@sema-agent/core 5.24.0 → 5.26.0

package/dist/core/runner/prepare-task.js

@@ -89,6 +89,10 @@ import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOI
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveAskEffective, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
+const announcedMaterializeEnv = new Set();
+export function __resetMaterializeEnvAnnouncements() {
+    announcedMaterializeEnv.clear();
+}
 const RECONCILE_MAX_RETRIES = 3;
 const DEFAULT_MAX_SUSPENDS = 5;
 const TASK_LIMIT_KEY_DICT = {
@@ -348,6 +352,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         e.code = "config.tool_materialize_invalid";
         throw e;
     }
+    if (spec.memoryPersistenceCapable !== undefined && typeof spec.memoryPersistenceCapable !== "boolean") {
+        const e = new Error(`memoryPersistenceCapable must be a boolean when present (got ${JSON.stringify(spec.memoryPersistenceCapable)}) — a non-boolean would silently read as capable.`);
+        e.code = "config.memory_persistence_invalid";
+        throw e;
+    }
     if (spec.toolMaterializeStrategy === "static" && spec.deferSelfResolve === false) {
         const e = new Error(`toolMaterializeStrategy "static" cannot be combined with deferSelfResolve: false — with the direct-call ` +
             `lane disabled a placeholder is never swapped and never self-resolves, so no deferred tool could ever be ` +
@@ -1150,6 +1159,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(spec.additionalDirectories !== undefined ? { additionalDirectories: Object.freeze([...spec.additionalDirectories]) } : {}),
             ...(spec.additionalReadDirectories !== undefined ? { additionalReadDirectories: Object.freeze([...spec.additionalReadDirectories]) } : {}),
             ...(spec.envFacts !== undefined ? { envFacts: { ...spec.envFacts } } : {}),
+            ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
             getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
             parentCwd: taskRootPath,
             ...(centerAdoption !== undefined ? { centerArtifactDigest: centerAdoption.artifact.artifactDigest } : {}),
@@ -1683,20 +1693,24 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     `Set spec.shellGate to "classify" or "always" if this deployment expects doctrine-gated shell behavior.`), { phase: "config", sessionId, classification: "shell-gate-off" });
             }
             if (shellGate !== "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
-                shellGatedBash = !egressTools.has("Bash") && !irreversibilityTier.has("Bash");
-                irreversibilityTier.set("Bash", shellGate === "always" ? "always" : "maybe");
+                const bashTierBefore = irreversibilityTier.get("Bash");
+                shellGatedBash = !egressTools.has("Bash") && bashTierBefore !== "always" && bashTierBefore !== "maybe";
+                const bashEffectiveTier = shellGate === "always" || bashTierBefore === "always" ? "always" : "maybe";
+                irreversibilityTier.set("Bash", bashEffectiveTier);
                 irreversibleTools.add("Bash");
                 const shellReadBoundary = () => ({
                     roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical],
                     ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}),
                 });
-                if (shellGate === "classify")
+                if (shellGate === "classify" && shellGatedBash)
                     reversibilityProbes.set("Bash", bashReversibilityProbe(undefined, shellReadBoundary));
                 if (backgroundTaskToolsActive) {
-                    shellGatedMonitor = !egressTools.has("Monitor") && !irreversibilityTier.has("Monitor");
-                    irreversibilityTier.set("Monitor", shellGate === "always" ? "always" : "maybe");
+                    const monitorTierBefore = irreversibilityTier.get("Monitor");
+                    shellGatedMonitor = !egressTools.has("Monitor") && monitorTierBefore !== "always" && monitorTierBefore !== "maybe";
+                    const monitorEffectiveTier = shellGate === "always" || monitorTierBefore === "always" ? "always" : "maybe";
+                    irreversibilityTier.set("Monitor", monitorEffectiveTier);
                     irreversibleTools.add("Monitor");
-                    if (shellGate === "classify")
+                    if (shellGate === "classify" && shellGatedMonitor)
                         reversibilityProbes.set("Monitor", bashReversibilityProbe(undefined, shellReadBoundary));
                 }
             }
@@ -1932,7 +1946,21 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             sessionId,
             taskRootPath,
             memoryWriteGateRef,
-            writeToolsMounted: tools.some((t) => t.name === "Write") && !(toolFaceSnapshot.exclude?.includes("Write") ?? false),
+            writeToolsMounted: tools.some((t) => t.name === "Write") &&
+                !(toolFaceSnapshot.exclude?.includes("Write") ?? false) &&
+                !(handsEnabled && isRemoteExecutionEnv(executionEnv) && spec.memoryPersistenceCapable !== true),
+            memoryPersistenceDeclared: spec.memoryPersistenceCapable,
+            rosterCanPersist: spec.memoryPersistenceCapable ??
+                tools.some((t) => {
+                    if (toolFaceSnapshot.exclude?.includes(t.name) ?? false)
+                        return false;
+                    const effect = (t.effect ?? toolEffects.get(t.name) ?? "write");
+                    if (effect === "read")
+                        return false;
+                    if (t.name !== "Write" && t.name !== "Edit" && t.name !== "NotebookEdit" && t.name !== "Bash")
+                        return false;
+                    return !(handsEnabled && isRemoteExecutionEnv(executionEnv));
+                }),
             memorySearchToolsPlanned,
             admissionCtx: {
                 orgMemoryDenied: complianceDenies.has("org_memory_mount"),
@@ -2572,6 +2600,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             toolsDeltaRef = { pending: [], pendingRemoved: [], pendingReadded: [], pendingFailed: failedMcpServers };
         }
         const listingRideRef = {};
+        {
+            const raw = process.env.SEMA_TOOL_MATERIALIZE_STRATEGY;
+            if (raw !== undefined && raw !== "swap" && raw !== "static" && deferred.size === 0) {
+                const line = `SEMA_TOOL_MATERIALIZE_STRATEGY=${JSON.stringify(raw)} is not "swap" or "static" — inert on this task (no deferred tools), but a deferring task WITHOUT an explicit spec strategy will refuse to prepare under it (an explicit legal spec outranks and discards it, loudly). Fix or unset the flag.`;
+                if (!announcedMaterializeEnv.has(line)) {
+                    announcedMaterializeEnv.add(line);
+                    console.warn(line);
+                }
+            }
+        }
         if (deferred.size > 0) {
             if (deferred.has(TOOL_SEARCH_NAME) || tools.some((t) => t.name === TOOL_SEARCH_NAME)) {
                 const e = new Error(`Tool name "${TOOL_SEARCH_NAME}" is reserved when deferred tools are present.`);
@@ -2579,12 +2617,21 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 throw e;
             }
             const registry = buildDeferredRegistry(deferred, tools);
-            const envStrategy = process.env.SEMA_TOOL_MATERIALIZE_STRATEGY;
-            if (envStrategy !== undefined && envStrategy !== "swap" && envStrategy !== "static") {
-                const e = new Error(`SEMA_TOOL_MATERIALIZE_STRATEGY must be "swap" or "static" (got ${JSON.stringify(envStrategy)}).`);
+            const rawEnvStrategy = process.env.SEMA_TOOL_MATERIALIZE_STRATEGY;
+            const envStrategyInvalid = rawEnvStrategy !== undefined && rawEnvStrategy !== "swap" && rawEnvStrategy !== "static";
+            if (envStrategyInvalid && spec.toolMaterializeStrategy === undefined) {
+                const e = new Error(`SEMA_TOOL_MATERIALIZE_STRATEGY must be "swap" or "static" (got ${JSON.stringify(rawEnvStrategy)}).`);
                 e.code = "config.tool_materialize_invalid";
                 throw e;
             }
+            if (envStrategyInvalid) {
+                const line = `SEMA_TOOL_MATERIALIZE_STRATEGY=${JSON.stringify(rawEnvStrategy)} was ignored — not "swap" or "static", and the task spec pins toolMaterializeStrategy=${JSON.stringify(spec.toolMaterializeStrategy)} which outranks it. Fix or unset the env flag.`;
+                if (!announcedMaterializeEnv.has(line)) {
+                    announcedMaterializeEnv.add(line);
+                    console.warn(line);
+                }
+            }
+            const envStrategy = envStrategyInvalid ? undefined : rawEnvStrategy;
             const requestedStrategy = spec.toolMaterializeStrategy ?? envStrategy ?? "swap";
             const laneDegrade = requestedStrategy === "static" && spec.deferSelfResolve === false;
             const materializeStatic = requestedStrategy === "static" && !laneDegrade;
@@ -3273,6 +3320,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq.toolName),
                     ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                    ...(re.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: re.persistedRuleShadowed } : {}),
                 }, onAskOf, csignal ?? abortController.signal);
                 if (rr.action !== "allow")
                     return rr;
@@ -3357,6 +3405,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...askSourceIdentity(),
                             ...riskAxesOf(creq.toolName),
                             ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                            ...(first.action === "ask" && first.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: first.persistedRuleShadowed } : {}),
                         }, pc.onAsk, csignal ?? abortController.signal);
                         const askWaitMs = Math.max(0, now() - askT0);
                         if (resolved.action === "deny" && resolved.approverUnavailable === true) {
@@ -3443,6 +3492,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...askSourceIdentity(),
                             ...riskAxesOf(creq.toolName),
                             ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                            ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
                         }, pc.onAsk, csignal ?? abortController.signal);
                         const askWaitMs = Math.max(0, now() - askT0);
                         if (resolved.action === "deny" && resolved.approverUnavailable === true) {
@@ -3755,6 +3805,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...askSourceIdentity(),
                     ...riskAxesOf(req.toolName),
                     ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                    ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
                 }, onAsk, abortController.signal);
                 const waitMs = Math.max(0, now() - t0);
                 if (resolved.approverUnavailable !== true) {
@@ -4236,7 +4287,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval) => {
+                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule) => {
                     const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
@@ -4341,6 +4392,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             toolName: req.toolName,
                             args: parkedArgs,
                             safety,
+                            ...(shadowedRule !== undefined ? { shadowedRule } : {}),
                             shellGated: (req.toolName === "Bash" && shellGatedBash) || (req.toolName === "Monitor" && shellGatedMonitor),
                             ...(effectiveShellGate !== "off" ? { shellGateDoctrine: effectiveShellGate } : {}),
                         });

package/dist/core/runner/runtask.js

@@ -1,6 +1,6 @@
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
+import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
 import { engineVersion } from "../version.js";
 import { CONFIG_CATALOG_VERSION, declarationReasons, resolveEffectiveConfig } from "../../config/catalog.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
@@ -71,6 +71,7 @@ const STOP_HOOK_BLOCK_CAP = 8;
 const COMPACTION_REGROWTH_FACTOR = 1.5;
 const COMPACTION_FREED_EPSILON = 256;
 const BATCH_RESPONSE_MAX_CHARS = 500;
+const ORG_DISCLOSURE_MAX_CHARS = 600;
 function batchResponseDigest(result) {
     const content = result !== null && typeof result === "object" ? result.content : result;
     if (content === undefined || content === null)
@@ -3702,7 +3703,7 @@ export class Runner {
             }
         }
         if (checkpointVersionOf(cp) > MAX_SUPPORTED_CHECKPOINT_VERSION) {
-            throw new CheckpointError("checkpoint.unsupported_version", `checkpoint version ${checkpointVersionOf(cp)} is newer than this worker supports (max ${MAX_SUPPORTED_CHECKPOINT_VERSION})`);
+            throw new CheckpointError("checkpoint.unsupported_version", `checkpoint version ${checkpointVersionOf(cp)} is newer than this worker supports (max ${MAX_SUPPORTED_CHECKPOINT_VERSION})`, { reason: "version_newer" });
         }
         const preCasGateBit = cp.gate.kind === "irreversible_ask" ? cp.gate.realApproval : undefined;
         const preCasBitWellFormed = preCasGateBit !== undefined &&
@@ -3713,11 +3714,11 @@ export class Runner {
         if (checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION ? !preCasBitWellFormed : preCasGateBit !== undefined) {
             throw new CheckpointError("checkpoint.invalid_outcome", checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION
                 ? `a v${checkpointVersionOf(cp)} checkpoint must carry a well-formed non-budgetable realApproval gate bit (origin org_rule/org_unavailable/policy) on an irreversible_ask gate — this row does not; refusing to resume a damaged real-approval row (corruption / downgrade guard), the checkpoint stays pending`
-                : `a v${checkpointVersionOf(cp)} checkpoint carries a realApproval gate bit no release of that version ever minted — refusing to honor a fabricated origin (corruption / forgery guard), the checkpoint stays pending`);
+                : `a v${checkpointVersionOf(cp)} checkpoint carries a realApproval gate bit no release of that version ever minted — refusing to honor a fabricated origin (corruption / forgery guard), the checkpoint stays pending`, { reason: checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION ? "real_approval_damaged" : "real_approval_forged" });
         }
         if ((preCasGateBit?.origin === "org_rule" || preCasGateBit?.origin === "org_unavailable") &&
             this.deps.permissionRuleOrg === undefined) {
-            throw new CheckpointError("checkpoint.unsupported_version", `this checkpoint's approval was minted under organization governance (${preCasGateBit.origin}) and this worker has no org adjudication wiring (permissionRuleOrg) — a governed approval may only be redeemed where governance can be enforced; the checkpoint stays pending, resume it on an org-wired worker`);
+            throw new CheckpointError("checkpoint.unsupported_version", `this checkpoint's approval was minted under organization governance (${preCasGateBit.origin}) and this worker has no org adjudication wiring (permissionRuleOrg) — a governed approval may only be redeemed where governance can be enforced; the checkpoint stays pending, resume it on an org-wired worker`, { reason: "governed_unwired" });
         }
         const retiredWalltimeTotal = cp.resourceLedger?.totalWalltimeSec;
         if (retiredWalltimeTotal !== undefined) {
@@ -3729,7 +3730,7 @@ export class Runner {
             throw new CheckpointError("checkpoint.resume_aborted", "the resume was handed an ALREADY-ABORTED signal — refusing to consume the approval on a leg that cannot run it (the checkpoint stays pending and is resumable with a live signal)");
         }
         if (cp.state.workspaceHandle !== undefined && this.deps.executionEnvFactory === undefined) {
-            throw new CheckpointError("checkpoint.unsupported_version", "checkpoint has a remote workspaceHandle but no RunnerDeps.executionEnvFactory is wired to rebuild the env");
+            throw new CheckpointError("checkpoint.unsupported_version", "checkpoint has a remote workspaceHandle but no RunnerDeps.executionEnvFactory is wired to rebuild the env", { reason: "env_factory_missing" });
         }
         if (cp.state.inheritedGate?.requiresParentConstraint === true) {
             const supplied = internals?.inheritedGate?.parentConstraints?.length ?? 0;
@@ -3745,6 +3746,10 @@ export class Runner {
                     "re-supply would run the resumed leg under a different ancestor chain than it suspended with; " +
                     "rejected pre-CAS (the checkpoint stays pending) — re-resume with the full original chain");
             }
+            if (checkpointVersionOf(cp) >= F012_CHECKPOINT_VERSION &&
+                (cp.state.inheritedGate.constraintChain === undefined || cp.state.inheritedGate.constraintDigest === undefined)) {
+                throw new CheckpointError("checkpoint.invalid_outcome", `a v${checkpointVersionOf(cp)} checkpoint that requires parent constraints must carry BOTH the frozen constraintChain and its constraintDigest (they are minted in one write with the version stamp) — this row carries neither or only one; refusing to fall back to the count-only contract on a damaged row (corruption / downgrade guard), the checkpoint stays pending`, { reason: "constraint_chain_missing" });
+            }
             const expectedDigest = cp.state.inheritedGate.constraintDigest;
             if (expectedDigest !== undefined) {
                 const persistedChain = cp.state.inheritedGate.constraintChain;
@@ -4037,16 +4042,28 @@ export class Runner {
             const orgVerdict = prepared.permissionRuleOrg
                 .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId })
                 .catch(() => ({ status: "unavailable", disclosures: ["the org adjudication face threw on resume"] }));
-            const org = await settleOrgVerdictWithin(orgVerdict, { status: "unavailable", disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`] }, { signal: prepared.abortController.signal, timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
+            let orgWaitCancelled = false;
+            const org = await settleOrgVerdictWithin(orgVerdict, { status: "unavailable", disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`] }, {
+                signal: prepared.abortController.signal,
+                timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS,
+                onFallback: (cause) => {
+                    orgWaitCancelled = cause === "aborted";
+                },
+            });
             const blocked = org.status === "unavailable"
                 ? gateRealApproval?.origin === "org_unavailable"
                     ? undefined
-                    : "this deployment is org-governed and cannot currently adjudicate against an organization policy snapshot"
+                    : orgWaitCancelled
+                        ? "this deployment is org-governed and the task was cancelled before the organization policy snapshot could be adjudicated"
+                        : "this deployment is org-governed and cannot currently adjudicate against an organization policy snapshot"
                 : org.verdict?.behavior === "deny"
                     ? `an organization policy rule (${org.verdict.rule}) denies it`
                     : undefined;
             if (blocked !== undefined) {
-                const orgDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${blocked}. This approval is spent — the call has to be re-issued and approved again once organization policy permits it.`);
+                const orgDisclosures = org.status === "unavailable" && org.disclosures.length > 0
+                    ? ` Governance disclosures: ${inlineUntrusted(org.disclosures.join("; "), ORG_DISCLOSURE_MAX_CHARS)}.`
+                    : "";
+                const orgDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${blocked}.${orgDisclosures} This approval is spent — the call has to be re-issued and approved again once organization policy permits it.`);
                 emitEnd(true, { content: orgDenial });
                 const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, orgDenial, true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);

package/dist/core/store-contracts/tool-result-store-contract.d.ts

@@ -12,5 +12,11 @@ import { type ContractAssertionRunner } from "./contract-harness.js";
  * with a narrower native key space owns an injective encoding, not a rejection). Before 2.1.0 the
  * bundled backends genuinely diverged on both halves (dev-green / deployment-red), so running this
  * kit against a pre-2.1.0-modeled backend is expected to go red on those two entries.
+ *
+ * Backlog #119 adds the provenance leg: `put`'s third argument and the `ownerOf` read face. `ownerOf`
+ * is typed OPTIONAL on the interface (source compatibility for a backend written against an older
+ * engine), but this kit REQUIRES it — a backend that cannot say who owns a ref cannot authorize a
+ * host-side read face, and an optional parameter one store honors while another drops it silently is
+ * exactly the divergence the two legs above exist to prevent.
  */
 export declare function toolResultStoreContract(make: () => ToolResultStore, runAssertion?: ContractAssertionRunner): Promise<void>;

package/dist/core/store-contracts/tool-result-store-contract.js

@@ -31,5 +31,29 @@ export async function toolResultStoreContract(make, runAssertion) {
         }
         assert.equal((await store.get("tr_sess_call:1")).content, "payload-tr_sess_call:1");
     });
+    run("#119 provenance: content+owner are one write; ownerOf answers; a different owner is a TYPED refusal; unowned rows stay unowned", async () => {
+        const store = make();
+        assert.equal(typeof store.ownerOf, "function", "a backend must implement ownerOf — a store that cannot say who owns a ref cannot back a host read face");
+        const ownerOf = (ref) => Promise.resolve(store.ownerOf(ref));
+        const ref = "tr_s1~c1";
+        await store.put(ref, "0123456789", { sessionId: "sess-A", taskId: "task-1" });
+        assert.deepEqual(await ownerOf(ref), { sessionId: "sess-A", taskId: "task-1" }, "the winning write's owner round-trips");
+        await store.put(ref, "IGNORED", { sessionId: "sess-A", taskId: "task-1" });
+        assert.equal((await store.get(ref)).content, "0123456789");
+        assert.deepEqual(await ownerOf(ref), { sessionId: "sess-A", taskId: "task-1" });
+        await store.put(ref, "IGNORED");
+        assert.deepEqual(await ownerOf(ref), { sessionId: "sess-A", taskId: "task-1" }, "an ownerless put must not clear the owner");
+        for (const other of [{ sessionId: "sess-B" }, { sessionId: "sess-A", taskId: "task-2" }]) {
+            await assert.rejects((async () => store.put(ref, "other tenant's bytes", other))(), (err) => err.code === "tool_result.ref_conflict", `put(${JSON.stringify(other)}) on an occupied ref must reject with code tool_result.ref_conflict`);
+        }
+        assert.equal((await store.get(ref)).content, "0123456789", "a refused put must not have overwritten anything");
+        const unowned = "tr_no_owner~c";
+        await store.put(unowned, "bytes from a write site that stated no owner");
+        assert.equal(await ownerOf(unowned), undefined, "a row stored without provenance is UNOWNED");
+        await store.put(unowned, "bytes from a write site that stated no owner", { sessionId: "sess-A" });
+        assert.equal(await ownerOf(unowned), undefined, "put must not back-fill an owner onto an unowned row");
+        assert.equal((await store.get(unowned)).content, "bytes from a write site that stated no owner");
+        assert.equal(await ownerOf("tr_never~written"), undefined);
+    });
     await settle();
 }

package/dist/core/task-registry-agent.js

@@ -6,7 +6,7 @@ import { shutdownDebug } from "./shutdown-debug.js";
 import { delimitUntrusted } from "./untrusted-text.js";
 import { boundedRedactedSummary } from "./untrusted-egress.js";
 import { mintCompletionId, commitCompletionIdIfEmpty, clipTaskOutput, assertOwnership, sleepPollStep, alreadyTerminalStopNote, canAccess, normalizeAgentName, closestName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR, } from "./task-registry-shared.js";
-import { buildToolResultRef, OFFLOAD_TOOL_NAME } from "./tool-result-store.js";
+import { buildToolResultRef, OFFLOAD_TOOL_NAME, toolResultProvenanceOf } from "./tool-result-store.js";
 export function ensureDurableHeartbeatLane(core) {
     if (core.durableHeartbeatTimer !== undefined)
         return;
@@ -1232,8 +1232,8 @@ export async function spillClippedAgentResult(handle, full, clipped, store, sess
     if (store === undefined)
         return clipped;
     if (handle.spillRef === undefined) {
-        const ref = buildToolResultRef(sessionId ?? "no-session", `${handle.id}_c${handle.reviveCycle ?? 0}`);
-        await store.put(ref, full);
+        const ref = buildToolResultRef(sessionId ?? "no-session", handle.id, `c${handle.reviveCycle ?? 0}`);
+        await store.put(ref, full, sessionId === undefined ? undefined : toolResultProvenanceOf(sessionId, handle.id));
         handle.spillRef = ref;
     }
     return `${clipped}\n\n[full output persisted — call ${OFFLOAD_TOOL_NAME} with ref "${handle.spillRef}" to read it back.]`;

package/dist/core/task-registry-monitor.js

@@ -1,6 +1,6 @@
 import { delimitUntrusted } from "./untrusted-text.js";
 import { assertOwnership, defaultMonitorTimers, MONITOR_MAX_TIMEOUT_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_BATCH_WINDOW_MS, MONITOR_MAX_BATCHES_PER_MINUTE, MONITOR_STORM_BURST, MONITOR_STORM_KILL_AFTER_MS, MONITOR_LINE_BUF_CAP, MONITOR_SPILL_CAP_CHARS, TASK_OUTPUT_MAX_CHARS, mintCompletionId, clipMonitorEvent, clipMonitorLine, terminalTaskSummary, accountDroppedBytes, renderSpoolBody, rollSpoolText, statusFromBackground, droppedGapNote, firstDropNote, alreadyTerminalStopNote, clipTaskOutput, sleepPollStep, } from "./task-registry-shared.js";
-import { buildToolResultRef, OFFLOAD_TOOL_NAME } from "./tool-result-store.js";
+import { buildToolResultRef, OFFLOAD_TOOL_NAME, toolResultProvenanceOf } from "./tool-result-store.js";
 export function registerMonitorLane(core, input) {
     assertOwnership(input, "registerMonitor");
     const id = core.mintTaskId("monitor");
@@ -61,14 +61,15 @@ function spillRolledMonitorChunk(handle, stream, dropped) {
         return;
     }
     const n = stream === "out" ? (handle.spillSegCount ?? 0) : (handle.spillErrSegCount ?? 0);
-    const ref = buildToolResultRef(handle.spillSessionId ?? "no-session", `${handle.id}_${stream}_seg${n}`);
+    const ref = buildToolResultRef(handle.spillSessionId ?? "no-session", handle.id, `${stream}_seg${n}`);
     handle.spillCharsUsed = used + dropped.length;
     if (stream === "out")
         handle.spillSegCount = n + 1;
     else
         handle.spillErrSegCount = n + 1;
     try {
-        void Promise.resolve(store.put(ref, dropped)).catch(() => {
+        const provenance = handle.spillSessionId === undefined ? undefined : toolResultProvenanceOf(handle.spillSessionId, handle.id);
+        void Promise.resolve(store.put(ref, dropped, provenance)).catch(() => {
             handle.spillFailed = true;
         });
     }
@@ -83,8 +84,8 @@ function monitorSpillNote(handle) {
         return "";
     const sid = handle.spillSessionId ?? "no-session";
     const segLabel = (stream, n) => {
-        const first = buildToolResultRef(sid, `${handle.id}_${stream}_seg0`);
-        return n <= 1 ? `ref "${first}"` : `refs "${first}" .. "${buildToolResultRef(sid, `${handle.id}_${stream}_seg${n - 1}`)}"`;
+        const first = buildToolResultRef(sid, handle.id, `${stream}_seg0`);
+        return n <= 1 ? `ref "${first}"` : `refs "${first}" .. "${buildToolResultRef(sid, handle.id, `${stream}_seg${n - 1}`)}"`;
     };
     const clauses = [];
     if (outN > 0)

package/dist/core/tool-policy.d.ts

@@ -167,6 +167,13 @@ export type PermissionResult = {
     message?: string;
     decisionReason?: DecisionReason;
     requiresRealApproval?: boolean;
+    /** #144 disclosure (additive): a persisted allow rule MATCHED this call but could not clear the
+     *  ask, because the ask is MANDATED (operator shellGate:"always", or the tool's own
+     *  egress/irreversibility marks) rather than a classifier's hesitation — "allow rules silence
+     *  the classifier's questions, never a mandated one". Carries the matched rule text so a
+     *  consumer (approval card, wire frame) can tell the person their rule is alive, just outranked.
+     *  Absent ⇒ no rule matched, or the ask was cleared normally. */
+    persistedRuleShadowed?: string;
 } | {
     action: "deny";
     updatedInput?: unknown;
@@ -601,6 +608,10 @@ export interface AskDelegationProvenance {
 /** The structured context an `onAsk` approver receives for an `ask` decision (design/37). */
 export interface AskRequest {
     toolName: string;
+    /** #144: a persisted allow rule MATCHED this call but could not clear the ask (mandated — see
+     *  {@link PermissionResult}'s ask arm). The matched rule text, so the approval card renders "your
+     *  rule is alive, just outranked" instead of leaving the person to regex the message prose. */
+    persistedRuleShadowed?: string;
     toolCallId: string;
     /** The (post-rewrite) args the tool would run with. */
     args: unknown;

package/dist/core/tool-result-budget.d.ts

@@ -10,7 +10,7 @@ import { type ToolResultStore } from "./tool-result-store.js";
  * **Simpler than CC by construction (§24.2):** a request-only, non-destructive transform (returns a new
  * array; the durable session keeps full results) applied in the existing `harness.on("context")` hook —
  * the same per-query point as `clearStaleToolResults` (the mirror of CC's query.ts:379). It is DETERMINISTIC
- * (stable `ref = tr_<sessionId>_<toolCallId>` + deterministic {@link buildPreview}), so re-running it every
+ * (stable `ref = tr_<sessionId>~<toolCallId>` + deterministic {@link buildPreview}), so re-running it every
  * query yields byte-identical previews → prompt-cache safe **without** CC's ContentReplacementState freeze
  * machine (the determinism IS the freeze), and resume-free (the transcript holds originals; this re-applies
  * on replay). Reuses design/30's offload store + preview format; with no store it falls back to a

package/dist/core/tool-result-budget.js

@@ -1,5 +1,5 @@
 import { isToolResult } from "./message-utils.js";
-import { buildPreview, buildToolResultRef, OFFLOAD_TOOL_NAME, PERSISTED_OUTPUT_PREFIX } from "./tool-result-store.js";
+import { buildPreview, buildToolResultRef, OFFLOAD_TOOL_NAME, PERSISTED_OUTPUT_PREFIX, toolResultContentSegment, toolResultProvenanceOf, } from "./tool-result-store.js";
 export const AGGREGATE_TOOL_RESULT_BUDGET_CHARS = 200_000;
 const HEAD = 1_000;
 const TAIL = 1_000;
@@ -61,13 +61,13 @@ export async function capAggregateToolResults(messages, opts) {
             const previewOne = async (k, before, head, tail, fromOriginal) => {
                 const m = out[k];
                 const full = textOf((fromOriginal ? messages[k] : m).content);
-                const ref = buildToolResultRef(opts.sessionId, m.toolCallId ?? `idx${k}`);
+                const ref = buildToolResultRef(opts.sessionId, m.toolCallId ?? `idx${k}`, toolResultContentSegment(full));
                 const sizes = head === HEAD && tail === TAIL ? undefined : { head, tail };
                 let previewText;
                 let storeFallback;
                 if (opts.store) {
                     try {
-                        await opts.store.put(ref, full);
+                        await opts.store.put(ref, full, toolResultProvenanceOf(opts.sessionId));
                         previewText = buildPreview(full, ref, sizes);
                         storeFallback = false;
                     }