@sema-agent/core 5.27.0 → 5.29.0

package/dist/core/memory.d.ts

@@ -194,7 +194,7 @@ export interface StructuredNoteInput {
 export interface MemoryNoteHeader {
     /** Store contract: ids must be SINGLE-LINE whitespace-free tokens (uuid-like). The manifest renders
      *  `- {id}: …` lines and the side-query matches selected ids by string equality — an id containing
-     *  a newline could forge manifest lines, and a renderer-side rewrite would break the equality match,
+     *  a newline could self-declare manifest lines, and a renderer-side rewrite would break the equality match,
      *  so the contract sits on the store (search 1.95.1 review #2). */
     id: string;
     /** A one-line summary used as the relevance signal (derived from the note's first sentence when untyped). */
@@ -306,7 +306,7 @@ export declare function enforceSecretWriteGate(body: string): void;
  * (rendered as `[[name]]` cross-references) and `description` (rendered into the recall manifest + injected
  * into the side-query sub-prompt) are ALSO persisted and surfaced, so a secret hidden there
  * (`appendStructured({ body: "safe", description: "sk_live_…" })`) would otherwise be durably stored and
- * leaked into every later same-scope manifest — a real bypass of the body-only scan. `links` slugs are NOT
+ * leaked into every later same-scope manifest — a real circumvention of the body-only scan. `links` slugs are NOT
  * scanned: they are short `[[name]]`-style reference tokens (no credential body shape clears the
  * conservative detector), and scanning them adds FP surface for no realistic gain. Fail-closed: the first
  * field that carries a high-confidence credential throws {@link MemoryGateError}`("memory.secret_detected")`.

package/dist/core/oracle-isolation.d.ts

@@ -46,7 +46,7 @@ export interface OracleIsolationVerdict {
 export interface GraderEnv {
     /** The isolated env the oracle grades in (service-provisioned; a {@link import("./remote-env.js").RemoteExecutionEnv} in production). */
     env: ExecutionEnv;
-    /** Paths the oracle must be protected behind — probed for writability through the WORKER's bash bypass surface. */
+    /** Paths the oracle must be protected behind — probed for writability through the WORKER's bash circumvention surface. */
     immutableOraclePaths: string[];
     /** Provenance brand — ONLY the control-plane factory sets this. Never derived from worker state. */
     provenance: "control_plane";
@@ -72,7 +72,7 @@ export interface AssertOracleIsolationOptions {
  * `candidate_only`); the class is what gates auto-accept (the 2-of-3 asymmetry).
  *
  * **(C) BASH WRITE-PROBE (necessary-not-sufficient, cheap early signal)** — for each `immutableOraclePath`, run
- * a write probe through the WORKER env's `exec` (the bash bypass surface — see {@link probeCommand}), against
+ * a write probe through the WORKER env's `exec` (the bash circumvention surface — see {@link probeCommand}), against
  * the path canonicalized via {@link canonicalizeTarget}. The probe PASSES only if the write returns a non-zero
  * exit code or an exec error (read-only mount / permission denied / not supported). Any SUCCESS (RC 0) ⇒ the
  * oracle dir is writable from the worker ⇒ `protected:false`. A probe THROW / abort / timeout ⇒ fail-closed

package/dist/core/permission-rule-consent.d.ts

@@ -23,11 +23,11 @@
  * ## The boundary this does NOT claim
  *
  * The confirmation transfer is an in-process call. A deployment must reach it only from its authenticated
- * approval channel, and a deployment that shares filesystem credentials with the user can bypass all of
+ * approval channel, and a deployment that shares filesystem credentials with the user can circumvent all of
  * this by editing a file backend's file. That is the settings-file trust model, stated rather than
  * defended against: for a file backend, host = user, no more and no less.
  */
-import { type RuleScope, type RuleDot } from "./permission-rule-model.js";
+import { type RuleRejectCode, type RuleScope, type RuleDot } from "./permission-rule-model.js";
 import type { PermissionRuleStoreProvider, RuleOwner } from "./permission-rule-store.js";
 /** One candidate rule inside an approval record: the exact text and where it would apply. */
 export interface RuleCandidate {
@@ -52,9 +52,19 @@ export interface RuleApprovalRecord {
     state: "pending" | "approved" | "redeemed";
     candidates: RuleCandidate[];
     createdAt: string;
-    /** The ask this record was drawn from, for reconciliation. Advisory metadata; never adjudication input. */
+    /** The ask this record was drawn from, for reconciliation. Advisory metadata; never adjudication input.
+     *  `boundInputHash` is ALSO the card-edit binding anchor: an edited-candidate confirmation must echo
+     *  it back, so a record minted without one refuses edits (there is nothing to bind the edit to). */
     toolCallId?: string;
     boundInputHash?: string;
+    /**
+     * The adjudicated command a CARD record was drawn for — the same post-rewrite bytes the ask carried
+     * (the form `boundInputHash` digests). Additive: absent on batch records and on every card a prior
+     * version minted. It is the edit gate's coverage input ("the edited rule must still admit THIS
+     * command"), so a record without one refuses edited candidates rather than guessing; the engine-
+     * candidate paths never read it.
+     */
+    command?: string;
     /** Monotonic revision of THIS record, bumped by every accepted transition. The compare-and-set key:
      *  comparing state alone cannot separate two different writes that both leave the state unchanged. */
     rev: number;
@@ -68,6 +78,20 @@ export interface RuleApprovalRecord {
      * previewed list by construction.
      */
     selectedCandidate?: number;
+    /**
+     * The person-EDITED candidate this record carries, if any — full provenance for the one candidate
+     * whose text was authored at the card rather than derived by the engine. `index` names the appended
+     * row in `candidates` (whose `rule` holds the CANONICAL spelling); `text` keeps the raw input bytes
+     * exactly as submitted (the idempotency primary key — a client retrying a lost response resends the
+     * same bytes); `at` is when the edit landed. Present ⇒ `selectedCandidate === index` (the edit and
+     * the choice are one CAS write). Absent on every record a prior version minted and on every card
+     * settled through an engine candidate.
+     */
+    edited?: {
+        index: number;
+        text: string;
+        at: string;
+    };
     /** Dots already minted for this record, keyed by candidate index — the replay anchor. */
     redeemedDots?: Record<number, RuleDot>;
 }
@@ -95,6 +119,16 @@ export interface RuleConsentDeps {
     /** Injectable clock/id for deterministic tests; defaults are the real ones. */
     now?: () => Date;
     newId?: () => string;
+    /**
+     * Deployment lever for the card-edit face: whether `confirmRuleApproval` accepts a FRESH
+     * `editedCandidate`. Absent or `false` = OFF (the default — the edit face widens what a fabricated
+     * confirmation could mint, from "one of the engine's bounded candidates" to "any same-head rule
+     * passing the coverage gate", so it is opt-in). Any other non-boolean value is a configuration
+     * mistake and refuses LOUDLY at the read — never silently mapped to a default. Replaying an edit a
+     * record already settled is a pure record read and does not consult this switch: the minting already
+     * happened, and withholding the receipt helps no one.
+     */
+    cardEdits?: boolean;
 }
 /** In-memory approval records — the test backend and the reference CAS semantics. */
 export declare class InMemoryRuleApprovalRecordStore implements RuleApprovalRecordStore {
@@ -157,21 +191,61 @@ export declare function confirmRuleApproval(opts: {
     /** design/182 §4.5 (additive): the structural owner — only the local-owner path needs it. */
     owner?: RuleOwner;
     /**
-     * REQUIRED for a card record: the index of the option the person chose. A card presents alternatives of
-     * different breadth, so "they said yes" is not an answer on its own — "they said yes to THIS one" is.
-     * Rejected on a batch record, whose confirmation covers the previewed list by construction.
+     * REQUIRED for a card record settled through an ENGINE candidate: the index of the option the person
+     * chose. A card presents alternatives of different breadth, so "they said yes" is not an answer on
+     * its own — "they said yes to THIS one" is. Rejected on a batch record, whose confirmation covers
+     * the previewed list by construction. Mutually exclusive with `editedCandidate`.
      */
     selectedCandidate?: number;
+    /**
+     * The person-EDITED rule text for this card, travelling on the SAME authenticated confirmation
+     * channel as a choice among the engine's candidates (never the un-authenticated prepare entry, which
+     * keeps refusing caller candidates). `text` is the rule as authored; `boundInputHash` must echo the
+     * record's own bound-input digest — the submitter's proof of "I am editing the card that showed THIS
+     * command", an in-process mis-binding fence (a caller holding only a leaked approvalId cannot spell
+     * it), not a cryptographic one. The engine validates the text through the one shared validator,
+     * requires it to still ADMIT the adjudicated command, appends it as a new candidate and binds the
+     * selection to it, returning the minted ticket. Mutually exclusive with `selectedCandidate`.
+     */
+    editedCandidate?: {
+        text: string;
+        boundInputHash: string;
+    };
     deps: RuleConsentDeps;
 }): Promise<ConfirmResult>;
-/** Why a confirmation did not land. A closed set so a host can branch (re-present, re-fetch, give up). */
-export type ConfirmRefusalReason = "record_not_found" | "selection_missing" | "selection_invalid" | "selection_mismatch" | "batch_takes_no_selection" | "not_pending" | "conflict";
-/** The confirmation outcome: landed, or refused with a named reason. */
+/** Why a confirmation did not land. A closed set so a host can branch (re-present, re-fetch, give up).
+ *  The three `edit_*` members are the card-edit face's own refusals:
+ *   - `"edit_disabled"` — the deployment has not opted into card edits (`RuleConsentDeps.cardEdits`);
+ *   - `"edit_binding_mismatch"` — the confirmation does not echo the record's bound-input digest
+ *     (missing echo, a record minted without one, or a different card). Refused BEFORE anything else,
+ *     settled replays included, and never returns a minted ticket;
+ *   - `"edit_rejected"` — the edited text failed a gate (validator refusal, coverage, record shape);
+ *     `detail` carries the specifics. */
+export type ConfirmRefusalReason = "record_not_found" | "selection_missing" | "selection_invalid" | "selection_mismatch" | "batch_takes_no_selection" | "not_pending" | "conflict" | "edit_disabled" | "edit_binding_mismatch" | "edit_rejected";
+/** The confirmation outcome: landed, or refused with a named reason.
+ *
+ *  `mintedCandidate` (additive) is present exactly when an EDITED candidate settled this confirmation —
+ *  fresh mint and idempotent replay alike (a client retrying a lost response gets the same index, the
+ *  same canonical rule text and the same deterministically re-minted ticket, never a push toward a
+ *  second card). `rule` is the CANONICAL spelling, which may differ from the submitted bytes (spelling
+ *  normalization); a surface echoes it back so the person sees the form that will actually persist.
+ *
+ *  `detail` (additive, refusal arm) rides `edit_rejected`: `code` is the shared validator's refusal
+ *  code when the validator is what refused, absent when another gate did; `message` always says why. */
 export type ConfirmResult = {
     ok: true;
+    mintedCandidate?: {
+        index: number;
+        rule: string;
+        ticket: RuleTicket;
+    };
 } | {
     ok: false;
     reason: ConfirmRefusalReason;
+    detail?: {
+        code?: RuleRejectCode;
+        message: string;
+    };
 };
 /** What a redemption produced. `alreadyRedeemed` marks the replay path — the same dot, no second rule. */
 export type RedeemResult = {

package/dist/core/permission-rule-consent.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { parseAllowRuleText, suggestRulesForCommand } from "./permission-rule-model.js";
+import { parseAllowRuleText, ruleAdmitsCommand, suggestRulesForCommand } from "./permission-rule-model.js";
 import { errText, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
     rows = new Map();
@@ -109,6 +109,7 @@ export async function prepareCardApproval(opts) {
         state: "pending",
         rev: 0,
         candidates,
+        command: opts.command,
         createdAt: nowIso(opts.deps),
         ...(opts.toolCallId !== undefined ? { toolCallId: opts.toolCallId } : {}),
         ...(opts.boundInputHash !== undefined ? { boundInputHash: opts.boundInputHash } : {}),
@@ -120,10 +121,17 @@ const CARD_RULE_TOOL = "Bash";
 export async function confirmRuleApproval(opts) {
     const caller = resolveCallerOwner(opts.principal, opts.owner, "confirmRuleApproval");
     const no = (reason) => ({ ok: false, reason });
+    if (opts.editedCandidate !== undefined && opts.selectedCandidate !== undefined) {
+        const e = new Error("confirmRuleApproval takes selectedCandidate OR editedCandidate, never both — one confirmation carries one choice");
+        e.code = "config.invalid_argument";
+        throw e;
+    }
     const rec = await opts.deps.approvals.get(opts.approvalId);
     const recOwner = rec === undefined ? undefined : ownerOfRecord(rec);
     if (rec === undefined || recOwner === undefined || !sameRuleOwner(recOwner, caller))
         return no("record_not_found");
+    if (opts.editedCandidate !== undefined)
+        return await confirmEditedCandidate(rec, opts.editedCandidate, opts.deps);
     if (rec.kind === "card") {
         const chosen = opts.selectedCandidate;
         if (chosen === undefined)
@@ -145,6 +153,89 @@ export async function confirmRuleApproval(opts) {
     const won = await opts.deps.approvals.cas(rec.id, rec.rev, { ...rec, rev: rec.rev + 1, state: "approved" });
     return won ? { ok: true } : no("conflict");
 }
+function normalizeEditedSpelling(text) {
+    const m = /^([A-Za-z][A-Za-z0-9_]*)\((.+) \*\)$/.exec(text);
+    if (m === null)
+        return text;
+    const head = m[1];
+    const body = m[2];
+    if (head === undefined || body === undefined || body.includes("*"))
+        return text;
+    return `${head}(${body}:*)`;
+}
+async function confirmEditedCandidate(rec, edit, deps) {
+    const no = (reason, detail) => ({
+        ok: false,
+        reason,
+        ...(detail !== undefined ? { detail } : {}),
+    });
+    if (rec.kind !== "card") {
+        return no("edit_rejected", { message: "a batch record takes no edited candidate — its confirmation covers the previewed list whole" });
+    }
+    if (typeof edit.boundInputHash !== "string" || edit.boundInputHash === "")
+        return no("edit_binding_mismatch");
+    if (rec.boundInputHash === undefined) {
+        return no("edit_binding_mismatch");
+    }
+    if (edit.boundInputHash !== rec.boundInputHash)
+        return no("edit_binding_mismatch");
+    if (rec.state === "approved" || rec.state === "redeemed") {
+        if (rec.edited === undefined)
+            return no("selection_mismatch");
+        const canonical = rec.candidates[rec.edited.index]?.rule;
+        if (canonical === undefined)
+            return no("selection_mismatch");
+        let hit = edit.text === rec.edited.text;
+        if (!hit) {
+            const reparsed = parseAllowRuleText(normalizeEditedSpelling(edit.text));
+            hit = "rule" in reparsed && reparsed.rule.rule === canonical;
+        }
+        if (!hit)
+            return no("selection_mismatch");
+        return { ok: true, mintedCandidate: { index: rec.edited.index, rule: canonical, ticket: mintRuleTicket(rec.id, rec.edited.index) } };
+    }
+    if (rec.state !== "pending")
+        return no("not_pending");
+    if (deps.cardEdits !== undefined && typeof deps.cardEdits !== "boolean") {
+        throw new Error(`RuleConsentDeps.cardEdits must be a boolean when present (got ${typeof deps.cardEdits}) — refusing to guess whether the card-edit face is enabled`);
+    }
+    if (deps.cardEdits !== true)
+        return no("edit_disabled");
+    const scope = rec.candidates[0]?.scope;
+    if (scope === undefined || !rec.candidates.every((c) => sameScope(c.scope, scope))) {
+        return no("edit_rejected", { message: "the record's candidates carry no single common scope — an edited candidate inherits the card's scope, and a record without one is malformed" });
+    }
+    if (rec.command === undefined) {
+        return no("edit_rejected", { message: "the record does not carry the adjudicated command (minted before card edits existed) — coverage cannot be verified, so the edit is refused" });
+    }
+    const parsed = parseAllowRuleText(normalizeEditedSpelling(edit.text));
+    if ("reject" in parsed)
+        return no("edit_rejected", { code: parsed.reject.code, message: parsed.reject.message });
+    if (!ruleAdmitsCommand(parsed.rule, rec.command)) {
+        return no("edit_rejected", {
+            message: `the edited rule "${parsed.rule.rule}" does not admit the command that was decided ("${rec.command}") — a card's edit may widen how much the rule covers, never move it to a different grant`,
+        });
+    }
+    const index = rec.candidates.length;
+    const next = {
+        ...rec,
+        rev: rec.rev + 1,
+        state: "approved",
+        candidates: [...rec.candidates, { rule: parsed.rule.rule, scope }],
+        selectedCandidate: index,
+        edited: { index, text: edit.text, at: nowIso(deps) },
+    };
+    const won = await deps.approvals.cas(rec.id, rec.rev, next);
+    if (!won) {
+        const again = await deps.approvals.get(rec.id);
+        if (again === undefined)
+            return no("record_not_found");
+        if (again.state === "pending")
+            return no("conflict");
+        return await confirmEditedCandidate(again, edit, deps);
+    }
+    return { ok: true, mintedCandidate: { index, rule: parsed.rule.rule, ticket: mintRuleTicket(rec.id, index) } };
+}
 export async function redeemRuleTicket(opts) {
     const caller = resolveCallerOwner(opts.principal, opts.owner, "redeemRuleTicket");
     const parsed = parseRuleTicket(opts.ticket);

package/dist/core/permission-rule-model.d.ts

@@ -18,7 +18,7 @@
  *
  * The floor is `parseLeadingCommandName` — the one simple-command parser already shared by the
  * read-only classifier, the reversibility probe, the coarse command-name policy and the skill tool
- * specifier. A second tokenizer would drift, and drift on a loosening face shows up as a bypass rather
+ * specifier. A second tokenizer would drift, and drift on a loosening face shows up as a circumvention rather
  * than as a test failure.
  *
  * ## Normalization order is load-bearing
@@ -94,7 +94,7 @@ export interface RuleTombstone {
     deletedBy: RuleDot;
 }
 /** Why a rule text was refused. Codes are stable so an import report can group by them. */
-export type RuleRejectCode = "invalid.grammar" | "invalid.empty_command" | "invalid.not_simple_command" | "invalid.bare_interpreter_prefix" | "invalid.unbalanced_quotes" | "invalid.too_long" | "unsupported.tool" | "unsupported.wildcard";
+export type RuleRejectCode = "invalid.grammar" | "invalid.empty_command" | "invalid.not_simple_command" | "invalid.bare_interpreter_prefix" | "invalid.unbalanced_quotes" | "invalid.control_chars" | "invalid.too_long" | "unsupported.tool" | "unsupported.wildcard";
 export interface RuleReject {
     code: RuleRejectCode;
     message: string;
@@ -167,6 +167,22 @@ export declare const BARE_INTERPRETER_NAMES: ReadonlySet<string>;
  * loosening; the other against a person being misled.
  */
 export declare const SUGGESTION_LEXICON: readonly string[];
+/**
+ * Render a peer- or file-controlled value for a DISCLOSURE line (a warning, a refusal message, an
+ * operator log). Takes `unknown` on purpose: most of these values are typed but arrive off a wire or a
+ * file, so the runtime value can be anything, and a signature that demanded a string would push a bare
+ * `String(x)` to every call site — the exact step that gets forgotten. Rule texts are the motivating case; the same treatment is owed to every untrusted
+ * field a line interpolates (a wire `reason`, an actor id), since the hazard is the character class,
+ * not which field carries it.
+ *
+ * Quoting a refused text verbatim would carry the exact sequence the refusal exists to keep off a
+ * display surface, and would print the two texts a reader has to tell apart — `Bash(echo hi)` and
+ * `Bash(echo<ZWSP>hi)` — identically, so the report could not name WHICH rule it means. Every character
+ * {@link CONTROL_CHARS_RE} covers is therefore printed as its `\uXXXX` escape (`\u{XXXXX}` above the
+ * BMP — the TAG block U+E0020–U+E007F is a `\p{Cf}` family that lives there); everything else passes
+ * through, so an ordinary rule text reads normally. The result is length-bounded.
+ */
+export declare function escapeForDisclosure(value: unknown): string;
 /**
  * Parse one rule text into its canonical shape, or refuse it with a reason.
  *

package/dist/core/permission-rule-model.js

@@ -91,10 +91,31 @@ function foldSpacing(s) {
 function reject(code, message) {
     return { reject: { code, message } };
 }
+const CONTROL_CHARS_RE = /[\u0000-\u0008\u000A-\u001F\u007F-\u009F\p{Cf}\u2028\u2029]/u;
+const CONTROL_CHARS_GLOBAL_RE = new RegExp(CONTROL_CHARS_RE.source, "gu");
+const DISCLOSED_RULE_TEXT_MAX_CHARS = 120;
+export function escapeForDisclosure(value) {
+    let text;
+    try {
+        text = typeof value === "string" ? value : String(value);
+    }
+    catch {
+        return "<unprintable>";
+    }
+    const escaped = text.replace(CONTROL_CHARS_GLOBAL_RE, (ch) => {
+        const cp = ch.codePointAt(0) ?? 0;
+        const hex = cp.toString(16).toUpperCase();
+        return cp > 0xffff ? `\\u{${hex}}` : `\\u${hex.padStart(4, "0")}`;
+    });
+    return escaped.length <= DISCLOSED_RULE_TEXT_MAX_CHARS ? escaped : `${escaped.slice(0, DISCLOSED_RULE_TEXT_MAX_CHARS)}…`;
+}
 export function parseAllowRuleText(text, opts) {
     if (text.length > MAX_RULE_TEXT_CHARS) {
         return reject("invalid.too_long", `rule text exceeds ${MAX_RULE_TEXT_CHARS} characters`);
     }
+    if (CONTROL_CHARS_RE.test(text)) {
+        return reject("invalid.control_chars", "rule text contains control characters (C0/C1, tab excepted), which cannot be part of a readable command");
+    }
     const parsed = parsePermissionRule(text);
     if (parsed.ruleContent === undefined) {
         return reject("invalid.grammar", `"${text}" is not a Tool(content) rule — a bare tool name claims the whole tool and is not a command rule`);

package/dist/core/permission-rule-org.d.ts

@@ -34,7 +34,7 @@
  * accept revision N−1 after a restart. Signature / predecessor chaining belongs to the privilege-
  * separation ticket; the high-water mark is the floor that needs no key distribution.
  */
-import { type RuleScope } from "./permission-rule-model.js";
+import { type RuleRejectCode, type RuleScope } from "./permission-rule-model.js";
 import { type PermissionRuleStore, type PermissionRuleStoreProvider, type RuleOwner } from "./permission-rule-store.js";
 /** One org rule. There is structurally no allow bucket (design/179 §9: the org layer only tightens). */
 export interface OrgPermissionRule {
@@ -160,13 +160,32 @@ export declare function createOrgRuleOverlay(cfg: {
     stalenessBoundMs: number;
     now?: () => number;
 }): OrgRuleOverlay;
+/**
+ * Which entries of an org snapshot the CURRENT rule validator refuses — the published deny/ask rules
+ * that can match nothing on this build. Empty ⟺ every rule is enforceable.
+ *
+ * Separate from {@link validateOrgSnapshot} because BOTH gates need it: the install gate (a fetched
+ * snapshot) and the serving gate (backlog #177 — a snapshot persisted by an earlier build is read back
+ * and served without ever having met this validator). It reports every offender rather than the first,
+ * since a refusal an administrator cannot act on names no line to fix.
+ */
+export declare function unenforceableOrgRules(rules: readonly OrgPermissionRule[]): Array<{
+    rule: string;
+    code: RuleRejectCode;
+}>;
 /**
  * design/182 §7.2 — which org rule speaks for this command, if any. Deny outranks ask; within a
  * behavior the first textual match wins (reporting order only — all denies are the same one answer).
  * Matching uses the SAME parser and matcher the personal lane uses (tighten direction: an
  * interpreter-headed prefix deny like `Bash(node:*)` is a legitimately wide tightening and matches).
- * A rule text the validator refuses never gets here — snapshot validation refuses the whole snapshot,
- * so an unenforceable deny cannot install as policy; the skip below is a defensive floor only.
+ *
+ * The skip below is a defensive floor, and what stands behind it is worth stating precisely: rules that
+ * arrive from {@link OrgRuleOverlay.resolve} have passed {@link validateOrgSnapshot} on BOTH the install
+ * and the serving path (backlog #177), so an unenforceable entry cannot reach here through the overlay
+ * — the whole snapshot is refused, or the resolution reports `unavailable`, and either way it is
+ * disclosed. A caller that hands this function a snapshot it obtained ELSEWHERE gets no such guarantee:
+ * the skip is silent, and naming the dead entries is that caller's job — {@link unenforceableOrgRules}
+ * is the shared way to do it.
  */
 export declare function orgRuleVerdictFor(rules: readonly OrgPermissionRule[], call: {
     tool: string;
@@ -184,7 +203,7 @@ export interface EffectivePermissionRule {
 /**
  * design/182 §7.3 — the introspection face: every personal rule with its effective status under the org
  * overlay. An org deny does not delete a personal rule — the personal rule is the user's approval
- * record, and the org's power is to OVERRIDE it, not to forge its removal — so a shadowed rule reports
+ * record, and the org's power is to OVERRIDE it, not to self-declare its removal — so a shadowed rule reports
  * `shadowed-by-org` and comes back by itself when the org deny is withdrawn. A rule whose every add is
  * tombstoned reports `removed` (its tombstone identity is still visible in the store).
  *

package/dist/core/permission-rule-org.js

@@ -1,4 +1,4 @@
-import { parseAllowRuleText, ruleAdmitsCommand } from "./permission-rule-model.js";
+import { escapeForDisclosure, parseAllowRuleText, ruleAdmitsCommand } from "./permission-rule-model.js";
 import { sameScope, writerOf } from "./permission-rule-store.js";
 export function orgRuleStatePersistenceOf(store) {
     const s = store;
@@ -46,7 +46,7 @@ export function createOrgRuleOverlay(cfg) {
         throw new Error("org-governed is declared but no OrgRuleSnapshotProvider is wired — a governed deployment without an org source is a configuration contradiction; refusing to boot rather than running silently ungoverned");
     }
     if (typeof cfg.stalenessBoundMs !== "number" || !Number.isFinite(cfg.stalenessBoundMs) || cfg.stalenessBoundMs <= 0) {
-        throw new Error(`org stalenessBoundMs must be a finite positive number of milliseconds (got ${String(cfg.stalenessBoundMs)})`);
+        throw new Error(`org stalenessBoundMs must be a finite positive number of milliseconds (got ${escapeForDisclosure(cfg.stalenessBoundMs)})`);
     }
     const provider = cfg.provider;
     const now = cfg.now ?? Date.now;
@@ -75,11 +75,11 @@ export function createOrgRuleOverlay(cfg) {
         let fetched;
         let fetchFailed = false;
         try {
-            fetched = await provider.current();
+            fetched = structuredClone(await provider.current());
         }
         catch (err) {
             fetchFailed = true;
-            disclosures.push(`org snapshot provider failed: ${err instanceof Error ? err.message : String(err)}`);
+            disclosures.push(`org snapshot provider failed: ${escapeForDisclosure(err instanceof Error ? err.message : err)}`);
         }
         return await serialize(async () => {
             const nowMs = now();
@@ -88,7 +88,7 @@ export function createOrgRuleOverlay(cfg) {
                     return await readState();
                 }
                 catch (err) {
-                    disclosures.push(`org state ${context} read failed: ${err instanceof Error ? err.message : String(err)}`);
+                    disclosures.push(`org state ${context} read failed: ${escapeForDisclosure(err instanceof Error ? err.message : err)}`);
                     return undefined;
                 }
             };
@@ -101,8 +101,12 @@ export function createOrgRuleOverlay(cfg) {
                     disclosures.push(`org snapshot refused: ${invalid}; the previously installed snapshot (if any) remains in force`);
                     return persisted;
                 }
-                if (persisted !== undefined && fetched.revision < persisted.revisionHighWater) {
-                    disclosures.push(`org snapshot revision ${fetched.revision} is below the installed high-water mark ${persisted.revisionHighWater} — refusing the rollback; the current deny set is unchanged`);
+                const persistedFloor = persisted === undefined ? undefined : antiRollbackFloor(persisted);
+                if (persisted !== undefined && !persistedMarkIsCoherent(persisted)) {
+                    disclosures.push(`the durable org state carries a high-water mark (${escapeForDisclosure(persisted.revisionHighWater)}) that is not a finite number at or above its own snapshot revision (${escapeForDisclosure(persisted.snapshot?.revision)}) — the anti-rollback fence is being held at ${escapeForDisclosure(persistedFloor)} instead, and the durable state should be repaired`);
+                }
+                if (persistedFloor !== undefined && fetched.revision < persistedFloor) {
+                    disclosures.push(`org snapshot revision ${fetched.revision} is below the installed high-water mark ${escapeForDisclosure(persistedFloor)} — refusing the rollback; the current deny set is unchanged`);
                     return persisted;
                 }
                 if (persisted !== undefined && fetched.revision === persisted.snapshot.revision && !sameOrgPolicyContent(fetched, persisted.snapshot)) {
@@ -110,7 +114,7 @@ export function createOrgRuleOverlay(cfg) {
                     return persisted;
                 }
                 const state = {
-                    revisionHighWater: Math.max(persisted?.revisionHighWater ?? 0, fetched.revision),
+                    revisionHighWater: Math.max(persistedFloor !== undefined && Number.isFinite(persistedFloor) ? persistedFloor : 0, fetched.revision),
                     snapshot: fetched,
                     installedAtMs: nowMs,
                 };
@@ -119,11 +123,11 @@ export function createOrgRuleOverlay(cfg) {
                 }
                 catch (err) {
                     const reread = await guardedRead("reconciliation");
-                    if (reread !== undefined && reread.revisionHighWater >= state.revisionHighWater) {
-                        disclosures.push(`org snapshot install was superseded by a concurrent install at revision ${reread.snapshot.revision} — continuing on the newer installed state`);
+                    if (reread !== undefined && antiRollbackFloor(reread) >= state.revisionHighWater) {
+                        disclosures.push(`org snapshot install was superseded by a concurrent install at revision ${escapeForDisclosure(reread.snapshot.revision)} — continuing on the newer installed state`);
                         return reread;
                     }
-                    disclosures.push(`org snapshot install failed (${err instanceof Error ? err.message : String(err)}) and no superseding installed state exists — org adjudication is UNAVAILABLE`);
+                    disclosures.push(`org snapshot install failed (${escapeForDisclosure(err instanceof Error ? err.message : err)}) and no superseding installed state exists — org adjudication is UNAVAILABLE`);
                     return undefined;
                 }
                 return state;
@@ -132,7 +136,12 @@ export function createOrgRuleOverlay(cfg) {
             const withinBound = (snap) => decisionMs - snap.fetchedAtMs <= cfg.stalenessBoundMs && snap.fetchedAtMs <= decisionMs + ORG_FETCHED_AT_SKEW_ALLOWANCE_MS;
             if (installed !== undefined) {
                 if (installed.snapshot.fetchedAtMs > decisionMs + ORG_FETCHED_AT_SKEW_ALLOWANCE_MS) {
-                    disclosures.push(`the installed org snapshot claims a FUTURE observation time (${installed.snapshot.fetchedAtMs} vs now ${decisionMs}) — org adjudication is UNAVAILABLE; the consuming gate must tighten every terminal allow to a real-approval ask`);
+                    disclosures.push(`the installed org snapshot claims a FUTURE observation time (${escapeForDisclosure(installed.snapshot.fetchedAtMs)} vs now ${decisionMs}) — org adjudication is UNAVAILABLE; the consuming gate must tighten every terminal allow to a real-approval ask`);
+                    return { status: "unavailable", rules: [], disclosures };
+                }
+                const servingRefusal = validateOrgSnapshot(installed.snapshot, decisionMs);
+                if (servingRefusal !== undefined) {
+                    disclosures.push(`the installed org snapshot (revision ${escapeForDisclosure(installed.snapshot.revision)}) does not meet this version's validator: ${servingRefusal} — org adjudication is UNAVAILABLE; the consuming gate must tighten every terminal allow to a real-approval ask`);
                     return { status: "unavailable", rules: [], disclosures };
                 }
                 if (withinBound(installed.snapshot)) {
@@ -156,16 +165,50 @@ export function createOrgRuleOverlay(cfg) {
     };
     return { resolve };
 }
+function antiRollbackFloor(state) {
+    const mark = typeof state.revisionHighWater === "number" && Number.isFinite(state.revisionHighWater) ? state.revisionHighWater : undefined;
+    const own = typeof state.snapshot?.revision === "number" && Number.isFinite(state.snapshot.revision) ? state.snapshot.revision : undefined;
+    if (mark === undefined)
+        return own ?? Number.NEGATIVE_INFINITY;
+    return own === undefined ? mark : Math.max(mark, own);
+}
+function persistedMarkIsCoherent(state) {
+    return (typeof state.revisionHighWater === "number" &&
+        Number.isFinite(state.revisionHighWater) &&
+        typeof state.snapshot?.revision === "number" &&
+        Number.isFinite(state.snapshot.revision) &&
+        state.revisionHighWater >= state.snapshot.revision);
+}
 function sameOrgPolicyContent(a, b) {
     if (a.rules.length !== b.rules.length)
         return false;
     return a.rules.every((r, i) => b.rules[i]?.rule === r.rule && b.rules[i]?.behavior === r.behavior);
 }
+const DISCLOSED_UNENFORCEABLE_RULES = 20;
+export function unenforceableOrgRules(rules) {
+    const out = [];
+    for (const r of rules) {
+        if (typeof r?.rule !== "string" || r.rule === "")
+            continue;
+        const parsed = parseAllowRuleText(r.rule, { direction: "tighten" });
+        if ("reject" in parsed)
+            out.push({ rule: r.rule, code: parsed.reject.code });
+    }
+    return out;
+}
+function describeUnenforceable(unenforceable) {
+    const named = unenforceable
+        .slice(0, DISCLOSED_UNENFORCEABLE_RULES)
+        .map((u) => `"${escapeForDisclosure(u.rule)}" (${u.code})`)
+        .join(", ");
+    const more = unenforceable.length - DISCLOSED_UNENFORCEABLE_RULES;
+    return more > 0 ? `${named} and ${more} more` : named;
+}
 function validateOrgSnapshot(s, nowMs) {
     if (typeof s.revision !== "number" || !Number.isFinite(s.revision))
-        return `revision is not a finite number (${String(s.revision)})`;
+        return `revision is not a finite number (${escapeForDisclosure(s.revision)})`;
     if (typeof s.fetchedAtMs !== "number" || !Number.isFinite(s.fetchedAtMs))
-        return `fetchedAtMs is not a finite number (${String(s.fetchedAtMs)})`;
+        return `fetchedAtMs is not a finite number (${escapeForDisclosure(s.fetchedAtMs)})`;
     if (s.fetchedAtMs > nowMs + ORG_FETCHED_AT_SKEW_ALLOWANCE_MS) {
         return `fetchedAtMs is ${s.fetchedAtMs - nowMs}ms in the future (allowance ${ORG_FETCHED_AT_SKEW_ALLOWANCE_MS}ms) — a future-dated observation would satisfy the staleness bound indefinitely`;
     }
@@ -174,11 +217,15 @@ function validateOrgSnapshot(s, nowMs) {
     for (const r of s.rules) {
         if (typeof r?.rule !== "string" || r.rule === "")
             return "a rule entry carries no rule text";
-        if (r.behavior !== "deny" && r.behavior !== "ask")
-            return `rule "${r.rule}" carries behavior "${String(r.behavior)}" — the org layer has no allow bucket`;
-        const parsed = parseAllowRuleText(r.rule, { direction: "tighten" });
-        if ("reject" in parsed)
-            return `rule "${r.rule}" does not parse (${parsed.reject.code}) — an unenforceable ${r.behavior} must not install as policy`;
+        if (r.behavior !== "deny" && r.behavior !== "ask") {
+            return `rule "${escapeForDisclosure(r.rule)}" carries behavior "${escapeForDisclosure(r.behavior)}" — the org layer has no allow bucket`;
+        }
+    }
+    const unenforceable = unenforceableOrgRules(s.rules);
+    const first = unenforceable[0];
+    if (first !== undefined) {
+        const rest = unenforceable.length > 1 ? ` (${unenforceable.length} in all — ${describeUnenforceable(unenforceable)})` : "";
+        return `rule "${escapeForDisclosure(first.rule)}" does not parse (${first.code}) — an unenforceable deny/ask must not stand as policy${rest}`;
     }
     return undefined;
 }
@@ -231,7 +278,7 @@ function resolveIntrospectionStore(opts) {
         return store;
     }
     if (opts.owner !== undefined && opts.owner.kind === "principal" && opts.principal !== undefined && opts.owner.principal !== opts.principal) {
-        throw new Error(`contradictory identity: principal "${opts.principal}" and owner principal "${opts.owner.principal}" disagree`);
+        throw new Error(`contradictory identity: principal "${escapeForDisclosure(opts.principal)}" and owner principal "${escapeForDisclosure(opts.owner.principal)}" disagree`);
     }
     const principal = opts.owner?.kind === "principal" ? opts.owner.principal : opts.principal;
     return opts.provider.forPrincipal(principal);

package/dist/core/permission-rule-store.d.ts

@@ -159,7 +159,7 @@ export interface RuleSyncJoinDelta {
  * What a write may say. Authorization discriminates on the DELTA SHAPE, not on a full snapshot: only the
  * add arm can introduce a dot, and the delete arm carries a tombstone and no adds. A backend additionally
  * REFUSES at runtime any delete that would introduce a new add dot — structure and runtime check together,
- * so "pick the delete arm and smuggle an add" is neither expressible nor accepted. The `sync-join` arm's
+ * so "pick the delete arm and carry across an add" is neither expressible nor accepted. The `sync-join` arm's
  * safety does not rest on hiding the type (ruled 2026-08-10: the backend contract IS exported for
  * out-of-repo store twins) — it rests on every inbound record inside it passing the single validator
  * again AT THE BACKEND: the fifth door of design/179 §4's validator list closes here, not at the

package/dist/core/permission-rule-store.js

@@ -1,6 +1,6 @@
 import { randomBytes } from "node:crypto";
 import { canonicalize } from "./canonical-json.js";
-import { isRuleLive, parseAllowRuleText } from "./permission-rule-model.js";
+import { escapeForDisclosure, isRuleLive, parseAllowRuleText } from "./permission-rule-model.js";
 export function sameRuleOwner(a, b) {
     return a.kind === "principal" ? b.kind === "principal" && a.principal === b.principal : b.kind === "local-owner";
 }
@@ -191,7 +191,7 @@ export function applySyncJoin(cur, delta, nowMs) {
         }
         const canonicalTomb = parseAllowRuleText(t.rule);
         if ("reject" in canonicalTomb || canonicalTomb.rule.rule !== t.rule) {
-            throw new Error(`an inbound tombstone names a non-canonical or invalid rule text ("${t.rule}") — refusing the whole sync-join (the client's partitioning must withhold the round's adds alongside a malformed tombstone)`);
+            throw new Error(`an inbound tombstone names a non-canonical or invalid rule text ("${escapeForDisclosure(t.rule)}") — refusing the whole sync-join (the client's partitioning must withhold the round's adds alongside a malformed tombstone)`);
         }
     }
     const droppedInbound = [];