@sema-agent/core 5.28.0 → 5.30.0

package/dist/core/checkpoint-store.d.ts

@@ -647,6 +647,37 @@ export interface CheckpointState {
     /** design/44: the hand's read-file state (content hashes), serialized from the hands-toolkit closure
      *  (NOT part of Prepared — §15.2 net-add #8). Without it a resumed `edit_file` is rejected "not read". */
     readFileState?: Array<[string, ReadEntry]>;
+    /**
+     * design/199 — the READ-face containment state at suspend (v9,
+     * {@link FACE_CHECKPOINT_VERSION}): the RESOLVED face plus the NORMALIZED deny-set ADDITIONS in
+     * force (deployment ∪ task layers; the built-in table is engine code, never frozen here — a newer
+     * engine's built-ins apply on resume as everywhere else). Written ONLY when the posture is
+     * non-default (face "open", or additions present) — an absent section IS the default posture and
+     * resumes as roots + built-ins on any worker. Resume folds STRICTER-WINS: face = roots unless the
+     * section says open AND the live resolution says open; deny additions = frozen ∪ live (add-only,
+     * monotone — a resume can never widen what the cut leg could read).
+     *
+     * The design's r3/r4 rounds carried a third key (the workspace domain at cut) to evaluate
+     * domain-scoped deny entries under their frozen domain; the D-4 ruling (2026-08-13) removed the
+     * scoped tier entirely, leaving that key without a consumer — it is deliberately NOT persisted
+     * (dead fields in a durable format are the drift surface the liveness gate exists to catch).
+     */
+    readFace?: {
+        face: "open" | "roots";
+        denyEntries?: Array<{
+            pattern: string;
+            caseSensitive: boolean;
+        }>;
+        /** codex r2 — REDUNDANT governance marker: `true` iff the row's gate was minted WITH a
+         *  {@link RealApprovalGateBit}. v8's bit-required invariant was version-keyed and v9 (face)
+         *  outranks v8 in the stamp, so without this a v9 GOVERNED row whose `gate.realApproval` member
+         *  was dropped in storage would pass pre-CAS and be redeemable on an unwired worker — the exact
+         *  #130/#120 corruption/downgrade hole, reopened one version up. The resume pre-CAS ladder
+         *  refuses a v9+ row whose section says `realApproval: true` while the gate carries no
+         *  well-formed bit (same protection level as v8: a coherent rewrite of BOTH sites remains out of
+         *  scope for any in-row invariant). Absent = the row was minted ungoverned. */
+        realApproval?: true;
+    };
     /**
      * design/78 Slice-1: the SAFE-tier self-repair loop's durable state (`failureTrace`/`diagnostics`/
      * `rejectedHypotheses`/`attemptCount`/`oracleTier` — all JSON/`structuredClone`-safe, no fn/Date). Set ONLY
@@ -784,7 +815,7 @@ export interface CheckpointState {
         /** THIS task's OWN admitted org verdict at suspend (adversarial-review adoption, 2026-08-05):
          *  distinct from {@link admittedOrgScopes} (the incoming PARENT constraint). The resume leg
          *  applies it as the SESSION freeze on the final admitted projection — regardless of origin
-         *  (deployment-origin scopes bypass the chain freeze, never the session freeze) — so a session's
+         *  (deployment-origin scopes circumvent the chain freeze, never the session freeze) — so a session's
          *  verdict can only NARROW across suspend/resume: re-adjudication still runs every leg (a
          *  revoked grant refuses the resume), but a policy widened mid-session cannot widen THIS
          *  session's mount or the chain its children inherit. Present (possibly EMPTY — an adjudicated
@@ -797,7 +828,7 @@ export interface CheckpointState {
          *  suspend leg did not hold); a scope string = the explicit grant. Present iff
          *  {@link ownAdmittedOrgScopes} is (same adjudication record). */
         ownAdmittedOrgWriteScope?: string | null;
-        /** The MONOTONIC org-governance provenance bit (adversarial round 5): `true` when any leg of
+        /** The MONOTONIC org-governance provenance bit (falsification-style round 5): `true` when any leg of
          *  the suspended tree ran with an org-admission surface (or inherited the bit). A resume worker
          *  missing the surface still treats the leg as governed — org-shaped scopes respelled outside
          *  the v2 contract are refused, even when every admitted set en route was EMPTY. Absent on
@@ -901,7 +932,7 @@ export declare const RESOURCE_CHECKPOINT_VERSION = 2;
  * `boundInputHash`) whose enforcement lives ENTIRELY in the resuming worker's resume path. A pre-D-1 worker
  * (released 1.100.0: `MAX_SUPPORTED`=2, and its resume code has ZERO binding logic) would otherwise resume a
  * D-1-minted v1 checkpoint and execute the pending tool with NO decision-action verification — the exact
- * "approve vendor-A $5 → execute vendor-B $5000" bypass the binding exists to prevent (council BLOCKER #1).
+ * "approve vendor-A $5 → execute vendor-B $5000" circumvent the binding exists to prevent (council BLOCKER #1).
  * Stamping these at **v3 (> the old worker's MAX of 2)** forces a pre-D-1 worker to reject them PRE-CAS
  * (`unsupported_version`, stays `pending`, retried on a binding-enforcing worker) instead of silently voiding
  * the binding. A resource_limit suspend keeps stamping v2; a pre-binding (legacy 1.100.0) checkpoint is v1.
@@ -923,7 +954,7 @@ export declare const BINDING_CHECKPOINT_VERSION = 3;
  */
 export declare const TOKEN_CHECKPOINT_VERSION = 5;
 /**
- * Org-memory admission state (adversarial round 2, 2026-08-05 — the BINDING_CHECKPOINT_VERSION
+ * Org-memory admission state (falsification-style round 2, 2026-08-05 — the BINDING_CHECKPOINT_VERSION
  * precedent replayed a fourth time): the schema version a suspend stamps when its state carries
  * org-admission freeze fields (`inheritedGate.admittedOrgScopes` / `ownAdmittedOrgScopes` /
  * `ownAdmittedOrgWriteScope` — the adjudicated-empty record included). The enforcement — the
@@ -937,7 +968,7 @@ export declare const TOKEN_CHECKPOINT_VERSION = 5;
 export declare const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
 /**
  * F-012 (2026-08-09 — the ORG_ADMISSION_CHECKPOINT_VERSION precedent replayed a fifth time, codex
- * adversarial finding): the schema version a suspend stamps when its state carries the F-012 durable
+ * falsification-style finding): the schema version a suspend stamps when its state carries the F-012 durable
  * enforcement fields — `inheritedGate.constraintChain`/`constraintDigest` (the frozen ancestor
  * projection chain the resume-edit re-adjudication executes) or `delegationProvenance` (the monotonic
  * provenance aggregate a resume re-seeds). Both enforcements live ENTIRELY in the resuming worker: a
@@ -963,14 +994,29 @@ export declare const F012_CHECKPOINT_VERSION = 7;
  * stays true: rows whose gate carries no realApproval bit keep their historic stamps everywhere.
  */
 export declare const REAL_APPROVAL_CHECKPOINT_VERSION = 8;
+/**
+ * design/199 (2026-08-13 — the precedent replayed a seventh time): the schema version a suspend
+ * stamps when its state carries the READ-FACE section ({@link CheckpointState.readFace} — the
+ * resolved open face and/or deny-set additions). The enforcement lives ENTIRELY in the resuming
+ * worker (the stricter-wins face fold + the deny-entry union at prepare): a pre-199 worker
+ * (MAX_SUPPORTED=8) would accept the row, ignore the section, and resume the leg under its own
+ * defaults — silently DROPPING the frozen deny additions (a widening), and re-deriving the face
+ * from live config alone. Stamping v9 forces it to reject PRE-CAS (`unsupported_version`, stays
+ * `pending`, retried on an enforcing worker). A row whose task ran the default posture (face roots,
+ * no additions) carries NO section and keeps the historic stamps — such a resume on ANY worker
+ * folds to roots + built-ins, which is exactly the semantics it was cut under.
+ */
+export declare const FACE_CHECKPOINT_VERSION = 9;
 /** The highest {@link Checkpoint.version} `runner.resume` will act on; a higher one is rejected pre-CAS with
  *  {@link CheckpointError} `unsupported_version` (the checkpoint stays `pending`, retryable on a newer worker).
  *  Raised to 8 for realApproval-bearing gates — this worker reads v1 (legacy human), v2 (resource), v3
  *  (binding human/irreversible_ask), v4 (a pre-164 row, refused only when it carries the retired
  *  wall-clock allocation), v5 (token-allocation-bearing resource/approval), v6 (org-admission freeze
- *  state), v7 (F-012 constraint-chain / delegation-provenance enforcement state) and v8 (a
- *  non-budgetable `realApproval` gate bit with its org-origin resume semantics). */
-export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 8;
+ *  state), v7 (F-012 constraint-chain / delegation-provenance enforcement state), v8 (a
+ *  non-budgetable `realApproval` gate bit with its org-origin resume semantics) and v9 (the
+ *  design/199 read-face section: resolved face + deny-set additions, folded stricter-wins on
+ *  resume). */
+export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 9;
 /**
  * Read a checkpoint's schema version, defaulting an absent field to **legacy `0`** (a 1.67-era checkpoint
  * written before the field existed — it carries no `workspaceHandle`, so resuming it the v1 way is safe).
@@ -1022,7 +1068,7 @@ export declare function debitLedger(prior: ResourceLedger | undefined, slice: {
  *  per-slice window / walltime). A resumed slice's effective `maxCostUsd` is `min(window, this)`. NB: `0` is a
  *  VALID, exhausted ceiling — NOT "unlimited" (only `undefined` is unlimited). Any spend then immediately trips
  *  `overBudget`, and the run loop fails an exhausted resume fast (runtask). Never falsy-test this value (a
- *  `if (remaining)` would skip a legitimate 0 ceiling and silently bypass the budget). */
+ *  `if (remaining)` would skip a legitimate 0 ceiling and silently circumvent the budget). */
 export declare function remainingBudgetMicroUsd(ledger: ResourceLedger | undefined): number | undefined;
 /** design/164 (the TOKEN sibling of {@link remainingBudgetMicroUsd}): tokens the NEXT slice may still
  *  spend = `totalTokens − spentTokens`, never negative. `undefined` when no token total is set (the run is
@@ -1270,7 +1316,7 @@ export interface Checkpoint {
      * `durableApproval` (an unattended safety suspend, a non-ask gate, or a legacy pre-1.389 checkpoint — the
      * consumer then falls back to the human-kind scope-only inference for legacy rows and injects NOTHING for
      * unattended parks, so a spawn that never opted in can never gain the opt-in through a resume). Engine-
-     * minted from the task's own spec — a worker/tool cannot forge it (`durableApproval` never rides tool args).
+     * minted from the task's own spec — a worker/tool cannot self-declare it (`durableApproval` never rides tool args).
      */
     durableApproval?: {
         scope: string;
@@ -1442,7 +1488,7 @@ export declare class CheckpointError extends Error {
      *  rather than evicting: an already-accepted operator instruction is never dropped to make room —
      *  the caller delivers or removes a parked steer first. Nothing is written on this path. */
      | "steering.queue_full"
-    /** design/171 §6.3 (adversarial review adoption): the append reused an `inputId` already parked on
+    /** design/171 §6.3 (falsification review adoption): the append reused an `inputId` already parked on
      *  this checkpoint, but with DIFFERENT content. Re-appending an IDENTICAL payload stays the
      *  idempotent no-op a retry needs; a differing one is refused, because swallowing it would lose the
      *  second operator's instruction — the exact silent loss the queue replaced. Retry with a fresh id.
@@ -1450,7 +1496,7 @@ export declare class CheckpointError extends Error {
      | "steering.duplicate_input_id"
     /** design/144 §3 (governance-gate purity, fail-closed pre-CAS): a `wake` outcome was supplied for a
      *  checkpoint that awaits a PENDING GATE DECISION (tool approval / dry-run review / plan review /
-     *  resource-limit continue). Wake is a pure un-park verb and must never bypass an approval — resume
+     *  resource-limit continue). Wake is a pure un-park verb and must never circumvent an approval — resume
      *  the checkpoint through its own decide entry instead (the error message names it). */
      | "wake.gate_pending"
     /** design/144 §3 (anti spin-wake): a `wake` outcome carried no `message` and the checkpoint has no
@@ -1498,7 +1544,7 @@ export declare class CheckpointError extends Error {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy";
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
-         *  damaged/forged and no worker ever will" — blanket-retriable and gate-shape heuristics were
+         *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were
          *  both refuted downstream, so the throw site carries the fact it always knew). Closed set;
          *  additive and optional like `field` — `code` remains the only REQUIRED discriminant.
          *   · `unsupported_version` arms: `"version_newer"` (retryable on a newer worker),
@@ -1507,7 +1553,7 @@ export declare class CheckpointError extends Error {
          *   · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`,
          *     `"real_approval_forged"`, `"constraint_chain_missing"` (all terminal for the row's
          *     current bytes — no worker version redeems a damaged row). */
-        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "real_approval_damaged" | "real_approval_forged" | "constraint_chain_missing";
+        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
     } | undefined;
     constructor(code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
     /** `runner.resume` was handed an {@link ResumeOutcome} whose `gate` arm does not match the
@@ -1563,7 +1609,7 @@ export declare class CheckpointError extends Error {
      *  rather than evicting: an already-accepted operator instruction is never dropped to make room —
      *  the caller delivers or removes a parked steer first. Nothing is written on this path. */
      | "steering.queue_full"
-    /** design/171 §6.3 (adversarial review adoption): the append reused an `inputId` already parked on
+    /** design/171 §6.3 (falsification review adoption): the append reused an `inputId` already parked on
      *  this checkpoint, but with DIFFERENT content. Re-appending an IDENTICAL payload stays the
      *  idempotent no-op a retry needs; a differing one is refused, because swallowing it would lose the
      *  second operator's instruction — the exact silent loss the queue replaced. Retry with a fresh id.
@@ -1571,7 +1617,7 @@ export declare class CheckpointError extends Error {
      | "steering.duplicate_input_id"
     /** design/144 §3 (governance-gate purity, fail-closed pre-CAS): a `wake` outcome was supplied for a
      *  checkpoint that awaits a PENDING GATE DECISION (tool approval / dry-run review / plan review /
-     *  resource-limit continue). Wake is a pure un-park verb and must never bypass an approval — resume
+     *  resource-limit continue). Wake is a pure un-park verb and must never circumvent an approval — resume
      *  the checkpoint through its own decide entry instead (the error message names it). */
      | "wake.gate_pending"
     /** design/144 §3 (anti spin-wake): a `wake` outcome carried no `message` and the checkpoint has no
@@ -1619,7 +1665,7 @@ export declare class CheckpointError extends Error {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy";
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
-         *  damaged/forged and no worker ever will" — blanket-retriable and gate-shape heuristics were
+         *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were
          *  both refuted downstream, so the throw site carries the fact it always knew). Closed set;
          *  additive and optional like `field` — `code` remains the only REQUIRED discriminant.
          *   · `unsupported_version` arms: `"version_newer"` (retryable on a newer worker),
@@ -1628,7 +1674,7 @@ export declare class CheckpointError extends Error {
          *   · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`,
          *     `"real_approval_forged"`, `"constraint_chain_missing"` (all terminal for the row's
          *     current bytes — no worker version redeems a damaged row). */
-        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "real_approval_damaged" | "real_approval_forged" | "constraint_chain_missing";
+        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
     } | undefined);
 }
 /**
@@ -1880,7 +1926,7 @@ export interface CheckpointStore {
      * REJECTED with a typed {@link CheckpointError} `steering.invalid_content` (mirroring runtask.ts's trusted-
      * steer reject) — a dirty steer NEVER enters {@link CheckpointState}, so the persisted state stays clean
      * regardless of `trusted`. (The untrusted RESUME-injection path ALSO sanitizes the text as untrusted data;
-     * this persist-time reject is the belt that keeps a forged close tag out of the durable record on BOTH
+     * this persist-time reject is the belt that keeps a caller-declared close tag out of the durable record on BOTH
      * paths.) Text over {@link MAX_PENDING_STEER_CHARS} is rejected with the same code (HRD-APV-4 — the
      * steer is re-delivered into the model context on every resume, so it is capped like every other
      * persisted model-facing field on this row; rejected rather than truncated because cutting an

package/dist/core/checkpoint-store.js

@@ -136,7 +136,8 @@ export const TOKEN_CHECKPOINT_VERSION = 5;
 export const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
 export const F012_CHECKPOINT_VERSION = 7;
 export const REAL_APPROVAL_CHECKPOINT_VERSION = 8;
-export const MAX_SUPPORTED_CHECKPOINT_VERSION = 8;
+export const FACE_CHECKPOINT_VERSION = 9;
+export const MAX_SUPPORTED_CHECKPOINT_VERSION = 9;
 export function checkpointVersionOf(cp) {
     return cp.version ?? 0;
 }

package/dist/core/file-snapshot-store.d.ts

@@ -72,7 +72,7 @@ export interface FileSnapshotStore {
     /**
      * 2c session-sync ([277]): STORE a single content-addressed blob — the symmetric WRITE side of {@link getBlob},
      * for a two-phase PUSH (upload blobs, THEN import the manifest that references them). VERIFIES content-address
-     * integrity (`sha256(bytes) === hash`) so a corrupt/mismatched upload can never poison the store (a later
+     * integrity (`sha256(bytes) === hash`) so a corrupt/mismatched upload can never contaminate the store (a later
      * getBlob/restore would otherwise return wrong content); a mismatch → `read_failed`, nothing stored. IMMUTABLE +
      * content-addressed: a repeat putBlob for the same hash is a no-op (the bytes are identical by definition).
      * Returns a {@link FileSnapshotResult} (NOT void) so the integrity failure is encodable under the never-throw

package/dist/core/hooks.d.ts

@@ -8,7 +8,7 @@ import { type AskClass } from "./ask-class.js";
  *
  *  - {@link Hooks.preToolUse} runs before a tool executes. It may **rewrite** the args (an `allow` with
  *    `updatedInput`), **restrict** the call (`deny`/`ask`), and/or inject `additionalContext`. It is a
- *    pre-filter only: a hook's `allow` does NOT bypass the tool-policy gate — the policy still runs on
+ *    pre-filter only: a hook's `allow` does NOT circumvent the tool-policy gate — the policy still runs on
  *    the (possibly rewritten) args and has the final say (load-bearing invariant; see {@link runToolGate}).
  *  - {@link Hooks.postToolUse} runs after a tool executes. It may replace the result content
  *    (`updatedOutput`) and/or append `additionalContext`.
@@ -55,7 +55,7 @@ export interface Hooks {
      * JSON on the ordinary path, which clones whole; the residual is reachable only through values a
      * DEPLOYMENT put there (its own rewrite, or driving `runToolGate` directly), and the face and the
      * deployment are one trust principal — this seam helps a deployment keep its own declaration, it is not
-     * a boundary against an adversary.
+     * a boundary against an untrusted party.
      *
      * If a declared-observational face RETURNS SOMETHING ANYWAY, the return is REFUSED, not obeyed: the
      * call proceeds as if the hook had no opinion (`undefined`), and the deployment's `onError` face is
@@ -142,7 +142,7 @@ export interface Hooks {
      * plan-mode write-deny. Closes the observation blind spot where a blocked call fires NEITHER postToolUse
      * NOR postToolUseFailure (R3 scoping). Does NOT fire for:
      *  - a **durable suspend** (the ask path — CC surfaces that via a `can_use_tool` control_request);
-     *  - a **PreToolUse hook deny** (CC-exact: "PreToolUse hook denies bypass canUseTool and are not
+     *  - a **PreToolUse hook deny** (CC-exact: "PreToolUse hook denies circumvention canUseTool and are not
      *    covered here").
      * DOES fire for a **PreToolUse hook CRASH** (RB-442, `source:"hook"`): a throwing hook is intercepted by
      * the ENGINE, which then makes its OWN fail-closed deny decision. The R5 exclusion above covers the
@@ -724,13 +724,20 @@ export interface ToolGateInput {
      *  - `unavailable`/`parse_error` → FAIL-CLOSED: the ask continues down the ORIGINAL chain
      *    (durable suspend / onAsk / headless auto-deny) exactly as if auto mode were absent
      *    (CC `automode-unavailable`/`automode-parsing-error` — "NOT a policy decision").
-     * SCOPE (declared semantic): this covers EVERY surviving ask, INCLUDING the deterministic egress/
+     * SCOPE (declared semantic): this covers every surviving ask INCLUDING the deterministic egress/
      * irreversibility safety tightens — auto mode is the deployment's explicit choice to let the
      * classifier be the "explicit ask-resolution" for this session (its rule set covers exactly those
      * action classes: outbound writes, irreversible operations, and sensitive-value handling). A
      * deployment that wants human-only
      * resolution for safety asks simply does not arm auto mode. The classifier can never AUTO-ALLOW by
      * failing — only an affirmative `<block>no</block>` allows.
+     * EXCLUDED from that scope (the ask flows the ORIGINAL chain untouched, exactly as if this field
+     * were absent for that one call): an org-constrained ask (design/182 §7.4, either org arm), the
+     * reserved question tool, a call MARKED unresolvable (design/153), a hook-raised or hook-promoted
+     * ask (`decisionReason:"hook"`), and an ask carrying `matchedAskRule` (an explicit `ask` permission
+     * rule matched — #213: a person's standing "ask me each time" is not classifier hesitation). The
+     * last two are the same pair the persisted-rule lane refuses, so the gate's two ask→allow seams
+     * answer provenance questions identically.
      */
     autoMode?: {
         decider: import("./auto-mode.js").AutoModeDecider;
@@ -769,6 +776,10 @@ export interface ToolGateInput {
      *    tool's own egress/irreversibility marks are structural requirements, not classifier hesitation
      *    ("allow rules silence the classifier's questions, never a mandated one"). When a rule matches
      *    but cannot clear, the surviving ask discloses it (message + `persistedRuleShadowed`).
+     *  · #213: an ask carrying `matchedAskRule` (an explicit `ask` permission rule matched this call)
+     *    is never consumed — a person's standing "ask me each time" outranks the memory of one past
+     *    yes, across lanes exactly as the DSL's own deny > ask > allow order says within one. Same
+     *    disclosure as the mandated family when a rule matches anyway.
      * What it DOES consume is the classify-DOCTRINE shell ask (the coarse tier "maybe" — the
      * don't-ask-again main case this feature exists for) and unmarked bare asks. Consuming such an ask
      * also skips the park it would have minted; that IS what a standing approval means, and the

package/dist/core/hooks.js

@@ -354,7 +354,7 @@ export async function runToolGate(input) {
             req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
             const hit = await input.persistedRules.admits(req).catch(() => undefined);
-            if (hit !== undefined && persistedRuleMandate === undefined) {
+            if (hit !== undefined && persistedRuleMandate === undefined && decision.matchedAskRule === undefined) {
                 decision = {
                     action: "allow",
                     message: `a persisted allow rule (${hit}) covers this call`,
@@ -365,7 +365,11 @@ export async function runToolGate(input) {
             }
             else if (hit !== undefined) {
                 const shownRule = inlineUntrusted(hit, 200);
-                const mandateNoun = persistedRuleMandate === "operator_always" ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)" : "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)";
+                const mandateNoun = persistedRuleMandate === "operator_always"
+                    ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)"
+                    : persistedRuleMandate !== undefined
+                        ? "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)"
+                        : "an explicit ask rule matched this call (a person's ask-me-each-time outranks a standing allow rule)";
                 decision = {
                     ...decision,
                     persistedRuleShadowed: shownRule,
@@ -376,6 +380,8 @@ export async function runToolGate(input) {
         if (input.autoMode &&
             !orgRealApprovalRequired &&
             decision.action === "ask" &&
+            decision.decisionReason !== "hook" &&
+            decision.matchedAskRule === undefined &&
             req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
             const verdict = await input.autoMode.decider

package/dist/core/human-input-projection.d.ts

@@ -18,8 +18,8 @@
  *
  * The label goes through the same two neutralizers as the external notification's `from="…"` header
  * (`inlineUntrusted` + `attrEscape` — one-line, capped, break-out-defused, quote-escaped), so a
- * hostile id can never close the `[from "…"]` frame, escape an enclosing `<system-reminder>`, or
- * smuggle a fake `(unverified)`-free identity. The projection runs BEFORE trust framing at every
+ * untrusted id can never close the `[from "…"]` frame, escape an enclosing `<system-reminder>`, or
+ * carry across a fake `(unverified)`-free identity. The projection runs BEFORE trust framing at every
  * call site, so the annotation always sits INSIDE the frame it attributes (a trusted frame's
  * reminder wrapper, an untrusted frame's fence) and can never be separated from its text.
  */

package/dist/core/memory-admission.d.ts

@@ -50,7 +50,7 @@ export interface MemoryAdmissionInput {
      *  request-origin scope outside it refuses the prepare; a deployment-origin scope outside it is
      *  dropped and disclosed; a write grant absent from it collapses to read-only. */
     priorOwnVerdict: OwnOrgAdmissionVerdict | undefined;
-    /** The monotonic governance-provenance bit (adversarial round 5): true when this leg's TREE is
+    /** The monotonic governance-provenance bit (falsification-style round 5): true when this leg's TREE is
      *  org-governed — the deployment surface is configured here, or ANY ancestor/prior leg recorded
      *  the bit (`InheritedGate.orgAdmissionGoverned`, persisted on checkpoints). Counts as governance
      *  evidence even when every admitted set en route is EMPTY: a governed parent's org-less child,
@@ -82,7 +82,7 @@ export interface MemoryAdmissionOutcome {
  * (an older-shape chain must never read as "unconstrained"); a top-level leg simply has no chain
  * constraint. The SESSION freeze (the leg's own suspend-time verdict) is a separate input to
  * {@link admitMemoryScopes} (`priorOwnVerdict`) — it must constrain the FINAL admitted projection
- * regardless of origin (deployment-origin scopes bypass the chain freeze, not the session freeze),
+ * regardless of origin (deployment-origin scopes circumvent the chain freeze, not the session freeze),
  * so it cannot ride this chain-side fold.
  */
 export declare function foldAdmissionFreeze(input: {

package/dist/core/memory-engine/engine.d.ts

@@ -37,7 +37,7 @@ export declare const MEMORY_RECALL_DISCIPLINE = "Before answering questions abou
  * CC-verbatim `# Memory` instruction stays byte-identical to its sha256-pinned capture. Appended
  * only when a WRITE channel exists (prepare-memory gates it) — the lines it teaches are frontmatter
  * the MODEL writes; the engine has no write arm for them (writing usage evidence for the model
- * would forge the very account the three-tier discipline forbids forging).
+ * would self-declare the very account the three-tier discipline forbids forging).
  */
 export declare const MEMORY_PREFERENCE_DISCIPLINE = "When the user confirms a stored preference or fact still holds, refresh that entry's `last-confirmed: <YYYY-MM-DD>` frontmatter line (add it when absent). When you save a preference, add an `applies-when: <context>` frontmatter line naming when it applies. Both are plain frontmatter lines \u2014 write them yourself; nothing fills them in for you.";
 /**

package/dist/core/memory-engine/file-backend.d.ts

@@ -323,7 +323,7 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
     applyPatches(patches: readonly NotePatch[]): Promise<PatchReport>;
     private txnLockDir;
     /**
-     * 对抗复审 L1/L2/L3 — the mkdir mutex, hardened (same shape as layout.ts' acquireSidecarLock, but
+     * 证伪式复审 L1/L2/L3 — the mkdir mutex, hardened (same shape as layout.ts' acquireSidecarLock, but
      * fail-closed timings and an async wait):
      *  - L2: every acquisition writes an OWNER TOKEN (`<lock>/owner`, crypto-random — never a
      *    timestamp) immediately after mkdir. Release only removes the lock while the token is still
@@ -338,7 +338,7 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      *    crashed with `remaining stale > waitMs` no longer strands every waiter in an all-throw window.
      */
     private acquireTxnLock;
-    /** 对抗复审 L2 — 提交点归属复验: called immediately before the JOURNAL write (the persistent commit
+    /** 证伪式复审 L2 — 提交点归属复验: called immediately before the JOURNAL write (the persistent commit
      *  point). A holder that stalled past the stale deadline (slow disk / GC pause / long txn) and was
      *  stolen from must ABORT — its staged tmps carry no committed state and the stealer's journal
      *  recovery is now authoritative; committing anyway would overwrite the stealer's transaction. */

package/dist/core/memory-engine/header-hints.d.ts

@@ -11,7 +11,7 @@
  * This accessor is the ONLY consumer-side reading: pure, lenient, and closed over bad values —
  * a malformed line reads as FIELD ABSENT, never an error and never a partial adoption. Nothing in
  * the engine writes these lines; the model does (the preference-discipline paragraph teaches it),
- * because an engine-written confirmation would forge the usage evidence it is supposed to record.
+ * because an engine-written confirmation would self-declare the usage evidence it is supposed to record.
  */
 /** The parsed v2 hints. Every field is absent unless a well-formed line was found. */
 export interface V2HeaderHints {

package/dist/core/memory-engine/layout.d.ts

@@ -133,7 +133,7 @@ export declare function claimRootScope(controlDir: string, scope: string): strin
 /** Register `scope` in the durable registry (idempotent) and return its home dir under `memoryDir`.
  *  H5 fail-closed: a dir-name collision with a DIFFERENT registered scope throws — two scopes must
  *  never share one directory (silent cross-scope merge). The collision test has TWO arms:
- *   - exact: two scopes whose labels are the SAME string (hash collision / forged registry);
+ *   - exact: two scopes whose labels are the SAME string (hash collision / caller-declared registry);
  *   - case-fold (2026-08-12): two labels differing ONLY in letter case are distinct strings to this
  *     registry yet ONE physical directory on a case-folding volume — cross-scope bleed the exact arm
  *     cannot see. The fold arm compares the FINAL dir labels (ASCII by construction, so toLowerCase
@@ -473,7 +473,7 @@ export declare function appendChallengeEvents(controlDir: string, events: Readon
  *
  *  `eventCount` rides along for the same reason it does on {@link appendChallengeEvents}: a resolve
  *  APPENDS an event too, so it crosses the size bound exactly as a challenge does (independent
- *  adversarial review, verified — hanging the disclosure off the challenge writer alone leaves a ledger
+ *  falsification review, verified — hanging the disclosure off the challenge writer alone leaves a ledger
  *  that crossed the bound on a resolve silent until the next challenge, which may never come).
  *  `undefined` when nothing was appended. */
 export declare function resolveChallengeEvent(controlDir: string, entryId: string, generation: number, reason: string, now: () => number, requestId?: string): {

package/dist/core/memory-recall.d.ts

@@ -162,7 +162,7 @@ export declare function composeSelectiveBody(manifestText: string, selected: Mem
 /** A `(scope, id)` composite key for the multi-scope durable de-dup (design/84 Seam A decision 5). Note ids
  *  are only unique WITHIN a scope, so the cross-scope `priorSurfacedKeys`/`surfacedKeys` set MUST be keyed on
  *  both. Core owns the FORMAT so a caller can't drift the wire format (decision 7) — the encoding is OPAQUE
- *  and length-prefixes the scope so a scope/id containing the separator cannot forge a collision.
+ *  and length-prefixes the scope so a scope/id containing the separator cannot self-declare a collision.
  *
  *  ONE-WAY by design (codex MINOR (d)): the key is only ever PRODUCED here (`surfacedKeys`) and compared by
  *  STRING EQUALITY against the caller's persisted set ({@link LayeredRecallOptions.priorSurfacedKeys}, applied

package/dist/core/memory.d.ts

@@ -194,7 +194,7 @@ export interface StructuredNoteInput {
 export interface MemoryNoteHeader {
     /** Store contract: ids must be SINGLE-LINE whitespace-free tokens (uuid-like). The manifest renders
      *  `- {id}: …` lines and the side-query matches selected ids by string equality — an id containing
-     *  a newline could forge manifest lines, and a renderer-side rewrite would break the equality match,
+     *  a newline could self-declare manifest lines, and a renderer-side rewrite would break the equality match,
      *  so the contract sits on the store (search 1.95.1 review #2). */
     id: string;
     /** A one-line summary used as the relevance signal (derived from the note's first sentence when untyped). */
@@ -306,7 +306,7 @@ export declare function enforceSecretWriteGate(body: string): void;
  * (rendered as `[[name]]` cross-references) and `description` (rendered into the recall manifest + injected
  * into the side-query sub-prompt) are ALSO persisted and surfaced, so a secret hidden there
  * (`appendStructured({ body: "safe", description: "sk_live_…" })`) would otherwise be durably stored and
- * leaked into every later same-scope manifest — a real bypass of the body-only scan. `links` slugs are NOT
+ * leaked into every later same-scope manifest — a real circumvention of the body-only scan. `links` slugs are NOT
  * scanned: they are short `[[name]]`-style reference tokens (no credential body shape clears the
  * conservative detector), and scanning them adds FP surface for no realistic gain. Fail-closed: the first
  * field that carries a high-confidence credential throws {@link MemoryGateError}`("memory.secret_detected")`.

package/dist/core/oracle-isolation.d.ts

@@ -46,7 +46,7 @@ export interface OracleIsolationVerdict {
 export interface GraderEnv {
     /** The isolated env the oracle grades in (service-provisioned; a {@link import("./remote-env.js").RemoteExecutionEnv} in production). */
     env: ExecutionEnv;
-    /** Paths the oracle must be protected behind — probed for writability through the WORKER's bash bypass surface. */
+    /** Paths the oracle must be protected behind — probed for writability through the WORKER's bash circumvention surface. */
     immutableOraclePaths: string[];
     /** Provenance brand — ONLY the control-plane factory sets this. Never derived from worker state. */
     provenance: "control_plane";
@@ -72,7 +72,7 @@ export interface AssertOracleIsolationOptions {
  * `candidate_only`); the class is what gates auto-accept (the 2-of-3 asymmetry).
  *
  * **(C) BASH WRITE-PROBE (necessary-not-sufficient, cheap early signal)** — for each `immutableOraclePath`, run
- * a write probe through the WORKER env's `exec` (the bash bypass surface — see {@link probeCommand}), against
+ * a write probe through the WORKER env's `exec` (the bash circumvention surface — see {@link probeCommand}), against
  * the path canonicalized via {@link canonicalizeTarget}. The probe PASSES only if the write returns a non-zero
  * exit code or an exec error (read-only mount / permission denied / not supported). Any SUCCESS (RC 0) ⇒ the
  * oracle dir is writable from the worker ⇒ `protected:false`. A probe THROW / abort / timeout ⇒ fail-closed

package/dist/core/permission-rule-consent.d.ts

@@ -23,7 +23,7 @@
  * ## The boundary this does NOT claim
  *
  * The confirmation transfer is an in-process call. A deployment must reach it only from its authenticated
- * approval channel, and a deployment that shares filesystem credentials with the user can bypass all of
+ * approval channel, and a deployment that shares filesystem credentials with the user can circumvent all of
  * this by editing a file backend's file. That is the settings-file trust model, stated rather than
  * defended against: for a file backend, host = user, no more and no less.
  */

package/dist/core/permission-rule-model.d.ts

@@ -18,7 +18,7 @@
  *
  * The floor is `parseLeadingCommandName` — the one simple-command parser already shared by the
  * read-only classifier, the reversibility probe, the coarse command-name policy and the skill tool
- * specifier. A second tokenizer would drift, and drift on a loosening face shows up as a bypass rather
+ * specifier. A second tokenizer would drift, and drift on a loosening face shows up as a circumvention rather
  * than as a test failure.
  *
  * ## Normalization order is load-bearing

package/dist/core/permission-rule-org.d.ts

@@ -203,7 +203,7 @@ export interface EffectivePermissionRule {
 /**
  * design/182 §7.3 — the introspection face: every personal rule with its effective status under the org
  * overlay. An org deny does not delete a personal rule — the personal rule is the user's approval
- * record, and the org's power is to OVERRIDE it, not to forge its removal — so a shadowed rule reports
+ * record, and the org's power is to OVERRIDE it, not to self-declare its removal — so a shadowed rule reports
  * `shadowed-by-org` and comes back by itself when the org deny is withdrawn. A rule whose every add is
  * tombstoned reports `removed` (its tombstone identity is still visible in the store).
  *

package/dist/core/permission-rule-store.d.ts

@@ -159,7 +159,7 @@ export interface RuleSyncJoinDelta {
  * What a write may say. Authorization discriminates on the DELTA SHAPE, not on a full snapshot: only the
  * add arm can introduce a dot, and the delete arm carries a tombstone and no adds. A backend additionally
  * REFUSES at runtime any delete that would introduce a new add dot — structure and runtime check together,
- * so "pick the delete arm and smuggle an add" is neither expressible nor accepted. The `sync-join` arm's
+ * so "pick the delete arm and carry across an add" is neither expressible nor accepted. The `sync-join` arm's
  * safety does not rest on hiding the type (ruled 2026-08-10: the backend contract IS exported for
  * out-of-repo store twins) — it rests on every inbound record inside it passing the single validator
  * again AT THE BACKEND: the fifth door of design/179 §4's validator list closes here, not at the

package/dist/core/permission-rules.js

@@ -287,11 +287,11 @@ export function createPermissionRulePolicy(rules, opts) {
                     return { action: "deny", message: ruleMessage("denied", paramDeny.ruleText, paramDeny.source) };
                 }
                 if (entry.bare.ask) {
-                    return { action: "ask", message: ruleMessage("flagged", entry.bare.ask.ruleText, entry.bare.ask.source) };
+                    return { action: "ask", message: ruleMessage("flagged", entry.bare.ask.ruleText, entry.bare.ask.source), matchedAskRule: entry.bare.ask.ruleText };
                 }
                 const paramAsk = matchParamRules(entry.param.ask, req.args, caps.maxScalarValueChars);
                 if (paramAsk) {
-                    return { action: "ask", message: ruleMessage("flagged", paramAsk.ruleText, paramAsk.source) };
+                    return { action: "ask", message: ruleMessage("flagged", paramAsk.ruleText, paramAsk.source), matchedAskRule: paramAsk.ruleText };
                 }
                 if (entry.bare.allow) {
                     return { action: "allow" };

package/dist/core/runner/active-skill-scope.d.ts

@@ -34,7 +34,7 @@ export declare class ActiveSkillScope {
  *  - DENY any tool not in the INTERSECTION of every active frame's `allowTools`.
  *  - For a WRITE tool with an `allowPaths` constraint on ANY active frame, DENY a write whose
  *    canonicalized target is outside every listed prefix (reuses {@link canonicalizeTarget}, so a
- *    symlink can't smuggle a write outside the allowed paths).
+ *    symlink can't carry across a write outside the allowed paths).
  *  - A frame whose manifest could not be resolved (`kind:"unresolved"`) → DENY-ALL (fail-closed: no
  *    allowlist means nothing is allowed — NOT the bare task policy).
  * When NO frame is active, the policy returns `allow` for everything (it only ever subtracts), leaving

package/dist/core/runner/memory-consolidation.d.ts

@@ -27,7 +27,7 @@ export declare const DEFAULT_CONSOLIDATION_MAX_NOTES = 50;
 export declare const DEFAULT_CONSOLIDATION_TIMEOUT_SEC = 30;
 /** Normalize a note body for the EXACT-restatement check in the `<lo` near-dup cheap path. Case- + whitespace-
  *  insensitive ONLY (lower-case, collapse whitespace runs, trim); it PRESERVES every symbol/punctuation so it can
- *  NOT false-equate semantically-distinct facts. (service [365] adversarial: the earlier `[^\p{L}\p{N}]`-stripping
+ *  NOT false-equate semantically-distinct facts. (service [365] falsification-style: the earlier `[^\p{L}\p{N}]`-stripping
  *  normalization made "C#"≡"C", "delta +5"≡"delta -5", "100%"≡"100" — and a textual-CONTAINMENT test on top of it
  *  also mis-judged "rate limit 1000" ⊇ "rate limit 100" (word boundary). A fire-on-every-note, no-LLM path must not
  *  make a semantic-subset call, so the cheap path now folds ONLY an exact restatement; every real near-dup defers