@sema-agent/core 5.28.0 → 5.30.0

package/dist/core/runner/prepare-task.d.ts

@@ -307,14 +307,14 @@ export interface Prepared {
      *  threaded to every compaction-boundary epoch selection so boundary re-pins hash the same
      *  artifact identity as the prepare-time pin. Empty on declaration-free runs. */
     epochDeclaredSections: import("../../prompt-assembly/epoch.js").EpochDeclaredSections;
+    /** design/148 S3 — the LIVE nine-element identity face (refreshed by deferred materialization and
+     *  the RB-31 adoption swap); the manifest holds the prepare-time initial copy. */
+    turnSnapshot?: import("../../prompt-assembly/turn-snapshot.js").TurnPromptSnapshot;
     /** RB-31 (design/148 S2) — the compaction-boundary center-adoption seam (undefined = no source
      *  wired or session not center-pinned). Returns the maybeCompact `centerAdoption` fragment or
      *  undefined; `apply` runs post-CAS only (auto-compaction owns the ordering). Both
      *  `epochDeclaredSections` and `promptOverheadTokens` on THIS object are mutated by a successful
      *  adoption (read them at call time, never capture early). */
-    /** design/148 S3 — the LIVE nine-element identity face (refreshed by deferred materialization and
-     *  the RB-31 adoption swap); the manifest holds the prepare-time initial copy. */
-    turnSnapshot?: import("../../prompt-assembly/turn-snapshot.js").TurnPromptSnapshot;
     centerCompactionCandidate?: () => {
         centerArtifactDigest?: string;
         sourceRevision?: string;
@@ -573,8 +573,15 @@ export interface Prepared {
     /** Narrow workspace reader for compaction working-file attachments (LONGRUN-2): reads a task file
      *  via the SAME env the hands ran against (so remote/k8s/E2B tasks read the container's tree, not
      *  the control plane's). Present only when the hands are enabled — without an env there is no
-     *  workspace to re-read. null = unreadable (deleted/binary/transport error); callers skip it. */
-    readTaskFile?: (path: string) => Promise<string | null>;
+     *  workspace to re-read. null = unreadable (deleted/binary/transport error); callers skip it.
+     *  design/199 件B: `{ withheld }` = the target matches the sensitive-path read deny list — the
+     *  attachment is deliberately withheld and the consumer must SAY so (an annotation, never a silent
+     *  skip: a silently missing attachment reads as "file gone", which is a different fact). */
+    readTaskFile?: (path: string) => Promise<string | null | {
+        withheld: {
+            pattern: string;
+        };
+    }>;
     /** CC post-compact restore parity (2026-07-03): the task's READ files, most recent
      *  first (from the hands' readFileState `lastReadAt` stamps). The compaction working-file
      *  attachment prefers this over the modified set — CC restores what the model RECENTLY READ,
@@ -864,7 +871,7 @@ export interface InheritedGate {
      * Org-memory admission freeze (ruled 2026-08-05): the spawning chain's FROZEN admitted org-scope
      * set — every org memory scope the parent actually mounted (deployment-origin + admitted request).
      * A delegated child's REQUEST-origin org scopes must be a subset (intersection ≠ request ⇒ the
-     * child's prepare refuses, `memory.admission_denied`); deployment-origin scopes bypass the freeze
+     * child's prepare refuses, `memory.admission_denied`); deployment-origin scopes circumvent the freeze
      * (operator authority is deployment-wide). ALWAYS emitted by chain assembly (empty array = parent
      * mounted no org plane), so an ABSENT field discriminates an older-shape chain — which the child
      * side reads fail-closed as the empty set. Serializable (plain strings): persists on the
@@ -872,7 +879,7 @@ export interface InheritedGate {
      */
     admittedOrgScopes?: readonly string[];
     /**
-     * The MONOTONIC org-governance provenance bit (adversarial round 5): `true` when any leg of this
+     * The MONOTONIC org-governance provenance bit (falsification-style round 5): `true` when any leg of this
      * tree ran with an org-admission surface configured (resolver / deployment scope list) or
      * inherited the bit. It never clears once set (a governed tree stays governed), and it counts as
      * governance evidence at the admission door EVEN when every admitted set en route is empty — a
@@ -1055,7 +1062,7 @@ export interface RunInternals {
      * arbitration is decided) and BEFORE the resumed leg starts. The parked-resume caller uses it to
      * flip the reserved row `parked→running` (guarded CAS) + adopt the live handle/lane — the ONLY
      * legal site for that flip (a pre-consume flip would let TaskStop hit the plain running arm and
-     * bypass the checkpoint arbitration entirely). A THROW here aborts the resume (propagates out of
+     * circumvent the checkpoint arbitration entirely). A THROW here aborts the resume (propagates out of
      * `resumeStream`): the checkpoint is already consumed, so the caller's compensation
      * (`rollbackParkedClaim`) reads `resolved` and settles the honest failed/outcome-unknown terminal
      * — never a silent run without an adopted row. Deployment/trusted-caller channel only, mirroring
@@ -1442,6 +1449,11 @@ export interface ResolvedWorkspace {
     cwd: string;
     /** True only for an accepted `isolation: "worktree"` request (⇒ `cwd` is this agent's own worktree). */
     isolated: boolean;
+    /** True when the task's execution env is REMOTE (#197 BGW-7): `cwd` then names a path INSIDE the remote
+     *  target (a per-task sandbox on the shape-(d) exemption leg, e.g. `/workspace`), which does not exist —
+     *  or names an unrelated directory — on the host. `isolated && !remote` is the only combination under
+     *  which `cwd` is a host path a consumer may diff / merge / remove. */
+    remote: boolean;
 }
 /**
  * From the resumed/active transcript, the batch position of `currentId` (design/45 §4.ter): the tool-call
@@ -1478,6 +1490,15 @@ export declare function rebaseWorkspacePath(p: string, fromRaw: string, toRaw: s
  * which case the earlier — more specific — spelling is the intended one. Exported for direct unit pinning.
  */
 export declare function rebaseWorkspacePathAcross(p: string, froms: readonly string[], to: string): string;
+/**
+ * Build everything a task run needs (council design/34 ②: a free function with EXPLICIT deps, not a
+ * Runner method — testable and decoupled). Resolves the model/role/thinking, acquires + reconciles the
+ * session (with the conflict-detecting Proxy + bounded re-wake on a lost CAS), assembles the tool set
+ * (caller tools + offload wrap + report_blocked + submit_output + MCP + memory + read_tool_result),
+ * builds the system prompt, constructs the harness, wires the tool-policy gate + context-edit/guard
+ * hooks + external-signal cancellation, and sets up the cache-break detector. **No run-loop control
+ * flow** lives here — that stays in the Runner loop.
+ */
 export declare function prepareTask(spec: TaskSpec, deps: RunnerDeps, sessions: SessionStore, resume?: PrepareResume, internals?: RunInternals, 
 /** design/98 §3.1 (S8c): a TRUSTED self-reference to the Runner, passed by the Runner itself (never a
  *  TaskSpec field) so the `run_workflow` tool can execute child tasks via `runner.runTask`. Undefined when

package/dist/core/runner/prepare-task.js

@@ -57,7 +57,7 @@ import { foldAdmissionFreeze } from "../memory-admission.js";
 import { prepareMemory } from "./prepare-memory.js";
 import { defaultPromptProvider, buildEnvironmentContext, buildGitSnapshot, formatLocalDate, isValidTimeZone, PROJECT_CONTEXT_FRAMING } from "../../prompts/default.js";
 import { assemblePrompt } from "../../prompt-assembly/assemble.js";
-import { auditToolCollisions, projectToolManifest } from "../../prompt-assembly/tool-catalog.js";
+import { auditToolCollisions, getToolContract, projectToolManifest } from "../../prompt-assembly/tool-catalog.js";
 import { resolveEpochAgainstBundled } from "../../prompt-assembly/epoch.js";
 import { artifactDeclarations } from "../../prompt-assembly/artifact.js";
 import { buildTurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js";
@@ -74,7 +74,7 @@ import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.j
 import { createTaskOutputTool, createTaskStopTool, defaultTaskRegistry } from "../task-registry.js";
 import { createMonitorTool } from "../../tools/monitor.js";
 import { createWorktreeTools } from "../../tools/worktree.js";
-import { applyCompactionToReadFileState, bashReversibilityProbe, createHandsToolkit, isReadDedupStubResult, seedReadFileStateFromContext, seedReadFileStateFromTranscript, HAND_TOOL_EFFECTS, pdfModelCapabilitiesOf } from "../../tools/fs/index.js";
+import { applyCompactionToReadFileState, bashReversibilityProbe, compileReadDeny, createHandsToolkit, isReadDedupStubResult, resolveReadFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, FULL_SHELL_CONTRACT_ID, HAND_TOOL_EFFECTS, pdfModelCapabilitiesOf } from "../../tools/fs/index.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
 import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool, classifyQuestionOutcome, isLiveQuestionFace, validateAskQuestions, } from "../ask-question.js";
 import { createSchedulerTools } from "../../tools/scheduler-tools.js";
@@ -85,7 +85,7 @@ import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-
 import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
-import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
+import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveAskEffective, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
@@ -219,6 +219,9 @@ export function resolveModelPromptTraits(model, spec, internals) {
         fableMitigations: isFableFamilyModelId(model.id),
     };
 }
+function hasConversationContent(branch) {
+    return branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
+}
 function isDelegatedNonForkChild(internals) {
     return internals?.isDelegatedChild === true && internals?.insideFork !== true;
 }
@@ -910,7 +913,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         if (internals?.onWorkspaceResolved !== undefined) {
             try {
-                internals.onWorkspaceResolved({ cwd: taskRootPath, isolated: internals.isolation === "worktree" });
+                const workspaceEnv = ownedEnv ?? deps.executionEnv;
+                internals.onWorkspaceResolved({
+                    cwd: taskRootPath,
+                    isolated: internals.isolation === "worktree",
+                    remote: workspaceEnv !== undefined &&
+                        (isRemoteExecutionEnv(workspaceEnv) || workspaceEnv.hostLocalPaths === false),
+                });
             }
             catch {
             }
@@ -1073,6 +1082,17 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const memoryAdmittedOrgScopesRef = { current: [] };
         const ownOrgVerdictRef = { current: undefined };
         const orgAdmissionCheckpointState = () => inheritedAdmittedOrgScopes !== undefined || ownOrgVerdictRef.current !== undefined || orgGovernedProvenance;
+        const faceCheckpointSection = () => {
+            if (resolvedReadFace === undefined) {
+                const seed = resume?.seed.readFace;
+                return seed !== undefined ? { face: seed.face, ...(seed.denyEntries !== undefined ? { denyEntries: seed.denyEntries.map((e) => ({ ...e })) } : {}) } : undefined;
+            }
+            if (resolvedReadFace === "open" || readDenyAdditionsNormalized.length > 0) {
+                return { face: resolvedReadFace, ...(readDenyAdditionsNormalized.length > 0 ? { denyEntries: readDenyAdditionsNormalized.map((e) => ({ ...e })) } : {}) };
+            }
+            return undefined;
+        };
+        const faceCheckpointState = () => faceCheckpointSection() !== undefined;
         const f012CheckpointState = () => (inheritedParentConstraints?.length ?? 0) > 0 ||
             seedInheritedGate?.constraintChain !== undefined ||
             internals?.delegationProvenance !== undefined;
@@ -1143,6 +1163,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         };
         let agentForkDenial;
         let observersActive = false;
+        let resolvedReadFace;
+        let readDenyAdditionsNormalized = [];
+        const fullShellReachable = handsEnabled &&
+            !(executionEnv instanceof StubExecutionEnv) &&
+            spec.handsReadOnly !== true &&
+            !(toolFaceSnapshot.exclude?.includes("Bash") ?? false);
         let autoModeDecider;
         const enrichSpecToolCtx = (ctx) => ({
             ...ctx,
@@ -1153,6 +1179,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
             ...(frozenOnQuestion !== undefined ? { onQuestion: frozenOnQuestion } : {}),
             ...(spec.handsReadOnly === true ? { handsReadOnly: true } : {}),
+            ...(resolvedReadFace === "roots" ? { readFace: "roots" } : {}),
+            ...(readDenyAdditionsNormalized.length > 0 ? { readDenyPatterns: Object.freeze(readDenyAdditionsNormalized.map((e) => ({ ...e }))) } : {}),
             ...(spec.interactiveTools === false ? { interactiveTools: false } : {}),
             oneShot: spec.oneShot,
             clientContext: spec.clientContext,
@@ -1358,6 +1386,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 workflowDepth: internals?.workflowDepth,
                 parentCwd: taskRootPath,
                 parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
+                parentReadFace: () => resolvedReadFace,
+                parentReadDenyPatterns: () => (readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized : undefined),
+                parentCheckpointStoreDisabled: spec.checkpointStore === null,
+                parentCenterArtifactDigest: () => centerAdoption?.artifact.artifactDigest,
+                parentCenterSourceRevision: () => centerAdoption?.sourceRevision,
                 ...(forwardEvent ? { forwardEvent } : {}),
                 inheritedGateForChildren,
             }));
@@ -1570,6 +1603,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const additionalRootsCanonical = [];
         const additionalReadRootsCanonical = [];
         let attachmentRootCanonical;
+        let readDenyMatcher;
         if (handsEnabled) {
             const rootRaw = taskRootPath;
             const canon = await executionEnv.canonicalPath(rootRaw);
@@ -1621,14 +1655,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             if (resume === undefined && spec.sessionId !== undefined) {
                 const prior = await session.buildContext().catch(() => undefined);
                 for (const rec of wholeFileRecordsFromTranscript(prior?.messages ?? [])) {
-                    const rk = await resolveKey(executionEnv, rootCanonical, rec.path, undefined, undefined, additionalRootsCanonical);
+                    const rk = await resolveKey(executionEnv, rootCanonical, rec.path, undefined, undefined, [...additionalRootsCanonical, ...additionalReadRootsCanonical]);
                     if (rk.ok)
                         seedReadFileStateFromTranscript(readFileState, rk.key, rec.content, rec.at);
                 }
             }
             seedContextFiles = async (files) => {
                 for (const f of files) {
-                    const rk = await resolveKey(executionEnv, rootCanonical, f.path, undefined, undefined, additionalRootsCanonical);
+                    const rk = await resolveKey(executionEnv, rootCanonical, f.path, undefined, undefined, [...additionalRootsCanonical, ...additionalReadRootsCanonical]);
                     if (rk.ok)
                         seedReadFileStateFromContext(readFileState, rk.key, f.content);
                 }
@@ -1650,9 +1684,28 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(resume !== undefined ? { baselineUnknown: true } : {}),
                 };
             }
+            const seedReadFaceSection = resume?.seed.readFace;
+            const readDenyAdditions = [...(deps.readDenyPatterns ?? []), ...(spec.readDenyPatterns ?? []), ...(seedReadFaceSection?.denyEntries ?? [])];
+            readDenyMatcher = compileReadDeny(readDenyAdditions, "readDenyPatterns");
+            {
+                const builtinCount = compileReadDeny([], "built-in").entries.length;
+                readDenyAdditionsNormalized = readDenyMatcher.entries.slice(builtinCount);
+            }
+            let liveReadFace = resolveReadFace({
+                specReadFace: spec.readFace,
+                depsReadFace: deps.readFace,
+                readOnlyMount: handsReadOnly,
+                orgGoverned: deps.permissionRuleOrg !== undefined,
+                fullShellReachable,
+            });
+            if (resume !== undefined && (seedReadFaceSection === undefined || seedReadFaceSection.face === "roots"))
+                liveReadFace = "roots";
+            resolvedReadFace = liveReadFace;
             const band = createHandsToolkit(executionEnv, readFileState, rootCanonical, {
                 ...(additionalRootsCanonical.length > 0 ? { additionalRoots: additionalRootsCanonical } : {}),
                 ...(additionalReadRootsCanonical.length > 0 ? { additionalReadRoots: additionalReadRootsCanonical } : {}),
+                ...(readDenyAdditions.length > 0 ? { readDenyPatterns: readDenyAdditions } : {}),
+                readFace: liveReadFace,
                 includeShell: handsIncludeShell,
                 readOnly: handsReadOnly,
                 ...(handsCwdRef ? { cwdRef: handsCwdRef } : {}),
@@ -1706,6 +1759,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 const shellReadBoundary = () => ({
                     roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical],
                     ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}),
+                    denyMatch: (p) => readDenyMatcher?.matchPath(p)?.pattern ?? null,
+                    ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}),
                 });
                 if (shellGate === "classify" && shellGatedBash)
                     reversibilityProbes.set("Bash", bashReversibilityProbe(undefined, shellReadBoundary));
@@ -2017,7 +2072,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             if (spec.sessionId) {
                 try {
                     const branch = await session.getBranch();
-                    const hasConversation = branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
+                    const hasConversation = hasConversationContent(branch);
                     if (!hasConversation)
                         projectMemoryPhase = "fresh";
                     else {
@@ -2156,6 +2211,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             policyEnabled: promptPolicyEnabled,
             hooksEnabled: promptHooksEnabled,
             isolationEnabled: isIsolated(executionEnv),
+            readFaceOpen: resolvedReadFace === "open",
             orchestrationEnabled: selfOrchestrationActive,
             orchestrationDeferred: selfOrchestrationActive && (toolFaceSnapshot.defer?.includes("Workflow") ?? false),
             promptProfile,
@@ -2208,6 +2264,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             if (additionalRootsCanonical.length > 0) {
                 envFacts.additionalDirectories = [...additionalRootsCanonical];
             }
+            if (resolvedReadFace !== undefined)
+                envFacts.readFace = resolvedReadFace;
             if (additionalReadRootsCanonical.length > 0) {
                 envFacts.additionalReadDirectories = [...additionalReadRootsCanonical];
             }
@@ -2301,6 +2359,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (excluded.has(tools[i].name))
                     tools.splice(i, 1);
         }
+        if (handsEnabled) {
+            const fullShellOnRoster = tools.some((t) => t.name === "Bash" && getToolContract(t, "core").contractId === FULL_SHELL_CONTRACT_ID);
+            if (fullShellOnRoster !== fullShellReachable) {
+                const e = new Error(`internal invariant: fullShellReachable=${String(fullShellReachable)} but the post-exclusion roster ` +
+                    `${fullShellOnRoster ? "carries" : "does not carry"} the full shell (${FULL_SHELL_CONTRACT_ID}). ` +
+                    `A new roster-affecting mechanism was added without updating the predicate.`);
+                e.code = "internal.full_shell_reachable_mismatch";
+                throw e;
+            }
+        }
         if (promptProfile === "classic") {
             for (let i = 0; i < tools.length; i++) {
                 const t = tools[i];
@@ -2498,7 +2566,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
                 else if (resume === undefined && internals?.parentTaskId === undefined && internals?.parentSessionId === undefined) {
                     const candidate = deps.promptSource?.current();
-                    if (candidate !== undefined && (await session.getBranch()).length === 0) {
+                    if (candidate !== undefined && !hasConversationContent(await session.getBranch())) {
                         centerAdoption = { artifact: candidate.artifact, sourceRevision: candidate.sourceRevision };
                         centerAdoptionFresh = true;
                     }
@@ -2577,7 +2645,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const resolved = resolveEpochAgainstBundled(pinned, SEMA_DEFAULT_PACK, epochDeclaredSections);
             epochArtifactDigestForSnapshot = resolved.descriptor.artifactDigest;
             if (resolved.migrated) {
-                const activatedBy = pinned === undefined && !spec.sessionId ? "session_start" : "legacy_migration";
+                const priorConversation = pinned === undefined ? hasConversationContent(await session.getBranch()) : true;
+                const activatedBy = pinned === undefined && !priorConversation ? "session_start" : "legacy_migration";
                 await session.appendPromptEpoch({
                     ...resolved.descriptor,
                     activatedBy,
@@ -3185,6 +3254,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...((internals?.explicitAgentName ?? internals?.agentName) !== undefined
                 ? { sourceAgentName: internals?.explicitAgentName ?? internals?.agentName }
                 : {}),
+            ...(internals?.isDelegatedChild === true ? { isDelegatedChild: true } : {}),
         });
         const riskAxesOf = (toolName) => {
             const tier = irreversibilityTier.get(toolName);
@@ -3290,6 +3360,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const suggestions = suggestRulesForCommand(command);
             return suggestions.length > 0 ? { ruleSuggestions: suggestions } : {};
         };
+        const frozenClassifierExcluded = (d) => d.decisionReason === "hook" || d.matchedAskRule !== undefined;
         const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal, ancestorDecider) => {
             let editArgs = edit;
             for (let round = 0;; round++) {
@@ -3316,7 +3387,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
                 if (re.updatedInput !== undefined)
                     editArgs = re.updatedInput;
-                if (ancestorDecider !== undefined) {
+                if (ancestorDecider !== undefined && !frozenClassifierExcluded(re)) {
                     const verdict = await ancestorDecider
                         .decide({ req: { ...creq, args: editArgs }, ...(re.message !== undefined ? { askMessage: re.message } : {}) }, csignal ?? abortController.signal)
                         .catch(() => ({ kind: "unavailable", cause: "error" }));
@@ -3395,7 +3466,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
                             };
                         }
-                        if (pc.autoMode !== undefined) {
+                        if (pc.autoMode !== undefined && !frozenClassifierExcluded(first)) {
                             const verdict = await pc.autoMode.decider
                                 .decide({ req: creq, ...(first.message !== undefined ? { askMessage: first.message } : {}) }, csignal ?? abortController.signal)
                                 .catch(() => ({ kind: "unavailable", cause: "error" }));
@@ -3482,7 +3553,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             };
                         }
                         const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                        if (pc.autoMode !== undefined) {
+                        if (pc.autoMode !== undefined && !frozenClassifierExcluded(decision)) {
                             const verdict = await pc.autoMode.decider
                                 .decide({ req: { ...creq, args: presentedArgs }, ...(decision.message !== undefined ? { askMessage: decision.message } : {}) }, csignal ?? abortController.signal)
                                 .catch(() => ({ kind: "unavailable", cause: "error" }));
@@ -3892,6 +3963,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 nestedStats: { ...nestedStats },
                 consolidationNotes: undefined,
                 readFileState: readFileStateForCheckpoint ? [...readFileStateForCheckpoint.entries()] : undefined,
+                readFace: faceCheckpointSection(),
                 repairBundle: repairBundleForCheckpoint(parkedSpendMicroUsd),
                 workspaceHandle,
                 handsCwd: handsCwdRef?.current,
@@ -4111,7 +4183,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 const mintedAt = Date.now();
                 const cp = {
                     token,
-                    version: f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : resourceLedgerOut.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
+                    version: faceCheckpointState() ? FACE_CHECKPOINT_VERSION : f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : resourceLedgerOut.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
                     scope,
                     sessionId,
                     leafId,
@@ -4193,7 +4265,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const mintedAt = Date.now();
                     const cp = {
                         token,
-                        version: f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : reviewLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                        version: faceCheckpointState() ? FACE_CHECKPOINT_VERSION : f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : reviewLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                         scope,
                         sessionId,
                         leafId,
@@ -4445,11 +4517,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const scope = durableApproval?.scope || checkpointScopeOf({ principal: spec.principal });
                         const ttlMs = sanitizedTtlMs(durableApproval?.ttlMs);
                         const checkpointState = serializeCheckpointState(remoteHandle, inFlightSpendMicroUsd());
+                        if (realApproval !== undefined && checkpointState.readFace !== undefined) {
+                            checkpointState.readFace = { ...checkpointState.readFace, realApproval: true };
+                        }
                         const approvalLedger = debitLedger(priorLedger, liveSpendRef.get?.() ?? { costMicroUsd: 0, tokens: 0, turns: 0, walltimeMs: 0 }, resourceTotal, { countSlice: false });
                         const mintedAt = Date.now();
                         cp = {
                             token,
-                            version: realApproval !== undefined ? REAL_APPROVAL_CHECKPOINT_VERSION : f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                            version: faceCheckpointState() ? FACE_CHECKPOINT_VERSION : realApproval !== undefined ? REAL_APPROVAL_CHECKPOINT_VERSION : f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                             scope,
                             sessionId,
                             leafId,
@@ -4799,21 +4874,42 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         promptManifest.lowering = turnSnapshot.lowering;
         const promptOverheadTokens = Math.ceil((systemPrompt.length +
             harnessTools.reduce((a, t) => a + t.name.length + (t.description?.length ?? 0) + JSON.stringify(t.parameters ?? {}).length, 0)) / charsPerToken);
+        const announceAttachmentSkip = (path, reason) => {
+            deps.onError?.(new Error(`working-file attachment skipped — ${path}: ${reason}`), {
+                phase: "degraded",
+                sessionId,
+                classification: "attachment-read",
+            });
+        };
         const readTaskFile = handsEnabled
             ? async (path) => {
                 try {
+                    let key = path;
                     if (attachmentRootCanonical !== undefined) {
-                        const rk = await resolveKey(executionEnv, attachmentRootCanonical, path, undefined, undefined, additionalRootsCanonical);
-                        if (!rk.ok)
+                        const rk = await resolveKey(executionEnv, attachmentRootCanonical, path, undefined, undefined, [...additionalRootsCanonical, ...additionalReadRootsCanonical], undefined, readDenyMatcher, resolvedReadFace);
+                        if (!rk.ok) {
+                            announceAttachmentSkip(path, rk.violation.message);
+                            if (rk.violation.code === "read_path_denied" && rk.violation.pattern !== undefined) {
+                                return { withheld: { pattern: rk.violation.pattern } };
+                            }
                             return null;
+                        }
+                        key = rk.key;
                     }
-                    const r = await executionEnv.readBinaryFile(path);
-                    if (!r.ok)
+                    const r = await executionEnv.readBinaryFile(key);
+                    if (!r.ok) {
+                        announceAttachmentSkip(path, r.error.message);
                         return null;
+                    }
                     const d = decodeTextBytes(r.value);
-                    return d.malformed ? null : d.text;
+                    if (d.malformed) {
+                        announceAttachmentSkip(path, "malformed text encoding (truncated UTF-16 body)");
+                        return null;
+                    }
+                    return d.text;
                 }
-                catch {
+                catch (err) {
+                    announceAttachmentSkip(path, err instanceof Error ? err.message : String(err));
                     return null;
                 }
             }
@@ -4823,7 +4919,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (attachmentRootCanonical === undefined)
                     return path;
                 try {
-                    const rk = await resolveKey(executionEnv, attachmentRootCanonical, path, undefined, handsCwdRef?.current, additionalRootsCanonical);
+                    const rk = await resolveKey(executionEnv, attachmentRootCanonical, path, undefined, handsCwdRef?.current, [...additionalRootsCanonical, ...additionalReadRootsCanonical], undefined, undefined, resolvedReadFace);
                     return rk.ok ? rk.key : path;
                 }
                 catch {

package/dist/core/runner/runtask.d.ts

@@ -300,7 +300,7 @@ export declare class Runner {
      *  `inheritedManifestScope` and every other RunInternals field) — the library caller is trusted to
      *  re-supply the genuine chain; a caller able to invoke resumeStream already holds full Runner
      *  authority, so constraint substitution here is outside the enforced threat model (the count check
-     *  catches shape MISTAKES, not a malicious trusted caller). */
+     *  catches shape MISTAKES, not a untrusted trusted caller). */
     internals?: RunInternals): Promise<TaskStream>;
     /**
      * design/45 resume step: with the harness idle and the branch rewound to the suspension leaf, resolve

package/dist/core/runner/runtask.js

@@ -1,6 +1,7 @@
+import { persistedReadDenyEntryProblem } from "../../tools/fs/read-deny.js";
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
+import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
 import { engineVersion } from "../version.js";
 import { CONFIG_CATALOG_VERSION, declarationReasons, resolveEffectiveConfig } from "../../config/catalog.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
@@ -35,7 +36,7 @@ import { hasDestroy, isIsolated } from "../remote-env.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { cloneObserverInput, formatHookFeedback } from "../hooks.js";
 import { buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
-import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
@@ -245,7 +246,7 @@ function resumeContinuation(resume) {
     if (resume.outcome.gate === "dry_run_review") {
         const verdict = resume.outcome.decision === "approve"
             ? "Your predicted change was REVIEWED and APPROVED; it has been applied"
-            : `Your predicted change was REVIEWED and REJECTED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason)}` : ""}; it was NOT applied`;
+            : `Your predicted change was REVIEWED and REJECTED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}; it was NOT applied`;
         return formatHookFeedback(`You were resumed after a dry-run review. ${verdict}. Before continuing, re-orient from the workspace ` +
             "(run `git status` and review your recent changes) to confirm the current state, then continue the " +
             "remaining work. Do NOT restart the task or re-run work that is already done.");
@@ -265,7 +266,7 @@ function resumeContinuation(resume) {
                 "or restart from scratch, just carry out the revised plan.\n\nThe REVISED plan to follow is:\n" +
                 delimitUntrusted("revised plan", resume.outcome.editedPlan));
         }
-        const why = resume.outcome.reason ? ` Reviewer note: ${delimitUntrusted("reviewer note", resume.outcome.reason)}` : "";
+        const why = resume.outcome.reason ? ` Reviewer note: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : "";
         return formatHookFeedback(`Your proposed PLAN was REVIEWED and REJECTED; it was NOT executed.${why} Produce a NEW plan that ` +
             "addresses the concern, then continue. This is a RESUMED task — re-plan from the current state; do " +
             "NOT execute the rejected plan.");
@@ -276,7 +277,7 @@ function resumeContinuation(resume) {
     }
     const decided = resume.outcome.decision === "allow"
         ? "was APPROVED and has now been executed — its result is in the tool results above"
-        : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason)}` : ""}`;
+        : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}`;
     const remaining = pendingAction.batchToolCallIds.filter((id) => id !== pendingAction.toolCallId && !pendingAction.completedCallIds.includes(id)).length;
     const batchNote = remaining > 0
         ? ` ${remaining} other tool call(s) from that batch were returned as deferred and not run — re-issue any you still need.`
@@ -3718,11 +3719,36 @@ export class Runner {
             (preCasGateBit.origin === "org_rule" ||
                 preCasGateBit.origin === "org_unavailable" ||
                 preCasGateBit.origin === "policy");
-        if (checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION ? !preCasBitWellFormed : preCasGateBit !== undefined) {
+        const faceSaysGoverned = (cp.state.readFace?.realApproval) === true;
+        const preCasBitViolation = checkpointVersionOf(cp) === REAL_APPROVAL_CHECKPOINT_VERSION
+            ? !preCasBitWellFormed
+            : checkpointVersionOf(cp) < REAL_APPROVAL_CHECKPOINT_VERSION
+                ? preCasGateBit !== undefined
+                : faceSaysGoverned
+                    ? !preCasBitWellFormed
+                    : preCasGateBit !== undefined && !preCasBitWellFormed;
+        if (preCasBitViolation) {
             throw new CheckpointError("checkpoint.invalid_outcome", checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION
-                ? `a v${checkpointVersionOf(cp)} checkpoint must carry a well-formed non-budgetable realApproval gate bit (origin org_rule/org_unavailable/policy) on an irreversible_ask gate — this row does not; refusing to resume a damaged real-approval row (corruption / downgrade guard), the checkpoint stays pending`
+                ? `a v${checkpointVersionOf(cp)} checkpoint's realApproval gate bit must be well-formed (origin org_rule/org_unavailable/policy)${checkpointVersionOf(cp) === REAL_APPROVAL_CHECKPOINT_VERSION ? " and present on an irreversible_ask gate" : ""} — this row's is not; refusing to resume a damaged real-approval row (corruption / downgrade guard), the checkpoint stays pending`
                 : `a v${checkpointVersionOf(cp)} checkpoint carries a realApproval gate bit no release of that version ever minted — refusing to honor a fabricated origin (corruption / forgery guard), the checkpoint stays pending`, { reason: checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION ? "real_approval_damaged" : "real_approval_forged" });
         }
+        {
+            const faceSectionRaw = cp.state.readFace;
+            const faceCandidate = faceSectionRaw !== undefined && typeof faceSectionRaw === "object" && faceSectionRaw !== null
+                ? faceSectionRaw
+                : undefined;
+            const faceWellFormed = faceCandidate !== undefined &&
+                (faceCandidate.face === "open" || faceCandidate.face === "roots") &&
+                (faceCandidate.realApproval === undefined || faceCandidate.realApproval === true) &&
+                (faceCandidate.denyEntries === undefined ||
+                    (Array.isArray(faceCandidate.denyEntries) &&
+                        faceCandidate.denyEntries.every((e) => persistedReadDenyEntryProblem(e) === null)));
+            if (checkpointVersionOf(cp) >= FACE_CHECKPOINT_VERSION ? !faceWellFormed : faceSectionRaw !== undefined) {
+                throw new CheckpointError("checkpoint.invalid_outcome", checkpointVersionOf(cp) >= FACE_CHECKPOINT_VERSION
+                    ? `a v${checkpointVersionOf(cp)} checkpoint must carry a well-formed read-face section (state.readFace) — this row's is missing or malformed; refusing to resume a damaged read-face row (corruption / downgrade guard), the checkpoint stays pending`
+                    : `a v${checkpointVersionOf(cp)} checkpoint carries a read-face section no release of that version ever minted — refusing to honor a fabricated read-face state (corruption / forgery guard), the checkpoint stays pending`, { reason: checkpointVersionOf(cp) >= FACE_CHECKPOINT_VERSION ? "read_face_damaged" : "read_face_forged" });
+            }
+        }
         if ((preCasGateBit?.origin === "org_rule" || preCasGateBit?.origin === "org_unavailable") &&
             this.deps.permissionRuleOrg === undefined) {
             throw new CheckpointError("checkpoint.unsupported_version", `this checkpoint's approval was minted under organization governance (${preCasGateBit.origin}) and this worker has no org adjudication wiring (permissionRuleOrg) — a governed approval may only be redeemed where governance can be enforced; the checkpoint stays pending, resume it on an org-wired worker`, { reason: "governed_unwired" });
@@ -4004,7 +4030,7 @@ export class Runner {
                 : outcome.settledBy === "aborted"
                     ? `The approval for the pending tool call "${pendingAction.toolName}" ended without anyone deciding it (it was cancelled or could not be delivered), so it was not executed.`
                     : `The pending tool call "${pendingAction.toolName}" was denied by an approver.`;
-            const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason) : defaultDenial;
+            const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason, REVIEWER_NOTE_MAX_BODY) : defaultDenial;
             emitEnd(true, { content: formatHookFeedback(reason) });
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(reason), true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);

package/dist/core/runner/session-rule-policy.d.ts

@@ -53,10 +53,11 @@ export declare function isWithin(root: string, p: string): boolean;
  *  - `toolDeny` → deny the listed tools.
  *  - `toolAllow` (if set) → deny any tool NOT listed (a narrowing allowlist).
  *  - `commandAllow`/`commandDeny` → delegate to {@link createCoarseCommandNamePolicy} (argv[0] names; only
- *    speaks about shell tools). allowlist mode denies the un-listed/un-parseable; blocklist mode asks on the
- *    un-parseable bypass surface (the gate decides).
+ *    speaks about shell tools) with `defaultAction:"deny"` in BOTH modes — so this policy structurally
+ *    emits no ask. Allowlist mode denies the un-listed and the un-parseable; blocklist mode denies the
+ *    listed and the un-parseable (a parseable command absent from the deny list stays allowed).
  *  - `allowDirs` (if set) → a WRITE tool must land inside one of the dirs (resolved via `canonicalizeTarget`,
- *    so a symlink can't smuggle a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
+ *    so a symlink can't carry across a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
  *    is DENIED while `allowDirs` is set (fail-closed, mirrors active-skill-scope MAJOR-2).
  * Returns `allow` when nothing constrains the call. `env`/`rootPath` are the task's real exec env + root, so
  * matching sees the actual filesystem (a remote/E2B task resolves in its container). RB-108: a relative

package/dist/core/runner/teardown-bounded.d.ts

@@ -9,7 +9,7 @@
  * mask the original error") — but a promise that never settles is not a throw, and one wedged
  * adapter turned into: for-await done, `result()` never settles (②型, process alive), or — when the
  * wedge happened before the queue closed — a zero-handle pure-logic hang (the 2.12.0 exit-13 shape).
- * The session lock releases in the run IIFE's finally, so one wedged run also poisoned every later
+ * The session lock releases in the run IIFE's finally, so one wedged run also contaminated every later
  * same-session resume.
  *
  * The remedy is the same doctrine as the workflow journal drain (batch-4 F2): a best-effort leg gets

package/dist/core/runner/tool-disclosure.d.ts

@@ -223,7 +223,7 @@ export declare function resolveToolSearch(args: ToolSearchArgs, registry: Readon
  * direct call (ruled 2026-08-03) activates too and is flagged as an error, so it lands in that same
  * under-approximated class by construction: within the process the in-memory `active` set carries it, and
  * a replay that loses it costs the corrected call — which succeeds, and is itself carrier ②. The one way to
- * forge a positive is a deployment `tool_result` hook that rewrites a rejection's error flag to false,
+ * self-declare a positive is a deployment `tool_result` hook that rewrites a rejection's error flag to false,
  * which is the deployment editing its own transcript.
  *
  * design/116 W1-2 note: pre-116 checkpoints whose KEYWORD queries activated up to 25 tools re-derive at

package/dist/core/runner/tool-output-projection.js

@@ -62,7 +62,7 @@ const CC_DETAIL_TYPES = new Set([
     "agent", "task", "task-list", "task-output", "workflow-run",
     "web-fetch", "web-search", "todo", "cron-create", "cron-delete", "cron-list", "image",
     "task-stop", "tool-search", "repo-map", "fork", "enter-plan-mode", "exit-plan-mode",
-    "monitor-start", "path_not_in_root", "readonly_out_of_root", "bash_invalid_timeout",
+    "monitor-start", "path_not_in_root", "read_path_denied", "readonly_out_of_root", "bash_invalid_timeout",
     "report-findings", "schedule-wakeup", "send-message", "agent-transcript", "a2a", "document",
 ]);
 export const structuredFrom = (result) => {