@sema-agent/core 5.22.0 → 5.24.0

package/CHANGELOG.md

@@ -1,5 +1,152 @@
 # Changelog
 
+## 5.24.0 — 2026-08-10
+
+No API-BREAKING changes (exports grow only; `suspendAsk` gains an optional fifth parameter;
+`removePersistedRule` widens its `principal` input to a union). Behavior-surface narrowings and two
+deliberate loosenings are called out below; checkpoint **v8** is a compatibility disclosure, not a
+breaking change (rows without the new gate bit keep their historic stamps).
+
+### Narrowed (behavior)
+
+- **The real-approval bit survives the durability boundary (#130/#120).** An ask carrying
+  `requiresRealApproval` (an org ASK rule, the org-unavailable tighten, or a policy that minted the
+  bit) now parks as the NON-BUDGETABLE `irreversible_ask` gate kind — it used to park as plain
+  `human`, the one kind a network budget resolver may auto-approve. The gate carries
+  `RealApprovalGateBit` (`origin: "org_rule" | "org_unavailable" | "policy"`), the row stamps
+  `REAL_APPROVAL_CHECKPOINT_VERSION = 8` (`MAX_SUPPORTED` raised to 8 — a pre-5.24 worker rejects a
+  v8 row pre-CAS as `unsupported_version`, the row stays pending). Resume adds three guards: a
+  governed row (org origin) is refused PRE-CAS on a worker with no `permissionRuleOrg` wiring (the
+  human decision stays unspent, redeemable on an org-wired worker; a post-CAS belt remains as
+  defense in depth); a v8 row whose bit was stripped in storage, and a sub-v8 row carrying a bit no
+  release minted, are both refused pre-CAS (corruption/forgery guards).
+- **`run_in_background: true` is judged by the backgrounding doctrine (#125, P0).** On a
+  `shellGate:"classify"` deployment, `bashReversibilityProbe` used to read only the command text, so
+  `ls` + the parameter form auto-admitted exactly what `ls &` asks for. The parameter spelling now
+  gets the textual spelling's verdict (not reversible ⇒ ask).
+- **Oversized strings inside `details` are offloaded (#116).** `withToolResultOffload` used to
+  replace only `res.content`; a Bash call's 140k-char `details.stdout` sailed into session
+  persistence and every wire projection. Every oversized string inside `details` (deep walk, plain
+  objects/arrays, cycle-cut with a completed-transform memo, identity-preserving when untouched) is
+  now offloaded to the same store and replaced by a bounded head naming its ref; judged
+  independently of content size. Sequenced after the server tool-results read face (7.11.0) so full
+  payloads always have a host-side egress. `Write` joins `Read`'s structural offload exemption: its
+  `details.content` is the session-continuation replay's authorization source, and the replay
+  additionally refuses to seed a content string carrying the offload-replacement notice
+  (`isOffloadedDetailReplacement`, exported). An own `__proto__` key in `details` survives the
+  rebuild as data (never installed as the rebuilt object's prototype), and below head+notice size a
+  string rides untouched (no replacement that grows).
+- **A local-owner adoption rebinds the anonymous session-policy estate (#132).** The
+  session-policy leg now runs for BOTH adoption shapes: the local-owner shape rewrites `[sid, null]`
+  rows to the adopted principal (a foreign principal's row stays), and the terminal report says
+  `row-rewrite` with the real count. On such a root the anonymous lane ALIASES to the adopted
+  principal (reads and writes), so the window between terminal adoption and the operator landing the
+  principal wiring cannot drop tighten-only deny rules; unadopted and principal-adopted roots are
+  untouched. Narrow disclosed window: a pre-5.24 in-flight local-owner marker (a stage-3 claim with
+  no session-policy evidence) reads as corrupt — recovery is an operator action (remove the root's
+  adoption.json and adopt afresh).
+
+### Loosened (deliberate, ruled)
+
+- **A park minted under org UNAVAILABILITY honors the approval it solicited (#131).** The gate's
+  own message promises "every allow tightens to a real approval until [the org] can [be read]" — but
+  the resume belt refused that very approval and burned it, livelocking a park-only deployment
+  (ask → park → approved → still unavailable → refused, forever). A row with
+  `origin:"org_unavailable"` now EXECUTES on an approved resume even while the org stays unreadable
+  (the durable row — origin plus the human outcome — is the audit record); `org_rule` rows and
+  pre-v8 rows keep the strict fail-closed posture, and a published org deny blocks regardless of
+  origin.
+- **The adoption terminal record's read validator checks shape, not this build's constants
+  (#133).** The stored report snapshots the by-design-not-migrated set and the config table AS RULED
+  AT ADOPTION TIME; both may grow by ruling, and the old exact-equality read marked every
+  already-adopted root corrupt on the first release after any growth (and again on rollback), across
+  13 store constructors at once. Read time now enforces non-empty/well-formed/no-duplicate-identity;
+  the writer-emits-the-constant drift guard moves to the test grid, where a change is a deliberate,
+  reviewable edit. Empty, duplicate-carrying and mangled reports are refused exactly as before.
+
+### Added
+
+- **The permission-rule BACKEND CONTRACT is exported** (ruled 2026-08-10): `PERMISSION_RULE_WRITER`,
+  `writerOf`, `foldDelta`, `addDotsOf`, the delta/writer/store types and the two consent-boundary
+  assertions — an out-of-repo store twin builds against the same definitions the file backend
+  implements instead of mirroring them. The consent boundary is unchanged and now PINNED: the engine
+  reaches `writer.apply` only on the consent redemption, tighten-delete and sync-join lanes
+  (registered-caller scan + a second net over every file naming the writer handle).
+- **`removePersistedRule` accepts a structural `RuleOwner`** — the string shorthand is unchanged;
+  `{ kind: "local-owner" }` resolves the local-owner bucket (previously unrevokable through this
+  entry), and a provider without `forLocalOwner` fails loudly instead of no-oping against the
+  zero-rule store.
+- `RealApprovalGateBit` exported (the supervisor-inbox / SQL-twin read of the new gate member).
+
+### Fixed
+
+- **The background time wall is stated as a budget, never a kill threat (#121).** Under deadline
+  pressure a model read "auto-terminates if still running after 600s" as "better TaskStop it myself
+  first" (a measured 6.3s self-stop where waiting was optimal). All three Bash minting arms and both
+  Monitor siblings now say "may run up to Ns"; the kill explanation stays with the terminal
+  timed-out wording, which fires only when a timeout actually happens. Retired-dialect tripwires on
+  both faces.
+- **`createAllowDenyPolicy`'s invalid-name refusal teaches each lesson once.** A CC-migrated
+  settings file with 39 content-form entries repeated the same three-line lesson 39 times; the
+  thrown string now groups by lesson (entries listed under it). The structured `issues` face stays
+  per-entry and gains a `lesson` member (additive).
+- Three public comment surfaces stopped recommending prefix recomposition over `buildToolResultRef`
+  (#134 — the encoding is not injective; ownership is exact-equality against a recomposed ref), the
+  `RunnerDeps.permissionRuleStore` docstring states the ruled backend-contract boundary instead of
+  "the write face is core-private", and dated errata landed for two past releases (5.22.0: the
+  design/182 rule-sync core half shipped unlisted; 5.13.0: safety asks going sync-first under a live
+  approver shipped unlisted and superseded a written park promise).
+- Docs: `docs/sdk/09` gains the sandbox-admission section (every exclusion conjunct, from source)
+  and an org-rule-layer account stated in terms of the mechanism that actually holds the line
+  (`requiresRealApproval` excluded at every loosening seam, now including the durability boundary).
+
+## 5.23.0 — 2026-08-10
+
+No BREAKING changes.
+
+### Added
+
+- **design/183 adoption protocol, core file half.** Root adoption marker + six-phase
+  `adoptLocalDataRoot` state machine + `readAdoptionStatus` standing introspection + config account
+  (witness/ack) + quarantine listing; 23 new exports. The I6 boot gate is a new refusal surface: every
+  file-store constructor under a root whose `adoption.json` marker is IN FLIGHT throws
+  `AdoptionError("adoption_in_flight")` (corrupt marker: `adoption_marker_corrupt`, fail-closed).
+  Roots without a marker are untouched. The terminal report carries `notMigratedByDesign` — the
+  machine-readable closed set of assets ruled to stay local, sharded per migration form.
+- **design/182 org layer wired into the decision chain** (org-governed deployments only): org deny
+  blocks on both the main gate and the durable-resume leg; an unavailable org snapshot past
+  `ORG_ADJUDICATION_TIMEOUT_MS` (15s, mandatory at both call sites) downgrades every terminal allow
+  to a human ask, fail-closed. Closed-set additions consumers should re-pin: `DecisionReason`
+  +`org_rule`/`org_unavailable`; `PermissionDeniedSource` +`org`; `TraceEvent`
+  +`rule_sync_resurrected`/`rule_sync_dropped`/`org_snapshot_unavailable`.
+- `AskOutcome` terminal arms accept an optional `settledBy` (host self-report; `allow` × `"timeout"`
+  is loudly refused); `GoalResult.budgetCause` names which ceiling ended a budget run;
+  `NON_GOVERNANCE_MEMORY_CODES` +3 members (`memory.challenge_ledger_oversize`,
+  `memory.control_plane_rebuilt`, `memory.control_plane_not_corrupt`);
+  `MemoryEngine.rebuildCorruptControlPlaneLedger` (host-only, refuses a healthy ledger, quarantines
+  corrupt bytes) and `CHALLENGE_LEDGER_MAX_EVENTS` disclosure threshold.
+
+### Fixed / narrowed
+
+- **#109**: separated option values (`head -c 5`, `cut -f 1`, `grep -A 3 pat`, …) are no longer
+  counted as file operands by the read-only shell classifier — fileless forms of these commands now
+  ask instead of auto-passing.
+- **#110**: a checkpoint `put` that errors but whose row is durably present (read-back claims it)
+  suspends instead of running on; `put`+`get` both failing aborts the run fail-closed.
+- **#114**: `settledBy:"timeout"` documented promise narrowed to the two core-managed wait windows.
+- **#115**: the offload truncation notice states where the remainder IS instead of implying any
+  caller can fetch it.
+- Consent-record ids and the in-memory CRDT actor default now take real entropy (`randomBytes`);
+  format is opaque, do not parse.
+
+### Tooling
+
+- New `gate:error-surface` (four invariants over model-visible error minting: no `.stack`,
+  >400-char templates ledgered, uncapped-arm ratchet, verbatim-guidance dedup) wired into CI.
+- The environment-knob surface (25 names) is under an exhaustive AST-driven liveness registry;
+  `docs/CONFIG-CATALOG-GUIDE.md` gained the environment-knobs chapter (two comment-only pseudo-knobs
+  called out: `MAX_TOOL_CONCURRENCY`, `APPROVAL_TTL_MS` — setting them has no effect).
+
 ## 5.22.0 — 2026-08-09
 
 ### BREAKING
@@ -45,7 +192,10 @@
   delegation-provenance aggregate rides the durable checkpoint; a resumed leg missing the state
   reads as `unknown` (static floor), never as `clean`.
 - **`buildToolResultRef` exported from the package root** — a host wiring an HTTP tool-result read
-  face binds an incoming ref to its owning task by prefix recomputation.
+  face composes refs through the single source instead of reimplementing the segment escaping.
+  (Erratum 2026-08-10: this entry originally said a read face binds a ref to its owning task "by
+  prefix recomputation". It must not — the encoding is not injective over the two segments, so
+  ownership is an exact-equality test against a recomposed ref, never a prefix match.)
 - **Content mandate split from the approval mandate (#94).** A delegated child's question routes on
   the QUESTION seat, not the approver seat. Behavior widening, called out explicitly: under
   `durableApproval` with a live `onQuestion`, an absent or string approver seat used to leave child
@@ -56,6 +206,13 @@
   `TaskRegistry.reviveBackgroundAgent`'s refusal union gains the `recycling` member — exhaustive
   consumers add one arm.
 
+_Addendum (2026-08-10, #135 erratum): the design/182 rule-sync **core half also shipped in this
+release** and was not listed. It added the sync client and its wire contract to the public surface:
+`syncPermissionRules` (full-state join, screened in both directions), `PERMISSION_RULE_SYNC_PATH`,
+`RuleSyncRequestBody` / `RuleSyncResponseBody` / `PermissionRuleSyncResult`, `parseRuleSyncResponse`,
+and `LOCAL_OWNER_UNSYNCABLE_CODE` (a local-owner bucket refuses to sync, loudly) — the definitions a
+server-side rule store builds against. Recorded as a dated erratum rather than a silent rewrite._
+
 ## 5.21.1 — 2026-08-09
 
 - **Fix: every `hands: none` deployment failed at the door on 5.21.0** (P0). `HAND_TOOL_EFFECTS`
@@ -1058,6 +1215,17 @@ mysterious runtime.
 
 - **`finalVerification` mechanism hardening (four of the seven field failure modes).** ① The injection headroom guard read only the turn axis — it now also reads the tightest caller-armed budget axis (tokens/cost/walltime, same axes as the limit-approach frames); ≥90% full skips the injection, so the gate can no longer convert an externally-passing run into `limits.*_exceeded`. ② Both injections emit the standard `steering_injected` echo (**new closed-set member: `source: "final_verification"`** — switches over the source union add an arm), closing the stats-vs-stream observability gap. ③ The nudge licenses cleaning up residue the model's own testing created (the state-harmless clause no longer reads as "leave your test residue in place"). ④ The nudge forbids laundering pre-existing uncertainty into "confirmed". The remaining modes are design-bounded: the engine never judges check semantics, and self-grading is the deployment's verifier-role wiring.
 
+_Addendum to 5.13.0 (2026-08-10, erratum — the entry below was missing at release): **SAFETY asks go
+sync-first when a live approver is wired.** With a FUNCTION-valued `onAsk` present, an
+egress/irreversibility-tightened ask now resolves in-stream through that approver (same turn, no
+checkpoint) instead of always parking as `irreversible_ask`; the durable park remains the headless /
+no-live-approver / `forceDurableGate` / live-face-answered-unavailable path, where the gate kind,
+`safetyAxis` and risk descriptor are unchanged. This superseded the earlier written promise that
+"safety asks … still park" with a live approver (the 1.37x sync-approval entry). The change shipped
+in 5.13.0 with no changelog entry — recorded here as a dated erratum rather than a silent rewrite;
+consumer flips: a probe pinning "an `irreversibility:'always'` tool always suspends" reds whenever a
+live `onAsk` is wired — drop the approver (or arm `forceDurableGate`) to test the park leg._
+
 ## 5.12.0 — 2026-08-05
 
 ### BREAKING

package/dist/agents/subagent.js

@@ -1,6 +1,7 @@
 import { Type } from "typebox";
 import { isAbsolute } from "node:path";
 import { withDelegationProvenance } from "../core/tool-policy.js";
+import { isHighSurrogate, isLowSurrogate } from "../core/surrogate-safe-slice.js";
 import { newDelegationProvenanceAggregate, reduceDelegationAttestation } from "../core/memory-engine/delegation-provenance.js";
 import { resolveModel, resolveModelDisplayLabel } from "../core/roles.js";
 import { OUTPUT_TOOL_NAME, REPORT_BLOCKED_TOOL_NAME } from "../core/runner/synthetic-tools.js";
@@ -65,8 +66,8 @@ function defuseGapMarkers(slice) {
     return slice.replace(/\[…/g, `${REVIEW_MARKER_SCAR}…`);
 }
 function surrogateSafeSlice(text, from, width, anchorEnd = false) {
-    const isLow = (i) => text.charCodeAt(i) >= 0xdc00 && text.charCodeAt(i) <= 0xdfff;
-    const isHigh = (i) => text.charCodeAt(i) >= 0xd800 && text.charCodeAt(i) <= 0xdbff;
+    const isLow = (i) => isLowSurrogate(text.charCodeAt(i));
+    const isHigh = (i) => isHighSurrogate(text.charCodeAt(i));
     let start = from;
     if (start > 0 && start < text.length && isLow(start) && isHigh(start - 1))
         start--;

package/dist/core/checkpoint-store.d.ts

@@ -267,6 +267,28 @@ export declare function buildRiskDescriptor(input: {
     /** The resolved doctrine to persist when `shellGated` (see {@link RiskDescriptor.shellGateDoctrine}). */
     shellGateDoctrine?: "classify" | "always";
 }): RiskDescriptor;
+/**
+ * #130/#131/#120 (2026-08-10) — the durable record of an ask's `requiresRealApproval` bit, which used
+ * to DIE at the park: the mint keyed the gate kind on the static tool marks only, so an org-governed
+ * ask on an unmarked tool minted a plain `{kind:"human"}` — the one kind a network budget resolver may
+ * auto-approve — and the org's "only judgment clears this" demand was silently budgetable after the
+ * durability boundary. Present ⇒ the mint escalates to `irreversible_ask` (non-budgetable) and stamps
+ * {@link REAL_APPROVAL_CHECKPOINT_VERSION}. `origin` additionally records WHY, for the resume belts:
+ *  · `"org_rule"` — an org ASK rule fired (governance was READABLE at mint). Resume keeps the strict
+ *    posture: org unavailable at resume still refuses (newly-blind ⇒ fail-closed).
+ *  · `"org_unavailable"` — governance could NOT be read at mint and the gate's own message promised
+ *    "every allow tightens to a real approval until it can". A person approving THIS park IS that real
+ *    approval — so a resume that finds org still unavailable executes instead of refusing and burning
+ *    the approval (the park-only livelock #131 closed). The durable row itself — this origin plus the
+ *    recorded human outcome — is the audit record of that passage; the resume emits no extra notice.
+ *  · `"policy"` — a policy/hook minted the bit (e.g. the always-on classifier-parity rule); no org
+ *    semantics, the resume belts treat it as a plain non-budgetable approval.
+ * Both org origins double as the #120 governed mark: a resuming worker with NO org adjudication wiring
+ * refuses to redeem such a row (the governed boundary must not vanish with a deployment's wiring).
+ */
+export interface RealApprovalGateBit {
+    origin: "org_rule" | "org_unavailable" | "policy";
+}
 export type CheckpointGate = 
 /** F4: a human (or any external authority) must allow/deny a pending tool call. design/80 §D-E:
  *  carries an OPTIONAL display-only {@link RiskDescriptor} (severity/axes/summary) for the supervisor
@@ -292,6 +314,7 @@ export type CheckpointGate =
     reason: string;
     toolName: string;
     safetyAxis?: SafetyAxis;
+    realApproval?: RealApprovalGateBit;
     riskDescriptor?: RiskDescriptor;
 }
 /** design/74: a resource slice limit (budget/walltime/turns) was reached — suspend (resumable) instead of
@@ -909,13 +932,25 @@ export declare const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
  * state keeps the historic stamps — deployments not delegating see zero version movement.
  */
 export declare const F012_CHECKPOINT_VERSION = 7;
+/**
+ * #130/#120 (2026-08-10 — the F012_CHECKPOINT_VERSION precedent replayed a sixth time): the schema
+ * version a suspend stamps when its gate carries {@link RealApprovalGateBit}. The enforcement lives
+ * ENTIRELY in the resuming worker (the no-org-wiring refusal, the org_unavailable resume-belt
+ * distinction): a pre-131 worker (MAX_SUPPORTED=7) would accept the row, ignore `realApproval`, and
+ * either redeem a governed row with no org wiring at all (#120's exact hole, replayed through version
+ * skew) or burn the approval on the unavailable belt the bit exists to soften. Stamping v8 forces it
+ * to reject PRE-CAS (`unsupported_version`, stays `pending`, retried on an enforcing worker). A gate
+ * with NO `realApproval` keeps the historic stamps — ungoverned deployments see zero version movement.
+ */
+export declare const REAL_APPROVAL_CHECKPOINT_VERSION = 8;
 /** The highest {@link Checkpoint.version} `runner.resume` will act on; a higher one is rejected pre-CAS with
  *  {@link CheckpointError} `unsupported_version` (the checkpoint stays `pending`, retryable on a newer worker).
- *  Raised to 7 for F-012-bearing checkpoints — this worker reads v1 (legacy human), v2 (resource), v3
+ *  Raised to 8 for realApproval-bearing gates — this worker reads v1 (legacy human), v2 (resource), v3
  *  (binding human/irreversible_ask), v4 (a pre-164 row, refused only when it carries the retired
  *  wall-clock allocation), v5 (token-allocation-bearing resource/approval), v6 (org-admission freeze
- *  state) and v7 (F-012 constraint-chain / delegation-provenance enforcement state). */
-export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 7;
+ *  state), v7 (F-012 constraint-chain / delegation-provenance enforcement state) and v8 (a
+ *  non-budgetable `realApproval` gate bit with its org-origin resume semantics). */
+export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 8;
 /**
  * Read a checkpoint's schema version, defaulting an absent field to **legacy `0`** (a 1.67-era checkpoint
  * written before the field existed — it carries no `workspaceHandle`, so resuming it the v1 way is safe).

package/dist/core/checkpoint-store.js

@@ -134,7 +134,8 @@ export const BINDING_CHECKPOINT_VERSION = 3;
 export const TOKEN_CHECKPOINT_VERSION = 5;
 export const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
 export const F012_CHECKPOINT_VERSION = 7;
-export const MAX_SUPPORTED_CHECKPOINT_VERSION = 7;
+export const REAL_APPROVAL_CHECKPOINT_VERSION = 8;
+export const MAX_SUPPORTED_CHECKPOINT_VERSION = 8;
 export function checkpointVersionOf(cp) {
     return cp.version ?? 0;
 }

package/dist/core/governance-codes.js

@@ -17,6 +17,9 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.challenge_sweep_failed",
     "memory.lineage_settle_failed",
     "memory.challenge_ledger_corrupt",
+    "memory.challenge_ledger_oversize",
+    "memory.control_plane_rebuilt",
+    "memory.control_plane_not_corrupt",
 ]);
 export function governanceRetryClass(code) {
     if (Object.prototype.hasOwnProperty.call(GOVERNANCE_CODES, code)) {

package/dist/core/hooks.d.ts

@@ -161,8 +161,13 @@ export interface Hooks {
  *  - `"shellGate"` — same tighten-deny, but the tool's irreversibility tier was installed by the COARSE
  *    `TaskSpec.shellGate` doctrine (design/80 D-E), not an explicit per-tool mark.
  *  - `"planMode"` — the design/108 plan-mode write-deny short-circuit (a read-only fidelity gate).
+ *  - `"org"` (design/182 §7) — the ORG layer: an organization deny rule, or the fail-closed tighten an
+ *    org-governed deployment applies while it cannot adjudicate against a snapshot (that tighten's ask
+ *    then resolving to deny). Its own word rather than `"policy"` because the authority is the ORG's
+ *    published snapshot, not this deployment's `ToolPolicy` — an operator reading "policy" on a call
+ *    their own policy allowed would be looking in the wrong place.
  */
-export type PermissionDeniedSource = "policy" | "hook" | "safety" | "shellGate" | "planMode" | "classifier";
+export type PermissionDeniedSource = "policy" | "hook" | "safety" | "shellGate" | "planMode" | "classifier" | "org";
 /** The payload a {@link Hooks.permissionDenied} callback observes (CC-exact fields + `source`). */
 export interface PermissionDeniedPayload {
     toolName: string;
@@ -520,6 +525,26 @@ export interface ParkAttemptFailed {
     /** Why the park could not be minted — a sentence, already worded for a reader. */
     parkFailed: string;
 }
+/**
+ * design/182 §7 — what the ORG layer answers for ONE call (see `ToolGateInput.orgRules`).
+ *
+ * The two arms are distinguished by `status`, NEVER by the absence of a verdict: "the org published no
+ * rule for this call" and "this deployment cannot see the org's rules" are opposite facts, and reading
+ * an empty answer as the first one is exactly the governance fail-open the availability contract exists
+ * to prevent.
+ */
+export type OrgGateVerdict = {
+    status: "available";
+    /** The org rule that speaks for this call, if any. Deny outranks ask; there is no allow bucket. */
+    verdict?: {
+        behavior: "deny" | "ask";
+        rule: string;
+    };
+} | {
+    status: "unavailable";
+    /** The overlay's own disclosure lines (engine/deployment-authored), for the operator channel. */
+    disclosures: readonly string[];
+};
 /** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort signal. */
 export interface ToolGateInput {
     /** RB-473 batch 2b — bounded disclosure for a HOST callback that throws inside this gate call's
@@ -577,7 +602,13 @@ export interface ToolGateInput {
      *  prefer, so the closure must NOT take its sync-first decline and should park durably. All other
      *  decline/pre-commit-failure paths keep their existing `undefined` fallbacks (the gate then keeps the
      *  fail-closed deny / typed refusal the caller carries). */
-    liveFaceUnavailable?: boolean) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
+    liveFaceUnavailable?: boolean, 
+    /** #130: present ⇒ the surviving ask carries `requiresRealApproval` and the mint must escalate to
+     *  the non-budgetable `irreversible_ask` kind carrying this bit (a budget resolver must never
+     *  auto-approve what only judgment may clear). `origin` records whether the bit came from an org
+     *  ASK rule, from the org-unavailable tighten (whose resume semantics differ — see
+     *  {@link import("./checkpoint-store.js").RealApprovalGateBit}), or from a policy/hook. */
+    realApproval?: import("./checkpoint-store.js").RealApprovalGateBit) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
     /**
      * design/174 — route a policy `ask` on the reserved question tool to this run's CONTENT-ask channel
      * before it can become a park or a refusal. Called in the `ask` branch with the FINAL post-hook,
@@ -713,6 +744,42 @@ export interface ToolGateInput {
             rule: string;
         }) => void;
     };
+    /**
+     * design/182 §7 — the ORG layer. Present ONLY when the deployment DECLARED org governance (the
+     * overlay constructor is the boot gate: a governed declaration with no snapshot provider refuses to
+     * boot). Absent ⇒ the whole step does not exist and the decision path is byte-identical.
+     *
+     * The org layer is the outermost TIGHTENING authority, so it runs after every fold and every engine
+     * tighten and before the ask-resolution chain — "org deny > org ask (non-dismissable) > personal
+     * allow rule > bare ask". It never loosens: there is structurally no org allow bucket.
+     *
+     * The `unavailable` arm is the load-bearing one. An org-governed deployment that cannot reach a
+     * snapshot fails the WHOLE decision boundary closed — every terminal allow (a deployment-policy
+     * allow and the no-policy default allow included) becomes an ask carrying
+     * `decisionReason: "org_unavailable"` AND `requiresRealApproval: true`, and both ask→allow seams (the
+     * personal-rule lane and the auto-mode classifier) are disarmed. Tightening only the two seams was
+     * refuted during design: a call that is ALREADY allow never passes through either seam, so it would
+     * have sailed past the org deny that could not be read. The `requiresRealApproval` bit closes the
+     * third loosening path — a blanket `onAsk: "allow"` would otherwise clear the synthetic ask.
+     */
+    orgRules?: {
+        /** Adjudicate this call against the current org overlay. MUST NOT throw — a throw is read as
+         *  `unavailable` (fail-closed), never as "no org rule spoke". */
+        adjudicate: (req: ToolCallRequest) => Promise<OrgGateVerdict>;
+        /** True iff the reserved question-tool NAME on this leg resolves to the ENGINE's own content-ask
+         *  tool. It is the exemption's real predicate: the name alone is not, because a caller may mount
+         *  its own tool under that name when the first-party one is not mounted, and such a tool has
+         *  arbitrary side effects (codex review, confirmed MED). Absent ⇒ `false` ⇒ the call is governed
+         *  like any other, which is the fail-closed default. */
+        contentAskToolMounted?: boolean;
+        /** Disclosure sink for the unavailable arm (trace `permission.org_snapshot_unavailable`). Never
+         *  affects the outcome. */
+        onUnavailable?: (info: {
+            toolName: string;
+            toolCallId: string;
+            message: string;
+        }) => void;
+    };
     /**
      * F-012 L2 — the SANDBOX ADMISSION leg. Present ONLY when the runner armed the mode: the execution
      * env DECLARES isolation (`RemoteExecutionEnv.capabilities.isolation === true` — a Runner-resolved

package/dist/core/hooks.js

@@ -3,6 +3,7 @@ import { brandPolicyAskClass } from "./ask-class.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { createSafeNotifier } from "./safe-notify.js";
+import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 export function cloneObserverInput(input) {
     try {
         return structuredClone(input);
@@ -246,12 +247,76 @@ export async function runToolGate(input) {
             denySource = input.shellGated === true ? "shellGate" : "safety";
         }
     }
+    let orgRealApprovalRequired = false;
+    let orgAskOrigin;
+    let orgTightenCount = 0;
+    const applyOrgLayer = async (current, args) => {
+        if (input.orgRules === undefined)
+            return current;
+        if (toolName === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
+            return current;
+        let decided = current;
+        const answer = await settleOrgVerdictWithin(input.orgRules
+            .adjudicate({ toolName, args, toolCallId })
+            .catch((err) => ({
+            status: "unavailable",
+            disclosures: [`the org adjudication face threw: ${err instanceof Error ? err.message : String(err)}`],
+        })), {
+            status: "unavailable",
+            disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`],
+        }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
+        if (answer.status === "unavailable") {
+            orgRealApprovalRequired = true;
+            orgAskOrigin = "unavailable";
+            await notifier.notifyAsync(() => input.orgRules?.onUnavailable?.({ toolName, toolCallId, message: answer.disclosures.join("; ") }), "toolGate.orgSnapshotUnavailable");
+            if (decided.action === "allow") {
+                decided = {
+                    action: "ask",
+                    message: `tool "${toolName}" needs approval: this deployment is org-governed and cannot currently adjudicate ` +
+                        `against an organization policy snapshot — every allow tightens to a real approval until it can`,
+                    decisionReason: ORG_UNAVAILABLE_DECISION_REASON,
+                    requiresRealApproval: true,
+                };
+                orgTightenCount += 1;
+                denySource = "org";
+            }
+            else if (decided.action === "ask" && decided.requiresRealApproval !== true) {
+                decided = { ...decided, requiresRealApproval: true };
+                orgTightenCount += 1;
+            }
+            return decided;
+        }
+        if (answer.verdict === undefined)
+            return decided;
+        const { behavior, rule } = answer.verdict;
+        if (behavior === "deny") {
+            orgTightenCount += 1;
+            denySource = "org";
+            return { action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON };
+        }
+        if (decided.action === "deny")
+            return decided;
+        orgTightenCount += 1;
+        denySource = "org";
+        orgRealApprovalRequired = true;
+        orgAskOrigin = "rule";
+        return decided.action === "ask"
+            ? { ...decided, requiresRealApproval: true }
+            : {
+                action: "ask",
+                message: `an organization policy rule (${rule}) requires approval for this call`,
+                decisionReason: ORG_RULE_DECISION_REASON,
+                requiresRealApproval: true,
+            };
+    };
+    decision = await applyOrgLayer(decision, policyRewrite !== undefined ? policyRewrite : currentInput);
     if (decision.action === "ask") {
         if (policyRewrite !== undefined) {
             currentInput = policyRewrite;
             req.args = policyRewrite;
         }
         if (input.persistedRules &&
+            !orgRealApprovalRequired &&
             decision.action === "ask" &&
             decision.requiresRealApproval !== true &&
             decision.decisionReason !== "hook" &&
@@ -269,6 +334,7 @@ export async function runToolGate(input) {
             }
         }
         if (input.autoMode &&
+            !orgRealApprovalRequired &&
             decision.action === "ask" &&
             req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
@@ -320,8 +386,11 @@ export async function runToolGate(input) {
         const egressTool = input.egress === true;
         const irreversibleTool = input.irreversibility === "always" || input.irreversibility === "maybe";
         const safety = egressTool || irreversibleTool ? { egress: egressTool, irreversible: irreversibleTool } : undefined;
+        const realApprovalOf = (d) => d.action === "ask" && d.requiresRealApproval === true
+            ? { origin: orgAskOrigin !== undefined ? `org_${orgAskOrigin}` : "policy" }
+            : undefined;
         if (suspendAsk && decision.action === "ask") {
-            const suspended = await suspendAsk(req, currentInput, safety);
+            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision));
             if (suspended) {
                 if ("parkFailed" in suspended)
                     parkFailed = suspended.parkFailed;
@@ -340,7 +409,7 @@ export async function runToolGate(input) {
                     req.args = outcome.presentedInput;
                 }
                 if (suspendAsk && outcome.parkDeclined && parkFailed === undefined) {
-                    const suspended = await suspendAsk(req, currentInput, safety, true);
+                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision));
                     if (suspended) {
                         if ("parkFailed" in suspended)
                             parkFailed = suspended.parkFailed;
@@ -364,10 +433,11 @@ export async function runToolGate(input) {
             }
         }
         if (decision.action === "ask") {
+            const askBeforeResolve = decision;
             const resolved = await resolveAsk(decision, req);
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
-                const suspended = await suspendAsk(req, currentInput, safety, true);
+                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve));
                 if (suspended) {
                     if ("parkFailed" in suspended)
                         parkFailed = suspended.parkFailed;
@@ -418,23 +488,34 @@ export async function runToolGate(input) {
                                 editArgs = hr.updatedInput;
                         }
                     }
-                    if (!adjudicate)
+                    if (!adjudicate && input.orgRules === undefined)
                         break;
-                    let recheck;
-                    try {
-                        recheck = await adjudicate({ toolName, args: editArgs, toolCallId });
-                    }
-                    catch (err) {
-                        recheck = {
-                            action: "deny",
-                            message: `policy re-check of the approved edit for "${toolName}" errored: ${err instanceof Error ? err.message : String(err)}`,
-                        };
+                    let recheck = { action: "allow" };
+                    if (adjudicate) {
+                        try {
+                            recheck = await adjudicate({ toolName, args: editArgs, toolCallId });
+                        }
+                        catch (err) {
+                            recheck = {
+                                action: "deny",
+                                message: `policy re-check of the approved edit for "${toolName}" errored: ${err instanceof Error ? err.message : String(err)}`,
+                            };
+                        }
                     }
                     if (recheck.action === "deny") {
                         editDenied = recheck;
                         denySource = "policy";
                         break;
                     }
+                    if (recheck.updatedInput !== undefined)
+                        editArgs = recheck.updatedInput;
+                    const orgTightensBefore = orgTightenCount;
+                    recheck = await applyOrgLayer(recheck, editArgs);
+                    const orgRaisedThisRound = orgTightenCount > orgTightensBefore;
+                    if (recheck.action === "deny") {
+                        editDenied = recheck;
+                        break;
+                    }
                     if (recheck.action === "allow") {
                         if (recheck.updatedInput !== undefined)
                             editArgs = recheck.updatedInput;
@@ -445,11 +526,15 @@ export async function runToolGate(input) {
                     const rr = await resolveAsk(recheck, { toolName, args: editArgs, toolCallId });
                     if (rr.action !== "allow") {
                         editDenied = rr;
-                        denySource = "policy";
+                        if (!orgRaisedThisRound)
+                            denySource = "policy";
                         break;
                     }
-                    if (rr.updatedInput === undefined)
+                    if (rr.updatedInput === undefined) {
+                        if (rr.presentedInput !== undefined)
+                            editArgs = rr.presentedInput;
                         break;
+                    }
                     editArgs = rr.updatedInput;
                 }
                 decision = editDenied ?? { ...decision, updatedInput: editArgs };

package/dist/core/memory-engine/engine.d.ts

@@ -1,4 +1,4 @@
-import { type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionRecord } from "./layout.js";
+import { type ChallengeAssignment, type ChallengeEvent, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionRecord } from "./layout.js";
 import type { HarvestReport, MemoryAnnouncement, MemoryBackend, MemorySessionHandle, ScanFinding } from "./types.js";
 /**
  * The CC `# Memory` instruction section — VERBATIM from the live capture
@@ -220,6 +220,33 @@ export declare class MemoryEngine {
      *  generation only — the announcement is a model-visible face, so no name/description/free reason
      *  rides it; content stays on the host audit face). Failures are disclosed, never thrown past. */
     private challengeAndAnnounce;
+    /** design/180 §10 — one disclosure per PROCESS per engine, not one per append: the size is a
+     *  standing property of the account, and repeating it on every challenge is the spam that gets
+     *  advisories muted (the same argument the durable-park disclosures are built on). */
+    private challengeLedgerSizeDisclosed;
+    /**
+     * design/180 §10 — the challenge ledger's size bound is a DISCLOSURE threshold, never a cap: the
+     * ledger cannot be rotated (the exclusion predicate is derived from the events, so dropping the
+     * oldest rows would un-withhold their entries), so crossing {@link CHALLENGE_LEDGER_MAX_EVENTS}
+     * changes nothing about what is withheld — it tells the deployment that an account on the
+     * per-tool-call read path has grown to where it costs the session latency.
+     */
+    private discloseChallengeLedgerSize;
+    /**
+     * design/180 §10 — the RECOVERY channel for a corrupt fail-closed ledger (lineage / challenges).
+     *
+     * The fail-closed family refuses every read on corruption so a silent "start fresh" cannot launder
+     * taint; permanent refusal is the point, and it left a deployment with genuinely corrupt bytes no way
+     * back except deleting engine files by hand. This is that way back, and it is explicit in every
+     * dimension: only a host call reaches it (nothing in the engine self-heals), a HEALTHY ledger is
+     * refused (`memory.control_plane_not_corrupt`), the corrupt bytes are quarantined beside the file
+     * rather than deleted, and the rebuild ANNOUNCES itself — resetting the challenge ledger un-withholds
+     * whatever it was withholding, which the model's next session must not learn about silently.
+     *
+     * `reason` is required and recorded in the announcement's shape (not its text — the announcement is a
+     * model-visible face and stays opaque); it is the operator's own note on the host error face.
+     */
+    rebuildCorruptControlPlaneLedger(ledger: StrictControlPlaneLedger, reason: string): ControlPlaneRebuildReceipt;
     /**
      * Host API (advisory, control-plane trust level — the same plane that can mark pollution):
      * challenge entries by id. `requestId` is REQUIRED (the generation ledger's idempotency identity;