@sema-agent/core 5.21.0 → 5.22.0

package/dist/core/runner/prepare-task.js

@@ -20,12 +20,13 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, combinePolicies, isApprovalSettledBy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
 import { inlineUntrusted } from "../untrusted-text.js";
+import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
 import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, runToolGate } from "../hooks.js";
@@ -46,6 +47,7 @@ import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { MEMORY_RECALL_DISCIPLINE } from "../memory-engine/engine.js";
 import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
+import { narrowContentSafety, readCardAttestation } from "../memory-engine/delegation-provenance.js";
 import { composeMemoryBlock } from "../memory.js";
 import { preflightLockedConfig } from "../locked-config.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies } from "../compliance.js";
@@ -82,7 +84,7 @@ import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-
 import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
-import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
+import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveAskEffective, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
@@ -1057,6 +1059,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const memoryAdmittedOrgScopesRef = { current: [] };
         const ownOrgVerdictRef = { current: undefined };
         const orgAdmissionCheckpointState = () => inheritedAdmittedOrgScopes !== undefined || ownOrgVerdictRef.current !== undefined || orgGovernedProvenance;
+        const f012CheckpointState = () => (inheritedParentConstraints?.length ?? 0) > 0 ||
+            seedInheritedGate?.constraintChain !== undefined ||
+            internals?.delegationProvenance !== undefined;
         const frozenOnAsk = spec.onAsk ?? deps.onAsk;
         const hookEnvSource = (ownedEnv ?? deps.executionEnv) != null ? executionEnv : undefined;
         const notifyOwnHookCrash = (err) => {
@@ -1067,6 +1072,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
         };
         const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
+        const provenanceForChildrenRef = {};
+        const delegationProvenanceForChildren = () => provenanceForChildrenRef.current;
         const inheritedGateForChildren = () => {
             const ancestorRules = [
                 ...(inheritedAncestorRules ?? []),
@@ -1075,12 +1082,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const ownCallerPolicy = lockedPreflight.toolPolicy;
             const durableMandate = runtimeCaps?.forceDurableGate === true ||
                 (spec.durableApproval !== undefined && !isLiveApproverSeat(frozenOnAsk));
+            const contentMandate = runtimeCaps?.forceDurableGate === true ||
+                (spec.durableApproval !== undefined && !isLiveQuestionFace(frozenOnQuestion));
             const ownPreToolUse = preToolUseObservational ? undefined : hooks?.preToolUse;
             const hookConstraint = ownPreToolUse !== undefined &&
                 !(inheritedParentConstraints ?? []).some((pc) => pc.preToolUse === ownPreToolUse &&
                     askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
                     (pc.durableMandate === true) === durableMandate &&
-                    pc.hookEnv === hookEnvSource)
+                    (pc.contentMandate === true) === contentMandate &&
+                    pc.hookEnv === hookEnvSource &&
+                    pc.autoMode?.decider === autoModeDecider)
                 ? [
                     {
                         policy: createPreToolUseConstraintPolicy(ownPreToolUse, hookEnvFace, notifyOwnHookCrash),
@@ -1088,6 +1099,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...(hookEnvSource !== undefined ? { hookEnv: hookEnvSource } : {}),
                         ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
                         ...(durableMandate ? { durableMandate: true } : {}),
+                        ...(contentMandate ? { contentMandate: true } : {}),
+                        ...(autoModeDecider !== undefined ? { autoMode: { decider: autoModeDecider } } : {}),
                     },
                 ]
                 : [];
@@ -1100,6 +1113,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             policy: ownCallerPolicy,
                             ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
                             ...(durableMandate ? { durableMandate: true } : {}),
+                            ...(contentMandate ? { contentMandate: true } : {}),
+                            ...(autoModeDecider !== undefined ? { autoMode: { decider: autoModeDecider } } : {}),
                         },
                     ]
                     : []),
@@ -1140,6 +1155,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(centerAdoption?.sourceRevision !== undefined ? { centerSourceRevision: centerAdoption.sourceRevision } : {}),
             activeSkillScope: () => skillScope.active(),
             inheritedGateForChildren,
+            delegationProvenanceForChildren,
             ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),
             ...(spec.durableApproval !== undefined ? { durableApprovalForChildren: { ...spec.durableApproval } } : {}),
             ...(spec.checkpointStore === null ? { checkpointStoreDisabledForChildren: true } : {}),
@@ -1939,6 +1955,19 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (internals?.ownOrgAdmissionRef !== undefined && ownOrgVerdictRef.current !== undefined) {
             internals.ownOrgAdmissionRef.current = ownOrgVerdictRef.current;
         }
+        if (internals?.delegationProvenance !== undefined && resume !== undefined) {
+            const live = internals.delegationProvenance.ref.current;
+            const seed = resume.seed.delegationProvenance;
+            if (seed === undefined || seed.version !== 1 || seed.coverageStartTurn !== 0) {
+                live.incomplete = true;
+            }
+            else {
+                if (seed.sawExternal)
+                    live.sawExternal = true;
+                if (seed.incomplete)
+                    live.incomplete = true;
+            }
+        }
         let memoryBlock = memoryBlockFromEngine;
         if (memorySeedFiles?.length && seedContextFiles) {
             try {
@@ -2312,15 +2341,28 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         else {
             deferred = classifyDeferredOverFace(tools, []);
         }
-        if (memoryEngineSession !== undefined) {
-            const { pollution, contentSafety } = memoryEngineSession;
+        const delegationProvenanceChannel = internals?.delegationProvenance;
+        if (memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined) {
+            const pollution = memoryEngineSession?.pollution;
+            const effectiveSafety = narrowContentSafety(delegationProvenanceChannel?.contentSafety, memoryEngineSession?.contentSafety);
+            const trustedTools = effectiveSafety.trustedTools;
+            const execIsExternalContent = effectiveSafety.execIsExternalContent;
+            provenanceForChildrenRef.current = { trustedTools: [...trustedTools], execIsExternalContent };
+            const recordExternal = () => {
+                if (delegationProvenanceChannel !== undefined)
+                    delegationProvenanceChannel.ref.current.sawExternal = true;
+            };
+            const recordIncomplete = () => {
+                if (delegationProvenanceChannel !== undefined)
+                    delegationProvenanceChannel.ref.current.incomplete = true;
+            };
             const callerToolNames = new Set((spec.tools ?? []).map((t) => t.name));
             const contentOriginWrapped = new WeakSet();
             const classOf = (t) => classifyToolContentOrigin({
                 declared: t.contentOrigin,
                 isProtocolTool: protocolOf(t.name) !== undefined,
                 isCallerTool: callerToolNames.has(t.name),
-                trusted: contentSafety.trustedTools.has(t.name),
+                trusted: trustedTools.has(t.name),
             });
             const delegationByName = new Map();
             for (const t of spec.tools ?? []) {
@@ -2333,8 +2375,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 declared: t.contentOrigin,
                 isProtocolTool: protocolOf(t.name) !== undefined,
                 isCallerTool: true,
-                trusted: contentSafety.trustedTools.has(t.name),
-            }), contentSafety.execIsExternalContent);
+                trusted: trustedTools.has(t.name),
+            }), execIsExternalContent);
             contentOriginWrapRef.current = () => {
                 for (let i = 0; i < tools.length; i++) {
                     const t = tools[i];
@@ -2343,7 +2385,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const origin = classOf(t);
                     const delegation = delegationByName.get(t.name);
                     const isDelegation = delegation !== undefined;
-                    const pollutes = contentOriginPollutes(origin, contentSafety.execIsExternalContent);
+                    const pollutes = contentOriginPollutes(origin, execIsExternalContent);
                     if (!pollutes && !isDelegation) {
                         contentOriginWrapped.add(t);
                         continue;
@@ -2351,7 +2393,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const inner = t.execute.bind(t);
                     const mark = (reason) => {
                         try {
-                            pollution.markPolluted(reason);
+                            pollution?.markPolluted(reason);
                         }
                         catch {
                         }
@@ -2359,8 +2401,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const wrapped = {
                         ...t,
                         execute: async (toolCallId, params, signal, onUpdate) => {
-                            if (pollutes)
+                            if (pollutes) {
                                 mark(`tool "${t.name}" (${origin} content class) was invoked in this session`);
+                                recordExternal();
+                            }
                             if (!isDelegation)
                                 return inner(toolCallId, params, signal, onUpdate);
                             const requested = params?.subagent_type;
@@ -2371,9 +2415,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 isPolluting: poolToolPollutes,
                             });
                             const result = await inner(toolCallId, params, signal, onUpdate);
-                            if (external) {
-                                mark(`tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
-                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)"));
+                            const att = readCardAttestation(result?.details);
+                            if (att === "external") {
+                                mark(`tool "${t.name}" returned the output of a delegated agent that invoked an external-content-class tool at runtime` +
+                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : ""));
+                                recordExternal();
+                            }
+                            else if (att !== "clean") {
+                                if (external) {
+                                    mark(`tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
+                                        (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)"));
+                                }
+                                recordIncomplete();
                             }
                             return result;
                         },
@@ -2941,11 +2994,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 toolEffects,
             })
             : undefined;
-        const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, skillScopePolicy].filter((p) => p !== undefined);
+        const frozenConstraintLayers = (seedInheritedGate?.constraintChain ?? [])
+            .filter((e) => !("opaque" in e))
+            .map((entry) => ({
+            check: (creq) => checkToolPolicyProjection(entry, creq) ?? { action: "allow" },
+        }));
+        const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, ...frozenConstraintLayers, skillScopePolicy].filter((p) => p !== undefined);
         for (const layer of narrowingLayers)
             auditPolicyNames(layer);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
-        const basePolicyForResumeEdit = lockedPreflight.toolPolicy;
+        const basePolicyForResumeEdit = lockedPreflight.basePolicyForResumeEdit ?? lockedPreflight.toolPolicy;
         const hooks = spec.hooks ?? deps.hooks;
         const preToolUseObservational = hooks?.preToolUse !== undefined && hooks.preToolUseObservational === true;
         const ownGatePreToolUse = !preToolUseObservational
@@ -2997,6 +3055,62 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return;
             inheritedAskGrants.set(toolCallId, { approver, argsJson, presented, waitMs });
         };
+        const sandboxDeclared = isIsolated(executionEnv);
+        const sandboxAdmissionArmed = (() => {
+            if (!sandboxDeclared)
+                return false;
+            const store = resolveCheckpointStore(spec, deps);
+            const missing = [];
+            if (store === undefined)
+                missing.push("a wired CheckpointStore");
+            else if (store.redecision?.reopen !== true)
+                missing.push("a CheckpointStore that DECLARES redecision.reopen (declaration, never duck-typing)");
+            if (spec.durableApproval === undefined && runtimeCaps?.forceDurableGate !== true)
+                missing.push("a durable park (spec.durableApproval, or the forceDurableGate entitlement)");
+            if (missing.length === 0)
+                return true;
+            try {
+                const e = new Error(`sandbox admission mode NOT armed: the execution env declares an isolated sandbox (capabilities.isolation), but the mode's ` +
+                    `park prerequisites are missing — ${missing.join("; ")}. Asks keep the conservative default chain (no auto-admission, no boundary park).`);
+                e.code = "config.sandbox_admission_unavailable";
+                deps.onError?.(e, { phase: "config", sessionId, classification: "sandbox-admission-unavailable" });
+            }
+            catch {
+            }
+            return false;
+        })();
+        const foldAskClasses = new Map();
+        const FOLD_ASK_CLASSES_CAP = 256;
+        const recordFoldAskClass = (toolCallId, cls, layer) => {
+            if (!foldAskClasses.has(toolCallId) && foldAskClasses.size >= FOLD_ASK_CLASSES_CAP)
+                return;
+            const list = foldAskClasses.get(toolCallId) ?? [];
+            list.push({ cls, layer });
+            foldAskClasses.set(toolCallId, list);
+        };
+        const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName);
+        const emitSandboxAdmitted = (info) => {
+            emitTrace(deps.tracer, () => ({
+                kind: "permission.sandbox_admitted",
+                version: 1,
+                taskId: spec.taskId ?? sessionId,
+                toolCallId: info.toolCallId,
+                toolName: info.toolName,
+                askClasses: info.askClasses.map((a) => a.cls),
+                sourceLayers: info.askClasses.map((a) => a.layer),
+                boundary: info.boundary,
+                ts: Date.now(),
+            }));
+        };
+        const ancestorSandboxAdmissions = new Map();
+        const recordAncestorSandboxAdmission = (toolCallId, toolName) => {
+            const list = ancestorSandboxAdmissions.get(toolCallId);
+            if (list !== undefined)
+                list.push({ cls: "sandbox_local", layer: "ancestor_constraint" });
+            else
+                ancestorSandboxAdmissions.set(toolCallId, [{ cls: "sandbox_local", layer: "ancestor_constraint" }]);
+            void toolName;
+        };
         const callerPolicyLayer = policy !== undefined && sameInstanceAncestorCount > 0
             ? {
                 check: async (creq, csignal) => {
@@ -3069,7 +3183,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const suggestions = suggestRulesForCommand(command);
             return suggestions.length > 0 ? { ruleSuggestions: suggestions } : {};
         };
-        const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal) => {
+        const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal, ancestorDecider) => {
             let editArgs = edit;
             for (let round = 0;; round++) {
                 if (round >= 3) {
@@ -3095,6 +3209,22 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
                 if (re.updatedInput !== undefined)
                     editArgs = re.updatedInput;
+                if (ancestorDecider !== undefined) {
+                    const verdict = await ancestorDecider
+                        .decide({ req: { ...creq, args: editArgs }, ...(re.message !== undefined ? { askMessage: re.message } : {}) }, csignal ?? abortController.signal)
+                        .catch(() => ({ kind: "unavailable", cause: "error" }));
+                    if (verdict.kind === "allow")
+                        return { action: "allow", updatedInput: editArgs };
+                    if (verdict.kind === "block") {
+                        const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
+                        const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+                        return {
+                            action: "deny",
+                            message: `auto-mode classifier blocked the approved edit at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                            decisionReason: "classifier",
+                        };
+                    }
+                }
                 const rr = await resolveAsk({
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
@@ -3116,8 +3246,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             pc.preToolUse === hooks?.preToolUse &&
             !preToolUseObservational &&
             pc.durableMandate !== true &&
+            pc.contentMandate !== true &&
             askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
-            pc.hookEnv === hookEnvSource
+            pc.hookEnv === hookEnvSource &&
+            pc.autoMode?.decider === autoModeDecider
             ? { check: () => ({ action: "allow" }) }
             : policy !== undefined && pc.policy === policy
                 ? {
@@ -3134,8 +3266,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             return first;
                         if (first.action === "allow")
                             return { action: "allow" };
-                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
-                            return first;
+                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+                            if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
+                                return first;
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
+                                    `denied fail-closed (tighten-only)`,
+                            };
                         }
                         if (pc.durableMandate === true) {
                             if (resolveCheckpointStore(spec, deps) !== undefined &&
@@ -3149,6 +3287,26 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
                             };
                         }
+                        if (pc.autoMode !== undefined) {
+                            const verdict = await pc.autoMode.decider
+                                .decide({ req: creq, ...(first.message !== undefined ? { askMessage: first.message } : {}) }, csignal ?? abortController.signal)
+                                .catch(() => ({ kind: "unavailable", cause: "error" }));
+                            if (verdict.kind === "allow")
+                                return { action: "allow" };
+                            if (verdict.kind === "block") {
+                                const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
+                                const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+                                return {
+                                    action: "deny",
+                                    message: `auto-mode classifier blocked this call at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                                    decisionReason: "classifier",
+                                };
+                            }
+                        }
+                        if (sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
+                            recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
+                            return { action: "allow" };
+                        }
                         const presentedArgs = creq.args;
                         const askT0 = now();
                         const resolved = await resolveAsk({
@@ -3173,7 +3331,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         if (resolved.action !== "allow")
                             return resolved;
                         if (resolved.updatedInput !== undefined) {
-                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider);
                         }
                         recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
                         return { action: "allow" };
@@ -3193,8 +3351,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         if (decision.action !== "ask")
                             return decision;
-                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
-                            return decision;
+                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+                            if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
+                                return decision;
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
+                                    `denied fail-closed (tighten-only)`,
+                            };
                         }
                         if (pc.durableMandate === true) {
                             if (resolveCheckpointStore(spec, deps) !== undefined &&
@@ -3209,6 +3373,27 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             };
                         }
                         const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+                        if (pc.autoMode !== undefined) {
+                            const verdict = await pc.autoMode.decider
+                                .decide({ req: { ...creq, args: presentedArgs }, ...(decision.message !== undefined ? { askMessage: decision.message } : {}) }, csignal ?? abortController.signal)
+                                .catch(() => ({ kind: "unavailable", cause: "error" }));
+                            if (verdict.kind === "allow") {
+                                return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
+                            }
+                            if (verdict.kind === "block") {
+                                const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
+                                const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+                                return {
+                                    action: "deny",
+                                    message: `auto-mode classifier blocked this call at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                                    decisionReason: "classifier",
+                                };
+                            }
+                        }
+                        if (sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
+                            recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
+                            return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
+                        }
                         const askT0 = now();
                         const resolved = await resolveAsk({
                             toolName: creq.toolName,
@@ -3232,7 +3417,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         if (resolved.action !== "allow")
                             return resolved;
                         if (resolved.updatedInput !== undefined) {
-                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider);
                         }
                         if (pc.preToolUse === undefined) {
                             recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
@@ -3257,6 +3442,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 const d = await layer.check(creq, csignal);
                 if (d.updatedInput !== undefined)
                     rewriteEmitterIndex.set(creq.toolCallId, idx);
+                if (d.action === "ask") {
+                    recordFoldAskClass(creq.toolCallId, idx < callerSlotOffset ? policyAskClassOf(policy) : "mandate", idx < callerSlotOffset ? "caller_policy" : "ancestor_constraint");
+                }
                 return d;
             },
         }));
@@ -3607,6 +3795,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 inheritedGate: (() => {
                     const requiresParentConstraint = (inheritedParentConstraints?.length ?? 0) > 0 || seedInheritedGate?.requiresParentConstraint === true;
                     const parentConstraintCount = (inheritedParentConstraints?.length ?? 0) > 0 ? inheritedParentConstraints.length : seedInheritedGate?.parentConstraintCount;
+                    const constraintChain = (inheritedParentConstraints?.length ?? 0) > 0
+                        ? inheritedParentConstraints.map((pc) => constraintChainEntryOf(pc.policy, { ...(pc.autoMode !== undefined ? { autoModeArmed: true } : {}), ...(pc.durableMandate === true ? { durableMandate: true } : {}), ...(pc.contentMandate === true ? { contentMandate: true } : {}) }))
+                        : seedInheritedGate?.constraintChain;
+                    const constraintDigest = (inheritedParentConstraints?.length ?? 0) > 0
+                        ? constraintChainDigest(constraintChain)
+                        : seedInheritedGate?.constraintDigest;
                     return inheritedAncestorRules !== undefined ||
                         inheritedShellGate !== undefined ||
                         inheritedAdmittedOrgScopes !== undefined ||
@@ -3623,6 +3817,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
                             requiresParentConstraint,
                             ...(requiresParentConstraint && parentConstraintCount !== undefined ? { parentConstraintCount } : {}),
+                            ...(requiresParentConstraint && constraintChain !== undefined
+                                ? { constraintChain: structuredClone(constraintChain), ...(constraintDigest !== undefined ? { constraintDigest } : {}) }
+                                : {}),
                         }
                         : undefined;
                 })(),
@@ -3633,6 +3830,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...(announcedListingsRef.models !== undefined ? { models: [...announcedListingsRef.models] } : {}),
                     }
                     : undefined,
+                delegationProvenance: internals?.delegationProvenance !== undefined ? { ...internals.delegationProvenance.ref.current } : undefined,
             });
             const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
                 if (!checkpointStore)
@@ -3752,7 +3950,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 const mintedAt = Date.now();
                 const cp = {
                     token,
-                    version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : resourceLedgerOut.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
+                    version: f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : resourceLedgerOut.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
                     scope,
                     sessionId,
                     leafId,
@@ -3834,7 +4032,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const mintedAt = Date.now();
                     const cp = {
                         token,
-                        version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : reviewLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                        version: f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : reviewLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                         scope,
                         sessionId,
                         leafId,
@@ -3983,6 +4181,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         const parkedArgs = captured.value;
                         const projectionMovedArgs = backendFidelity !== "structured-clone" && !samePlainValue(parked.value, parkedArgs);
+                        if (projectionMovedArgs && basePolicyForResumeEdit === undefined) {
+                            throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and no policy is wired to re-adjudicate the stored shape ` +
+                                `(no basePolicyForResumeEdit override and no caller toolPolicy) — refusing to file a row whose executable form nothing adjudicated`);
+                        }
                         if (projectionMovedArgs && basePolicyForResumeEdit !== undefined) {
                             const presented = encodeAtFidelity(backendFidelity, parkedArgs);
                             if (!presented.ok) {
@@ -3992,6 +4194,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 toolName: req.toolName,
                                 args: presented.value,
                                 toolCallId: req.toolCallId,
+                                budget: budgetSnapshot,
                                 ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}),
                             }, abortController.signal));
                             const demanded = reprojected.updatedInput !== undefined ? tryCloneArgs(reprojected.updatedInput) : undefined;
@@ -4081,7 +4284,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const mintedAt = Date.now();
                         cp = {
                             token,
-                            version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                            version: f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                             scope,
                             sessionId,
                             leafId,
@@ -4220,11 +4423,27 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 }
                                 : {}),
                             isMarkedUnresolvable: (toolCallId) => inheritedUnavailableAsks.has(toolCallId),
+                            ...(sandboxAdmissionArmed
+                                ? {
+                                    sandboxAdmission: {
+                                        askClassesOf: (toolCallId) => foldAskClasses.get(toolCallId),
+                                        boundaryCapable: sandboxBoundaryCapable(e.toolName),
+                                        onAdmitted: emitSandboxAdmitted,
+                                    },
+                                }
+                                : {}),
                         });
                     }
                     finally {
                         inheritedUnavailableAsks.delete(e.toolCallId);
                         inheritedAskGrants.delete(e.toolCallId);
+                        foldAskClasses.delete(e.toolCallId);
+                    }
+                    const ancestorAdmitted = ancestorSandboxAdmissions.get(e.toolCallId);
+                    ancestorSandboxAdmissions.delete(e.toolCallId);
+                    if (ancestorAdmitted !== undefined && !result.block && !result.suspend) {
+                        emitSandboxAdmitted({ toolCallId: e.toolCallId, toolName: e.toolName, askClasses: ancestorAdmitted, boundary: "sandbox_internal" });
+                        result.preToolContext.push(`permission.sandbox_admitted: this call's inherited pending approval was auto-admitted because the deployment declares an isolated sandbox execution env and the request stays inside it. Recorded for audit.`);
                     }
                     if (!result.block && !result.suspend && result.preToolContext.length > 0) {
                         preToolContexts.set(e.toolCallId, result.preToolContext);