@sema-agent/core 5.21.1 → 5.23.0

package/dist/core/ask-class.d.ts

@@ -0,0 +1,48 @@
+/**
+ * F-012 L2 — the ENGINE-INTERNAL ask-class envelope.
+ *
+ * An `ask` verdict's SEMANTIC CLASS decides whether a deployment-declared sandbox may auto-admit it
+ * (clay's ruling: a declared sandbox admits everything inside it — the boundary crossings park to a
+ * human, escape prevention belongs to the sandbox, not to engine re-policing). The class deliberately
+ * lives OUTSIDE the public `PermissionResult`: a decision object is caller-supplied data, and a
+ * self-reported "this ask is sandbox-local" field would be the same trust hole as the
+ * `decisionReason:"safety"` self-declaration this codebase already refuses. Instead, BUILT-IN policy
+ * factories register their instances here (private WeakMap brand — nothing a deployment policy can
+ * forge by shaping its return value), and everything unregistered reads as `unknown`.
+ *
+ * Classes and their dominance (STRICT — merge keeps the strongest; only an all-`sandbox_local` set
+ * may auto-admit):
+ *  - `sandbox_local`   — an engine-authored "confirm a potentially destructive LOCAL action" ask
+ *                        (name/pattern confirmation lists). Sandbox containment answers it.
+ *  - `external_authority` — an ask whose whole point is real judgment (the safety-rule policies with
+ *                        `requiresRealApproval`); containment answers nothing about it.
+ *  - `hook`            — a screening-face ask (a deployment's PreToolUse verdict folded to policy
+ *                        form); the face's authority is the deployment's, not the sandbox's.
+ *  - `mandate`         — an ask bound to durable-park semantics (inherited durable mandate /
+ *                        approver-unavailable float); it must reach the park untouched.
+ *  - `unknown`         — everything unregistered, every deployment policy. Fail-closed: never
+ *                        admitted.
+ */
+export type AskClass = "sandbox_local" | "external_authority" | "hook" | "mandate" | "unknown";
+/**
+ * Brand a built-in policy instance with its ask class (engine factories only — not exported from the
+ * package). The `check` binding is LOCKED as a non-writable, non-configurable DATA property before the
+ * policy is returned (codex adversarial round 4, HIGH): reading `policy.check` and INVOKING it must
+ * name the same callable, atomically. A plain `===` re-read was TOCTOU-able by an accessor — a getter
+ * could return the branded function to `policyAskClassOf` and a deployment ask to the gate's
+ * invocation. Locking the property makes the callable un-swappable and un-redefinable, so the class
+ * travels with the exact decision function. An `check` that is ALREADY accessor-backed (or a frozen
+ * object we cannot lock) is refused branding — it reads back `unknown` (fail-closed), never trusted.
+ */
+export declare function brandPolicyAskClass<T extends {
+    check: unknown;
+}>(policy: T, cls: AskClass): T;
+/** The registered class of a policy instance — `unknown` for anything unregistered, whose `check` is
+ *  no longer the locked data value, or whose `check` became accessor-backed (fail-closed: a
+ *  replaced/decorated/getter-shadowed decision function is not the branded one). Reads the property
+ *  DESCRIPTOR's value (never invokes a getter), so the check is atomic with what the gate will call. */
+export declare function policyAskClassOf(policy: (object & {
+    check?: unknown;
+}) | null | undefined): AskClass;
+/** The strongest class in a set (strict dominance — any non-`sandbox_local` member dominates). */
+export declare function dominantAskClass(classes: readonly AskClass[]): AskClass;

package/dist/core/ask-class.js

@@ -0,0 +1,33 @@
+const RANK = { sandbox_local: 0, external_authority: 1, hook: 2, mandate: 3, unknown: 4 };
+const registry = new WeakMap();
+export function brandPolicyAskClass(policy, cls) {
+    const desc = Object.getOwnPropertyDescriptor(policy, "check");
+    if (desc === undefined || desc.get !== undefined || desc.set !== undefined)
+        return policy;
+    try {
+        Object.defineProperty(policy, "check", { value: policy.check, writable: false, configurable: false, enumerable: desc.enumerable ?? true });
+    }
+    catch {
+        return policy;
+    }
+    registry.set(policy, { cls, check: policy.check });
+    return policy;
+}
+export function policyAskClassOf(policy) {
+    if (policy === null || policy === undefined)
+        return "unknown";
+    const entry = registry.get(policy);
+    if (entry === undefined)
+        return "unknown";
+    const desc = Object.getOwnPropertyDescriptor(policy, "check");
+    if (desc === undefined || desc.get !== undefined || desc.set !== undefined)
+        return "unknown";
+    return desc.value === entry.check ? entry.cls : "unknown";
+}
+export function dominantAskClass(classes) {
+    let strongest = "sandbox_local";
+    for (const c of classes)
+        if (RANK[c] > RANK[strongest])
+            strongest = c;
+    return strongest;
+}

package/dist/core/checkpoint-store.d.ts

@@ -774,6 +774,25 @@ export interface CheckpointState {
          *  (`resume.parent_constraint_mismatch`) — a partial re-supply is a typed error, never a silently
          *  thinner chain. Absent on older checkpoints ⇒ only the non-empty check applies. */
         parentConstraintCount?: number;
+        /**
+         * F-012 L1 — the persisted CONSTRAINT PROJECTIONS of the inherited chain, one ordered entry per
+         * `parentConstraints` layer: the layer's deterministic deny data
+         * ({@link import("./tool-policy.js").ToolPolicyProjection} content) or an explicit `{opaque:true}`
+         * placeholder for a layer that exports none. The resume leg EXECUTES these persisted projections
+         * (extra deny-narrowing layers + the pre-CAS edit re-adjudication) rather than trusting a
+         * re-supplied policy's execution half for the frozen deny data — a re-supplied closure that
+         * matches the digest but behaves differently cannot un-deny what the suspend froze. Present iff
+         * `requiresParentConstraint` on new mints; absent on older checkpoints (⇒ no frozen deny data —
+         * the count-only contract governs, and an EDIT resume is refused for want of a validatable chain). */
+        constraintChain?: ReadonlyArray<import("./tool-policy.js").ConstraintChainEntry>;
+        /**
+         * F-012 L1 — the content digest over `constraintChain` ({@link import("./tool-policy.js").constraintChainDigest}):
+         * binds the ordered chain topology (layer boundaries + opaque placeholders) and each projection's
+         * content. The resume pre-CAS ladder recomputes the digest over the RE-SUPPLIED chain's
+         * projections and rejects a mismatch (`resume.parent_constraint_mismatch`) — replacing the
+         * count-only shape check with a content contract (a same-length chain of different frozen deny
+         * data no longer passes). Present iff `constraintChain` is. */
+        constraintDigest?: string;
     };
     /**
      * [c209-C] Q5 — the listing frames' announced NAME-SETS at suspend (agent types / skills the model
@@ -799,6 +818,16 @@ export interface CheckpointState {
         skills?: string[];
         models?: string[];
     };
+    /**
+     * design/180 R-4 (R-2 cross-process variant) — the armed delegation child's MONOTONIC runtime-provenance
+     * aggregate at suspend ({@link import("./memory-engine/delegation-provenance.js").DelegationProvenanceAggregate}:
+     * version + coverageStartTurn + the two never-cleared bits sawExternal/incomplete). Persisted so a
+     * resume — a cross-process one especially, which lost the in-memory ref — CONTINUES accumulating from
+     * the recorded bits instead of restarting a fresh aggregate that could prove "clean" on the post-resume
+     * segment alone. Plain data → JSON/structuredClone round-trips. Present ONLY when the suspended leg ran
+     * with a recorder armed; ABSENT on an unarmed leg AND on an older checkpoint — the resume side reads
+     * absence-on-an-armed-child fail-closed as `incomplete`. */
+    delegationProvenance?: import("./memory-engine/delegation-provenance.js").DelegationProvenanceAggregate;
 }
 /**
  * {@link CheckpointState} with **every** field made required-PRESENT, while each value keeps its original
@@ -867,13 +896,26 @@ export declare const TOKEN_CHECKPOINT_VERSION = 5;
  * memory see zero version movement.
  */
 export declare const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
+/**
+ * F-012 (2026-08-09 — the ORG_ADMISSION_CHECKPOINT_VERSION precedent replayed a fifth time, codex
+ * adversarial finding): the schema version a suspend stamps when its state carries the F-012 durable
+ * enforcement fields — `inheritedGate.constraintChain`/`constraintDigest` (the frozen ancestor
+ * projection chain the resume-edit re-adjudication executes) or `delegationProvenance` (the monotonic
+ * provenance aggregate a resume re-seeds). Both enforcements live ENTIRELY in the resuming worker: a
+ * pre-F-012 worker (MAX_SUPPORTED=6) would accept the row, ignore constraintChain (so an approver-edited
+ * resume executes WITHOUT the frozen ancestor deny), and restart the aggregate clean (false-clean after
+ * pre-suspend external activity). Stamping v7 forces such a worker to reject PRE-CAS
+ * (`unsupported_version`, stays `pending`, retried on an enforcing worker). A checkpoint with NO F-012
+ * state keeps the historic stamps — deployments not delegating see zero version movement.
+ */
+export declare const F012_CHECKPOINT_VERSION = 7;
 /** The highest {@link Checkpoint.version} `runner.resume` will act on; a higher one is rejected pre-CAS with
  *  {@link CheckpointError} `unsupported_version` (the checkpoint stays `pending`, retryable on a newer worker).
- *  Raised to 6 for org-admission-bearing checkpoints — this worker reads v1 (legacy human), v2
- *  (resource), v3 (binding human/irreversible_ask), v4 (a pre-164 row, refused only when it carries the
- *  retired wall-clock allocation), v5 (token-allocation-bearing resource/approval) and v6
- *  (org-admission freeze state). */
-export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 6;
+ *  Raised to 7 for F-012-bearing checkpoints — this worker reads v1 (legacy human), v2 (resource), v3
+ *  (binding human/irreversible_ask), v4 (a pre-164 row, refused only when it carries the retired
+ *  wall-clock allocation), v5 (token-allocation-bearing resource/approval), v6 (org-admission freeze
+ *  state) and v7 (F-012 constraint-chain / delegation-provenance enforcement state). */
+export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 7;
 /**
  * Read a checkpoint's schema version, defaulting an absent field to **legacy `0`** (a 1.67-era checkpoint
  * written before the field existed — it carries no `workspaceHandle`, so resuming it the v1 way is safe).
@@ -992,8 +1034,16 @@ export interface ResolvedOutcome {
  * RETRY of the ALREADY-APPROVED action — the re-resume MUST replay the persisted {@link ResolvedOutcome}
  * winner, never a new vote — while a `tool_unavailable` reopen (the action could not run, may now be
  * invalid — P-7) lets a human RE-DECIDE with the tool present, so a fresh operator decision IS allowed.
+ *
+ * `constraint_rejected` (F-012 L3) carries the same FRESH-REDECISION semantics as `tool_unavailable`:
+ * a resolve was retracted because its decided INPUT failed a constraint re-adjudication (a frozen
+ * ancestor projection / resume-edit policy denied the approver's edit) — the ask itself is unconsumed,
+ * so the returned-to-pending row takes a fresh operator decision, never a forced replay of the
+ * rejected one. Core's own edit re-adjudication runs PRE-CAS (nothing to reopen there); this reason
+ * exists for a deployment lane that discovers the same rejection only after its own resolve landed
+ * and must return the row to pending without inventing an out-of-vocabulary reason.
  */
-export type ReopenReason = "env_failed" | "tool_unavailable";
+export type ReopenReason = "env_failed" | "tool_unavailable" | "constraint_rejected";
 /**
  * design/80 D-1 (atomicity fix): the optimistic-concurrency precondition a {@link CheckpointStore.resolve}
  * caller passes so its CAS is atomic with the validation it did against an earlier `get()` snapshot. The
@@ -1361,10 +1411,23 @@ export declare class CheckpointError extends Error {
      | "resume.parent_constraint_missing"
     /** Parent effective-policy inheritance (shape check): the resume DID re-supply
      *  `internals.inheritedGate.parentConstraints`, but its length differs from the checkpoint's recorded
-     *  `parentConstraintCount` — a partial/mismatched re-supply would silently run the child under a
+     *  `parentConstraintCount` — or (F-012 L1) its projection CONTENT digests differently from the
+     *  recorded `constraintDigest` — a partial/mismatched re-supply would silently run the child under a
      *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
      *  stays `pending`); re-resume with the full original chain. */
-     | "resume.parent_constraint_mismatch";
+     | "resume.parent_constraint_mismatch"
+    /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
+     *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
+     *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
+     *  the same token remains decidable (approve as shown, deny, or edit differently) — the rejection
+     *  consumed the decision's INPUT, never the ask itself. */
+     | "resume.constraint_rejected"
+    /** F-012 L3: the resume carried an approver EDIT but the inherited ancestor chain cannot be
+     *  re-adjudicated statically — an OPAQUE layer is present, a layer declares a live remainder beyond
+     *  its projection, or the checkpoint predates the projection chain. "Would have been allowed" is not
+     *  computable from a self-reported closure, so the edited resume is refused typed pre-CAS (the
+     *  checkpoint stays `pending`, still decidable); an UNEDITED approval is untouched. */
+     | "resume.constraint_unprojectable";
     /** Structured discrimination a caller can branch on where the code alone is ambiguous. Today one
      *  member: `field` names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
@@ -1457,10 +1520,23 @@ export declare class CheckpointError extends Error {
      | "resume.parent_constraint_missing"
     /** Parent effective-policy inheritance (shape check): the resume DID re-supply
      *  `internals.inheritedGate.parentConstraints`, but its length differs from the checkpoint's recorded
-     *  `parentConstraintCount` — a partial/mismatched re-supply would silently run the child under a
+     *  `parentConstraintCount` — or (F-012 L1) its projection CONTENT digests differently from the
+     *  recorded `constraintDigest` — a partial/mismatched re-supply would silently run the child under a
      *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
      *  stays `pending`); re-resume with the full original chain. */
-     | "resume.parent_constraint_mismatch", message: string, 
+     | "resume.parent_constraint_mismatch"
+    /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
+     *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
+     *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
+     *  the same token remains decidable (approve as shown, deny, or edit differently) — the rejection
+     *  consumed the decision's INPUT, never the ask itself. */
+     | "resume.constraint_rejected"
+    /** F-012 L3: the resume carried an approver EDIT but the inherited ancestor chain cannot be
+     *  re-adjudicated statically — an OPAQUE layer is present, a layer declares a live remainder beyond
+     *  its projection, or the checkpoint predates the projection chain. "Would have been allowed" is not
+     *  computable from a self-reported closure, so the edited resume is refused typed pre-CAS (the
+     *  checkpoint stays `pending`, still decidable); an UNEDITED approval is untouched. */
+     | "resume.constraint_unprojectable", message: string, 
     /** Structured discrimination a caller can branch on where the code alone is ambiguous. Today one
      *  member: `field` names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
@@ -1633,6 +1709,19 @@ export interface CheckpointStore {
      * that still matches.
      */
     readonly fidelity?: StoreFidelity;
+    /**
+     * F-012 L2/L3 — the RE-DECISION capability declaration: whether this store's `reopen` (and, when
+     * present, a durable validating-lease discipline) actually works — a promise, not a method-presence
+     * sniff (`reopen` is optional and a stub that returns `false` still satisfies the type). The
+     * sandbox-admission mode's pre-flight REQUIRES `redecision.reopen === true` (its boundary asks park
+     * to a human and must be re-decidable); absent reads fail-closed as "no declared re-decision face"
+     * and the mode refuses to arm, loudly. Same "declaration, never duck-typing" posture as
+     * {@link retention}/{@link durability}/{@link fidelity}.
+     */
+    readonly redecision?: {
+        reopen: boolean;
+        validatingLease?: boolean;
+    };
     /** Create-once. Throws {@link CheckpointError} `already_exists` on a token collision (never a silent
      *  overwrite — a reused token would clobber a live suspension). */
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
@@ -1887,6 +1976,10 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     /** Honest declaration on the fidelity axis: `put`/`get` are `structuredClone`, so a row keeps the
      *  whole structured-clone domain — a `Date` filed here is a `Date` when it comes back. */
     readonly fidelity: "structured-clone";
+    /** F-012 L2: this store's `reopen` is a real resolved→pending CAS (below) — declared, not sniffed. */
+    readonly redecision: {
+        readonly reopen: true;
+    };
     private cps;
     private fault;
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;

package/dist/core/checkpoint-store.js

@@ -133,7 +133,8 @@ export const RESOURCE_CHECKPOINT_VERSION = 2;
 export const BINDING_CHECKPOINT_VERSION = 3;
 export const TOKEN_CHECKPOINT_VERSION = 5;
 export const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
-export const MAX_SUPPORTED_CHECKPOINT_VERSION = 6;
+export const F012_CHECKPOINT_VERSION = 7;
+export const MAX_SUPPORTED_CHECKPOINT_VERSION = 7;
 export function checkpointVersionOf(cp) {
     return cp.version ?? 0;
 }
@@ -458,6 +459,7 @@ export class InMemoryCheckpointStore {
     retention = "none";
     durability = "process-local";
     fidelity = "structured-clone";
+    redecision = { reopen: true };
     cps = new Map();
     fault = null;
     async put(token, cp) {

package/dist/core/governance-codes.d.ts

@@ -29,3 +29,41 @@ export declare const NON_GOVERNANCE_MEMORY_CODES: ReadonlySet<string>;
  * `undefined` (NOT governance — the caller falls through to its ordinary taxonomy).
  */
 export declare function governanceRetryClass(code: string): GovernanceRetryClass | undefined;
+/**
+ * The CLOSED registry of reasons a permission-rule sync round may refuse an inbound record or move a
+ * local row into the quarantine area (design/182 §4.3/§5.2/§8.1). Same doctrine as
+ * {@link GOVERNANCE_CODES}: the machine reads THIS table, never free text — "silently dropped" is a
+ * contract violation, so every drop names a registered code and a consumer can branch on it.
+ *
+ * These are DISCLOSURE codes, not subagent error codes: they never enter {@link GOVERNANCE_CODES}
+ * (that table classifies a failed child's error for retry, and its gate enforces a suffix convention
+ * these codes do not carry). The value states which side of the wire loses bytes:
+ * `inbound-refused` = the peer's copy was refused here (the peer still holds it — no loss);
+ * `local-quarantined` = a LOCAL row left the live view into the quarantine area (bytes preserved,
+ * disclosed, re-enterable only through a new consent).
+ */
+export declare const RULE_SYNC_DROP_CODES: {
+    /** The single validator refused the rule text (e.g. a bare-interpreter prefix). Both directions. */
+    readonly invalid_rule_text: "inbound-refused-or-local-quarantined";
+    /** Stored tool/match/command disagree with the re-projection of the rule text. Both directions. */
+    readonly metadata_mismatch: "inbound-refused-or-local-quarantined";
+    /** An inbound dot claims THIS replica's actor above its minted counter — forgery on our own name.
+     *  Covers adds, a tombstone's `deletedBy`, AND a tombstone's `removedDots` (a tombstone naming our
+     *  future dot would pre-position a kill for an approval not yet given). */
+    readonly own_actor_forged: "inbound-refused";
+    /** An inbound add reuses a dot that already identifies a DIFFERENT (rule, scope) row — a dot is
+     *  minted once for one add, so a reuse is damage or forgery, and admitting it would let quarantine
+     *  or tombstone identity on one row reach the other. */
+    readonly dot_identity_conflict: "inbound-refused";
+    /** A live local add at-or-below the collected GC frontier and absent from the inbound state — the
+     *  residue of an already-recycled tombstone. Never resurrected; quarantined and disclosed. */
+    readonly below_gc_frontier: "local-quarantined";
+    /** The server refused this local row (its response `dropped` names it); it leaves the live view so
+     *  it does not ride — and get refused on — every future round. */
+    readonly server_rejected: "local-quarantined";
+};
+/** Every reason a sync round may drop or quarantine a record. Closed set; free text is not a member. */
+export type RuleSyncDropReason = keyof typeof RULE_SYNC_DROP_CODES;
+/** The subset that may appear on a LOCAL quarantined row (design/182 §8.1 `quarantine` instruction /
+ *  fence arm / local screening). `own_actor_forged` is inbound-only by construction. */
+export type RuleQuarantineReason = Exclude<RuleSyncDropReason, "own_actor_forged">;

package/dist/core/governance-codes.js

@@ -14,6 +14,12 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.partition_split",
     "memory.tail",
     "memory.pollution_mark_failed",
+    "memory.challenge_sweep_failed",
+    "memory.lineage_settle_failed",
+    "memory.challenge_ledger_corrupt",
+    "memory.challenge_ledger_oversize",
+    "memory.control_plane_rebuilt",
+    "memory.control_plane_not_corrupt",
 ]);
 export function governanceRetryClass(code) {
     if (Object.prototype.hasOwnProperty.call(GOVERNANCE_CODES, code)) {
@@ -23,3 +29,11 @@ export function governanceRetryClass(code) {
         return "terminal";
     return undefined;
 }
+export const RULE_SYNC_DROP_CODES = {
+    invalid_rule_text: "inbound-refused-or-local-quarantined",
+    metadata_mismatch: "inbound-refused-or-local-quarantined",
+    own_actor_forged: "inbound-refused",
+    dot_identity_conflict: "inbound-refused",
+    below_gc_frontier: "local-quarantined",
+    server_rejected: "local-quarantined",
+};

package/dist/core/hooks.d.ts

@@ -1,6 +1,7 @@
 import type { DocumentContent, ImageContent, TextContent } from "../internal/llm.js";
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
+import { type AskClass } from "./ask-class.js";
 /**
  * In-process hook seam (design/37) — a small, provider-agnostic interception layer modeled on CC's
  * hooks but reduced to three process-internal callbacks (no shell/HTTP executors, no settings files):
@@ -160,8 +161,13 @@ export interface Hooks {
  *  - `"shellGate"` — same tighten-deny, but the tool's irreversibility tier was installed by the COARSE
  *    `TaskSpec.shellGate` doctrine (design/80 D-E), not an explicit per-tool mark.
  *  - `"planMode"` — the design/108 plan-mode write-deny short-circuit (a read-only fidelity gate).
+ *  - `"org"` (design/182 §7) — the ORG layer: an organization deny rule, or the fail-closed tighten an
+ *    org-governed deployment applies while it cannot adjudicate against a snapshot (that tighten's ask
+ *    then resolving to deny). Its own word rather than `"policy"` because the authority is the ORG's
+ *    published snapshot, not this deployment's `ToolPolicy` — an operator reading "policy" on a call
+ *    their own policy allowed would be looking in the wrong place.
  */
-export type PermissionDeniedSource = "policy" | "hook" | "safety" | "shellGate" | "planMode" | "classifier";
+export type PermissionDeniedSource = "policy" | "hook" | "safety" | "shellGate" | "planMode" | "classifier" | "org";
 /** The payload a {@link Hooks.permissionDenied} callback observes (CC-exact fields + `source`). */
 export interface PermissionDeniedPayload {
     toolName: string;
@@ -519,6 +525,26 @@ export interface ParkAttemptFailed {
     /** Why the park could not be minted — a sentence, already worded for a reader. */
     parkFailed: string;
 }
+/**
+ * design/182 §7 — what the ORG layer answers for ONE call (see `ToolGateInput.orgRules`).
+ *
+ * The two arms are distinguished by `status`, NEVER by the absence of a verdict: "the org published no
+ * rule for this call" and "this deployment cannot see the org's rules" are opposite facts, and reading
+ * an empty answer as the first one is exactly the governance fail-open the availability contract exists
+ * to prevent.
+ */
+export type OrgGateVerdict = {
+    status: "available";
+    /** The org rule that speaks for this call, if any. Deny outranks ask; there is no allow bucket. */
+    verdict?: {
+        behavior: "deny" | "ask";
+        rule: string;
+    };
+} | {
+    status: "unavailable";
+    /** The overlay's own disclosure lines (engine/deployment-authored), for the operator channel. */
+    disclosures: readonly string[];
+};
 /** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort signal. */
 export interface ToolGateInput {
     /** RB-473 batch 2b — bounded disclosure for a HOST callback that throws inside this gate call's
@@ -712,6 +738,80 @@ export interface ToolGateInput {
             rule: string;
         }) => void;
     };
+    /**
+     * design/182 §7 — the ORG layer. Present ONLY when the deployment DECLARED org governance (the
+     * overlay constructor is the boot gate: a governed declaration with no snapshot provider refuses to
+     * boot). Absent ⇒ the whole step does not exist and the decision path is byte-identical.
+     *
+     * The org layer is the outermost TIGHTENING authority, so it runs after every fold and every engine
+     * tighten and before the ask-resolution chain — "org deny > org ask (non-dismissable) > personal
+     * allow rule > bare ask". It never loosens: there is structurally no org allow bucket.
+     *
+     * The `unavailable` arm is the load-bearing one. An org-governed deployment that cannot reach a
+     * snapshot fails the WHOLE decision boundary closed — every terminal allow (a deployment-policy
+     * allow and the no-policy default allow included) becomes an ask carrying
+     * `decisionReason: "org_unavailable"` AND `requiresRealApproval: true`, and both ask→allow seams (the
+     * personal-rule lane and the auto-mode classifier) are disarmed. Tightening only the two seams was
+     * refuted during design: a call that is ALREADY allow never passes through either seam, so it would
+     * have sailed past the org deny that could not be read. The `requiresRealApproval` bit closes the
+     * third loosening path — a blanket `onAsk: "allow"` would otherwise clear the synthetic ask.
+     */
+    orgRules?: {
+        /** Adjudicate this call against the current org overlay. MUST NOT throw — a throw is read as
+         *  `unavailable` (fail-closed), never as "no org rule spoke". */
+        adjudicate: (req: ToolCallRequest) => Promise<OrgGateVerdict>;
+        /** True iff the reserved question-tool NAME on this leg resolves to the ENGINE's own content-ask
+         *  tool. It is the exemption's real predicate: the name alone is not, because a caller may mount
+         *  its own tool under that name when the first-party one is not mounted, and such a tool has
+         *  arbitrary side effects (codex review, confirmed MED). Absent ⇒ `false` ⇒ the call is governed
+         *  like any other, which is the fail-closed default. */
+        contentAskToolMounted?: boolean;
+        /** Disclosure sink for the unavailable arm (trace `permission.org_snapshot_unavailable`). Never
+         *  affects the outcome. */
+        onUnavailable?: (info: {
+            toolName: string;
+            toolCallId: string;
+            message: string;
+        }) => void;
+    };
+    /**
+     * F-012 L2 — the SANDBOX ADMISSION leg. Present ONLY when the runner armed the mode: the execution
+     * env DECLARES isolation (`RemoteExecutionEnv.capabilities.isolation === true` — a Runner-resolved
+     * fact, never caller self-report) AND the park prerequisites hold (durable park configured + a
+     * checkpoint store that explicitly declares `redecision.reopen`). Absent ⇒ the whole step does not
+     * exist and the decision path is byte-identical to a build without it.
+     *
+     * Semantics (clay's ruling): inside a declared sandbox, an engine-authored "confirm a potentially
+     * destructive local action" ask is answered by containment itself — auto-allow + durable
+     * disclosure (`permission.sandbox_admitted`), never a headless deny that pollutes the model.
+     * STRICT dominance governs: the leg admits only when EVERY surviving ask on the call is classified
+     * `sandbox_local` in the engine's private envelope (deployment-policy asks are `unknown`, hook
+     * asks `hook`, marked calls `mandate`, `requiresRealApproval` asks external — none admit), and
+     * the call crosses NO declared boundary (`boundaryCapable`: egress-marked tools and
+     * protocol-mounted (MCP/A2A) tools — a server's self-report is always boundary-capable). A
+     * boundary-crossing ask under the armed mode takes the ordinary durable-park leg below — "park to
+     * a human", never an auto-deny.
+     */
+    sandboxAdmission?: {
+        /** The ask classes recorded for this call's fold-layer asks (with their source layers), or
+         *  `undefined` when no fold layer asked — the gate's own safety tighten is then the only asker. */
+        askClassesOf: (toolCallId: string) => ReadonlyArray<{
+            cls: AskClass;
+            layer: string;
+        }> | undefined;
+        /** This call's tool crosses a DECLARED boundary (egress axis / protocol-mounted) — never admitted. */
+        boundaryCapable: boolean;
+        /** The durable disclosure sink — fired on every admission BEFORE the allow is returned. */
+        onAdmitted: (info: {
+            toolCallId: string;
+            toolName: string;
+            askClasses: ReadonlyArray<{
+                cls: AskClass;
+                layer: string;
+            }>;
+            boundary: "sandbox_internal";
+        }) => void;
+    };
 }
 /**
  * Fold a {@link Hooks.preToolUse} callback into a {@link ToolPolicy} layer, so a screening face a task