@sema-agent/core 5.22.0 → 5.23.0

package/dist/core/memory-engine/layout.js

@@ -1,4 +1,4 @@
-import { closeSync, constants as fsConstants, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { closeSync, constants as fsConstants, copyFileSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 const { O_WRONLY, O_CREAT, O_TRUNC, O_NOFOLLOW } = fsConstants;
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
@@ -984,9 +984,10 @@ function coerceChallenges(raw) {
     }
     return raw;
 }
+export const CHALLENGE_LEDGER_MAX_EVENTS = 10_000;
 export function appendChallengeEvents(controlDir, events, now) {
     if (events.length === 0)
-        return [];
+        return { assignments: [], eventCount: undefined };
     return lockedStrictUpdate(controlDir, CHALLENGES_FILE, "memory challenge ledger", coerceChallenges, (rec) => {
         const byEventId = new Map(rec.events.map((e) => [e.eventId, e]));
         const maxGen = new Map();
@@ -1020,17 +1021,17 @@ export function appendChallengeEvents(controlDir, events, now) {
             out.push({ entryId: ev.entryId, eventId: ev.eventId, generation, at: ev.at, replayed: false });
             changed = true;
         }
-        return { ...(changed ? { next: rec } : {}), result: out };
+        return { ...(changed ? { next: rec } : {}), result: { assignments: out, eventCount: rec.events.length } };
     });
 }
 export function resolveChallengeEvent(controlDir, entryId, generation, reason, now, requestId) {
     return lockedStrictUpdate(controlDir, CHALLENGES_FILE, "memory challenge ledger", coerceChallenges, (rec) => {
         const opened = rec.events.some((e) => e.kind === "challenge" && e.entryId === entryId && e.generation === generation);
         if (!opened)
-            return { result: false };
+            return { result: { resolved: false, eventCount: undefined } };
         const alreadyResolved = rec.events.some((e) => e.kind === "resolve" && e.entryId === entryId && e.generation === generation);
         if (alreadyResolved)
-            return { result: true };
+            return { result: { resolved: true, eventCount: undefined } };
         rec.events.push({
             eventId: requestId !== undefined && requestId !== "" ? `${requestId}:${entryId}` : `resolve:${entryId}:${generation}`,
             entryId,
@@ -1039,7 +1040,7 @@ export function resolveChallengeEvent(controlDir, entryId, generation, reason, n
             at: now(),
             reason,
         });
-        return { next: rec, result: true };
+        return { next: rec, result: { resolved: true, eventCount: rec.events.length } };
     });
 }
 export function challengedEntryIds(controlDir) {
@@ -1061,6 +1062,74 @@ export function challengedEntryIds(controlDir) {
 export function readChallengeEvents(controlDir) {
     return coerceChallenges(readStrictSidecar(controlDir, CHALLENGES_FILE, "memory challenge ledger")).events;
 }
+export function isStrictControlPlaneLedgerCorrupt(controlDir, ledger) {
+    const fileName = ledger === "lineage" ? LINEAGE_FILE : CHALLENGES_FILE;
+    const what = ledger === "lineage" ? "memory lineage ledger" : "memory challenge ledger";
+    const coerce = ledger === "lineage" ? coerceLineage : coerceChallenges;
+    try {
+        coerce(readStrictSidecar(controlDir, fileName, what));
+        return false;
+    }
+    catch (err) {
+        if (err instanceof ControlPlaneCorruptError)
+            return true;
+        throw err;
+    }
+}
+export function rebuildStrictControlPlaneLedger(controlDir, ledger, now) {
+    const fileName = ledger === "lineage" ? LINEAGE_FILE : CHALLENGES_FILE;
+    const what = ledger === "lineage" ? "memory lineage ledger" : "memory challenge ledger";
+    const coerce = ledger === "lineage" ? coerceLineage : coerceChallenges;
+    const empty = ledger === "lineage" ? { version: 1, committed: {}, pending: {} } : { version: 1, events: [] };
+    ensureDirExists(controlDir);
+    const file = join(controlDir, fileName);
+    const journal = `${file}.journal`;
+    const lock = `${file}.lock`;
+    const token = acquireSidecarLock(lock, { onDeadline: "throw" });
+    try {
+        let healthy = false;
+        try {
+            coerce(readStrictSidecar(controlDir, fileName, what));
+            healthy = true;
+        }
+        catch (err) {
+            if (!(err instanceof ControlPlaneCorruptError))
+                throw err;
+        }
+        if (healthy) {
+            const e = new Error(`${what} reads cleanly — refusing to rebuild it. This call exists to recover a ledger whose corruption already refuses every read; resetting a healthy one would drop taint evidence that is still doing its job.`);
+            e.code = "memory.control_plane_not_corrupt";
+            throw e;
+        }
+        const at = now();
+        const quarantinedTo = [];
+        assertSidecarLockOwnership(lock, token, what);
+        for (const path of [file, journal]) {
+            if (!existsSync(path))
+                continue;
+            let dest = `${path}.corrupt-${at}`;
+            for (let n = 2;; n++) {
+                try {
+                    copyFileSync(path, dest, fsConstants.COPYFILE_EXCL);
+                    break;
+                }
+                catch (err) {
+                    if (err.code !== "EEXIST")
+                        throw err;
+                    dest = `${path}.corrupt-${at}-${n}`;
+                }
+            }
+            quarantinedTo.push(dest);
+        }
+        assertSidecarLockOwnership(lock, token, what);
+        atomicWriteFileSync(file, `${JSON.stringify(empty, null, 2)}\n`);
+        rmSync(journal, { force: true });
+        return { ledger, quarantinedTo, at };
+    }
+    finally {
+        releaseSidecarLock(lock, token);
+    }
+}
 function coerceChallengedHistory(raw) {
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
         return {};

package/dist/core/permission-rule-consent.js

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import { parseAllowRuleText, suggestRulesForCommand } from "./permission-rule-model.js";
 import { errText, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
@@ -28,7 +29,7 @@ function nowIso(deps) {
 function mintId(deps, prefix) {
     if (deps.newId !== undefined)
         return deps.newId();
-    return `${prefix}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
+    return `${prefix}_${Date.now().toString(36)}_${randomBytes(9).toString("base64url")}`;
 }
 function requirePrincipal(principal, entry) {
     if (typeof principal !== "string" || principal === "") {

package/dist/core/permission-rule-org.d.ts

@@ -80,8 +80,42 @@ export interface OrgRuleStatePersistence {
 /** Duck-typed discovery of the persistence face on a store backend, `writerOf` style. */
 export declare function orgRuleStatePersistenceOf(store: PermissionRuleStore): OrgRuleStatePersistence | undefined;
 /** The `decisionReason` the consuming gate stamps on the synthetic asks it mints while org adjudication
- *  is unavailable. Exported so the gate integration and its tests share one spelling. */
-export declare const ORG_UNAVAILABLE_DECISION_REASON = "org_unavailable";
+ *  is unavailable. Exported so the gate integration and its tests share one spelling — and TYPED as the
+ *  member of {@link import("./tool-policy.js").DecisionReason} it must equal, so the constant and the
+ *  vocabulary cannot drift into two spellings of one word. */
+export declare const ORG_UNAVAILABLE_DECISION_REASON: Extract<import("./tool-policy.js").DecisionReason, "org_unavailable">;
+/**
+ * How long a single org adjudication may take before the consuming gate stops waiting and reads the
+ * answer as UNAVAILABLE (its fail-closed word).
+ *
+ * A bound is MANDATORY rather than optional because of where this call sits: on the hot path of every
+ * governed tool call, and — on the durable resume leg — after the checkpoint has been consumed and the
+ * start frame emitted. A provider that never settles would otherwise wedge the call past any task
+ * deadline (tasks carry no walltime by default), leaving the frame unpaired and the approval spent with
+ * nothing retryable. A hang is the one outcome worse than either verdict.
+ *
+ * The value matches the auto-mode classifier's per-round-trip cap — the other model/network call the
+ * permission path makes — because the reasoning is the same: a governance lookup that takes longer than
+ * this is indistinguishable from an outage, and an outage is exactly what the unavailable arm is for.
+ * The task's own abort signal still applies in parallel; whichever fires first ends the wait.
+ */
+export declare const ORG_ADJUDICATION_TIMEOUT_MS = 15000;
+/**
+ * Await `p`, but settle with `fallback` if the deadline elapses or the signal fires first.
+ *
+ * Shared by both org consumption sites so one bound cannot drift into two. Deliberately NOT `.unref()`
+ * on the timer: this is a foreground rescue timer, and the caller is awaiting it inside the control
+ * flow — an unref'd timer stops firing in exactly the situation it exists for (an otherwise idle loop).
+ * A rejecting `p` also lands on the fallback: the callers' fail-closed word is the same either way, and
+ * an escaping rejection here would turn a dependency failure into a task crash.
+ */
+export declare function settleOrgVerdictWithin<T>(p: Promise<T>, fallback: T, opts: {
+    signal?: AbortSignal;
+    timeoutMs: number;
+}): Promise<T>;
+/** The `decisionReason` of a decision an ORG RULE produced (a deny, or a non-dismissable ask). Same
+ *  single-spelling contract as {@link ORG_UNAVAILABLE_DECISION_REASON}. */
+export declare const ORG_RULE_DECISION_REASON: Extract<import("./tool-policy.js").DecisionReason, "org_rule">;
 /** How far into the future a snapshot's `fetchedAtMs` may sit before it is refused — ordinary NTP-level
  *  clock skew passes; a far-future timestamp (which would satisfy the staleness bound INDEFINITELY,
  *  turning fail-closed into evergreen freshness) does not. */

package/dist/core/permission-rule-org.js

@@ -7,6 +7,29 @@ export function orgRuleStatePersistenceOf(store) {
         : undefined;
 }
 export const ORG_UNAVAILABLE_DECISION_REASON = "org_unavailable";
+export const ORG_ADJUDICATION_TIMEOUT_MS = 15_000;
+export function settleOrgVerdictWithin(p, fallback, opts) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (v) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            opts.signal?.removeEventListener("abort", onAbort);
+            resolve(v);
+        };
+        const onAbort = () => finish(fallback);
+        const timer = setTimeout(() => finish(fallback), opts.timeoutMs);
+        if (opts.signal?.aborted === true) {
+            finish(fallback);
+            return;
+        }
+        opts.signal?.addEventListener("abort", onAbort);
+        p.then(finish, () => finish(fallback));
+    });
+}
+export const ORG_RULE_DECISION_REASON = "org_rule";
 export const ORG_FETCHED_AT_SKEW_ALLOWANCE_MS = 5 * 60_000;
 export function createOrgRuleOverlay(cfg) {
     if (cfg.governed !== true) {

package/dist/core/permission-rule-store.js

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import { canonicalize } from "./canonical-json.js";
 import { isRuleLive, parseAllowRuleText } from "./permission-rule-model.js";
 export function sameRuleOwner(a, b) {
@@ -396,7 +397,7 @@ export class InMemoryPermissionRuleStore {
     observedVector;
     rev = 0;
     counter = 0;
-    constructor(actor = `mem-${Math.random().toString(36).slice(2, 10)}`, now = Date.now) {
+    constructor(actor = `mem-${randomBytes(6).toString("base64url")}`, now = Date.now) {
         this.actor = actor;
         this.now = now;
     }

package/dist/core/permission-rule-sync.d.ts

@@ -27,6 +27,7 @@
  */
 import type { PersistedAllowRule, RuleDot, RuleScope, RuleTombstone } from "./permission-rule-model.js";
 import type { PermissionRuleStoreProvider, RuleOwner, RuleSyncDrop, RuleSyncFrontier, RuleSyncState } from "./permission-rule-store.js";
+import { type TracerHook } from "./trace.js";
 /** The injected HTTP seam — core never bundles a fetch. The deployment owns base URL, auth, TLS and
  *  retries; a non-2xx / network failure should THROW (the round then aborts with zero local effects —
  *  the transport runs before any local write). */
@@ -103,6 +104,13 @@ export declare function syncPermissionRules(opts: {
     transport: PermissionRuleSyncTransport;
     /** Injected clock — observation timestamps only, never adjudication input. */
     now?: () => number;
+    /** design/182 §4.6 — optional trace sink for the round's DISCLOSURES: one
+     *  `permission.rule_sync_resurrected` per removed→live transition and one
+     *  `permission.rule_sync_dropped` per refused/quarantined row. The same facts are already on the
+     *  returned result; this is the operator channel for a deployment that drives sync outside a task
+     *  (where there is no `RunnerDeps.tracer` in scope) and does not read the result itself. Absent ⇒ no
+     *  events, and the round is byte-identical. */
+    tracer?: TracerHook;
 }): Promise<PermissionRuleSyncResult>;
 interface ParsedRuleSyncResponse {
     principal: string;

package/dist/core/permission-rule-sync.js

@@ -1,5 +1,6 @@
 import { parseAllowRuleText } from "./permission-rule-model.js";
 import { applyTombstones, errText, joinFrontiers, joinRuleStates, normalizePersistedRule, ruleSyncVector, sameScope, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
+import { emitTrace } from "./trace.js";
 export const PERMISSION_RULE_SYNC_PATH = "/v1/permission-rules/sync";
 export const LOCAL_OWNER_UNSYNCABLE_CODE = "permission_rules.local_owner_unsyncable";
 function refuseLocalOwnerSync() {
@@ -19,6 +20,34 @@ export async function syncPermissionRules(opts) {
     if (typeof opts.principal !== "string" || opts.principal === "") {
         throw new Error("syncPermissionRules requires a verified principal — an unauthenticated deployment has no cloud bucket to sync");
     }
+    const traceClock = opts.now ?? Date.now;
+    const disclose = (result) => {
+        const tracer = opts.tracer;
+        if (tracer === undefined)
+            return result;
+        for (const r of result.resurrected) {
+            emitTrace(tracer, () => ({
+                kind: "permission.rule_sync_resurrected",
+                version: 1,
+                principal: opts.principal,
+                rule: r.rule,
+                scopeKind: r.scope.kind,
+                ts: traceClock(),
+            }));
+        }
+        for (const d of result.dropped) {
+            emitTrace(tracer, () => ({
+                kind: "permission.rule_sync_dropped",
+                version: 1,
+                principal: opts.principal,
+                rule: d.rule,
+                scopeKind: d.scope.kind,
+                reason: d.reason,
+                ts: traceClock(),
+            }));
+        }
+        return result;
+    };
     const store = opts.provider.forPrincipal(opts.principal);
     const writer = writerOf(store);
     if (writer === undefined) {
@@ -111,7 +140,7 @@ export async function syncPermissionRules(opts) {
             res = await writer.apply(delta, { expectedRev: current.rev });
         }
         catch (err) {
-            return {
+            return disclose({
                 ok: false,
                 pushed: { addDots: raw.rules.reduce((n, r) => n + r.adds.length, 0), tombstones: raw.tombstones.length },
                 landed: { newAdds: 0, newTombstones: 0 },
@@ -119,7 +148,7 @@ export async function syncPermissionRules(opts) {
                 dropped,
                 rev: current.rev,
                 warnings: [...warnings, `the store refused the sync landing: ${errText(err)} — nothing landed, the local state is unchanged`],
-            };
+            });
         }
         if ("conflict" in res) {
             current = await writer.readRaw();
@@ -156,7 +185,7 @@ export async function syncPermissionRules(opts) {
             if (!dropped.some((x) => x.dot.actor === q.dot.actor && x.dot.counter === q.dot.counter && x.reason === q.reason))
                 dropped.push(q);
         }
-        return {
+        return disclose({
             ok: dropped.length === 0 && warnings.length === 0,
             pushed: { addDots: raw.rules.reduce((n, r) => n + r.adds.length, 0), tombstones: raw.tombstones.length },
             landed: { newAdds, newTombstones },
@@ -164,9 +193,9 @@ export async function syncPermissionRules(opts) {
             dropped,
             rev: landedRaw.rev,
             ...(warnings.length > 0 ? { warnings } : {}),
-        };
+        });
     }
-    return {
+    return disclose({
         ok: false,
         pushed: { addDots: raw.rules.reduce((n, r) => n + r.adds.length, 0), tombstones: raw.tombstones.length },
         landed: { newAdds: 0, newTombstones: 0 },
@@ -174,7 +203,7 @@ export async function syncPermissionRules(opts) {
         dropped,
         rev: current.rev,
         warnings: [...warnings, `optimistic-concurrency retries exhausted after ${SYNC_MAX_ATTEMPTS} attempts — nothing landed, the local state is unchanged`],
-    };
+    });
 }
 function isDot(v) {
     const d = v;

package/dist/core/runner/prepare-task.d.ts

@@ -8,10 +8,10 @@ import type { HarvestReport, MemorySessionHandle } from "../memory-engine/types.
 import { StoredSession } from "../session.js";
 import type { SessionStore } from "../session.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import type { OnAsk, ToolPolicy } from "../tool-policy.js";
+import type { OnAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import { type ActiveSkillFrame } from "./active-skill-scope.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
-import { type Hooks } from "../hooks.js";
+import { type Hooks, type OrgGateVerdict } from "../hooks.js";
 import { type RecoveredOrphan } from "../session-reconcile.js";
 import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-detector.js";
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
@@ -214,6 +214,14 @@ export interface Prepared {
     /** RB-63: the deployment's own caller policy, re-checked on a durable resume ONLY when the approver
      *  rewrote the pending call's args (see the composition site for why the edit case is special). */
     basePolicyForResumeEdit?: ToolPolicy;
+    /** design/182 §7 — the ORG adjudication face, re-resolved on a durable RESUME before an approved
+     *  pending call executes. The resume path bypasses the harness gate by design (a human already
+     *  adjudicated the checkpointed call), which is exactly where org policy skew is most likely: the
+     *  suspend may have outlived the snapshot revision that was current when it was minted. Present only
+     *  on a governed deployment. */
+    permissionRuleOrg?: {
+        adjudicate: (req: ToolCallRequest) => Promise<OrgGateVerdict>;
+    };
     /** Removes the `spec.signal` abort listener on task end (else a long-lived signal leaks listeners). */
     releaseSignal: () => void;
     /**

package/dist/core/runner/prepare-task.js

@@ -30,6 +30,7 @@ import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
 import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, runToolGate } from "../hooks.js";
+import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -3144,12 +3145,22 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         };
         const permissionRuleLane = (() => {
             const provider = deps.permissionRuleStore;
+            const localOwnerDeclared = deps.localOwnerRules === true;
+            if (localOwnerDeclared) {
+                if (provider === undefined) {
+                    throw new Error("RunnerDeps.localOwnerRules is declared but no permissionRuleStore provider is wired — there is no bucket for the local owner to hold rules in; refusing rather than running as if the declaration were absent");
+                }
+                if (provider.forLocalOwner === undefined) {
+                    throw new Error("RunnerDeps.localOwnerRules is declared but the wired permissionRuleStore provider implements no forLocalOwner() face — a provider without a local-owner bucket cannot honor the declaration; refusing rather than silently resolving zero rules");
+                }
+            }
             if (provider === undefined)
                 return undefined;
             const root = taskRootPath;
             return {
                 admits: async (req) => {
-                    if (spec.principal === undefined || spec.principal === "")
+                    const anonymous = spec.principal === undefined || spec.principal === "";
+                    if (anonymous && !localOwnerDeclared)
                         return undefined;
                     if (req.toolName !== PERSISTED_RULE_TOOL)
                         return undefined;
@@ -3158,7 +3169,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         return undefined;
                     let listed;
                     try {
-                        listed = await provider.forPrincipal(spec.principal).list();
+                        listed = anonymous
+                            ?
+                                await provider.forLocalOwner().list()
+                            : await provider.forPrincipal(spec.principal).list();
                     }
                     catch (err) {
                         emitTrace(deps.tracer, () => ({
@@ -3174,6 +3188,31 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 },
             };
         })();
+        const permissionRuleOrgLane = (() => {
+            const overlay = deps.permissionRuleOrg;
+            if (overlay === undefined)
+                return undefined;
+            return {
+                adjudicate: async (req) => {
+                    if (req.toolName === ASK_USER_QUESTION_TOOL_NAME && questionToolMounted)
+                        return { status: "available" };
+                    let resolution;
+                    try {
+                        resolution = await overlay.resolve();
+                    }
+                    catch (err) {
+                        return { status: "unavailable", disclosures: [`the org rule overlay threw: ${err instanceof Error ? err.message : String(err)}`] };
+                    }
+                    if (resolution.status === "unavailable")
+                        return { status: "unavailable", disclosures: resolution.disclosures };
+                    const command = req.args?.command;
+                    if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
+                        return { status: "available" };
+                    const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
+                    return verdict === undefined ? { status: "available" } : { status: "available", verdict };
+                },
+            };
+        })();
         const ruleSuggestionsOf = (toolName, args) => {
             if (permissionRuleLane === undefined || toolName !== PERSISTED_RULE_TOOL)
                 return {};
@@ -3621,6 +3660,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             sessionDurability: resolveDeclaredDurability(sessions, "sessionStore"),
             backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
             permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
+            permissionRuleSyncWired: deps.permissionRuleSyncWired === true,
+            permissionRuleOrgGoverned: deps.permissionRuleOrg !== undefined,
             hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
             lockedConfigWired: deps.lockedConfig !== undefined,
             complianceWired: deps.compliancePostureResolver !== undefined,
@@ -3837,8 +3878,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     return { ok: false };
                 if (memoryEngineSession)
                     await memoryEngineSession.harvest("checkpoint");
-                try {
-                    await checkpointStore.put(token, cp);
+                const announceCommittedScreeningPark = () => {
                     const committedCount = cp.state.inheritedGate?.parentConstraintCount;
                     if (cp.state.inheritedGate?.requiresParentConstraint === true &&
                         !screeningParkDisclosedRef.done &&
@@ -3855,10 +3895,59 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         catch {
                         }
                     }
+                };
+                const confirmPutOutcome = async (putErr) => {
+                    if (putErr?.code === "checkpoint.already_exists")
+                        return "absent";
+                    try {
+                        const row = await checkpointStore.get(token);
+                        if (row == null)
+                            return "absent";
+                        const sameCall = (a, b) => a.kind === b.kind && (a.kind !== "tool_approval" || b.kind !== "tool_approval" || a.toolCallId === b.toolCallId);
+                        const isOurs = row.scope === cp.scope && row.sessionId === cp.sessionId && row.leafId === cp.leafId && sameCall(row.pendingAction, cp.pendingAction);
+                        return isOurs ? "committed" : "absent";
+                    }
+                    catch (readErr) {
+                        deps.onError?.(readErr, { phase: "config", sessionId });
+                        return "unknown";
+                    }
+                };
+                try {
+                    await checkpointStore.put(token, cp);
+                    announceCommittedScreeningPark();
                     return { ok: true };
                 }
                 catch (putErr) {
                     deps.onError?.(putErr, { phase: "config", sessionId });
+                    const confirmed = await confirmPutOutcome(putErr);
+                    if (confirmed === "committed") {
+                        try {
+                            deps.onError?.(new Error(`durable approval checkpoint: the store's write reported a failure but the row EXISTS — the commit ` +
+                                `landed and its acknowledgement was lost (a network backend can complete the INSERT and drop the ` +
+                                `connection before replying). The run suspends on that row rather than continuing, which would leave ` +
+                                `a redeemable pending checkpoint behind. This backend's acknowledgement path is lossy — the operator ` +
+                                `face carries the store's own message.`), { phase: "degraded", sessionId, classification: "checkpoint-put-confirmation-lost" });
+                        }
+                        catch {
+                        }
+                        announceCommittedScreeningPark();
+                        return { ok: true };
+                    }
+                    if (confirmed === "unknown") {
+                        const unknownReason = "the approval checkpoint's state cannot be established (the store rejected the write and then could not be read back; a committed-but-unacknowledged row may exist) — the run is stopped rather than continued past an approval whose durable record is unknown";
+                        try {
+                            deps.onError?.(new Error(`durable approval checkpoint: ${unknownReason}`), {
+                                phase: "degraded",
+                                sessionId,
+                                classification: "checkpoint-put-outcome-unknown",
+                            });
+                        }
+                        catch {
+                        }
+                        abortController.abort();
+                        void harness.abort();
+                        return { ok: false, reason: unknownReason };
+                    }
                     const reason = "the approval checkpoint could not be persisted (the store rejected the write; the deployment's error face carries the store's own message)";
                     if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
                         const { outcome: back, attempts: backAttempts } = await restoreWorkspaceWithRetry(remoteEnv, remoteHandle.snapshotId, {
@@ -4422,6 +4511,23 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     },
                                 }
                                 : {}),
+                            ...(permissionRuleOrgLane
+                                ? {
+                                    orgRules: {
+                                        adjudicate: permissionRuleOrgLane.adjudicate,
+                                        contentAskToolMounted: questionToolMounted,
+                                        onUnavailable: (info) => emitTrace(deps.tracer, () => ({
+                                            kind: "permission.org_snapshot_unavailable",
+                                            version: 1,
+                                            taskId: spec.taskId ?? sessionId,
+                                            toolName: info.toolName,
+                                            toolCallId: info.toolCallId,
+                                            message: info.message,
+                                            ts: Date.now(),
+                                        })),
+                                    },
+                                }
+                                : {}),
                             isMarkedUnresolvable: (toolCallId) => inheritedUnavailableAsks.has(toolCallId),
                             ...(sandboxAdmissionArmed
                                 ? {
@@ -4750,7 +4856,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             : undefined;
         overheadState.promptChars = systemPrompt.length;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.js

@@ -9,6 +9,7 @@ import { ASK_USER_QUESTION_TOOL_NAME, canonicalizeCapturedPlainData, classifyQue
 import { boundInputHashOf } from "../canonical-json.js";
 import { computeCostMicroUsd, modelCostToPricing } from "../pricing.js";
 import { emitTrace } from "../trace.js";
+import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { emitTaskOutcome } from "../task-outcome.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { primaryActivityArg } from "../arg-summary.js";
@@ -4008,6 +4009,24 @@ export class Runner {
                 return;
             }
         }
+        if (prepared.permissionRuleOrg !== undefined) {
+            const orgVerdict = prepared.permissionRuleOrg
+                .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId })
+                .catch(() => ({ status: "unavailable", disclosures: ["the org adjudication face threw on resume"] }));
+            const org = await settleOrgVerdictWithin(orgVerdict, { status: "unavailable", disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`] }, { signal: prepared.abortController.signal, timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
+            const blocked = org.status === "unavailable"
+                ? "this deployment is org-governed and cannot currently adjudicate against an organization policy snapshot"
+                : org.verdict?.behavior === "deny"
+                    ? `an organization policy rule (${org.verdict.rule}) denies it`
+                    : undefined;
+            if (blocked !== undefined) {
+                const orgDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${blocked}. This approval is spent — the call has to be re-issued and approved again once organization policy permits it.`);
+                emitEnd(true, { content: orgDenial });
+                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, orgDenial, true));
+                emitCommitted(eid, "toolResult", pendingAction.toolCallId);
+                return;
+            }
+        }
         if (prepared.denyNarrowingPolicy) {
             const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check({
                 toolName: pendingAction.toolName,