addDots: raw.rules.reduce((n, r) => n + r.adds.length, 0), tombstones: raw.tombstones.length },
+            landed: { newAdds, newTombstones },
+            resurrected,
+            dropped,
+            rev: landedRaw.rev,
+            ...(warnings.length > 0 ? { warnings } : {}),
+        };
+    }
+    return {
+        ok: false,
+        pushed: { addDots: raw.rules.reduce((n, r) => n + r.adds.length, 0), tombstones: raw.tombstones.length },
+        landed: { newAdds: 0, newTombstones: 0 },
+        resurrected: [],
+        dropped,
+        rev: current.rev,
+        warnings: [...warnings, `optimistic-concurrency retries exhausted after ${SYNC_MAX_ATTEMPTS} attempts — nothing landed, the local state is unchanged`],
+    };
+}
+function isDot(v) {
+    const d = v;
+    return typeof d?.actor === "string" && d.actor !== "" && typeof d.counter === "number" && Number.isFinite(d.counter);
+}
+function pickScope(v) {
+    const s = v;
+    if (s?.kind === "global")
+        return { kind: "global" };
+    if (s?.kind === "project" && typeof s.root === "string" && s.root !== "")
+        return { kind: "project", root: s.root };
+    return undefined;
+}
+function pickAdd(v) {
+    const a = v;
+    if (!isDot(a?.dot))
+        return undefined;
+    if (a.origin !== "user" && a.origin !== "imported-cc" && a.origin !== "starter")
+        return undefined;
+    if (typeof a.createdAt !== "string")
+        return undefined;
+    return { dot: { actor: a.dot.actor, counter: a.dot.counter }, origin: a.origin, createdAt: a.createdAt };
+}
+function pickFrontier(v) {
+    if (v === null || typeof v !== "object" || Array.isArray(v))
+        return undefined;
+    const out = {};
+    for (const [actor, counter] of Object.entries(v)) {
+        if (typeof counter !== "number" || !Number.isFinite(counter))
+            return undefined;
+        out[actor] = counter;
+    }
+    return out;
+}
+export function parseRuleSyncResponse(raw, expectedPrincipal) {
+    if (raw === null || typeof raw !== "object") {
+        throw new Error("the sync response is not an object — protocol error, nothing landed");
+    }
+    const r = raw;
+    if (typeof r.principal !== "string") {
+        throw new Error("the sync response carries no principal echo — protocol error, nothing landed");
+    }
+    if (r.principal !== expectedPrincipal) {
+        throw new Error(`the sync response echoes principal "${r.principal}" but this round synced "${expectedPrincipal}" — the transport is wired to the wrong bucket; refusing the whole round`);
+    }
+    const merged = r.merged;
+    if (merged === null || typeof merged !== "object" || !Array.isArray(merged.rules) || !Array.isArray(merged.tombstones)) {
+        throw new Error("the sync response carries no merged state — protocol error, nothing landed");
+    }
+    let gcFrontier;
+    if (r.gcFrontier !== undefined) {
+        gcFrontier = pickFrontier(r.gcFrontier);
+        if (gcFrontier === undefined) {
+            throw new Error("the sync response carries an unparseable gcFrontier — refusing the whole round (a garbled frontier must not drive the fence arm)");
+        }
+    }
+    const warnings = [];
+    const rules = [];
+    for (const entry of merged.rules) {
+        const e = entry;
+        const scope = pickScope(e?.scope);
+        if (typeof e?.rule !== "string" || scope === undefined || !Array.isArray(e.adds) || typeof e.command !== "string" || typeof e.tool !== "string" || typeof e.match !== "string") {
+            warnings.push("the response carried an unshapeable rule entry — skipped (it never reaches the local store)");
+            continue;
+        }
+        const adds = [];
+        let addDamaged = false;
+        for (const a of e.adds) {
+            const picked = pickAdd(a);
+            if (picked === undefined) {
+                addDamaged = true;
+                continue;
+            }
+            adds.push(picked);
+        }
+        if (addDamaged)
+            warnings.push(`rule "${e.rule}" carried at least one unshapeable add — skipped those adds`);
+        if (adds.length === 0)
+            continue;
+        rules.push({
+            rule: e.rule,
+            tool: e.tool,
+            match: e.match,
+            command: e.command,
+            scope,
+            adds,
+        });
+    }
+    const tombstones = [];
+    for (const entry of merged.tombstones) {
+        const t = entry;
+        const scope = pickScope(t?.scope);
+        const canonicalTomb = typeof t?.rule === "string" ? parseAllowRuleText(t.rule) : undefined;
+        if (typeof t?.rule !== "string" ||
+            canonicalTomb === undefined ||
+            "reject" in canonicalTomb ||
+            canonicalTomb.rule.rule !== t.rule ||
+            scope === undefined ||
+            !isDot(t.deletedBy) ||
+            !Array.isArray(t.removedDots) ||
+            t.removedDots.length === 0 ||
+            !t.removedDots.every(isDot)) {
+            tombstones.push(undefined);
+            continue;
+        }
+        tombstones.push({
+            rule: t.rule,
+            scope,
+            removedDots: t.removedDots.map((d) => ({ actor: d.actor, counter: d.counter })),
+            deletedBy: { actor: t.deletedBy.actor, counter: t.deletedBy.counter },
+        });
+    }
+    const dropped = [];
+    if (r.dropped !== undefined) {
+        if (!Array.isArray(r.dropped)) {
+            warnings.push("the response carried a non-array dropped field — ignored");
+        }
+        else {
+            for (const entry of r.dropped) {
+                const d = entry;
+                const scope = pickScope(d?.scope);
+                if (typeof d?.rule !== "string" || scope === undefined || !isDot(d.dot) || typeof d.reason !== "string") {
+                    warnings.push("the response carried an unshapeable dropped entry — ignored (the server's own drop discipline is its contract obligation)");
+                    continue;
+                }
+                dropped.push({ rule: d.rule, scope, dot: { actor: d.dot.actor, counter: d.dot.counter }, reason: d.reason });
+            }
+        }
+    }
+    return {
+        principal: r.principal,
+        merged: { rules, tombstones },
+        ...(gcFrontier !== undefined ? { gcFrontier } : {}),
+        dropped,
+        warnings,
+    };
+}

package/dist/core/runner/prepare-memory.js

@@ -2,7 +2,7 @@ import { admitMemoryScopes } from "../memory-admission.js";
 import { adoptLegacyRepoDirs, deriveRepoControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
 import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir, mergeHarvestReports, mergeInjections, needsDualRoots, parsedProjectPlane } from "../memory-engine/dual-root.js";
 import { normalizeMemorySpec } from "../memory.js";
-import { MEMORY_RECALL_DISCIPLINE, MemoryEngine } from "../memory-engine/engine.js";
+import { MEMORY_PREFERENCE_DISCIPLINE, MEMORY_RECALL_DISCIPLINE, MemoryEngine } from "../memory-engine/engine.js";
 import { createMemoryEngineTools } from "../memory-engine/tools.js";
 import { assertScopeContractPlacement, parseScopeKey, resolveProjectId } from "../memory-engine/scope-contract.js";
 import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
@@ -151,13 +151,23 @@ export async function prepareMemory(input) {
                 writeHandle = writeIsPersonal ? personalHandle : projectHandle;
                 injectFn = () => mergeInjections(projectEngine.inject(projectHandle, { writeToolMounted: input.writeToolsMounted }), personalEngine.inject(personalHandle, { writeToolMounted: input.writeToolsMounted }));
                 toolPlanes = [
-                    { backend: retrievalBackend(backend), scopes: planeScopes(p.project, p.writePlane === "project" ? memorySpec.writeScope : null), recordRetrieved: (ids) => projectEngine.recordRetrieved(ids) },
-                    { backend: retrievalBackend(personal.backend), scopes: planeScopes(p.personal, p.writePlane === "personal" ? memorySpec.writeScope : null), recordRetrieved: (ids) => personalEngine.recordRetrieved(ids) },
+                    {
+                        backend: retrievalBackend(backend),
+                        scopes: planeScopes(p.project, p.writePlane === "project" ? memorySpec.writeScope : null),
+                        recordRetrieved: (ids) => projectEngine.recordRetrieved(ids),
+                        challengeExclusions: () => projectEngine.readChallengeExclusions(),
+                    },
+                    {
+                        backend: retrievalBackend(personal.backend),
+                        scopes: planeScopes(p.personal, p.writePlane === "personal" ? memorySpec.writeScope : null),
+                        recordRetrieved: (ids) => personalEngine.recordRetrieved(ids),
+                        challengeExclusions: () => personalEngine.readChallengeExclusions(),
+                    },
                 ];
                 harvestBoth = async () => {
                     const writeFirst = writeIsPersonal ? [personalEngine, personalHandle] : [projectEngine, projectHandle];
                     const readOther = writeIsPersonal ? [projectEngine, projectHandle] : [personalEngine, personalHandle];
-                    const writeReport = await writeFirst[0].harvest(writeFirst[1], pollutedOpts(writeFirst[0]));
+                    const writeReport = await writeFirst[0].harvest(writeFirst[1], { ...pollutedOpts(writeFirst[0]), sessionId });
                     let readReport;
                     let readFailure;
                     try {
@@ -179,8 +189,15 @@ export async function prepareMemory(input) {
                 writeEngine = personalEngine;
                 writeHandle = handle;
                 injectFn = () => personalEngine.inject(handle, { writeToolMounted: input.writeToolsMounted });
-                harvestBoth = () => personalEngine.harvest(handle, pollutedOpts(personalEngine));
-                toolPlanes = [{ backend: retrievalBackend(personal.backend), scopes: planeScopes(memorySpec.scopes, memorySpec.writeScope), recordRetrieved: (ids) => personalEngine.recordRetrieved(ids) }];
+                harvestBoth = () => personalEngine.harvest(handle, { ...pollutedOpts(personalEngine), sessionId });
+                toolPlanes = [
+                    {
+                        backend: retrievalBackend(personal.backend),
+                        scopes: planeScopes(memorySpec.scopes, memorySpec.writeScope),
+                        recordRetrieved: (ids) => personalEngine.recordRetrieved(ids),
+                        challengeExclusions: () => personalEngine.readChallengeExclusions(),
+                    },
+                ];
             }
             else {
                 const engine = new MemoryEngine({
@@ -193,8 +210,15 @@ export async function prepareMemory(input) {
                 writeEngine = engine;
                 writeHandle = handle;
                 injectFn = () => engine.inject(handle, { writeToolMounted: input.writeToolsMounted });
-                harvestBoth = () => engine.harvest(handle, pollutedOpts(engine));
-                toolPlanes = [{ backend: retrievalBackend(backend), scopes: planeScopes(memorySpec.scopes, memorySpec.writeScope), recordRetrieved: (ids) => engine.recordRetrieved(ids) }];
+                harvestBoth = () => engine.harvest(handle, { ...pollutedOpts(engine), sessionId });
+                toolPlanes = [
+                    {
+                        backend: retrievalBackend(backend),
+                        scopes: planeScopes(memorySpec.scopes, memorySpec.writeScope),
+                        recordRetrieved: (ids) => engine.recordRetrieved(ids),
+                        challengeExclusions: () => engine.readChallengeExclusions(),
+                    },
+                ];
             }
             memoryWriteGateRef.current = (w) => writeEngine.gateWrite(writeHandle, w.key, w.content);
             const harvestSafe = async (phase = "terminal") => {
@@ -256,6 +280,9 @@ export async function prepareMemory(input) {
         if (memoryTools !== undefined) {
             memoryBlock = memoryBlock !== undefined ? `${memoryBlock}\n\n${MEMORY_RECALL_DISCIPLINE}` : MEMORY_RECALL_DISCIPLINE;
         }
+        if (memoryEngineSession.handle.writeScope !== null && input.writeToolsMounted) {
+            memoryBlock = memoryBlock !== undefined ? `${memoryBlock}\n\n${MEMORY_PREFERENCE_DISCIPLINE}` : MEMORY_PREFERENCE_DISCIPLINE;
+        }
         if (memoryBlock !== undefined && injection.indexSeed !== undefined)
             seedFiles = [injection.indexSeed];
     }

package/dist/core/runner/prepare-task.d.ts

@@ -1,6 +1,7 @@
 import { AgentHarness, type ThinkingLevel } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
 import { type CompactionForkContext } from "../auto-compaction.js";
+import { type AutoModeDecider } from "../auto-mode.js";
 import { type MaterializedMcp } from "../mcp.js";
 import { type MaterializedA2a } from "../a2a.js";
 import type { HarvestReport, MemorySessionHandle } from "../memory-engine/types.js";
@@ -869,7 +870,20 @@ export interface InheritedGate {
     orgAdmissionGoverned?: true;
     /** Live ancestor caller-policy constraints (opaque half), ancestors first. `policy` is the ancestor's
      *  RESOLVED caller policy (`spec.toolPolicy ?? deps.toolPolicy` — the same slot the ancestor itself
-     *  enforces, so a deps-level baseline is inherited too). `onAsk` is the ancestor's frozen
+     *  enforces, so a deps-level baseline is inherited too).
+     *
+     *  ⚖️ A-005.13 (ruled with the F-012 family, 2026-08-09): the ancestor's per-run BUDGET LEDGER does
+     *  NOT travel this chain — by design, not by omission. An inherited policy's `check` receives the
+     *  CHILD run's own `ToolCallRequest.budget` snapshot (the child's durable resource ledger), so a
+     *  SELF-LIMITING ancestor policy ("allow N escalations, then ask") sees a fresh ledger in each
+     *  delegated child rather than a continuation of the ancestor's counts. Freezing/snapshotting the
+     *  ancestor ledger was considered and rejected: a frozen ledger goes stale the moment the ancestor
+     *  keeps running (a stale ledger is a NEW wrongness surface, not a fix), and the durable resource
+     *  ledger's identity is per-run by contract. A deployment wanting cross-delegation budget coherence
+     *  carries it in its own policy state (the closure travels the chain intact — a closure-counter
+     *  policy DOES aggregate across the tree, since every layer evaluates the same instance).
+     *
+     *  `onAsk` is the ancestor's frozen
      *  `spec.onAsk ?? deps.onAsk` — an ancestor `ask` resolves at that ancestor's own approver
      *  (headless ⇒ deny), never at the child's. `durableMandate` is frozen at chain-assembly time when the
      *  ancestor ran under a durable-approval regime that would actually PARK its own plain asks — a
@@ -883,6 +897,29 @@ export interface InheritedGate {
         policy: ToolPolicy;
         onAsk?: OnAsk;
         durableMandate?: boolean;
+        /** The CONTENT-ask twin of `durableMandate`, frozen from the QUESTION seat (`spec.onQuestion ??
+         *  deps.onQuestion`) on the same rule: a `forceDurableGate` entitlement, or `durableApproval` with no
+         *  LIVE question face frozen (absent, or the reserved resume placeholder — neither can answer). A
+         *  wrapper seeing an `ask` on the question tool consults THIS bit, never the permission one: the two
+         *  asks are answered by two different faces, and a run with a live `onQuestion` and no permission
+         *  approver can answer a delegated question perfectly well. When it IS set the delegated question is
+         *  marked unresolvable and takes the child gate's park / honest-refusal leg, exactly as an inherited
+         *  permission ask does under `durableMandate`. */
+        contentMandate?: boolean;
+        /**
+         * F-012 (#106) — the ancestor's FROZEN auto-mode classifier: the same decider instance the
+         * ancestor's own gate consults for a surviving ask (`ToolGateInput.autoMode`). Without it the
+         * ancestor's ask DECISION CHAIN did not travel — the wrappers resolved an inherited ask straight
+         * at the frozen approver, so an ask the ancestor's classifier would have BLOCKED executed in the
+         * child on the frozen approver's allow. The wrapper runs it BEFORE the frozen approver, in the
+         * ancestor's own gate order (classifier → approver): `block` ⇒ deny (`decisionReason:"classifier"`),
+         * `allow` ⇒ the classifier's auto-allow (the frozen approver is not consulted), anything else
+         * falls through to the approver chain. Never consulted for the reserved question tool nor under a
+         * durable mandate (a marked call must reach the park with no synchronous decision-maker between).
+         */
+        autoMode?: {
+            decider: AutoModeDecider;
+        };
         /**
          * Set ONLY on an entry whose `policy` is the folded form of an ancestor's PreToolUse screening face
          * (issue #33 — the face used to stop at the task that installed it, so a call the ancestor had
@@ -1022,6 +1059,22 @@ export interface RunInternals {
      * Absent ⇒ no inheritance (a top-level task; fully backward-compatible).
      */
     inheritedGate?: InheritedGate;
+    /**
+     * design/180 half A — the delegation RUNTIME-PROVENANCE channel. Minted by the spawning delegation
+     * tool when the parent chain is armed (the parent mounts a memory session, or is itself recording
+     * for ITS parent): `ref` is the child's monotonic aggregate — the child's recorder writes into it
+     * as the run progresses (live faces read the current bits; the terminal attestation reduces from
+     * it); `contentSafety` is the chain's FROZEN classification snapshot — the child may narrow it
+     * with its own config, never widen (design/180 A-2). Trusted internals chain only, same posture as
+     * {@link inheritedGate}. Absent ⇒ the child records nothing (its deliveries then read `unknown`,
+     * and every judgment falls back to the static floor — fail-closed by construction).
+     */
+    delegationProvenance?: {
+        ref: {
+            current: import("../memory-engine/delegation-provenance.js").DelegationProvenanceAggregate;
+        };
+        contentSafety: import("../memory-engine/delegation-provenance.js").DelegationContentSafety;
+    };
     /**
      * #22 (ruled 2026-08-05) — the SESSION-scoped org-admission freeze for a SAME-SESSION continuation
      * that is NOT a checkpoint resume: a retained background child revived through the in-process resume