@sema-agent/core 5.21.1 → 5.23.0

package/dist/core/runner/prepare-task.js

@@ -20,15 +20,17 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, combinePolicies, isApprovalSettledBy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
 import { inlineUntrusted } from "../untrusted-text.js";
+import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
 import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, runToolGate } from "../hooks.js";
+import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -46,6 +48,7 @@ import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { MEMORY_RECALL_DISCIPLINE } from "../memory-engine/engine.js";
 import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
+import { narrowContentSafety, readCardAttestation } from "../memory-engine/delegation-provenance.js";
 import { composeMemoryBlock } from "../memory.js";
 import { preflightLockedConfig } from "../locked-config.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies } from "../compliance.js";
@@ -82,7 +85,7 @@ import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-
 import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
-import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
+import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveAskEffective, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
@@ -1057,6 +1060,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const memoryAdmittedOrgScopesRef = { current: [] };
         const ownOrgVerdictRef = { current: undefined };
         const orgAdmissionCheckpointState = () => inheritedAdmittedOrgScopes !== undefined || ownOrgVerdictRef.current !== undefined || orgGovernedProvenance;
+        const f012CheckpointState = () => (inheritedParentConstraints?.length ?? 0) > 0 ||
+            seedInheritedGate?.constraintChain !== undefined ||
+            internals?.delegationProvenance !== undefined;
         const frozenOnAsk = spec.onAsk ?? deps.onAsk;
         const hookEnvSource = (ownedEnv ?? deps.executionEnv) != null ? executionEnv : undefined;
         const notifyOwnHookCrash = (err) => {
@@ -1067,6 +1073,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
         };
         const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
+        const provenanceForChildrenRef = {};
+        const delegationProvenanceForChildren = () => provenanceForChildrenRef.current;
         const inheritedGateForChildren = () => {
             const ancestorRules = [
                 ...(inheritedAncestorRules ?? []),
@@ -1075,12 +1083,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const ownCallerPolicy = lockedPreflight.toolPolicy;
             const durableMandate = runtimeCaps?.forceDurableGate === true ||
                 (spec.durableApproval !== undefined && !isLiveApproverSeat(frozenOnAsk));
+            const contentMandate = runtimeCaps?.forceDurableGate === true ||
+                (spec.durableApproval !== undefined && !isLiveQuestionFace(frozenOnQuestion));
             const ownPreToolUse = preToolUseObservational ? undefined : hooks?.preToolUse;
             const hookConstraint = ownPreToolUse !== undefined &&
                 !(inheritedParentConstraints ?? []).some((pc) => pc.preToolUse === ownPreToolUse &&
                     askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
                     (pc.durableMandate === true) === durableMandate &&
-                    pc.hookEnv === hookEnvSource)
+                    (pc.contentMandate === true) === contentMandate &&
+                    pc.hookEnv === hookEnvSource &&
+                    pc.autoMode?.decider === autoModeDecider)
                 ? [
                     {
                         policy: createPreToolUseConstraintPolicy(ownPreToolUse, hookEnvFace, notifyOwnHookCrash),
@@ -1088,6 +1100,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...(hookEnvSource !== undefined ? { hookEnv: hookEnvSource } : {}),
                         ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
                         ...(durableMandate ? { durableMandate: true } : {}),
+                        ...(contentMandate ? { contentMandate: true } : {}),
+                        ...(autoModeDecider !== undefined ? { autoMode: { decider: autoModeDecider } } : {}),
                     },
                 ]
                 : [];
@@ -1100,6 +1114,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             policy: ownCallerPolicy,
                             ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
                             ...(durableMandate ? { durableMandate: true } : {}),
+                            ...(contentMandate ? { contentMandate: true } : {}),
+                            ...(autoModeDecider !== undefined ? { autoMode: { decider: autoModeDecider } } : {}),
                         },
                     ]
                     : []),
@@ -1140,6 +1156,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(centerAdoption?.sourceRevision !== undefined ? { centerSourceRevision: centerAdoption.sourceRevision } : {}),
             activeSkillScope: () => skillScope.active(),
             inheritedGateForChildren,
+            delegationProvenanceForChildren,
             ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),
             ...(spec.durableApproval !== undefined ? { durableApprovalForChildren: { ...spec.durableApproval } } : {}),
             ...(spec.checkpointStore === null ? { checkpointStoreDisabledForChildren: true } : {}),
@@ -1939,6 +1956,19 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (internals?.ownOrgAdmissionRef !== undefined && ownOrgVerdictRef.current !== undefined) {
             internals.ownOrgAdmissionRef.current = ownOrgVerdictRef.current;
         }
+        if (internals?.delegationProvenance !== undefined && resume !== undefined) {
+            const live = internals.delegationProvenance.ref.current;
+            const seed = resume.seed.delegationProvenance;
+            if (seed === undefined || seed.version !== 1 || seed.coverageStartTurn !== 0) {
+                live.incomplete = true;
+            }
+            else {
+                if (seed.sawExternal)
+                    live.sawExternal = true;
+                if (seed.incomplete)
+                    live.incomplete = true;
+            }
+        }
         let memoryBlock = memoryBlockFromEngine;
         if (memorySeedFiles?.length && seedContextFiles) {
             try {
@@ -2312,15 +2342,28 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         else {
             deferred = classifyDeferredOverFace(tools, []);
         }
-        if (memoryEngineSession !== undefined) {
-            const { pollution, contentSafety } = memoryEngineSession;
+        const delegationProvenanceChannel = internals?.delegationProvenance;
+        if (memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined) {
+            const pollution = memoryEngineSession?.pollution;
+            const effectiveSafety = narrowContentSafety(delegationProvenanceChannel?.contentSafety, memoryEngineSession?.contentSafety);
+            const trustedTools = effectiveSafety.trustedTools;
+            const execIsExternalContent = effectiveSafety.execIsExternalContent;
+            provenanceForChildrenRef.current = { trustedTools: [...trustedTools], execIsExternalContent };
+            const recordExternal = () => {
+                if (delegationProvenanceChannel !== undefined)
+                    delegationProvenanceChannel.ref.current.sawExternal = true;
+            };
+            const recordIncomplete = () => {
+                if (delegationProvenanceChannel !== undefined)
+                    delegationProvenanceChannel.ref.current.incomplete = true;
+            };
             const callerToolNames = new Set((spec.tools ?? []).map((t) => t.name));
             const contentOriginWrapped = new WeakSet();
             const classOf = (t) => classifyToolContentOrigin({
                 declared: t.contentOrigin,
                 isProtocolTool: protocolOf(t.name) !== undefined,
                 isCallerTool: callerToolNames.has(t.name),
-                trusted: contentSafety.trustedTools.has(t.name),
+                trusted: trustedTools.has(t.name),
             });
             const delegationByName = new Map();
             for (const t of spec.tools ?? []) {
@@ -2333,8 +2376,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 declared: t.contentOrigin,
                 isProtocolTool: protocolOf(t.name) !== undefined,
                 isCallerTool: true,
-                trusted: contentSafety.trustedTools.has(t.name),
-            }), contentSafety.execIsExternalContent);
+                trusted: trustedTools.has(t.name),
+            }), execIsExternalContent);
             contentOriginWrapRef.current = () => {
                 for (let i = 0; i < tools.length; i++) {
                     const t = tools[i];
@@ -2343,7 +2386,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const origin = classOf(t);
                     const delegation = delegationByName.get(t.name);
                     const isDelegation = delegation !== undefined;
-                    const pollutes = contentOriginPollutes(origin, contentSafety.execIsExternalContent);
+                    const pollutes = contentOriginPollutes(origin, execIsExternalContent);
                     if (!pollutes && !isDelegation) {
                         contentOriginWrapped.add(t);
                         continue;
@@ -2351,7 +2394,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const inner = t.execute.bind(t);
                     const mark = (reason) => {
                         try {
-                            pollution.markPolluted(reason);
+                            pollution?.markPolluted(reason);
                         }
                         catch {
                         }
@@ -2359,8 +2402,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const wrapped = {
                         ...t,
                         execute: async (toolCallId, params, signal, onUpdate) => {
-                            if (pollutes)
+                            if (pollutes) {
                                 mark(`tool "${t.name}" (${origin} content class) was invoked in this session`);
+                                recordExternal();
+                            }
                             if (!isDelegation)
                                 return inner(toolCallId, params, signal, onUpdate);
                             const requested = params?.subagent_type;
@@ -2371,9 +2416,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 isPolluting: poolToolPollutes,
                             });
                             const result = await inner(toolCallId, params, signal, onUpdate);
-                            if (external) {
-                                mark(`tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
-                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)"));
+                            const att = readCardAttestation(result?.details);
+                            if (att === "external") {
+                                mark(`tool "${t.name}" returned the output of a delegated agent that invoked an external-content-class tool at runtime` +
+                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : ""));
+                                recordExternal();
+                            }
+                            else if (att !== "clean") {
+                                if (external) {
+                                    mark(`tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
+                                        (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)"));
+                                }
+                                recordIncomplete();
                             }
                             return result;
                         },
@@ -2941,11 +2995,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 toolEffects,
             })
             : undefined;
-        const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, skillScopePolicy].filter((p) => p !== undefined);
+        const frozenConstraintLayers = (seedInheritedGate?.constraintChain ?? [])
+            .filter((e) => !("opaque" in e))
+            .map((entry) => ({
+            check: (creq) => checkToolPolicyProjection(entry, creq) ?? { action: "allow" },
+        }));
+        const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, ...frozenConstraintLayers, skillScopePolicy].filter((p) => p !== undefined);
         for (const layer of narrowingLayers)
             auditPolicyNames(layer);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
-        const basePolicyForResumeEdit = lockedPreflight.toolPolicy;
+        const basePolicyForResumeEdit = lockedPreflight.basePolicyForResumeEdit ?? lockedPreflight.toolPolicy;
         const hooks = spec.hooks ?? deps.hooks;
         const preToolUseObservational = hooks?.preToolUse !== undefined && hooks.preToolUseObservational === true;
         const ownGatePreToolUse = !preToolUseObservational
@@ -2997,6 +3056,62 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return;
             inheritedAskGrants.set(toolCallId, { approver, argsJson, presented, waitMs });
         };
+        const sandboxDeclared = isIsolated(executionEnv);
+        const sandboxAdmissionArmed = (() => {
+            if (!sandboxDeclared)
+                return false;
+            const store = resolveCheckpointStore(spec, deps);
+            const missing = [];
+            if (store === undefined)
+                missing.push("a wired CheckpointStore");
+            else if (store.redecision?.reopen !== true)
+                missing.push("a CheckpointStore that DECLARES redecision.reopen (declaration, never duck-typing)");
+            if (spec.durableApproval === undefined && runtimeCaps?.forceDurableGate !== true)
+                missing.push("a durable park (spec.durableApproval, or the forceDurableGate entitlement)");
+            if (missing.length === 0)
+                return true;
+            try {
+                const e = new Error(`sandbox admission mode NOT armed: the execution env declares an isolated sandbox (capabilities.isolation), but the mode's ` +
+                    `park prerequisites are missing — ${missing.join("; ")}. Asks keep the conservative default chain (no auto-admission, no boundary park).`);
+                e.code = "config.sandbox_admission_unavailable";
+                deps.onError?.(e, { phase: "config", sessionId, classification: "sandbox-admission-unavailable" });
+            }
+            catch {
+            }
+            return false;
+        })();
+        const foldAskClasses = new Map();
+        const FOLD_ASK_CLASSES_CAP = 256;
+        const recordFoldAskClass = (toolCallId, cls, layer) => {
+            if (!foldAskClasses.has(toolCallId) && foldAskClasses.size >= FOLD_ASK_CLASSES_CAP)
+                return;
+            const list = foldAskClasses.get(toolCallId) ?? [];
+            list.push({ cls, layer });
+            foldAskClasses.set(toolCallId, list);
+        };
+        const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName);
+        const emitSandboxAdmitted = (info) => {
+            emitTrace(deps.tracer, () => ({
+                kind: "permission.sandbox_admitted",
+                version: 1,
+                taskId: spec.taskId ?? sessionId,
+                toolCallId: info.toolCallId,
+                toolName: info.toolName,
+                askClasses: info.askClasses.map((a) => a.cls),
+                sourceLayers: info.askClasses.map((a) => a.layer),
+                boundary: info.boundary,
+                ts: Date.now(),
+            }));
+        };
+        const ancestorSandboxAdmissions = new Map();
+        const recordAncestorSandboxAdmission = (toolCallId, toolName) => {
+            const list = ancestorSandboxAdmissions.get(toolCallId);
+            if (list !== undefined)
+                list.push({ cls: "sandbox_local", layer: "ancestor_constraint" });
+            else
+                ancestorSandboxAdmissions.set(toolCallId, [{ cls: "sandbox_local", layer: "ancestor_constraint" }]);
+            void toolName;
+        };
         const callerPolicyLayer = policy !== undefined && sameInstanceAncestorCount > 0
             ? {
                 check: async (creq, csignal) => {
@@ -3030,12 +3145,22 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         };
         const permissionRuleLane = (() => {
             const provider = deps.permissionRuleStore;
+            const localOwnerDeclared = deps.localOwnerRules === true;
+            if (localOwnerDeclared) {
+                if (provider === undefined) {
+                    throw new Error("RunnerDeps.localOwnerRules is declared but no permissionRuleStore provider is wired — there is no bucket for the local owner to hold rules in; refusing rather than running as if the declaration were absent");
+                }
+                if (provider.forLocalOwner === undefined) {
+                    throw new Error("RunnerDeps.localOwnerRules is declared but the wired permissionRuleStore provider implements no forLocalOwner() face — a provider without a local-owner bucket cannot honor the declaration; refusing rather than silently resolving zero rules");
+                }
+            }
             if (provider === undefined)
                 return undefined;
             const root = taskRootPath;
             return {
                 admits: async (req) => {
-                    if (spec.principal === undefined || spec.principal === "")
+                    const anonymous = spec.principal === undefined || spec.principal === "";
+                    if (anonymous && !localOwnerDeclared)
                         return undefined;
                     if (req.toolName !== PERSISTED_RULE_TOOL)
                         return undefined;
@@ -3044,7 +3169,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         return undefined;
                     let listed;
                     try {
-                        listed = await provider.forPrincipal(spec.principal).list();
+                        listed = anonymous
+                            ?
+                                await provider.forLocalOwner().list()
+                            : await provider.forPrincipal(spec.principal).list();
                     }
                     catch (err) {
                         emitTrace(deps.tracer, () => ({
@@ -3060,6 +3188,31 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 },
             };
         })();
+        const permissionRuleOrgLane = (() => {
+            const overlay = deps.permissionRuleOrg;
+            if (overlay === undefined)
+                return undefined;
+            return {
+                adjudicate: async (req) => {
+                    if (req.toolName === ASK_USER_QUESTION_TOOL_NAME && questionToolMounted)
+                        return { status: "available" };
+                    let resolution;
+                    try {
+                        resolution = await overlay.resolve();
+                    }
+                    catch (err) {
+                        return { status: "unavailable", disclosures: [`the org rule overlay threw: ${err instanceof Error ? err.message : String(err)}`] };
+                    }
+                    if (resolution.status === "unavailable")
+                        return { status: "unavailable", disclosures: resolution.disclosures };
+                    const command = req.args?.command;
+                    if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
+                        return { status: "available" };
+                    const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
+                    return verdict === undefined ? { status: "available" } : { status: "available", verdict };
+                },
+            };
+        })();
         const ruleSuggestionsOf = (toolName, args) => {
             if (permissionRuleLane === undefined || toolName !== PERSISTED_RULE_TOOL)
                 return {};
@@ -3069,7 +3222,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const suggestions = suggestRulesForCommand(command);
             return suggestions.length > 0 ? { ruleSuggestions: suggestions } : {};
         };
-        const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal) => {
+        const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal, ancestorDecider) => {
             let editArgs = edit;
             for (let round = 0;; round++) {
                 if (round >= 3) {
@@ -3095,6 +3248,22 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
                 if (re.updatedInput !== undefined)
                     editArgs = re.updatedInput;
+                if (ancestorDecider !== undefined) {
+                    const verdict = await ancestorDecider
+                        .decide({ req: { ...creq, args: editArgs }, ...(re.message !== undefined ? { askMessage: re.message } : {}) }, csignal ?? abortController.signal)
+                        .catch(() => ({ kind: "unavailable", cause: "error" }));
+                    if (verdict.kind === "allow")
+                        return { action: "allow", updatedInput: editArgs };
+                    if (verdict.kind === "block") {
+                        const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
+                        const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+                        return {
+                            action: "deny",
+                            message: `auto-mode classifier blocked the approved edit at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                            decisionReason: "classifier",
+                        };
+                    }
+                }
                 const rr = await resolveAsk({
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
@@ -3116,8 +3285,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             pc.preToolUse === hooks?.preToolUse &&
             !preToolUseObservational &&
             pc.durableMandate !== true &&
+            pc.contentMandate !== true &&
             askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
-            pc.hookEnv === hookEnvSource
+            pc.hookEnv === hookEnvSource &&
+            pc.autoMode?.decider === autoModeDecider
             ? { check: () => ({ action: "allow" }) }
             : policy !== undefined && pc.policy === policy
                 ? {
@@ -3134,8 +3305,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             return first;
                         if (first.action === "allow")
                             return { action: "allow" };
-                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
-                            return first;
+                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+                            if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
+                                return first;
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
+                                    `denied fail-closed (tighten-only)`,
+                            };
                         }
                         if (pc.durableMandate === true) {
                             if (resolveCheckpointStore(spec, deps) !== undefined &&
@@ -3149,6 +3326,26 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
                             };
                         }
+                        if (pc.autoMode !== undefined) {
+                            const verdict = await pc.autoMode.decider
+                                .decide({ req: creq, ...(first.message !== undefined ? { askMessage: first.message } : {}) }, csignal ?? abortController.signal)
+                                .catch(() => ({ kind: "unavailable", cause: "error" }));
+                            if (verdict.kind === "allow")
+                                return { action: "allow" };
+                            if (verdict.kind === "block") {
+                                const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
+                                const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+                                return {
+                                    action: "deny",
+                                    message: `auto-mode classifier blocked this call at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                                    decisionReason: "classifier",
+                                };
+                            }
+                        }
+                        if (sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
+                            recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
+                            return { action: "allow" };
+                        }
                         const presentedArgs = creq.args;
                         const askT0 = now();
                         const resolved = await resolveAsk({
@@ -3173,7 +3370,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         if (resolved.action !== "allow")
                             return resolved;
                         if (resolved.updatedInput !== undefined) {
-                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider);
                         }
                         recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
                         return { action: "allow" };
@@ -3193,8 +3390,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         if (decision.action !== "ask")
                             return decision;
-                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
-                            return decision;
+                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+                            if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
+                                return decision;
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
+                                    `denied fail-closed (tighten-only)`,
+                            };
                         }
                         if (pc.durableMandate === true) {
                             if (resolveCheckpointStore(spec, deps) !== undefined &&
@@ -3209,6 +3412,27 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             };
                         }
                         const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+                        if (pc.autoMode !== undefined) {
+                            const verdict = await pc.autoMode.decider
+                                .decide({ req: { ...creq, args: presentedArgs }, ...(decision.message !== undefined ? { askMessage: decision.message } : {}) }, csignal ?? abortController.signal)
+                                .catch(() => ({ kind: "unavailable", cause: "error" }));
+                            if (verdict.kind === "allow") {
+                                return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
+                            }
+                            if (verdict.kind === "block") {
+                                const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
+                                const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+                                return {
+                                    action: "deny",
+                                    message: `auto-mode classifier blocked this call at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                                    decisionReason: "classifier",
+                                };
+                            }
+                        }
+                        if (sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
+                            recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
+                            return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
+                        }
                         const askT0 = now();
                         const resolved = await resolveAsk({
                             toolName: creq.toolName,
@@ -3232,7 +3456,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         if (resolved.action !== "allow")
                             return resolved;
                         if (resolved.updatedInput !== undefined) {
-                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider);
                         }
                         if (pc.preToolUse === undefined) {
                             recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
@@ -3257,6 +3481,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 const d = await layer.check(creq, csignal);
                 if (d.updatedInput !== undefined)
                     rewriteEmitterIndex.set(creq.toolCallId, idx);
+                if (d.action === "ask") {
+                    recordFoldAskClass(creq.toolCallId, idx < callerSlotOffset ? policyAskClassOf(policy) : "mandate", idx < callerSlotOffset ? "caller_policy" : "ancestor_constraint");
+                }
                 return d;
             },
         }));
@@ -3433,6 +3660,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             sessionDurability: resolveDeclaredDurability(sessions, "sessionStore"),
             backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
             permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
+            permissionRuleSyncWired: deps.permissionRuleSyncWired === true,
+            permissionRuleOrgGoverned: deps.permissionRuleOrg !== undefined,
             hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
             lockedConfigWired: deps.lockedConfig !== undefined,
             complianceWired: deps.compliancePostureResolver !== undefined,
@@ -3607,6 +3836,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 inheritedGate: (() => {
                     const requiresParentConstraint = (inheritedParentConstraints?.length ?? 0) > 0 || seedInheritedGate?.requiresParentConstraint === true;
                     const parentConstraintCount = (inheritedParentConstraints?.length ?? 0) > 0 ? inheritedParentConstraints.length : seedInheritedGate?.parentConstraintCount;
+                    const constraintChain = (inheritedParentConstraints?.length ?? 0) > 0
+                        ? inheritedParentConstraints.map((pc) => constraintChainEntryOf(pc.policy, { ...(pc.autoMode !== undefined ? { autoModeArmed: true } : {}), ...(pc.durableMandate === true ? { durableMandate: true } : {}), ...(pc.contentMandate === true ? { contentMandate: true } : {}) }))
+                        : seedInheritedGate?.constraintChain;
+                    const constraintDigest = (inheritedParentConstraints?.length ?? 0) > 0
+                        ? constraintChainDigest(constraintChain)
+                        : seedInheritedGate?.constraintDigest;
                     return inheritedAncestorRules !== undefined ||
                         inheritedShellGate !== undefined ||
                         inheritedAdmittedOrgScopes !== undefined ||
@@ -3623,6 +3858,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
                             requiresParentConstraint,
                             ...(requiresParentConstraint && parentConstraintCount !== undefined ? { parentConstraintCount } : {}),
+                            ...(requiresParentConstraint && constraintChain !== undefined
+                                ? { constraintChain: structuredClone(constraintChain), ...(constraintDigest !== undefined ? { constraintDigest } : {}) }
+                                : {}),
                         }
                         : undefined;
                 })(),
@@ -3633,14 +3871,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...(announcedListingsRef.models !== undefined ? { models: [...announcedListingsRef.models] } : {}),
                     }
                     : undefined,
+                delegationProvenance: internals?.delegationProvenance !== undefined ? { ...internals.delegationProvenance.ref.current } : undefined,
             });
             const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
                 if (!checkpointStore)
                     return { ok: false };
                 if (memoryEngineSession)
                     await memoryEngineSession.harvest("checkpoint");
-                try {
-                    await checkpointStore.put(token, cp);
+                const announceCommittedScreeningPark = () => {
                     const committedCount = cp.state.inheritedGate?.parentConstraintCount;
                     if (cp.state.inheritedGate?.requiresParentConstraint === true &&
                         !screeningParkDisclosedRef.done &&
@@ -3657,10 +3895,59 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         catch {
                         }
                     }
+                };
+                const confirmPutOutcome = async (putErr) => {
+                    if (putErr?.code === "checkpoint.already_exists")
+                        return "absent";
+                    try {
+                        const row = await checkpointStore.get(token);
+                        if (row == null)
+                            return "absent";
+                        const sameCall = (a, b) => a.kind === b.kind && (a.kind !== "tool_approval" || b.kind !== "tool_approval" || a.toolCallId === b.toolCallId);
+                        const isOurs = row.scope === cp.scope && row.sessionId === cp.sessionId && row.leafId === cp.leafId && sameCall(row.pendingAction, cp.pendingAction);
+                        return isOurs ? "committed" : "absent";
+                    }
+                    catch (readErr) {
+                        deps.onError?.(readErr, { phase: "config", sessionId });
+                        return "unknown";
+                    }
+                };
+                try {
+                    await checkpointStore.put(token, cp);
+                    announceCommittedScreeningPark();
                     return { ok: true };
                 }
                 catch (putErr) {
                     deps.onError?.(putErr, { phase: "config", sessionId });
+                    const confirmed = await confirmPutOutcome(putErr);
+                    if (confirmed === "committed") {
+                        try {
+                            deps.onError?.(new Error(`durable approval checkpoint: the store's write reported a failure but the row EXISTS — the commit ` +
+                                `landed and its acknowledgement was lost (a network backend can complete the INSERT and drop the ` +
+                                `connection before replying). The run suspends on that row rather than continuing, which would leave ` +
+                                `a redeemable pending checkpoint behind. This backend's acknowledgement path is lossy — the operator ` +
+                                `face carries the store's own message.`), { phase: "degraded", sessionId, classification: "checkpoint-put-confirmation-lost" });
+                        }
+                        catch {
+                        }
+                        announceCommittedScreeningPark();
+                        return { ok: true };
+                    }
+                    if (confirmed === "unknown") {
+                        const unknownReason = "the approval checkpoint's state cannot be established (the store rejected the write and then could not be read back; a committed-but-unacknowledged row may exist) — the run is stopped rather than continued past an approval whose durable record is unknown";
+                        try {
+                            deps.onError?.(new Error(`durable approval checkpoint: ${unknownReason}`), {
+                                phase: "degraded",
+                                sessionId,
+                                classification: "checkpoint-put-outcome-unknown",
+                            });
+                        }
+                        catch {
+                        }
+                        abortController.abort();
+                        void harness.abort();
+                        return { ok: false, reason: unknownReason };
+                    }
                     const reason = "the approval checkpoint could not be persisted (the store rejected the write; the deployment's error face carries the store's own message)";
                     if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
                         const { outcome: back, attempts: backAttempts } = await restoreWorkspaceWithRetry(remoteEnv, remoteHandle.snapshotId, {
@@ -3752,7 +4039,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 const mintedAt = Date.now();
                 const cp = {
                     token,
-                    version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : resourceLedgerOut.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
+                    version: f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : resourceLedgerOut.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
                     scope,
                     sessionId,
                     leafId,
@@ -3834,7 +4121,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const mintedAt = Date.now();
                     const cp = {
                         token,
-                        version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : reviewLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                        version: f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : reviewLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                         scope,
                         sessionId,
                         leafId,
@@ -3983,6 +4270,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         const parkedArgs = captured.value;
                         const projectionMovedArgs = backendFidelity !== "structured-clone" && !samePlainValue(parked.value, parkedArgs);
+                        if (projectionMovedArgs && basePolicyForResumeEdit === undefined) {
+                            throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and no policy is wired to re-adjudicate the stored shape ` +
+                                `(no basePolicyForResumeEdit override and no caller toolPolicy) — refusing to file a row whose executable form nothing adjudicated`);
+                        }
                         if (projectionMovedArgs && basePolicyForResumeEdit !== undefined) {
                             const presented = encodeAtFidelity(backendFidelity, parkedArgs);
                             if (!presented.ok) {
@@ -3992,6 +4283,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 toolName: req.toolName,
                                 args: presented.value,
                                 toolCallId: req.toolCallId,
+                                budget: budgetSnapshot,
                                 ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}),
                             }, abortController.signal));
                             const demanded = reprojected.updatedInput !== undefined ? tryCloneArgs(reprojected.updatedInput) : undefined;
@@ -4081,7 +4373,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const mintedAt = Date.now();
                         cp = {
                             token,
-                            version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                            version: f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                             scope,
                             sessionId,
                             leafId,
@@ -4219,12 +4511,45 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     },
                                 }
                                 : {}),
+                            ...(permissionRuleOrgLane
+                                ? {
+                                    orgRules: {
+                                        adjudicate: permissionRuleOrgLane.adjudicate,
+                                        contentAskToolMounted: questionToolMounted,
+                                        onUnavailable: (info) => emitTrace(deps.tracer, () => ({
+                                            kind: "permission.org_snapshot_unavailable",
+                                            version: 1,
+                                            taskId: spec.taskId ?? sessionId,
+                                            toolName: info.toolName,
+                                            toolCallId: info.toolCallId,
+                                            message: info.message,
+                                            ts: Date.now(),
+                                        })),
+                                    },
+                                }
+                                : {}),
                             isMarkedUnresolvable: (toolCallId) => inheritedUnavailableAsks.has(toolCallId),
+                            ...(sandboxAdmissionArmed
+                                ? {
+                                    sandboxAdmission: {
+                                        askClassesOf: (toolCallId) => foldAskClasses.get(toolCallId),
+                                        boundaryCapable: sandboxBoundaryCapable(e.toolName),
+                                        onAdmitted: emitSandboxAdmitted,
+                                    },
+                                }
+                                : {}),
                         });
                     }
                     finally {
                         inheritedUnavailableAsks.delete(e.toolCallId);
                         inheritedAskGrants.delete(e.toolCallId);
+                        foldAskClasses.delete(e.toolCallId);
+                    }
+                    const ancestorAdmitted = ancestorSandboxAdmissions.get(e.toolCallId);
+                    ancestorSandboxAdmissions.delete(e.toolCallId);
+                    if (ancestorAdmitted !== undefined && !result.block && !result.suspend) {
+                        emitSandboxAdmitted({ toolCallId: e.toolCallId, toolName: e.toolName, askClasses: ancestorAdmitted, boundary: "sandbox_internal" });
+                        result.preToolContext.push(`permission.sandbox_admitted: this call's inherited pending approval was auto-admitted because the deployment declares an isolated sandbox execution env and the request stays inside it. Recorded for audit.`);
                     }
                     if (!result.block && !result.suspend && result.preToolContext.length > 0) {
                         preToolContexts.set(e.toolCallId, result.preToolContext);
@@ -4531,7 +4856,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             : undefined;
         overheadState.promptChars = systemPrompt.length;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;