@sema-agent/core 5.22.0 → 5.24.0

package/dist/core/permission-rule-sync.js

@@ -1,5 +1,6 @@
 import { parseAllowRuleText } from "./permission-rule-model.js";
 import { applyTombstones, errText, joinFrontiers, joinRuleStates, normalizePersistedRule, ruleSyncVector, sameScope, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
+import { emitTrace } from "./trace.js";
 export const PERMISSION_RULE_SYNC_PATH = "/v1/permission-rules/sync";
 export const LOCAL_OWNER_UNSYNCABLE_CODE = "permission_rules.local_owner_unsyncable";
 function refuseLocalOwnerSync() {
@@ -19,6 +20,34 @@ export async function syncPermissionRules(opts) {
     if (typeof opts.principal !== "string" || opts.principal === "") {
         throw new Error("syncPermissionRules requires a verified principal — an unauthenticated deployment has no cloud bucket to sync");
     }
+    const traceClock = opts.now ?? Date.now;
+    const disclose = (result) => {
+        const tracer = opts.tracer;
+        if (tracer === undefined)
+            return result;
+        for (const r of result.resurrected) {
+            emitTrace(tracer, () => ({
+                kind: "permission.rule_sync_resurrected",
+                version: 1,
+                principal: opts.principal,
+                rule: r.rule,
+                scopeKind: r.scope.kind,
+                ts: traceClock(),
+            }));
+        }
+        for (const d of result.dropped) {
+            emitTrace(tracer, () => ({
+                kind: "permission.rule_sync_dropped",
+                version: 1,
+                principal: opts.principal,
+                rule: d.rule,
+                scopeKind: d.scope.kind,
+                reason: d.reason,
+                ts: traceClock(),
+            }));
+        }
+        return result;
+    };
     const store = opts.provider.forPrincipal(opts.principal);
     const writer = writerOf(store);
     if (writer === undefined) {
@@ -111,7 +140,7 @@ export async function syncPermissionRules(opts) {
             res = await writer.apply(delta, { expectedRev: current.rev });
         }
         catch (err) {
-            return {
+            return disclose({
                 ok: false,
                 pushed: { addDots: raw.rules.reduce((n, r) => n + r.adds.length, 0), tombstones: raw.tombstones.length },
                 landed: { newAdds: 0, newTombstones: 0 },
@@ -119,7 +148,7 @@ export async function syncPermissionRules(opts) {
                 dropped,
                 rev: current.rev,
                 warnings: [...warnings, `the store refused the sync landing: ${errText(err)} — nothing landed, the local state is unchanged`],
-            };
+            });
         }
         if ("conflict" in res) {
             current = await writer.readRaw();
@@ -156,7 +185,7 @@ export async function syncPermissionRules(opts) {
             if (!dropped.some((x) => x.dot.actor === q.dot.actor && x.dot.counter === q.dot.counter && x.reason === q.reason))
                 dropped.push(q);
         }
-        return {
+        return disclose({
             ok: dropped.length === 0 && warnings.length === 0,
             pushed: { addDots: raw.rules.reduce((n, r) => n + r.adds.length, 0), tombstones: raw.tombstones.length },
             landed: { newAdds, newTombstones },
@@ -164,9 +193,9 @@ export async function syncPermissionRules(opts) {
             dropped,
             rev: landedRaw.rev,
             ...(warnings.length > 0 ? { warnings } : {}),
-        };
+        });
     }
-    return {
+    return disclose({
         ok: false,
         pushed: { addDots: raw.rules.reduce((n, r) => n + r.adds.length, 0), tombstones: raw.tombstones.length },
         landed: { newAdds: 0, newTombstones: 0 },
@@ -174,7 +203,7 @@ export async function syncPermissionRules(opts) {
         dropped,
         rev: current.rev,
         warnings: [...warnings, `optimistic-concurrency retries exhausted after ${SYNC_MAX_ATTEMPTS} attempts — nothing landed, the local state is unchanged`],
-    };
+    });
 }
 function isDot(v) {
     const d = v;

package/dist/core/runner/prepare-task.d.ts

@@ -8,10 +8,10 @@ import type { HarvestReport, MemorySessionHandle } from "../memory-engine/types.
 import { StoredSession } from "../session.js";
 import type { SessionStore } from "../session.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import type { OnAsk, ToolPolicy } from "../tool-policy.js";
+import type { OnAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import { type ActiveSkillFrame } from "./active-skill-scope.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
-import { type Hooks } from "../hooks.js";
+import { type Hooks, type OrgGateVerdict } from "../hooks.js";
 import { type RecoveredOrphan } from "../session-reconcile.js";
 import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-detector.js";
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
@@ -214,6 +214,14 @@ export interface Prepared {
     /** RB-63: the deployment's own caller policy, re-checked on a durable resume ONLY when the approver
      *  rewrote the pending call's args (see the composition site for why the edit case is special). */
     basePolicyForResumeEdit?: ToolPolicy;
+    /** design/182 §7 — the ORG adjudication face, re-resolved on a durable RESUME before an approved
+     *  pending call executes. The resume path bypasses the harness gate by design (a human already
+     *  adjudicated the checkpointed call), which is exactly where org policy skew is most likely: the
+     *  suspend may have outlived the snapshot revision that was current when it was minted. Present only
+     *  on a governed deployment. */
+    permissionRuleOrg?: {
+        adjudicate: (req: ToolCallRequest) => Promise<OrgGateVerdict>;
+    };
     /** Removes the `spec.signal` abort listener on task end (else a long-lived signal leaks listeners). */
     releaseSignal: () => void;
     /**

package/dist/core/runner/prepare-task.js

@@ -30,6 +30,7 @@ import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
 import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, runToolGate } from "../hooks.js";
+import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -84,7 +85,7 @@ import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-
 import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
-import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
+import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveAskEffective, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
@@ -3144,12 +3145,22 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         };
         const permissionRuleLane = (() => {
             const provider = deps.permissionRuleStore;
+            const localOwnerDeclared = deps.localOwnerRules === true;
+            if (localOwnerDeclared) {
+                if (provider === undefined) {
+                    throw new Error("RunnerDeps.localOwnerRules is declared but no permissionRuleStore provider is wired — there is no bucket for the local owner to hold rules in; refusing rather than running as if the declaration were absent");
+                }
+                if (provider.forLocalOwner === undefined) {
+                    throw new Error("RunnerDeps.localOwnerRules is declared but the wired permissionRuleStore provider implements no forLocalOwner() face — a provider without a local-owner bucket cannot honor the declaration; refusing rather than silently resolving zero rules");
+                }
+            }
             if (provider === undefined)
                 return undefined;
             const root = taskRootPath;
             return {
                 admits: async (req) => {
-                    if (spec.principal === undefined || spec.principal === "")
+                    const anonymous = spec.principal === undefined || spec.principal === "";
+                    if (anonymous && !localOwnerDeclared)
                         return undefined;
                     if (req.toolName !== PERSISTED_RULE_TOOL)
                         return undefined;
@@ -3158,7 +3169,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         return undefined;
                     let listed;
                     try {
-                        listed = await provider.forPrincipal(spec.principal).list();
+                        listed = anonymous
+                            ?
+                                await provider.forLocalOwner().list()
+                            : await provider.forPrincipal(spec.principal).list();
                     }
                     catch (err) {
                         emitTrace(deps.tracer, () => ({
@@ -3174,6 +3188,31 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 },
             };
         })();
+        const permissionRuleOrgLane = (() => {
+            const overlay = deps.permissionRuleOrg;
+            if (overlay === undefined)
+                return undefined;
+            return {
+                adjudicate: async (req) => {
+                    if (req.toolName === ASK_USER_QUESTION_TOOL_NAME && questionToolMounted)
+                        return { status: "available" };
+                    let resolution;
+                    try {
+                        resolution = await overlay.resolve();
+                    }
+                    catch (err) {
+                        return { status: "unavailable", disclosures: [`the org rule overlay threw: ${err instanceof Error ? err.message : String(err)}`] };
+                    }
+                    if (resolution.status === "unavailable")
+                        return { status: "unavailable", disclosures: resolution.disclosures };
+                    const command = req.args?.command;
+                    if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
+                        return { status: "available" };
+                    const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
+                    return verdict === undefined ? { status: "available" } : { status: "available", verdict };
+                },
+            };
+        })();
         const ruleSuggestionsOf = (toolName, args) => {
             if (permissionRuleLane === undefined || toolName !== PERSISTED_RULE_TOOL)
                 return {};
@@ -3621,6 +3660,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             sessionDurability: resolveDeclaredDurability(sessions, "sessionStore"),
             backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
             permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
+            permissionRuleSyncWired: deps.permissionRuleSyncWired === true,
+            permissionRuleOrgGoverned: deps.permissionRuleOrg !== undefined,
             hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
             lockedConfigWired: deps.lockedConfig !== undefined,
             complianceWired: deps.compliancePostureResolver !== undefined,
@@ -3837,8 +3878,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     return { ok: false };
                 if (memoryEngineSession)
                     await memoryEngineSession.harvest("checkpoint");
-                try {
-                    await checkpointStore.put(token, cp);
+                const announceCommittedScreeningPark = () => {
                     const committedCount = cp.state.inheritedGate?.parentConstraintCount;
                     if (cp.state.inheritedGate?.requiresParentConstraint === true &&
                         !screeningParkDisclosedRef.done &&
@@ -3855,10 +3895,59 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         catch {
                         }
                     }
+                };
+                const confirmPutOutcome = async (putErr) => {
+                    if (putErr?.code === "checkpoint.already_exists")
+                        return "absent";
+                    try {
+                        const row = await checkpointStore.get(token);
+                        if (row == null)
+                            return "absent";
+                        const sameCall = (a, b) => a.kind === b.kind && (a.kind !== "tool_approval" || b.kind !== "tool_approval" || a.toolCallId === b.toolCallId);
+                        const isOurs = row.scope === cp.scope && row.sessionId === cp.sessionId && row.leafId === cp.leafId && sameCall(row.pendingAction, cp.pendingAction);
+                        return isOurs ? "committed" : "absent";
+                    }
+                    catch (readErr) {
+                        deps.onError?.(readErr, { phase: "config", sessionId });
+                        return "unknown";
+                    }
+                };
+                try {
+                    await checkpointStore.put(token, cp);
+                    announceCommittedScreeningPark();
                     return { ok: true };
                 }
                 catch (putErr) {
                     deps.onError?.(putErr, { phase: "config", sessionId });
+                    const confirmed = await confirmPutOutcome(putErr);
+                    if (confirmed === "committed") {
+                        try {
+                            deps.onError?.(new Error(`durable approval checkpoint: the store's write reported a failure but the row EXISTS — the commit ` +
+                                `landed and its acknowledgement was lost (a network backend can complete the INSERT and drop the ` +
+                                `connection before replying). The run suspends on that row rather than continuing, which would leave ` +
+                                `a redeemable pending checkpoint behind. This backend's acknowledgement path is lossy — the operator ` +
+                                `face carries the store's own message.`), { phase: "degraded", sessionId, classification: "checkpoint-put-confirmation-lost" });
+                        }
+                        catch {
+                        }
+                        announceCommittedScreeningPark();
+                        return { ok: true };
+                    }
+                    if (confirmed === "unknown") {
+                        const unknownReason = "the approval checkpoint's state cannot be established (the store rejected the write and then could not be read back; a committed-but-unacknowledged row may exist) — the run is stopped rather than continued past an approval whose durable record is unknown";
+                        try {
+                            deps.onError?.(new Error(`durable approval checkpoint: ${unknownReason}`), {
+                                phase: "degraded",
+                                sessionId,
+                                classification: "checkpoint-put-outcome-unknown",
+                            });
+                        }
+                        catch {
+                        }
+                        abortController.abort();
+                        void harness.abort();
+                        return { ok: false, reason: unknownReason };
+                    }
                     const reason = "the approval checkpoint could not be persisted (the store rejected the write; the deployment's error face carries the store's own message)";
                     if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
                         const { outcome: back, attempts: backAttempts } = await restoreWorkspaceWithRetry(remoteEnv, remoteHandle.snapshotId, {
@@ -4147,7 +4236,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-                ? async (req, postHookArgs, safety, liveFaceUnavailable) => {
+                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval) => {
                     const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
@@ -4256,12 +4345,15 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...(effectiveShellGate !== "off" ? { shellGateDoctrine: effectiveShellGate } : {}),
                         });
                         gate =
-                            safety !== undefined
+                            safety !== undefined || realApproval !== undefined
                                 ? {
                                     kind: "irreversible_ask",
-                                    reason: `human approval required before safety-tightened tool "${req.toolName}"`,
+                                    reason: safety !== undefined
+                                        ? `human approval required before safety-tightened tool "${req.toolName}"`
+                                        : `real human approval required for tool "${req.toolName}" (non-budgetable: ${realApproval.origin})`,
                                     toolName: req.toolName,
-                                    safetyAxis: safety,
+                                    ...(safety !== undefined ? { safetyAxis: safety } : {}),
+                                    ...(realApproval !== undefined ? { realApproval } : {}),
                                     riskDescriptor,
                                 }
                                 : durableApproval
@@ -4284,7 +4376,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const mintedAt = Date.now();
                         cp = {
                             token,
-                            version: f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                            version: realApproval !== undefined ? REAL_APPROVAL_CHECKPOINT_VERSION : f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                             scope,
                             sessionId,
                             leafId,
@@ -4422,6 +4514,23 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     },
                                 }
                                 : {}),
+                            ...(permissionRuleOrgLane
+                                ? {
+                                    orgRules: {
+                                        adjudicate: permissionRuleOrgLane.adjudicate,
+                                        contentAskToolMounted: questionToolMounted,
+                                        onUnavailable: (info) => emitTrace(deps.tracer, () => ({
+                                            kind: "permission.org_snapshot_unavailable",
+                                            version: 1,
+                                            taskId: spec.taskId ?? sessionId,
+                                            toolName: info.toolName,
+                                            toolCallId: info.toolCallId,
+                                            message: info.message,
+                                            ts: Date.now(),
+                                        })),
+                                    },
+                                }
+                                : {}),
                             isMarkedUnresolvable: (toolCallId) => inheritedUnavailableAsks.has(toolCallId),
                             ...(sandboxAdmissionArmed
                                 ? {
@@ -4750,7 +4859,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             : undefined;
         overheadState.promptChars = systemPrompt.length;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.js

@@ -1,6 +1,6 @@
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, MAX_SUPPORTED_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
+import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
 import { engineVersion } from "../version.js";
 import { CONFIG_CATALOG_VERSION, declarationReasons, resolveEffectiveConfig } from "../../config/catalog.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
@@ -9,6 +9,7 @@ import { ASK_USER_QUESTION_TOOL_NAME, canonicalizeCapturedPlainData, classifyQue
 import { boundInputHashOf } from "../canonical-json.js";
 import { computeCostMicroUsd, modelCostToPricing } from "../pricing.js";
 import { emitTrace } from "../trace.js";
+import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { emitTaskOutcome } from "../task-outcome.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { primaryActivityArg } from "../arg-summary.js";
@@ -3703,6 +3704,21 @@ export class Runner {
         if (checkpointVersionOf(cp) > MAX_SUPPORTED_CHECKPOINT_VERSION) {
             throw new CheckpointError("checkpoint.unsupported_version", `checkpoint version ${checkpointVersionOf(cp)} is newer than this worker supports (max ${MAX_SUPPORTED_CHECKPOINT_VERSION})`);
         }
+        const preCasGateBit = cp.gate.kind === "irreversible_ask" ? cp.gate.realApproval : undefined;
+        const preCasBitWellFormed = preCasGateBit !== undefined &&
+            typeof preCasGateBit === "object" &&
+            (preCasGateBit.origin === "org_rule" ||
+                preCasGateBit.origin === "org_unavailable" ||
+                preCasGateBit.origin === "policy");
+        if (checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION ? !preCasBitWellFormed : preCasGateBit !== undefined) {
+            throw new CheckpointError("checkpoint.invalid_outcome", checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION
+                ? `a v${checkpointVersionOf(cp)} checkpoint must carry a well-formed non-budgetable realApproval gate bit (origin org_rule/org_unavailable/policy) on an irreversible_ask gate — this row does not; refusing to resume a damaged real-approval row (corruption / downgrade guard), the checkpoint stays pending`
+                : `a v${checkpointVersionOf(cp)} checkpoint carries a realApproval gate bit no release of that version ever minted — refusing to honor a fabricated origin (corruption / forgery guard), the checkpoint stays pending`);
+        }
+        if ((preCasGateBit?.origin === "org_rule" || preCasGateBit?.origin === "org_unavailable") &&
+            this.deps.permissionRuleOrg === undefined) {
+            throw new CheckpointError("checkpoint.unsupported_version", `this checkpoint's approval was minted under organization governance (${preCasGateBit.origin}) and this worker has no org adjudication wiring (permissionRuleOrg) — a governed approval may only be redeemed where governance can be enforced; the checkpoint stays pending, resume it on an org-wired worker`);
+        }
         const retiredWalltimeTotal = cp.resourceLedger?.totalWalltimeSec;
         if (retiredWalltimeTotal !== undefined) {
             throw new CheckpointError("checkpoint.walltime_axis_retired", "this checkpoint's ledger carries a cross-slice WALL-CLOCK allocation (resourceLedger.totalWalltimeSec), an axis this engine version retired — " +
@@ -4008,6 +4024,35 @@ export class Runner {
                 return;
             }
         }
+        const gateRealApproval = resume.cp.gate.kind === "irreversible_ask" ? resume.cp.gate.realApproval : undefined;
+        const gateOrgGoverned = gateRealApproval?.origin === "org_rule" || gateRealApproval?.origin === "org_unavailable";
+        if (gateOrgGoverned && prepared.permissionRuleOrg === undefined) {
+            const unwiredDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: its approval was minted under organization governance (${gateRealApproval.origin}), and this worker has no org adjudication wiring — a governed approval may only be redeemed where governance can be enforced. This approval is spent; re-issue the call on an org-wired worker.`);
+            emitEnd(true, { content: unwiredDenial });
+            const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, unwiredDenial, true));
+            emitCommitted(eid, "toolResult", pendingAction.toolCallId);
+            return;
+        }
+        if (prepared.permissionRuleOrg !== undefined) {
+            const orgVerdict = prepared.permissionRuleOrg
+                .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId })
+                .catch(() => ({ status: "unavailable", disclosures: ["the org adjudication face threw on resume"] }));
+            const org = await settleOrgVerdictWithin(orgVerdict, { status: "unavailable", disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`] }, { signal: prepared.abortController.signal, timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
+            const blocked = org.status === "unavailable"
+                ? gateRealApproval?.origin === "org_unavailable"
+                    ? undefined
+                    : "this deployment is org-governed and cannot currently adjudicate against an organization policy snapshot"
+                : org.verdict?.behavior === "deny"
+                    ? `an organization policy rule (${org.verdict.rule}) denies it`
+                    : undefined;
+            if (blocked !== undefined) {
+                const orgDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${blocked}. This approval is spent — the call has to be re-issued and approved again once organization policy permits it.`);
+                emitEnd(true, { content: orgDenial });
+                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, orgDenial, true));
+                emitCommitted(eid, "toolResult", pendingAction.toolCallId);
+                return;
+            }
+        }
         if (prepared.denyNarrowingPolicy) {
             const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check({
                 toolName: pendingAction.toolName,

package/dist/core/runner/session-file-state-replay.js

@@ -1,4 +1,5 @@
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
+import { isOffloadedDetailReplacement } from "../tool-result-store.js";
 const READ_TOOL = "Read";
 const WRITE_TOOL = "Write";
 const RETRACTING_RESULTS = [
@@ -50,6 +51,8 @@ export function wholeFileRecordsFromTranscript(messages) {
         const content = isRead ? wholeFileFromReadCard(rest) : typeof rest.content === "string" ? rest.content : undefined;
         if (content === undefined)
             continue;
+        if (isOffloadedDetailReplacement(content))
+            continue;
         byPath.set(filePath, { path: filePath, content, at: m.timestamp });
     }
     return [...byPath.values()];

package/dist/core/tool-policy.d.ts

@@ -69,8 +69,16 @@ export interface ToolCallRequest {
 /** Where a decision came from, for audit (design/37). `"sandbox"` (F-012 L2) marks an allow the
  *  sandbox-admission leg resolved: the deployment declared an isolated execution env, every surviving
  *  ask on the call was engine-classified sandbox-local, and the call crosses no declared boundary —
- *  disclosed durably as `permission.sandbox_admitted`. */
-export type DecisionReason = "rule" | "mode" | "hook" | "safety" | "classifier" | "persisted_rule" | "sandbox";
+ *  disclosed durably as `permission.sandbox_admitted`.
+ *
+ *  design/182 §7 adds the two ORG-layer words, both TIGHTENING-only:
+ *   - `"org_rule"` — an organization policy rule spoke (a deny, or an ask that no configuration can
+ *     dismiss). Distinct from `"rule"` (a deployment `ToolPolicy` rule) because the AUTHORITY differs:
+ *     an org rule comes from the org's server-published snapshot, not from this deployment's policy.
+ *   - `"org_unavailable"` — an org-governed deployment could not adjudicate against a snapshot, so the
+ *     whole decision boundary failed closed (see `ORG_UNAVAILABLE_DECISION_REASON`, the single
+ *     spelling this word is minted from). */
+export type DecisionReason = "rule" | "mode" | "hook" | "safety" | "classifier" | "persisted_rule" | "sandbox" | "org_rule" | "org_unavailable";
 /**
  * WHO (or what) ENDED an approval — the machine-readable twin of a settlement's human-readable text,
  * so a consumer tells "a person decided this" from "nobody answered" without prose-matching a sentence.
@@ -78,10 +86,20 @@ export type DecisionReason = "rule" | "mode" | "hook" | "safety" | "classifier"
  * what ended the WAIT.
  *
  *  - `"human"` — a person, or the approver acting for one, returned a final verdict (allow or deny).
- *  - `"timeout"` — the configured approval window elapsed with no answer.
+ *  - `"timeout"` — an approval window elapsed with no answer.
  *  - `"aborted"` — every other NON-HUMAN end: the task aborted, the approver threw or reported nobody
  *    reachable, the decision arrived out of contract, a store or transport gave way, retries ran out.
  *
+ * **Which windows `"timeout"` speaks for** (#114①, 2026-08-09 — the promise this note used to make was
+ * wider than the code): the engine stamps it at the waits IT owns — `createApprovalPolicy`'s
+ * `approvalTimeoutMs` window, and the durable park's TTL. The SYNCHRONOUS `onAsk` leg is not one of
+ * them: there the deployment owns the window (the engine starts no timer for a callback it does not
+ * schedule), so an unanswered card and a refused one arrive as the same `false` and the engine records
+ * `"human"` rather than inventing a cause it did not observe. A host that DOES time its own card out
+ * can say so — {@link AskOutcome}'s object arm carries an optional `settledBy` for exactly this — but a
+ * host that does not is indistinguishable, by construction. Read an absent `"timeout"` as "no window
+ * the engine owns elapsed", never as "nobody's window elapsed".
+ *
  * The three words are exhaustive and mutually exclusive over the ways an approval can end, and the
  * minimum discrimination a consumer needs — someone refused vs nobody answered — is `"human"` vs the
  * other two.
@@ -694,17 +712,32 @@ export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal)
  *    untyped bridge is a fail-closed deny naming the defect (the historical truthy leniency was a
  *    fail-open on the security face with no live producer).
  *  - `"unavailable"` — the G1 per-ask routing verdict (see {@link OnAsk}).
- *  - `{ allow, updatedInput? }` — verdict PLUS an operator EDIT of the presented args
+ *  - `{ allow, updatedInput?, settledBy? }` — verdict PLUS an operator EDIT of the presented args
  *    (whole-replacement form, e.g. ctrl+g "edit script in $EDITOR"): the human approved a MODIFIED
  *    action, and executing the un-edited args would betray that consent. `allow` folds STRICTLY
  *    (`allow === true`) — an object arm is a deliberate caller, so no truthy leniency — and
  *    `updatedInput` is honored only on allow (a deny edit never executes anything). The edit is
  *    applied as the resolved decision's own rewrite: the gate re-validates it against the tool
  *    schema exactly like a hook/policy rewrite.
+ *
+ * #114② (2026-08-09) — `settledBy` on the object arm is the SYNCHRONOUS leg's only channel for saying
+ * what ended the wait. This leg's window belongs to the HOST (`onAsk` is a callback the deployment
+ * owns; the engine starts no timer for it), so a host that timed its own approval card out could
+ * previously only report a plain `false`, which the engine correctly recorded as `"human"` — a person
+ * refusing. The two words the host may self-report:
+ *  - `"human"` — a person answered (identical to omitting the field);
+ *  - `"timeout"` — the host's own approval window elapsed with no answer. Legal ONLY with
+ *    `allow: false`: a window that elapsed cannot be the thing that approved an action, so
+ *    `{allow: true, settledBy: "timeout"}` is a contradiction and is refused fail-closed (the same
+ *    narrowing the `PermissionResult` allow arm already spells in its type).
+ * `"aborted"` is deliberately NOT accepted here — that word names the engine's OWN fail-closed ends
+ * (abort, throw, unavailable, out-of-contract value), each already stamped at its own arm, and a
+ * self-reported one would let a host relabel its refusal as an engine failure.
  */
 export type AskOutcome = boolean | "unavailable" | {
     allow: boolean;
     updatedInput?: unknown;
+    settledBy?: Extract<ApprovalSettledBy, "human" | "timeout">;
 };
 /**
  * ruled 2026-08-04 — forward an approver into a delegated child, stamping every ask it raises with the

package/dist/core/tool-policy.js

@@ -122,12 +122,9 @@ export function createAllowDenyPolicy(opts) {
             if (entry.startsWith("mcp__")) {
                 const segments = entry.slice("mcp__".length).split("__");
                 if (segments.some((seg) => seg.length === 0)) {
-                    invalid.push({
-                        entry,
-                        list,
-                        message: `"${entry}" is a malformed MCP tool name (empty segment) — it can never match any mounted tool. ` +
-                            `Use \`mcp__<server>\` for every tool of a server, or \`mcp__<server>__<tool>\` for one tool.`,
-                    });
+                    const lesson = `a malformed MCP tool name (empty segment) — it can never match any mounted tool. ` +
+                        `Use \`mcp__<server>\` for every tool of a server, or \`mcp__<server>__<tool>\` for one tool.`;
+                    invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
                     continue;
                 }
             }
@@ -135,14 +132,11 @@ export function createAllowDenyPolicy(opts) {
                 kept.push(entry);
                 continue;
             }
-            invalid.push({
-                entry,
-                list,
-                message: `"${entry}" is a rule CONTENT form, not a tool name — a name set matches raw tool names, so this entry ` +
-                    `can never match any mounted tool (in an allow list it removes the tool entirely). Use the tool NAME here, ` +
-                    `and route the narrowing through the lane that speaks this grammar: parameter rules via ` +
-                    `createPermissionRulePolicy, Bash command prefixes via the persisted allow-rule lane.`,
-            });
+            const lesson = `a rule CONTENT form, not a tool name — a name set matches raw tool names, so this entry ` +
+                `can never match any mounted tool (in an allow list it removes the tool entirely). Use the tool NAME here, ` +
+                `and route the narrowing through the lane that speaks this grammar: parameter rules via ` +
+                `createPermissionRulePolicy, Bash command prefixes via the persisted allow-rule lane.`;
+            invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
         }
         return kept;
     };
@@ -150,8 +144,16 @@ export function createAllowDenyPolicy(opts) {
     const screenedDeny = screen(opts.deny, "deny");
     if (invalid.length > 0) {
         if ((opts.onInvalidName ?? "throw") === "throw") {
+            const byLesson = new Map();
+            for (const i of invalid) {
+                const group = byLesson.get(i.lesson) ?? [];
+                group.push({ entry: i.entry, list: i.list });
+                byLesson.set(i.lesson, group);
+            }
             const e = new Error(`createAllowDenyPolicy: ${invalid.length} entr${invalid.length === 1 ? "y is" : "ies are"} not tool name(s):\n` +
-                invalid.map((i) => `  [${i.list}] ${i.message}`).join("\n"));
+                [...byLesson.entries()]
+                    .map(([lesson, group]) => `  Each of the following is ${lesson}\n` + group.map((g) => `    [${g.list}] "${g.entry}"`).join("\n"))
+                    .join("\n"));
             e.code = "config.invalid_tool_name_set";
             e.issues = invalid;
             throw e;
@@ -844,12 +846,40 @@ export async function resolveAsk(req, onAsk, signal) {
         };
     }
     if (typeof ok === "object" && ok !== null) {
-        if (ok.allow !== true) {
-            return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode", settledBy: "human" };
+        const supplied = ok.settledBy;
+        const allowed = ok.allow;
+        const suppliedEdit = ok.updatedInput;
+        if (supplied !== undefined && supplied !== "human" && supplied !== "timeout") {
+            return {
+                action: "deny",
+                message: `the approver for "${req.toolName}" reported settledBy "${typeof supplied === "string" ? containThrownText(supplied) : supplied === null ? "null" : typeof supplied}", which is outside what a synchronous ` +
+                    `approver may self-report — it is exactly "human" or "timeout" (or omitted); denied fail-closed`,
+                decisionReason: "mode",
+                settledBy: "aborted",
+            };
+        }
+        if (supplied === "timeout" && allowed === true) {
+            return {
+                action: "deny",
+                message: `the approver for "${req.toolName}" returned an allow settled by "timeout" — an elapsed approval window cannot be ` +
+                    `what approved a call; denied fail-closed (report timeout with allow:false, or allow with settledBy "human"/omitted)`,
+                decisionReason: "mode",
+                settledBy: "timeout",
+            };
+        }
+        if (allowed !== true) {
+            return {
+                action: "deny",
+                message: supplied === "timeout"
+                    ? `approval for "${req.toolName}" was not answered before the approver's own window elapsed: ${req.message}`
+                    : `approval denied for "${req.toolName}": ${req.message}`,
+                decisionReason: "mode",
+                settledBy: supplied === "timeout" ? "timeout" : "human",
+            };
         }
-        if (ok.updatedInput === undefined)
+        if (suppliedEdit === undefined)
             return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settledBy: "human" };
-        const edit = tryCloneArgs(ok.updatedInput);
+        const edit = tryCloneArgs(suppliedEdit);
         if (!edit.ok) {
             return {
                 action: "deny",