@sema-agent/core 5.34.0 → 5.35.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 5.35.0 — 2026-08-15
+
+No BREAKING changes. One deliberate fail-closed tighten and one loosening-direction fix are called
+out under Changed; everything else is additive.
+
+### Added
+
+- `TaskStream.steer` takes an optional `inputId` dedup key (additive; absent ⇒ byte-identical
+  behavior). The live steer leg becomes idempotent the way the parked leg already was: an identical
+  payload under a seen key is a no-op (nothing injected, no second ledger frame), a DIFFERENT payload
+  under a seen key is refused loudly (`steering.duplicate_input_id`, the parked leg's code), and the
+  caller's key rides the `human_input` frame verbatim (previously a fresh uuid was always minted, so
+  a replayed injection was indistinguishable from an idempotent hit in the receipt). Validation runs
+  before liveness (empty/overlong/reserved-sentinel values are refused, never silently treated as
+  "no key"). Dedup scope is the live stream's lifetime — narrower than the parked queue's persisted
+  window; the contract states the asymmetry rather than pretending parity.
+- `AskRequest.ruleEvidence` (design/252 G-2): an ask carries the rule-provenance evidence behind it —
+  the org snapshot `revision`, the org rule text, and the matched personal rule's add dots — each
+  member present as a value or as a NAMED absence (`not_wired` / `not_adjudicated` / `unavailable` /
+  `no_match` / `not_reported`), so "nothing governed this", "the source was unreadable" and "the lane
+  was skipped" stop sharing one wire shape.
+- Settlement approver attribution (design/252 G-7): both settlement lanes accept an optional
+  `approver` identity, screened (length/control-characters/lone-surrogates, refused not truncated)
+  and TRANSCRIBED — never adjudicated — onto the settled call's `tool_end` frame beside `settledBy`.
+- `probeParkRoundTrip` + `durableParkGapOf` (design/252 G-6): a park-lane liveness self-check (file a
+  synthetic checkpoint, read it back, enumerate, fence) plus the static two-halves reading that turns
+  a missing-session resume symptom into a named absent seat. `ParkSelfCheckResult.casLossObserved`
+  (additive) marks the one green arm a CAS-mis-reporting backend would pass through.
+
+### Changed
+
+- Fail-closed tighten: a `persistedRules.admits()` answer that is neither a string nor an object no
+  longer clears an ask. Previously any non-`undefined` answer cleared it — "`null` admits this call"
+  was an allow built on an unreadable answer.
+- The org-verdict normalizer reads ANY non-array carrier (class instances and callables included —
+  the structural contract admits them) with own-data field reads; refusing the carrier outright
+  could fold a structurally valid org DENY into `unavailable`, i.e. from un-approvable into a
+  real-approval ask a person could clear. Inherited members still never authorize; revoked proxies
+  are contained; foreign array methods (an overridden or species-substituted `.map`/`.filter`) no
+  longer run anywhere on the evidence path.
+- The park probe sweeps behind a late-committing timed-out `put` on either settle, and the
+  approver screen refuses oversized values before materializing a code-point array.
+- Dev-surface: the live-gate recipe and examples switch the reference live model to
+  `deepseek-v4-flash` (operator directive; prior cache/behavior figures quoted against
+  `deepseek-v4-pro` re-anchor on next measurement).
+
 ## 5.34.0 — 2026-08-15
 
 No BREAKING changes. Two behavior-surface additions (both additive seats), one packaging addition,

package/dist/core/checkpoint-store.d.ts

@@ -577,6 +577,31 @@ export type ResumeOutcome = {
      * with the backends and belongs to its own change, not to this one.
      */
     settledBy?: import("./tool-policy.js").ApprovalSettledBy;
+    /**
+     * design/252 G-7 — WHOSE settlement: the identifier the approval channel reports for the party
+     * that ended this wait, transcribed onto the resolved call's `tool_end` frame beside
+     * {@link settledBy}.
+     *
+     * Core AUTHENTICATES NOTHING here. On the durable lane the identity work is entirely the
+     * deployment's — its approval card, its signature check, its operator console decide who this
+     * was; a library holding no identity surface has nothing to check the claim against and does not
+     * pretend otherwise. What core owns is that the claim is well-formed: a plain string, bounded,
+     * free of control characters, refused pre-CAS (`checkpoint.invalid_outcome`) otherwise, like
+     * every other out-of-domain field on this arm. Refused rather than dropped, because a settlement
+     * that silently lost its attributed party reads as unattributed — the misreport this seat exists
+     * to end.
+     *
+     * SCOPE — like {@link settledBy}, this rides the SETTLEMENT and not the persisted winner:
+     * `winnerFromOutcome` records what an `env_failed` replay must reproduce exactly, and who
+     * reported a settlement is not part of that authorization. A replay states its own attribution
+     * and is not held to the first one; binding it into the durable row would also make a re-supply
+     * that merely omits the field fail closed on the recovery path. Carrying it into the row is a
+     * store-shape change owned jointly with the backends and belongs to its own change.
+     *
+     * OPTIONAL and additive: absent means the caller named nobody, which is not the same as "nobody
+     * approved this" and must not be read as one.
+     */
+    approver?: string;
 }
 /** design/74: continue a resource-suspended run with the next slice's allowance. NO decision payload and
  *  NO budget figure — the allowance is computed from {@link Checkpoint.resourceLedger}, so money never
@@ -1631,12 +1656,14 @@ export declare class CheckpointError extends Error {
      *  action: re-review), or `"answer"` (the content-ask answer is missing, or was attached to a
      *  decision that cannot carry one: re-decide with a well-formed answer — ruled 2026-08-04), or
      *  `"settledBy"` (the settlement source is outside the three-word vocabulary: re-decide naming one
-     *  of them, or omit the field). The throw
+     *  of them, or omit the field), or — design/252 G-7 — `"approver"` (the attribution is not a
+     *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
+     *  it). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     readonly detail?: {
-        field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy";
+        field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
          *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were
@@ -1752,12 +1779,14 @@ export declare class CheckpointError extends Error {
      *  action: re-review), or `"answer"` (the content-ask answer is missing, or was attached to a
      *  decision that cannot carry one: re-decide with a well-formed answer — ruled 2026-08-04), or
      *  `"settledBy"` (the settlement source is outside the three-word vocabulary: re-decide naming one
-     *  of them, or omit the field). The throw
+     *  of them, or omit the field), or — design/252 G-7 — `"approver"` (the attribution is not a
+     *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
+     *  it). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     detail?: {
-        field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy";
+        field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
          *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were

package/dist/core/hooks.d.ts

@@ -481,6 +481,14 @@ export interface ToolGateResult {
      * and no post-tool hook can write.
      */
     settledBy?: import("./tool-policy.js").ApprovalSettledBy;
+    /**
+     * design/252 G-7 — WHOSE settlement that was: the identifier the approval channel reported, carried
+     * out verbatim beside {@link settledBy}. This layer authenticates nothing and compares nothing; the
+     * value was screened for shape at the seam that received it (`screenApproverAttribution`) and is a
+     * transcription from there on. Present only where the caller settled something AND reported an
+     * identity — absent everywhere else, and absence never means "nobody": it means nobody said.
+     */
+    approver?: string;
     /** Rewritten args to execute with (re-validated by the loop); omitted when nothing rewrote. */
     updatedInput?: unknown;
     /**
@@ -569,11 +577,90 @@ export type OrgGateVerdict = {
         behavior: "deny" | "ask";
         rule: string;
     };
+    /** design/252 G-2 (additive): the REVISION of the snapshot this answer was read off — the
+     *  published-policy version an auditor reconciles the resulting decision against. Present on the
+     *  available arm whether or not a rule spoke: "revision 41 published nothing about this call" is
+     *  itself the audit answer, and it is a different fact from "we never looked". ABSENT ⇒ the lane
+     *  did not report one (a foreign overlay, or a revision that failed its own domain screen — the
+     *  evidence records that as `"not_reported"` rather than inventing a number). Never adjudication
+     *  input: the verdict above is the whole decision, and dropping this field would leave every
+     *  outcome byte-identical. */
+    revision?: number;
 } | {
     status: "unavailable";
     /** The overlay's own disclosure lines (engine/deployment-authored), for the operator channel. */
     disclosures: readonly string[];
 };
+/**
+ * design/252 G-2 — the richer answer a persisted-rule lane may give instead of the bare rule text (see
+ * `ToolGateInput.persistedRules.admits`): the same canonical text, plus the matched rule's add dots.
+ *
+ * Why the dots and not an id: a persisted allow rule HAS no scalar id — it is a (text, scope) group
+ * whose identity is the set of add dots that redeemed it, and two concurrently approved records for one
+ * text each carry their own. The set is the identity; a joined string would not be one.
+ */
+export interface PersistedRuleHit {
+    /** The canonical text of the admitting rule — the same value the bare-string shape returns. */
+    readonly rule: string;
+    /** The matched rule's LIVE add dots (tombstoned adds already filtered by the store's read). Omitted
+     *  by a lane that has the text but not the dots; the evidence then reports `"not_reported"`. */
+    readonly dots?: readonly import("./permission-rule-model.js").RuleDot[];
+}
+/**
+ * design/252 G-2 — the answer a lane gives when it could not READ its store.
+ *
+ * Its DECISION meaning is identical to "no rule" — a loosening seam that cannot read its source fails
+ * toward asking, and this shape changes no verdict anywhere. What it changes is the RECORD: without it,
+ * an unreadable rule store and a store that genuinely holds no matching rule are the same answer
+ * (`undefined`), and the ask's evidence has to report one of them as the other. The absence vocabulary
+ * distinguishes "we looked and found nothing" (`"no_match"`) from "we could not look" (`"unavailable"`),
+ * and this is how a lane says which one it means.
+ */
+export interface PersistedRuleUnreadable {
+    readonly unreadable: true;
+}
+/** Every shape a lane may answer with. A bare string stays valid and unchanged. */
+export type PersistedRuleAnswer = string | PersistedRuleHit | PersistedRuleUnreadable | undefined;
+/**
+ * design/252 review r3 — read a foreign {@link OrgGateVerdict} the way the personal-rule answer is read:
+ * OWN DATA properties only, never the prototype chain, never an accessor.
+ *
+ * Unlike the personal-rule normalizer below, this one accepts ANY non-array object as the carrier —
+ * not only a plain record. The two seams tighten in opposite directions when a shape is refused: the
+ * personal lane is a LOOSENING seam, so refusing a class instance degrades toward asking; this answer
+ * carries the org's DENY, and folding a structurally valid `{status:"available", verdict:{behavior:
+ * "deny"}}` class instance into `unavailable` would LOOSEN it — from a deny nobody can approve into a
+ * real-approval ask a person can clear. A class instance's fields are its own data properties, so the
+ * own-data read below already gives the full pollution guarantee (inherited members never authorize);
+ * the prototype test added nothing here but the downgrade.
+ *
+ * The two seams are the same class of trust boundary and were not being read the same way. What that
+ * cost here is worse than on the personal lane, because this answer is GOVERNANCE:
+ *  · an inherited `revision` (a polluted `Object.prototype`) stamped a fabricated snapshot version onto
+ *    a human's approval request — a WRONG record, which is worse than an absent one;
+ *  · an inherited `verdict` invented an org rule, and with it an org ask or deny the lane never gave;
+ *  · an answer that is not a record at all read as "available, nothing to say", i.e. the governance
+ *    fail-open the availability contract exists to prevent.
+ * Anything this function cannot read as a well-formed answer becomes `unavailable` — the fail-CLOSED
+ * word, never the empty one.
+ */
+export declare function normalizeOrgGateVerdict(answer: unknown, unreadable: string): OrgGateVerdict;
+/**
+ * Normalize the accepted {@link ToolGateInput.persistedRules} answers into one reading.
+ *
+ * `{}` = a clean negative (no rule admits this call). `{ unreadable: true }` = the lane could not read
+ * its source. `{ hit }` = a match. An answer outside every accepted shape — a number, `null`, an object
+ * with no `rule` — is read as a clean negative rather than a match: this is a LOOSENING seam, so an
+ * answer nobody can name degrades toward asking, never toward an allow built on it.
+ *
+ * The hit's dots are COPIED, not aliased. The array travels onto an ask that may sit in front of a
+ * person for a long time; a lane that retains and mutates its own array would otherwise change what the
+ * approver is looking at, and what an audit later reads, after the evidence was stamped.
+ */
+export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
+    hit?: PersistedRuleHit;
+    unreadable?: true;
+};
 /** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort signal. */
 export interface ToolGateInput {
     /** RB-473 batch 2b — bounded disclosure for a HOST callback that throws inside this gate call's
@@ -794,9 +881,17 @@ export interface ToolGateInput {
      * bullets above are what keep integrity/hook/mandated asks out of that set.
      */
     persistedRules?: {
-        /** The canonical text of the rule that admits this call, or `undefined`. Must not throw: a store that
-         *  cannot be read answers "no rule" and discloses on its own channel (fail-closed = more asks). */
-        admits: (req: ToolCallRequest) => Promise<string | undefined>;
+        /** The rule that admits this call, or `undefined`. Must not throw: a store that cannot be read
+         *  answers "no rule" and discloses on its own channel (fail-closed = more asks).
+         *
+         *  TWO ACCEPTED SHAPES (design/252 G-2, additive — a lane returning the bare string is unchanged
+         *  and stays supported): the canonical rule TEXT, or a {@link PersistedRuleHit} carrying that same
+         *  text plus the matched rule's add DOTS. The dots are the rule's durable identity, and the text
+         *  is not one (it reaches a card sanitized and capped); a lane that can name them lets the
+         *  shadowed-ask evidence say WHICH stored rule matched rather than merely what it looked like.
+         *  Widening the RETURN is why this is additive for implementers: every existing lane satisfies
+         *  the union unchanged, and the gate reads both through one normalizer. */
+        admits: (req: ToolCallRequest) => Promise<PersistedRuleAnswer>;
         /** Observation sink for an ask a rule resolved — the allow-side disclosure. Never affects the outcome. */
         onResolved?: (info: {
             toolName: string;

package/dist/core/hooks.js

@@ -1,4 +1,4 @@
-import { decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
+import { decisionText, describeThrown, refuseOutOfContractDecision } from "./tool-policy.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
@@ -89,6 +89,99 @@ function withParkFailureCause(reason, parkFailed) {
         `(${inlineUntrusted(parkFailed, PARK_FAILURE_CAUSE_MAX)}), so the refusal above is what the fallback had ` +
         `left to say, not the reason the call stopped.`);
 }
+function isPlainOwnRecord(x) {
+    try {
+        if (x === null || typeof x !== "object" || Array.isArray(x))
+            return false;
+        const p = Object.getPrototypeOf(x);
+        return p === Object.prototype || p === null;
+    }
+    catch {
+        return false;
+    }
+}
+function ownDataValue(obj, key) {
+    try {
+        const d = Object.getOwnPropertyDescriptor(obj, key);
+        return d && "value" in d ? d.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function normalizeOrgGateVerdict(answer, unreadable) {
+    const clean = (v) => Object.assign(Object.create(null), v);
+    const readable = (x) => {
+        try {
+            return x !== null && (typeof x === "object" || typeof x === "function") && !Array.isArray(x);
+        }
+        catch {
+            return false;
+        }
+    };
+    if (!readable(answer))
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    const status = ownDataValue(answer, "status");
+    if (status === "unavailable") {
+        const disclosures = ownDataValue(answer, "disclosures");
+        let lines = [];
+        if (Array.isArray(disclosures)) {
+            try {
+                for (let i = 0; i < disclosures.length; i++) {
+                    const d = disclosures[i];
+                    if (typeof d === "string")
+                        lines.push(d);
+                }
+            }
+            catch {
+                lines = [];
+            }
+        }
+        return clean({ status: "unavailable", disclosures: lines.length > 0 ? lines : [unreadable] });
+    }
+    if (status !== "available")
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    const revision = ownDataValue(answer, "revision");
+    const revisionCell = typeof revision === "number" && Number.isFinite(revision) ? { revision } : {};
+    const verdict = ownDataValue(answer, "verdict");
+    if (verdict === undefined)
+        return clean({ status: "available", ...revisionCell });
+    if (!readable(verdict))
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    const behavior = ownDataValue(verdict, "behavior");
+    const rule = ownDataValue(verdict, "rule");
+    if ((behavior !== "deny" && behavior !== "ask") || typeof rule !== "string")
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    return clean({ status: "available", verdict: clean({ behavior: behavior, rule }), ...revisionCell });
+}
+export function normalizePersistedRuleHit(hit) {
+    if (typeof hit === "string")
+        return { hit: { rule: hit } };
+    if (!isPlainOwnRecord(hit))
+        return {};
+    if (ownDataValue(hit, "unreadable") === true)
+        return { unreadable: true };
+    const rule = ownDataValue(hit, "rule");
+    if (typeof rule !== "string")
+        return {};
+    const dots = ownDataValue(hit, "dots");
+    let copied;
+    try {
+        if (Array.isArray(dots)) {
+            const walked = [];
+            for (let i = 0; i < dots.length; i++) {
+                const d = dots[i];
+                walked.push(isPlainOwnRecord(d) ? { actor: ownDataValue(d, "actor"), counter: ownDataValue(d, "counter") } : { actor: undefined, counter: undefined });
+            }
+            copied = walked;
+        }
+    }
+    catch {
+        copied = undefined;
+    }
+    const usable = copied?.every((d) => typeof d.actor === "string" && typeof d.counter === "number" && Number.isFinite(d.counter)) === true && copied.length > 0;
+    return { hit: { rule, ...(usable ? { dots: copied } : {}) } };
+}
 function preToolUseCrashReason(subject, err) {
     const raw = err instanceof Error ? err.message.trim() || err.name : String(err);
     const cause = inlineUntrusted(raw, 200);
@@ -291,22 +384,39 @@ export async function runToolGate(input) {
     let orgRealApprovalRequired = false;
     let orgAskOrigin;
     let orgTightenCount = 0;
+    let resolvedApprover;
+    let orgEvidence = (() => {
+        const w = input.orgRules === undefined ? "not_wired" : "not_adjudicated";
+        return { revisionAbsent: w, ruleAbsent: w };
+    })();
+    const mintRuleEvidence = (personal) => ({
+        ...(orgEvidence.revision !== undefined ? { orgRevision: orgEvidence.revision } : { orgRevisionAbsent: orgEvidence.revisionAbsent ?? "not_reported" }),
+        ...(orgEvidence.rule !== undefined ? { orgRule: orgEvidence.rule } : { orgRuleAbsent: orgEvidence.ruleAbsent ?? "not_reported" }),
+        ...(personal.dots !== undefined ? { personalRuleDots: personal.dots } : { personalRuleDotsAbsent: personal.dotsAbsent ?? "not_reported" }),
+    });
     const applyOrgLayer = async (current, args) => {
         if (input.orgRules === undefined)
             return current;
         if (toolName === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
             return current;
         let decided = current;
-        const answer = await settleOrgVerdictWithin(input.orgRules
-            .adjudicate({ toolName, args, toolCallId })
-            .catch((err) => ({
+        let pending;
+        try {
+            pending = Promise.resolve(input.orgRules.adjudicate({ toolName, args, toolCallId }));
+        }
+        catch (err) {
+            pending = Promise.resolve({ status: "unavailable", disclosures: [`the org adjudication face threw before answering: ${describeThrown(err)}`] });
+        }
+        const raw = await settleOrgVerdictWithin(pending.catch((err) => ({
             status: "unavailable",
-            disclosures: [`the org adjudication face threw: ${err instanceof Error ? err.message : String(err)}`],
+            disclosures: [`the org adjudication face threw: ${describeThrown(err)}`],
         })), {
             status: "unavailable",
             disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`],
         }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
+        const answer = normalizeOrgGateVerdict(raw, "the org adjudication face answered something this gate cannot read as a verdict — treated as unreadable governance, never as an empty one");
         if (answer.status === "unavailable") {
+            orgEvidence = { revisionAbsent: "unavailable", ruleAbsent: "unavailable" };
             orgRealApprovalRequired = true;
             orgAskOrigin = "unavailable";
             await notifier.notifyAsync(() => input.orgRules?.onUnavailable?.({ toolName, toolCallId, message: answer.disclosures.join("; ") }), "toolGate.orgSnapshotUnavailable");
@@ -327,9 +437,13 @@ export async function runToolGate(input) {
             }
             return decided;
         }
-        if (answer.verdict === undefined)
+        const revisionCell = answer.revision !== undefined ? { revision: answer.revision } : { revisionAbsent: "not_reported" };
+        if (answer.verdict === undefined) {
+            orgEvidence = { ...revisionCell, ruleAbsent: "no_match" };
             return decided;
+        }
         const { behavior, rule } = answer.verdict;
+        orgEvidence = { ...revisionCell, rule };
         if (behavior === "deny") {
             orgTightenCount += 1;
             denySource = "org";
@@ -357,6 +471,7 @@ export async function runToolGate(input) {
             req.args = policyRewrite;
         }
         const persistedRuleMandate = persistedRuleMandateOf(input);
+        let personalEvidence = { dotsAbsent: input.persistedRules === undefined ? "not_wired" : "not_adjudicated" };
         if (input.persistedRules &&
             !orgRealApprovalRequired &&
             decision.action === "ask" &&
@@ -364,7 +479,19 @@ export async function runToolGate(input) {
             decision.decisionReason !== "hook" &&
             req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
-            const hit = await input.persistedRules.admits(req).catch(() => undefined);
+            const answer = await (async () => {
+                let pendingHit;
+                try {
+                    pendingHit = Promise.resolve(input.persistedRules?.admits(req));
+                }
+                catch {
+                    return { unreadable: true };
+                }
+                return await pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true }));
+            })();
+            const hitEntry = answer.hit;
+            const hit = hitEntry?.rule;
+            personalEvidence = { dotsAbsent: answer.unreadable === true ? "unavailable" : "no_match" };
             if (hit !== undefined && persistedRuleMandate === undefined && decision.matchedAskRule === undefined) {
                 decision = {
                     action: "allow",
@@ -375,6 +502,7 @@ export async function runToolGate(input) {
                 await notifier.notifyAsync(() => input.persistedRules?.onResolved?.({ toolName: req.toolName, toolCallId, rule: hit }), "toolGate.persistedRuleResolved");
             }
             else if (hit !== undefined) {
+                personalEvidence = hitEntry?.dots !== undefined && hitEntry.dots.length > 0 ? { dots: hitEntry.dots } : { dotsAbsent: "not_reported" };
                 const shownRule = inlineUntrusted(hit, 200);
                 const mandateNoun = persistedRuleMandate === "operator_always"
                     ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)"
@@ -388,6 +516,9 @@ export async function runToolGate(input) {
                 };
             }
         }
+        if (decision.action === "ask") {
+            decision = { ...decision, ruleEvidence: mintRuleEvidence(personalEvidence) };
+        }
         if (input.autoMode &&
             !orgRealApprovalRequired &&
             decision.action === "ask" &&
@@ -492,6 +623,8 @@ export async function runToolGate(input) {
         if (decision.action === "ask") {
             const askBeforeResolve = decision;
             const resolved = await resolveAsk(decision, req);
+            if (resolved.action !== "ask" && resolved.approver !== undefined)
+                resolvedApprover = resolved.approver;
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
                 const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined);
@@ -580,7 +713,8 @@ export async function runToolGate(input) {
                     }
                     if (recheck.updatedInput !== undefined)
                         editArgs = recheck.updatedInput;
-                    const rr = await resolveAsk(recheck, { toolName, args: editArgs, toolCallId });
+                    const rr = await resolveAsk({ ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) }, { toolName, args: editArgs, toolCallId });
+                    resolvedApprover = rr.action !== "ask" ? rr.approver : undefined;
                     if (rr.action !== "allow") {
                         editDenied = rr;
                         if (!orgRaisedThisRound)
@@ -610,10 +744,12 @@ export async function runToolGate(input) {
             await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource }), "toolGate.permissionDenied");
         }
         const denySettledBy = decision.settledBy;
+        const denyApprover = denySettledBy !== undefined ? resolvedApprover : undefined;
         return {
             block: true,
             reason: formatHookFeedback(denyReason),
             ...(denySettledBy !== undefined ? { settledBy: denySettledBy } : {}),
+            ...(denyApprover !== undefined ? { approver: denyApprover } : {}),
             preToolContext,
         };
     }
@@ -623,9 +759,11 @@ export async function runToolGate(input) {
             currentInput = rw;
     }
     const allowSettledBy = decision.action === "allow" ? decision.settledBy : undefined;
+    const allowApprover = decision.action === "allow" && allowSettledBy !== undefined ? resolvedApprover : undefined;
     return {
         updatedInput: currentInput === event.input ? undefined : currentInput,
         ...(allowSettledBy !== undefined ? { settledBy: allowSettledBy } : {}),
+        ...(allowApprover !== undefined ? { approver: allowApprover } : {}),
         preToolContext,
     };
 }