@sema-agent/core 5.21.1 → 5.23.0

package/dist/core/tool-policy.js

@@ -1,4 +1,6 @@
+import { createHash } from "node:crypto";
 import { homedir } from "node:os";
+import { brandPolicyAskClass } from "./ask-class.js";
 import { join, normalize as normalizePath, posix as posixPath, sep, win32 as winPath } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { boundInputHashOf } from "./canonical-json.js";
@@ -12,6 +14,67 @@ export function isApprovalSettledBy(v) {
 export function decisionText(d) {
     return d.message;
 }
+export function checkToolPolicyProjection(projection, req) {
+    for (const c of projection.components) {
+        if (c.kind === "tool_deny") {
+            if (c.names.includes(req.toolName)) {
+                return { action: "deny", message: `tool "${req.toolName}" is denied by a frozen inherited policy projection` };
+            }
+            continue;
+        }
+        if (c.kind === "tool_allowlist") {
+            if (!c.names.includes(req.toolName)) {
+                return { action: "deny", message: `tool "${req.toolName}" is not in a frozen inherited policy projection's allowlist` };
+            }
+            continue;
+        }
+        if (!c.tools.includes(req.toolName))
+            continue;
+        const command = req.args?.command;
+        if (typeof command !== "string") {
+            if (c.unparseableAction === "deny") {
+                return { action: "deny", message: `tool "${req.toolName}" call has no parseable command string (frozen inherited policy projection)` };
+            }
+            continue;
+        }
+        const parsed = parseLeadingCommandName(command);
+        if ("reject" in parsed) {
+            if (c.unparseableAction === "deny") {
+                return { action: "deny", message: `command is not a single simple command (${parsed.reject}) (frozen inherited policy projection)` };
+            }
+            continue;
+        }
+        if (c.deny.includes(parsed.name)) {
+            return { action: "deny", message: `command "${parsed.name}" is denied by a frozen inherited policy projection` };
+        }
+        if (c.allow !== undefined && !c.allow.includes(parsed.name) && c.unmatchedAction === "deny") {
+            return { action: "deny", message: `command "${parsed.name}" is not in a frozen inherited policy projection's allowlist` };
+        }
+    }
+    return undefined;
+}
+export function constraintChainEntryOf(policy, meta) {
+    const m = {
+        ...(meta?.autoModeArmed ? { autoModeArmed: true } : {}),
+        ...(meta?.durableMandate ? { durableMandate: true } : {}),
+        ...(meta?.contentMandate ? { contentMandate: true } : {}),
+    };
+    const p = policy.projection;
+    if (p === undefined)
+        return { opaque: true, ...m };
+    return { components: p.components, requiresLiveRemainder: p.requiresLiveRemainder, ...m };
+}
+function stableJson(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v) ?? "null";
+    if (Array.isArray(v))
+        return `[${v.map(stableJson).join(",")}]`;
+    const keys = Object.keys(v).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${stableJson(v[k])}`).join(",")}}`;
+}
+export function constraintChainDigest(chain) {
+    return `cpv1:${createHash("sha256").update(stableJson(chain)).digest("hex")}`;
+}
 const ALLOW = { action: "allow" };
 const RETIRED_TEXT_FIELD = "reason";
 const RETIRED_TEXT_FIELD_DENY_MESSAGE = `a permission decision carries the retired "${RETIRED_TEXT_FIELD}" field — rename it to "message" (the one text field ` +
@@ -100,6 +163,13 @@ export function createAllowDenyPolicy(opts) {
     const allow = opts.allow ? new Set(opts.allow) : undefined;
     const deny = new Set(opts.deny ?? []);
     return {
+        projection: {
+            components: [
+                ...(opts.deny && opts.deny.length > 0 ? [{ kind: "tool_deny", names: [...opts.deny] }] : []),
+                ...(opts.allow ? [{ kind: "tool_allowlist", names: [...opts.allow] }] : []),
+            ],
+            requiresLiveRemainder: false,
+        },
         nameSets: [{ ...(opts.allow ? { allow: [...opts.allow] } : {}), ...(opts.deny ? { deny: [...opts.deny] } : {}) }],
         check(req) {
             const toolName = req.toolName;
@@ -124,6 +194,13 @@ export function createApprovalPolicy(opts) {
     const deny = new Set(opts.deny ?? []);
     const auto = new Set(opts.autoAllow ?? []);
     return {
+        projection: {
+            components: [
+                ...(opts.deny && opts.deny.length > 0 ? [{ kind: "tool_deny", names: [...opts.deny] }] : []),
+                ...(opts.denyByDefault === true ? [{ kind: "tool_allowlist", names: [...opts.requireApproval, ...(opts.autoAllow ?? [])] }] : []),
+            ],
+            requiresLiveRemainder: opts.requireApproval.length > 0,
+        },
         nameSets: [
             {
                 ask: [...opts.requireApproval],
@@ -179,7 +256,25 @@ export function createApprovalPolicy(opts) {
 }
 export function combinePolicies(...policies) {
     const nameSets = policies.flatMap(toolPolicyNameSets);
+    const childProjections = policies.map((p) => p.projection);
+    const projectedComponents = [];
+    let combinedRemainder = false;
+    for (const p of childProjections) {
+        if (p === undefined) {
+            combinedRemainder = true;
+            break;
+        }
+        projectedComponents.push(...p.components);
+        if (p.requiresLiveRemainder) {
+            combinedRemainder = true;
+            break;
+        }
+    }
+    const combinedProjection = childProjections.some((p) => p !== undefined)
+        ? { components: projectedComponents, requiresLiveRemainder: combinedRemainder }
+        : undefined;
     return {
+        ...(combinedProjection !== undefined ? { projection: combinedProjection } : {}),
         ...(nameSets.length > 0 ? { nameSets } : {}),
         async check(req, signal) {
             let asked;
@@ -225,7 +320,22 @@ export function createCoarseCommandNamePolicy(opts) {
     const fallback = (reason) => defaultAction === "deny"
         ? { action: "deny", message: reason, decisionReason: "rule" }
         : { action: "ask", message: reason, decisionReason: "rule" };
-    return {
+    const fallbackIsDeny = defaultAction === "deny";
+    const projection = {
+        components: [
+            {
+                kind: "shell_command",
+                tools: [...shellTools],
+                deny: [...deny],
+                ...(allow !== undefined ? { allow: [...allow] } : {}),
+                unmatchedAction: fallbackIsDeny ? "deny" : "none",
+                unparseableAction: fallbackIsDeny ? "deny" : "none",
+            },
+        ],
+        requiresLiveRemainder: !fallbackIsDeny,
+    };
+    return brandPolicyAskClass({
+        projection,
         check(req) {
             if (!shellTools.has(req.toolName))
                 return ALLOW;
@@ -245,7 +355,7 @@ export function createCoarseCommandNamePolicy(opts) {
             }
             return ALLOW;
         },
-    };
+    }, "sandbox_local");
 }
 const UNVERIFIABLE_DELETE_SAFE_VARS = ["TMPDIR", "HOME", "PWD"];
 const DELETE_HEADS = new Set(["rm", "xargs", "Remove-Item"]);
@@ -473,7 +583,7 @@ function hasRecursiveForce(argvTail) {
 export function createUnverifiableDeletePolicy(opts) {
     const safeVars = new Set([...UNVERIFIABLE_DELETE_SAFE_VARS, ...(opts?.safeVars ?? [])]);
     const shellTools = canonicalToolNameSet(opts?.tools);
-    return {
+    return brandPolicyAskClass({
         check(req) {
             if (!shellTools.has(req.toolName))
                 return ALLOW;
@@ -492,7 +602,7 @@ export function createUnverifiableDeletePolicy(opts) {
                     `(or assign the variable in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`,
             };
         },
-    };
+    }, "external_authority");
 }
 function pathSegments(p) {
     return p.split(/[\\/]/).filter(Boolean);
@@ -569,7 +679,7 @@ export function createTranscriptIntegrityPolicy(opts) {
             `files — modifying or deleting them tampers with the run's own audit trail. Reading them (ls/cat/grep ` +
             `as a single simple command) is fine.`,
     });
-    return {
+    return brandPolicyAskClass({
         check(req) {
             const toolName = req.toolName;
             if (shellTools.has(toolName)) {
@@ -597,7 +707,7 @@ export function createTranscriptIntegrityPolicy(opts) {
             }
             return ALLOW;
         },
-    };
+    }, "external_authority");
 }
 const delegatedApproverRoot = new WeakMap();
 export function withDelegationProvenance(onAsk, delegation) {
@@ -734,12 +844,40 @@ export async function resolveAsk(req, onAsk, signal) {
         };
     }
     if (typeof ok === "object" && ok !== null) {
-        if (ok.allow !== true) {
-            return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode", settledBy: "human" };
+        const supplied = ok.settledBy;
+        const allowed = ok.allow;
+        const suppliedEdit = ok.updatedInput;
+        if (supplied !== undefined && supplied !== "human" && supplied !== "timeout") {
+            return {
+                action: "deny",
+                message: `the approver for "${req.toolName}" reported settledBy "${typeof supplied === "string" ? containThrownText(supplied) : supplied === null ? "null" : typeof supplied}", which is outside what a synchronous ` +
+                    `approver may self-report — it is exactly "human" or "timeout" (or omitted); denied fail-closed`,
+                decisionReason: "mode",
+                settledBy: "aborted",
+            };
+        }
+        if (supplied === "timeout" && allowed === true) {
+            return {
+                action: "deny",
+                message: `the approver for "${req.toolName}" returned an allow settled by "timeout" — an elapsed approval window cannot be ` +
+                    `what approved a call; denied fail-closed (report timeout with allow:false, or allow with settledBy "human"/omitted)`,
+                decisionReason: "mode",
+                settledBy: "timeout",
+            };
+        }
+        if (allowed !== true) {
+            return {
+                action: "deny",
+                message: supplied === "timeout"
+                    ? `approval for "${req.toolName}" was not answered before the approver's own window elapsed: ${req.message}`
+                    : `approval denied for "${req.toolName}": ${req.message}`,
+                decisionReason: "mode",
+                settledBy: supplied === "timeout" ? "timeout" : "human",
+            };
         }
-        if (ok.updatedInput === undefined)
+        if (suppliedEdit === undefined)
             return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settledBy: "human" };
-        const edit = tryCloneArgs(ok.updatedInput);
+        const edit = tryCloneArgs(suppliedEdit);
         if (!edit.ok) {
             return {
                 action: "deny",

package/dist/core/tool-result-store.d.ts

@@ -213,7 +213,15 @@ export declare function firstPartyOffloadPolicy(toolName: string): {
 };
 /** Head+tail preview of an offloaded result, pointing at {@link OFFLOAD_TOOL_NAME} via `ref`. Exported so
  *  the per-message aggregate budget (design/64 §17.2) produces the SAME preview format (deterministic →
- *  byte-identical across queries → prompt-cache safe). */
+ *  byte-identical across queries → prompt-cache safe).
+ *
+ *  #115 (2026-08-09) — the truncation line states WHERE the rest is, not what anyone can do with it.
+ *  "read more" alone reads as a promise that the full output is retrievable, and the model relays that
+ *  promise to the person it is talking to; what is actually guaranteed is narrower and exactly two
+ *  things: the text is retained in this run's tool-result store, and THIS chain can page it back. A
+ *  host-side read face (an HTTP route that hands the user the whole output) is a separate deployment
+ *  feature that may or may not exist — so the line names it as a deployment fact instead of implying
+ *  it, and the model can answer "can I get the full log?" without guessing. */
 export declare function buildPreview(full: string, ref: string, sizes?: {
     head: number;
     tail: number;

package/dist/core/tool-result-store.js

@@ -154,7 +154,8 @@ export function buildPreview(full, ref, sizes, reachableTools) {
     const tail = full.slice(tailStart);
     return (`${PERSISTED_OUTPUT_PREFIX}"${ref}" chars="${total}">\n` +
         `${head}\n` +
-        `…[truncated — ${total} chars total. ${offloadPagebackHint(ref, "preview", reachableTools)}]\n` +
+        `…[truncated — ${total} chars total, retained in this run's tool-result store; a user-facing read face is a deployment fact. ` +
+        `${offloadPagebackHint(ref, "preview", reachableTools)}]\n` +
         `${tail}\n` +
         `</persisted-output>`);
 }

package/dist/core/trace.d.ts

@@ -16,7 +16,7 @@
  * core's own contract is only the field names here; it deliberately stops at supplying the FACTS a bridge
  * needs (ids, turn indices, token counts) rather than adopting the convention's vocabulary internally.
  */
-import type { TaskStatus, ToolEffect } from "./types.js";
+import type { BrainRetryErrClass, TaskStatus, ToolEffect } from "./types.js";
 import type { ThinkingLevel } from "../internal/harness-types.js";
 import type { ToolManifestRow } from "../prompt-assembly/tool-catalog.js";
 /**
@@ -382,6 +382,76 @@ export type TraceEvent = {
     taskId: string;
     message: string;
     ts: number;
+} | {
+    /**
+     * design/182 §4.6 — a cloud-sync round moved a (rule, scope) from REMOVED back to LIVE: another
+     * replica's add outlived the local tombstone (add-wins is the locked merge semantic, so the
+     * transition itself is not news — its VISIBILITY is). The person who deleted the rule has to be
+     * able to learn that it came back, and to delete it again. Metadata only: the canonical rule
+     * text and the scope KIND — a project scope's root path stays out of the trace.
+     */
+    kind: "permission.rule_sync_resurrected";
+    version: 1;
+    /** The bucket this round synced. A local-owner bucket cannot sync, so this is always a principal. */
+    principal: string;
+    rule: string;
+    scopeKind: "global" | "project";
+    ts: number;
+} | {
+    /**
+     * design/182 §4.3/§5.2 — a cloud-sync round REFUSED an inbound row, or quarantined a local one.
+     * The reason is a closed code from the governance-codes family (never free text): the machine
+     * reads the table. One event per dropped row — a silently refused row is indistinguishable from
+     * a row that never existed, which is the failure this event exists to prevent.
+     */
+    kind: "permission.rule_sync_dropped";
+    version: 1;
+    principal: string;
+    rule: string;
+    scopeKind: "global" | "project";
+    /** Closed reason code ({@link import("./governance-codes.js").RuleSyncDropReason}). */
+    reason: string;
+    ts: number;
+} | {
+    /**
+     * design/182 §7.4 — an org-governed deployment could NOT adjudicate against an org snapshot
+     * (never installed, provider failed past the staleness bound, or the persisted state was
+     * refused). The gate answered by failing the WHOLE decision boundary closed: every terminal
+     * allow became a real-approval ask. This is the operator-facing half of that tighten — the
+     * deployment is paying the "ask about everything" price and has to be able to see why.
+     */
+    kind: "permission.org_snapshot_unavailable";
+    version: 1;
+    taskId: string;
+    toolName: string;
+    toolCallId: string;
+    /** The overlay's own disclosure lines (deployment-authored/engine-authored, never model text),
+     *  joined — provider failure, refused snapshot, rollback refusal, missing durable persistence. */
+    message: string;
+    ts: number;
+} | {
+    /**
+     * F-012 L2 — a pending ask was AUTO-ADMITTED by the sandbox-admission leg: the deployment's
+     * execution env declares an isolated sandbox, every surviving ask on the call was
+     * engine-classified `sandbox_local`, and the call crosses no declared boundary. This record is
+     * the durable admission ledger's operator half (the transcript half rides the tool result's
+     * system-reminder context); a consumer anchors on THIS kind, never on wording.
+     */
+    kind: "permission.sandbox_admitted";
+    version: 1;
+    taskId: string;
+    toolName: string;
+    toolCallId: string;
+    /** The engine ask classes of the admitted call's surviving asks (all `sandbox_local` by the
+     *  admission predicate; carried explicitly so the ledger states what was judged, not just that
+     *  judgment passed). */
+    askClasses: readonly string[];
+    /** Which layers raised the admitted asks (`caller_policy` / `ancestor_constraint` /
+     *  `gate_safety_tighten`). */
+    sourceLayers: readonly string[];
+    /** The boundary classification the admission asserted. */
+    boundary: "sandbox_internal";
+    ts: number;
 } | {
     /** C1 — the failover brain served this call from a FALLBACK entry (`createFailoverBrain`): the
      *  primary (and possibly earlier hops) failed cleanly upfront. Without this, same-model gateway
@@ -418,6 +488,14 @@ export type TraceEvent = {
     /** 1-based attempt number that was ABANDONED (the retry that follows is attempt+1). */
     attempt: number;
     phase: "connect" | "midstream";
+    /** WHY the attempt is being retried, as the closed neutral bucket the user-facing status frame
+     *  also carries ({@link BrainRetryErrClass}) — an operator reading this and a user reading a
+     *  progress line then agree on the reason. Optional: absent on frames minted before it existed. */
+    errClass?: BrainRetryErrClass;
+    /** The backoff about to be slept, ms — 0 for an immediate re-send. Together with `attempt` this
+     *  makes a whole retry chain reconstructible from the trace alone, which is what a caller that saw
+     *  only silence needs to explain where the time went. */
+    nextDelayMs?: number;
     ts: number;
 } | {
     /** C2 — the agent loop drove one of its self-heal recoveries (malformed-tool retry / thinking-only

package/dist/core/types.d.ts

@@ -737,6 +737,17 @@ export interface ToolExecuteContext {
      * tool runs outside a Runner task.
      */
     inheritedGateForChildren?: () => import("./runner/prepare-task.js").InheritedGate;
+    /**
+     * design/180 half A — the delegation runtime-provenance ARMING face. Runner-filled; a delegation
+     * tool calls it at spawn time: a non-undefined return means this (parent) run is armed (it mounts
+     * a memory session, or is itself recording for its own parent) and carries the chain's FROZEN
+     * content-safety snapshot — the tool then mints the child's recorder ref and threads both into
+     * the child's trusted `RunInternals.delegationProvenance`. Undefined return / absent field ⇒ the
+     * child spawns without a recorder (its deliveries read `unknown` and every judgment stays on the
+     * static floor — v1 behavior byte-identical). Same trust posture as
+     * {@link inheritedGateForChildren}: never a model/tool argument, never a TaskSpec field.
+     */
+    delegationProvenanceForChildren?: () => import("./memory-engine/delegation-provenance.js").DelegationContentSafety | undefined;
     /**
      * RB-201 FO-3 (form-one audit, CC 220 `Ipd`/`ein` parity) — the auto-mode classifier decider ARMED
      * for THIS task (`RuntimeCaps.autoMode === true` AND `RunnerDeps.autoMode` both present; the same
@@ -1802,6 +1813,17 @@ export interface TaskSpec {
     agents?: AgentDefinition[];
     /** Gate tool calls before they run (allow/deny/approval). Overrides `RunnerDeps.toolPolicy`. */
     toolPolicy?: import("./tool-policy.js").ToolPolicy;
+    /**
+     * #93 (F-012 L3) — the OVERRIDE seat for the durable resume-edit re-adjudication policy: the policy
+     * an approver's `updatedInput` EDIT is re-checked against before a resumed pending call executes
+     * (and, at park-mint time, the policy a store-codec-moved projection is re-adjudicated by). ABSENT
+     * falls back to the caller policy (`toolPolicy ?? RunnerDeps.toolPolicy`) — never to a silent skip:
+     * the pre-#93 shape skipped the whole recheck for deployments with no caller policy, which let a
+     * fidelity-projection-moved value land unadjudicated. Supply this only to make the resume-edit
+     * boundary STRICTER/different from the live caller policy; it never widens (the frozen ancestor
+     * projections and the deny-narrowing layers still apply regardless).
+     */
+    basePolicyForResumeEdit?: import("./tool-policy.js").ToolPolicy;
     /** How `ask` decisions resolve for this task (headless auto-deny by default). Overrides `RunnerDeps.onAsk`. */
     onAsk?: import("./tool-policy.js").OnAsk;
     /** Content-ask seam (design/64 §5): routes an AskUserQuestion tool call to a real human/UI. When set, the
@@ -2999,6 +3021,24 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  * Both mean the same thing to a renderer — stop showing the retry state.
  */
  | "recovered" | "gave_up";
+/**
+ * WHY a retry wait is happening, as a closed, provider-NEUTRAL bucket — the companion to
+ * {@link BrainStatusPhase}, which says what the brain is doing about it. A consumer rendering an
+ * unattended progress line ("no answer for three minutes") needs the reason, and until this existed the
+ * only carriers of it were the HTTP status and the syscall code, neither of which may cross this
+ * channel. Values are about the SHAPE of the failure, never its provider taxonomy:
+ *  - `connect_refused` — the attempt got a definite negative about the target itself (nothing accepts
+ *    at that address, or the name has no address). This is the class the SHORT retry lane serves.
+ *  - `transport`      — any other transport-level failure: a connect timeout, a reset, a mid-stream
+ *    tear, a stalled stream. No verdict about the target; the full ladder applies.
+ *  - `rate_limit`     — the provider asked the caller to slow down.
+ *  - `server`         — the provider reported a failure on its own side.
+ *  - `http`           — a response the status predicate calls terminal, retried anyway because the
+ *    provider's own explicit retry verdict said to.
+ *  - `output_cap`     — not a failure of the connection at all: the request is being re-sent with a
+ *    lowered output cap after the provider reported the context limit exceeded (no backoff).
+ */
+export type BrainRetryErrClass = "connect_refused" | "transport" | "rate_limit" | "server" | "http" | "output_cap";
 /** design/99 §E3/§E10 — the payload of a {@link TaskEvent} `status` event (and the brain→runner signal). */
 export interface BrainStatus {
     phase: BrainStatusPhase;
@@ -3013,8 +3053,14 @@ export interface BrainStatus {
     /** RB-420-c — 1-based index of the attempt that just failed (the wait precedes attempt `attempt + 1`);
      *  same numbering as the `brain.retry` telemetry frame. Absent on frames that are not a retry wait. */
     attempt?: number;
-    /** RB-420-c — the retry budget of THIS lane, so a consumer can render "attempt 3 of 10". */
+    /** RB-420-c — the retry budget of THIS lane, so a consumer can render "attempt 3 of 10". Lane, not
+     *  engine: a failure class served by a shorter ladder reports that ladder's budget, so the fraction a
+     *  consumer renders is the one actually in force rather than the engine-wide ceiling. */
     maxRetries?: number;
+    /** Why this wait is happening ({@link BrainRetryErrClass}). Present on retry-wait frames whose cause
+     *  the engine classified; absent on frames that are not a retry wait (`recovered`/`gave_up`) and on a
+     *  `circuit_open` fast-fail, which is a local verdict rather than an observed failure. */
+    errClass?: BrainRetryErrClass;
 }
 /**
  * design/97 CORE-8 (③): one lightweight TOOL-ACTIVITY beat surfaced from a running task, for a per-agent live
@@ -3955,8 +4001,11 @@ export interface BackgroundChildEvent {
      */
     editedFiles?: import("../agents/subagent-steps.js").SubagentEditedFile[];
     /**
-     * terminal (residual observability, lane E): `true` when the child can be revived with `SendMessage` (its session is
-     * retained and it was not stopped by the user); `false` for a user-stopped / non-resumable child.
+     * terminal (residual observability, lane E): `true` when the child can be revived with `SendMessage` —
+     * either its session is retained live and the run was not killed, or it has a NAMED durable row that no
+     * USER stop closed (a parent teardown, a reap or a host death is precisely what the durable revival
+     * lane recovers from). `false` for a user-stopped child, an anonymous or store-less one, and for the
+     * session-teardown reap frame, whose lane cannot know what survives the teardown.
      * Lets a parent's orchestration logic decide "continue it" vs "start fresh" without trial-and-error.
      */
     resumable?: boolean;
@@ -4151,6 +4200,44 @@ export interface RunnerDeps {
      * disclosure — a loosening face fails toward asking.
      */
     permissionRuleStore?: import("./permission-rule-store.js").PermissionRuleStoreProvider;
+    /**
+     * design/182 §4.5 (F-011) — declare that this deployment keeps its permission rules in the
+     * IDENTITY-LESS local bucket: a task with no `principal` resolves rules through the provider's
+     * `forLocalOwner()` face instead of resolving to zero rules.
+     *
+     * A DECLARATION, never an inference (same rule as {@link permissionRuleOrg}): the local bucket is
+     * "this machine's owner", a fact only the deployment knows. Omitted/`false` ⇒ v1 exactly — an
+     * unauthenticated task reads no rules. Declared `true` while the wired provider has no local-owner
+     * face (or while no provider is wired at all) is a configuration contradiction and is refused loudly
+     * at prepare, rather than silently degrading to "the rules this person approved stopped applying".
+     *
+     * A local-owner bucket cannot cloud-sync (syncing is an authenticated act); it is adopted into a
+     * principal bucket by `adoptFilePermissionRuleStore`, after which the local-owner face resolves the
+     * adopted principal's bucket forever.
+     */
+    localOwnerRules?: boolean;
+    /**
+     * design/182 §7 — the ORG rule overlay for an org-GOVERNED deployment. Constructed with
+     * `createOrgRuleOverlay` (that constructor is the boot gate: a governed declaration with no snapshot
+     * provider refuses to boot), so a value here IS the declaration — nothing is inferred from wiring.
+     *
+     * Present ⇒ every tool call is adjudicated against the org's published deny/ask snapshot BEFORE the
+     * ask-resolution chain (org deny > org ask > personal allow rule > bare ask), and while the overlay
+     * cannot adjudicate (never installed / past the staleness bound / a refused rollback) the WHOLE
+     * decision boundary fails closed: every terminal allow becomes a real-approval ask and both
+     * ask→allow seams are disarmed. Omitted ⇒ the org layer does not exist and the decision path is
+     * byte-identical to a build without it.
+     */
+    permissionRuleOrg?: import("./permission-rule-org.js").OrgRuleOverlay;
+    /**
+     * design/182 §9 — DECLARE that this deployment drives cloud sync (`syncPermissionRules`) for the
+     * wired rule store. Purely a disclosure input: it is reported as `permissionRules.syncWired` on the
+     * wiring manifest and changes no decision. It exists because the sync loop is HOST-driven (core
+     * bundles no fetch and owns no timer), so there is nothing for the engine to infer — and "are this
+     * machine's standing approvals shared with other devices and a server?" is exactly the trust-domain
+     * fact an operator must be able to read off the manifest instead of guessing.
+     */
+    permissionRuleSyncWired?: boolean;
     /**
      * design/99 §K — resolve the **per-principal runtime ENTITLEMENTS** the engine
      * ENFORCES server-side, keyed by `spec.principal`. A deployment (the SERVICE) implements it over center's
@@ -4543,6 +4630,10 @@ export interface RunnerDeps {
     mcpImageResizer?: import("./mcp.js").McpImageResizer;
     /** Default tool-call gate for all tasks (a task's own `toolPolicy` overrides this). */
     toolPolicy?: import("./tool-policy.js").ToolPolicy;
+    /** Deployment default for {@link TaskSpec.basePolicyForResumeEdit} (#93 / F-012 L3): the resume-edit
+     *  re-adjudication override. Resolution: `spec.basePolicyForResumeEdit ?? THIS ?? (spec.toolPolicy ??
+     *  deps.toolPolicy)` — absence falls back to the caller policy, never to a silent skip. */
+    basePolicyForResumeEdit?: import("./tool-policy.js").ToolPolicy;
     /**
      * How `ask` decisions resolve when a policy/hook requests human confirmation (design/37). Default
      * (omitted) = `"deny"`: **headless auto-deny** — no approver, so `ask` resolves deterministically to

package/dist/core/wiring-manifest.d.ts

@@ -136,6 +136,17 @@ export interface WiringManifest {
      *  "this build has no such feature", and a present-and-false one says "it exists and is off here". */
     permissionRules: {
         storeWired: boolean;
+        /** design/182 §9 — this deployment DECLARED that it drives cloud sync for the wired rule store
+         *  (`RunnerDeps.permissionRuleSyncWired`). Connecting a bucket to a sync endpoint merges every
+         *  device, the transport and the server into ONE consent trust domain, which is a fact an operator
+         *  reads off the manifest rather than infers. `false` on a deployment that does not sync — same
+         *  present-and-false shape as `storeWired`, for the same reason. */
+        syncWired: boolean;
+        /** design/182 §7 — this deployment DECLARED org governance (`RunnerDeps.permissionRuleOrg`, whose
+         *  constructor refuses to boot a governed declaration with no snapshot provider). `true` also means
+         *  the fail-closed availability contract is armed: while no org snapshot can be adjudicated
+         *  against, every terminal allow tightens to a real-approval ask. */
+        orgGoverned: boolean;
     };
     /**
      * Governance surfaces (presence facts only). `audience: "operator"` is the MACHINE-READABLE
@@ -192,6 +203,10 @@ export interface WiringFacts {
     backgroundAgentStoreWired: boolean;
     /** design/179 — a persisted allow-rule store provider is wired. */
     permissionRuleStoreWired: boolean;
+    /** design/182 §9 — the deployment declared that it drives cloud sync for that store. */
+    permissionRuleSyncWired: boolean;
+    /** design/182 §7 — the deployment declared org governance (an org rule overlay is wired). */
+    permissionRuleOrgGoverned: boolean;
     hostChildEventSinkWired: boolean;
     lockedConfigWired: boolean;
     complianceWired: boolean;
@@ -200,7 +215,7 @@ export interface WiringFacts {
 }
 /** Named view of the deps seats the static half reads (a `Pick` of the real {@link RunnerDeps} —
  *  single-source shapes, no parallel hand-copied interface). */
-export type StaticWiringDeps = Pick<RunnerDeps, "onAsk" | "onQuestion" | "interactionPosture" | "onElicit" | "checkpointStore" | "sessionStore" | "backgroundAgentStore" | "onBackgroundChildEvent" | "lockedConfig" | "compliancePostureResolver" | "memoryScopeAdmission" | "retentionPolicy" | "permissionRuleStore">;
+export type StaticWiringDeps = Pick<RunnerDeps, "onAsk" | "onQuestion" | "interactionPosture" | "onElicit" | "checkpointStore" | "sessionStore" | "backgroundAgentStore" | "onBackgroundChildEvent" | "lockedConfig" | "compliancePostureResolver" | "memoryScopeAdmission" | "retentionPolicy" | "permissionRuleStore" | "permissionRuleSyncWired" | "permissionRuleOrg">;
 /** Named view of the spec seats the static half reads (a `Pick` of the real {@link TaskSpec}). */
 export type StaticWiringSpec = Pick<TaskSpec, "onAsk" | "onQuestion" | "checkpointStore" | "durableApproval" | "mcp" | "interactiveTools" | "interactionPosture">;
 /**

package/dist/core/wiring-manifest.js

@@ -86,7 +86,11 @@ export function deriveWiringManifest(facts) {
         parkLane,
         session: { store: manifestDurabilityOf(facts.sessionDurability) },
         fleet: { backgroundAgentStore: facts.backgroundAgentStoreWired, hostChildEventSink: facts.hostChildEventSinkWired },
-        permissionRules: { storeWired: facts.permissionRuleStoreWired },
+        permissionRules: {
+            storeWired: facts.permissionRuleStoreWired,
+            syncWired: facts.permissionRuleSyncWired,
+            orgGoverned: facts.permissionRuleOrgGoverned,
+        },
         governance: {
             audience: "operator",
             lockedConfig: facts.lockedConfigWired,
@@ -179,6 +183,8 @@ export function describeStaticWiring(deps, spec = {}) {
         sessionDurability: resolveDeclaredDurability(deps.sessionStore, "sessionStore"),
         backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
         permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
+        permissionRuleSyncWired: deps.permissionRuleSyncWired === true,
+        permissionRuleOrgGoverned: deps.permissionRuleOrg !== undefined,
         hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
         lockedConfigWired: deps.lockedConfig !== undefined,
         complianceWired: deps.compliancePostureResolver !== undefined,