@sema-agent/core 5.34.0 → 5.35.0

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,7 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
@@ -88,6 +88,7 @@ import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
 import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
+import { durableParkGapFor } from "../park-selfcheck.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "../usage-window-store.js";
 import { deliverEngineNotice } from "../types.js";
 const announcedMaterializeEnv = new Set();
@@ -192,6 +193,46 @@ async function forgetQuietly(sessions, sessionId) {
     catch {
     }
 }
+function screenGateSettlement(result, settling) {
+    const defects = [];
+    const reportedBy = result.settledBy;
+    let settledBy;
+    if (reportedBy !== undefined) {
+        if (!isApprovalSettledBy(reportedBy) || (!settling && reportedBy !== "human")) {
+            defects.push(`a tool-gate settlement reported settledBy "${String(reportedBy)}" on ${settling ? "a blocked" : "an executing"} call — ` +
+                `it is one of "human" / "timeout" / "aborted", and only "human" can be the source of a call that runs; the frame carries no source`);
+        }
+        else
+            settledBy = reportedBy;
+    }
+    const attribution = screenApproverAttribution(result.approver);
+    if (attribution.defect !== undefined) {
+        defects.push(`a tool-gate settlement reported an attribution this engine refuses: ${attribution.defect}; the frame carries no approver`);
+    }
+    const record = {
+        ...(settledBy !== undefined ? { settledBy } : {}),
+        ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}),
+    };
+    return { ...(settledBy !== undefined || attribution.approver !== undefined ? { record } : {}), defects };
+}
+function inheritedAskRuleEvidence(deps) {
+    const org = deps.permissionRuleOrg === undefined ? "not_wired" : "not_adjudicated";
+    const personal = deps.permissionRuleStore === undefined ? "not_wired" : "not_adjudicated";
+    return Object.freeze({ orgRevisionAbsent: org, orgRuleAbsent: org, personalRuleDotsAbsent: personal });
+}
+function orgRevisionEvidenceOf(resolution, onDefect) {
+    const reported = resolution.revision;
+    if (reported === undefined)
+        return {};
+    if (typeof reported === "number" && Number.isFinite(reported))
+        return { revision: reported };
+    onDefect(`the org rule overlay reported revision ${JSON.stringify(reported)} — a snapshot revision is a finite number; ` +
+        `the adjudication stands, but the ask carries no revision evidence for this call`);
+    return {};
+}
+function persistedRuleHitOf(admitting) {
+    return admitting === undefined ? undefined : { rule: admitting.rule, dots: admitting.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) };
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
@@ -204,7 +245,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         e.code = "resume.session_not_found";
         throw e;
     }
-    const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects });
+    const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
     const hostTaskId = spec.taskId ?? sessionId;
     if (compModel !== undefined) {
@@ -2778,6 +2819,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return {};
             return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
         };
+        const inheritedAskEvidence = inheritedAskRuleEvidence(deps);
         const permissionRuleLane = (() => {
             const provider = deps.permissionRuleStore;
             const localOwnerDeclared = deps.localOwnerRules === true;
@@ -2817,9 +2859,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             message: err instanceof Error ? err.message : String(err),
                             ts: Date.now(),
                         }));
-                        return undefined;
+                        return { unreadable: true };
                     }
-                    return findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root })?.rule;
+                    return persistedRuleHitOf(findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root }));
                 },
             };
         })();
@@ -2840,11 +2882,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                     if (resolution.status === "unavailable")
                         return { status: "unavailable", disclosures: resolution.disclosures };
+                    const revisionCell = orgRevisionEvidenceOf(resolution, (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }));
                     const command = req.args?.command;
                     if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
-                        return { status: "available" };
+                        return { status: "available", ...revisionCell };
                     const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
-                    return verdict === undefined ? { status: "available" } : { status: "available", verdict };
+                    return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
                 },
             };
         })();
@@ -2926,6 +2969,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...riskAxesOf(creq.toolName),
                     ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     ...(re.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: re.persistedRuleShadowed } : {}),
+                    ruleEvidence: inheritedAskEvidence,
                 }, onAskOf, csignal ?? abortController.signal);
                 if (rr.action !== "allow")
                     return rr;
@@ -3011,6 +3055,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...riskAxesOf(creq.toolName),
                             ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                             ...(first.action === "ask" && first.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: first.persistedRuleShadowed } : {}),
+                            ruleEvidence: inheritedAskEvidence,
                         }, pc.onAsk, csignal ?? abortController.signal);
                         const askWaitMs = Math.max(0, now() - askT0);
                         if (resolved.action === "deny" && resolved.approverUnavailable === true) {
@@ -3098,6 +3143,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...riskAxesOf(creq.toolName),
                             ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                             ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
+                            ruleEvidence: inheritedAskEvidence,
                         }, pc.onAsk, csignal ?? abortController.signal);
                         const askWaitMs = Math.max(0, now() - askT0);
                         if (resolved.action === "deny" && resolved.approverUnavailable === true) {
@@ -3239,7 +3285,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const preToolContexts = new Map();
         const blockedToolCalls = new Set();
-        const approvalSettledBy = new Map();
+        const approvalSettlement = new Map();
         const blockedTracked = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure || hooks?.postToolBatch);
         const restoreSurfaceGap = ownedEnv !== undefined && isRemoteExecutionEnv(ownedEnv) && ownedEnv.capabilities.suspendable ? missingRestoreSurface(ownedEnv) : [];
         const incompleteSuspendAdapter = restoreSurfaceGap.length > 0 ? restoreSurfaceGap : undefined;
@@ -3413,6 +3459,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
                     ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
                     ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
+                    ...(decision.action === "ask" && decision.ruleEvidence !== undefined ? { ruleEvidence: decision.ruleEvidence } : {}),
                 }, onAsk, abortController.signal);
                 const waitMs = Math.max(0, now() - t0);
                 if (resolved.approverUnavailable !== true) {
@@ -4230,17 +4277,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     if (blockedTracked && (result.block || result.suspend)) {
                         blockedToolCalls.add(e.toolCallId);
                     }
-                    const reported = result.settledBy;
-                    if (reported !== undefined) {
-                        const settling = result.block === true;
-                        if (!isApprovalSettledBy(reported) || (!settling && reported !== "human")) {
-                            deps.onError?.(new Error(`a tool-gate settlement reported settledBy "${String(reported)}" on ${settling ? "a blocked" : "an executing"} call — ` +
-                                `it is one of "human" / "timeout" / "aborted", and only "human" can be the source of a call that runs; the frame carries no source`), { phase: "config", sessionId });
-                        }
-                        else {
-                            approvalSettledBy.set(e.toolCallId, reported);
-                        }
-                    }
+                    const settlement = screenGateSettlement(result, result.block === true);
+                    for (const defect of settlement.defects)
+                        deps.onError?.(new Error(defect), { phase: "config", sessionId });
+                    if (settlement.record !== undefined)
+                        approvalSettlement.set(e.toolCallId, settlement.record);
                     return result.block
                         ? { block: true, reason: result.reason }
                         : result.updatedInput !== undefined
@@ -4552,7 +4593,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.d.ts

@@ -80,13 +80,18 @@ declare function toolEndBodyFrom(result: unknown, isError: boolean,
  *  a parameter and never derived from `result`: a tool's own `details` (which post-tool hooks may
  *  also replace) is writable by layers that adjudicate nothing, so reading provenance out of it would
  *  let a failing tool claim a person approved it. Omitted ⇒ this call settled no approval. */
-settledBy?: ApprovalSettledBy): {
+settledBy?: ApprovalSettledBy, 
+/** design/252 G-7 — WHOSE settlement, from the same caller and the same channel as `settledBy`, and
+ *  for the same reason it is a parameter: an attribution read out of a tool's own result would let a
+ *  tool name the person who approved it. Omitted ⇒ this call's settlement named nobody. */
+approver?: string): {
     output?: unknown;
     truncated?: boolean;
     totalChars?: number;
     structured?: unknown;
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
+    approver?: string;
 };
 /**
  * scan-1/A1 — the BODY of the synthetic `tool_end` that closes a reconcile-recovered orphan. ONE

package/dist/core/runner/runtask.js

@@ -2,7 +2,7 @@ import { persistedReadDenyEntryProblem } from "../../tools/fs/read-deny.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
+import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, LEGACY_PENDING_STEER_INPUT_ID, MAX_STEER_INPUT_ID_CHARS, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
 import { engineVersion } from "../version.js";
 import { CONFIG_CATALOG_VERSION, declarationReasons, resolveEffectiveConfig } from "../../config/catalog.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
@@ -41,7 +41,7 @@ import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntr
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
-import { checkToolPolicyProjection, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, refuseOutOfContractDecision, toolPolicyNameSets } from "../tool-policy.js";
+import { checkToolPolicyProjection, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, refuseOutOfContractDecision, screenApproverAttribution, toolPolicyNameSets } from "../tool-policy.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { discloseDroppedPending, isDelegatedAgentTerminal, PendingSessionNotifications, renderTaskNotificationXml, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
@@ -68,6 +68,13 @@ function nextHumanInputSeq(key) {
     }
     return ++box.n;
 }
+function sameAcceptedSteerInput(a, b) {
+    return (a.payload === b.payload &&
+        a.trusted === b.trusted &&
+        a.actor?.id === b.actor?.id &&
+        a.actor?.hostAsserted === b.actor?.hostAsserted &&
+        a.actor?.issuer === b.actor?.issuer);
+}
 const MAX_CONSECUTIVE_COMPACTION_FAILURES = 3;
 const STOP_HOOK_BLOCK_CAP = 8;
 const COMPACTION_REGROWTH_FACTOR = 1.5;
@@ -130,7 +137,7 @@ function resumeDecisionWasNegative(resume) {
 }
 const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
     "NOT executed on resume. If you still need it, issue it again now.";
-function toolEndBodyFrom(result, isError, settledBy) {
+function toolEndBodyFrom(result, isError, settledBy, approver) {
     const o = toolOutputFrom(result);
     const st = structuredFrom(result);
     const det = isError ? result?.details : undefined;
@@ -142,6 +149,7 @@ function toolEndBodyFrom(result, isError, settledBy) {
         ...(st !== undefined ? { structured: st } : {}),
         ...(typeof code === "string" ? { errorCode: code } : {}),
         ...(settledBy !== undefined ? { settledBy } : {}),
+        ...(approver !== undefined ? { approver } : {}),
     };
 }
 export function reconciledToolEndBody(orphan) {
@@ -1213,16 +1221,16 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                     prepared.lspDiagnostics.nudge(p);
             }
         }
-        const settledBy = prepared.approvalSettledBy.get(event.toolCallId);
-        if (settledBy !== undefined)
-            prepared.approvalSettledBy.delete(event.toolCallId);
+        const settlement = prepared.approvalSettlement.get(event.toolCallId);
+        if (settlement !== undefined)
+            prepared.approvalSettlement.delete(event.toolCallId);
         pushContent({
             type: "tool_end",
             toolCallId: event.toolCallId,
             toolName: event.toolName,
             ...(toolLabels.get(event.toolName) !== undefined ? { label: toolLabels.get(event.toolName) } : {}),
             isError: event.isError,
-            ...toolEndBodyFrom(event.result, event.isError, settledBy),
+            ...toolEndBodyFrom(event.result, event.isError, settlement?.settledBy, settlement?.approver),
             ...ident(),
         });
         announceWorkspaceMove();
@@ -1444,6 +1452,7 @@ export class Runner {
         };
         let reapHandle;
         let steerChain = Promise.resolve();
+        const acceptedSteerInputs = new Map();
         const notifyRef = {};
         const manualCompactRef = { requested: false, waiters: [] };
         const drainManualCompactWaiters = (outcome) => {
@@ -1565,6 +1574,7 @@ export class Runner {
             queue.push({ type: "done", result: resultValue });
             queue.close();
         });
+        void settled.then(() => acceptedSteerInputs.clear(), () => acceptedSteerInputs.clear());
         const steeringError = (msg, code = "steering.not_running") => {
             const e = new Error(`cannot steer: ${msg}`);
             e.code = code;
@@ -1613,22 +1623,40 @@ export class Runner {
                 return suggestionsDone.catch(() => []);
             },
             steer: async (text, options) => {
-                if (options?.trusted && sanitizeUntrustedText(text) !== text) {
+                const trusted = options?.trusted ? true : false;
+                if (trusted && sanitizeUntrustedText(text) !== text) {
                     throw steeringError("trusted steering text must not contain a </system-reminder> tag", "steering.invalid_content");
                 }
-                const actor = options?.actor === undefined ? undefined : snapshotActorAssertion(options.actor);
+                const inputId = options?.inputId;
+                if (inputId !== undefined) {
+                    if (typeof inputId !== "string") {
+                        throw steeringError("inputId must be a string when supplied", "steering.invalid_content");
+                    }
+                    if (inputId === "" || inputId.length > MAX_STEER_INPUT_ID_CHARS) {
+                        throw steeringError(`inputId must be a non-empty string of at most ${MAX_STEER_INPUT_ID_CHARS} characters`, "steering.invalid_content");
+                    }
+                    if (inputId === LEGACY_PENDING_STEER_INPUT_ID) {
+                        throw steeringError(`inputId "${LEGACY_PENDING_STEER_INPUT_ID}" is reserved for a pre-queue parked steer and cannot be supplied by a caller`, "steering.invalid_content");
+                    }
+                }
+                const actorIn = options?.actor;
+                const actor = actorIn === undefined ? undefined : snapshotActorAssertion(actorIn);
                 const projected = projectHumanInput({ text, actor, source: "steer" });
-                const payload = options?.trusted ? formatHookFeedback(projected) : projected;
+                const payload = trusted ? formatHookFeedback(projected) : projected;
                 const mintsAFrame = payload.trim().length !== 0;
-                const emitAccepted = (h) => {
+                const replay = { payload, trusted, ...(actor !== undefined ? { actor } : {}) };
+                const noteAccepted = (h) => {
                     if (!mintsAFrame)
                         return;
+                    if (typeof inputId === "string")
+                        acceptedSteerInputs.set(inputId, replay);
                     queue.push({
                         ...buildHumanInputEvent({
                             carrier: "steer",
                             source: "steer",
                             delivery: "queued",
                             sessionSeq: nextHumanInputSeq(h.harness),
+                            ...(typeof inputId === "string" ? { inputId } : {}),
                             ...(actor !== undefined ? { actor } : {}),
                             ...(actor?.issuer !== undefined ? { issuer: actor.issuer } : {}),
                             ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
@@ -1645,9 +1673,21 @@ export class Runner {
                     const h = handle ?? (await orTimeout(ready));
                     if (!h)
                         throw steeringError("the task is not running");
+                    if (typeof inputId === "string") {
+                        const prior = acceptedSteerInputs.get(inputId);
+                        if (prior !== undefined) {
+                            if (resultValue !== undefined || h.loop.ended)
+                                throw steeringError("the task is no longer running");
+                            if (!sameAcceptedSteerInput(prior, replay)) {
+                                throw steeringError("a different steering instruction was already accepted under this inputId — re-issue this one with a fresh inputId " +
+                                    "(an identical payload would have been an idempotent retry)", "steering.duplicate_input_id");
+                            }
+                            return;
+                        }
+                    }
                     try {
                         await h.harness.steer(payload, { provenance: "engine-note", ...(actor !== undefined ? { actor } : {}) });
-                        emitAccepted(h);
+                        noteAccepted(h);
                         return;
                     }
                     catch (e) {
@@ -1658,7 +1698,7 @@ export class Runner {
                     while (resultValue === undefined && !h.loop.ended && Date.now() < birthDeadline) {
                         try {
                             await h.harness.steer(payload, { provenance: "engine-note", ...(actor !== undefined ? { actor } : {}) });
-                            emitAccepted(h);
+                            noteAccepted(h);
                             return;
                         }
                         catch (e2) {
@@ -3664,6 +3704,15 @@ export class Runner {
                 throw new CheckpointError("checkpoint.invalid_outcome", `resume carries decision "allow" with settledBy "${settledBy}" — a non-human settlement is a fail-closed end (nobody answered), so it cannot be the source of an approval that EXECUTES; ` +
                     "supply \"human\", or omit the field if the allow came from configuration rather than a person; refusing pre-CAS, the checkpoint stays pending", { field: "settledBy" });
             }
+            const approver = decide.approver;
+            const attribution = screenApproverAttribution(approver);
+            if (attribution.defect !== undefined) {
+                throw new CheckpointError("checkpoint.invalid_outcome", `resume carries an approver attribution this engine refuses: ${attribution.defect}; refusing pre-CAS, the checkpoint stays pending`, { field: "approver" });
+            }
+            if (attribution.approver !== undefined && settledBy === undefined) {
+                throw new CheckpointError("checkpoint.invalid_outcome", `resume names an approver but no settledBy — an attribution says WHOSE settlement it was and needs the word that says what KIND of end it was beside it; ` +
+                    `supply settledBy ("human" / "timeout" / "aborted"), or omit the approver; refusing pre-CAS, the checkpoint stays pending`, { field: "approver" });
+            }
             const reason = decide.reason;
             assertOutcomeText(reason, "reason");
             plainPolicyOutcome = {
@@ -3675,6 +3724,7 @@ export class Runner {
                 ...(reason !== undefined ? { reason } : {}),
                 ...(redeemedAnswer !== undefined ? { answer: redeemedAnswer } : {}),
                 ...(settledBy !== undefined ? { settledBy } : {}),
+                ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}),
             };
             if (plainPolicyOutcome.decision === "deny" && plainPolicyOutcome.reason && sanitizeUntrustedText(plainPolicyOutcome.reason) !== plainPolicyOutcome.reason) {
                 throw new CheckpointError("checkpoint.invalid_outcome", "resume deny/reject reason must not contain a </system-reminder> tag");
@@ -4037,7 +4087,7 @@ export class Runner {
         const resolvedArgs = pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME ? pendingAction.args : (outcome.updatedInput !== undefined ? outcome.updatedInput : pendingAction.args);
         const pendingLabel = (() => { const l = prepared.tools.find((t) => t.name === pendingAction.toolName)?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
         emit({ type: "tool_start", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, args: resolvedArgs });
-        const emitEnd = (isError, result) => emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError, outcome.settledBy) });
+        const emitEnd = (isError, result) => emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError, outcome.settledBy, outcome.approver) });
         if (outcome.decision === "deny") {
             const defaultDenial = outcome.settledBy === "timeout"
                 ? `No one answered the approval request for the pending tool call "${pendingAction.toolName}" — the approval window elapsed with no answer, so it was not executed.`

package/dist/core/tool-errors.d.ts

@@ -117,8 +117,8 @@ export type WorkerErrorClass = "budget" | "limit" | "output" | "suspend" | "revi
  * are NOT all terminal-errorCode-shaped — see {@link EXACT_CODE_CLASS}'s comment), plus the flat 1.36 codes.
  * The `limits.` namespace splits into the `budget` and `limit` classes by exact code — see
  * {@link EXACT_CODE_CLASS}. Operation-level dotted codes that are surfaced to a *caller* and never become a
- * task outcome are deliberately OUT of scope: `steering.*` (`steering.not_running`/`steering.invalid_content`,
- * rejected to the `steer()` caller) and `mcp.*` (`mcp.server_unavailable`, an `onWarn` warning code) — neither
+ * task outcome are deliberately OUT of scope: `steering.*` (`steering.not_running`/`steering.invalid_content`/
+ * `steering.duplicate_input_id`, rejected to the `steer()` caller) and `mcp.*` (`mcp.server_unavailable`, an `onWarn` warning code) — neither
  * reaches `TaskResult.errorCode`, so a caller will never pass them here. A genuinely unmapped code → `"unknown"` (which therefore means
  * "known-but-foreign or no code", e.g. a leaked fs/Node code, NOT "an OUR terminal class we forgot to add").
  */

package/dist/core/tool-policy.d.ts

@@ -118,6 +118,34 @@ export type ApprovalSettledBy = "human" | "timeout" | "aborted";
 export declare const APPROVAL_SETTLED_BY_VALUES: readonly ApprovalSettledBy[];
 /** True iff `v` is one of the three {@link ApprovalSettledBy} words. */
 export declare function isApprovalSettledBy(v: unknown): v is ApprovalSettledBy;
+/**
+ * design/252 G-7 — how long an approver-attribution identifier may be.
+ *
+ * Sized for the identifiers approval channels actually carry (a login, an email, an opaque account id,
+ * a queue name) with room to spare, and bounded at all because this value lands on an operator-plane
+ * frame that a deployment may persist: an unbounded field on a record channel is its own denial of a
+ * readable record. An over-long value is REFUSED, never truncated — a cut identifier names a different
+ * party, or nobody, and either is worse than the honest refusal.
+ */
+export declare const APPROVER_ATTRIBUTION_MAX_CHARS = 256;
+/**
+ * design/252 G-7 — screen a deployment-supplied approver identifier before it becomes an observation.
+ *
+ * THE POSTURE, stated so it is not mistaken for something stronger: core does not authenticate this
+ * value, does not compare it to anything, and never reads it back to decide anything. It is a
+ * TRANSCRIPTION of what the approval channel said about its own settlement — the channel (a server's
+ * approval card, an HMAC-verified callback, an operator console) is where identity is established, and
+ * a library that holds no identity surface cannot second-guess it. What core owns is that the value is
+ * a value: a string, bounded, free of control bytes, or else loudly refused.
+ *
+ * Returns `{}` for "nothing supplied" (absent, and an empty string — an id of no characters is the
+ * absence of an id, the same truthiness fold the deny-note seat uses), `{ approver }` for a value to
+ * carry, or `{ defect }` with the sentence a caller puts in its own refusal.
+ */
+export declare function screenApproverAttribution(v: unknown): {
+    approver?: string;
+    defect?: string;
+};
 /**
  * A three-state permission decision for a tool call (design/37). Upgrades the old two-state
  * `{allow|deny}`:
@@ -162,6 +190,7 @@ export type PermissionResult = {
     message?: string;
     decisionReason?: DecisionReason;
     settledBy?: Extract<ApprovalSettledBy, "human">;
+    approver?: string;
 } | {
     action: "ask";
     updatedInput?: unknown;
@@ -199,13 +228,86 @@ export type PermissionResult = {
      *  when ANY folded-away concurrent ask bore it (monotone, tighten-only); it is consumed inside the
      *  gate and deliberately NOT copied onto the park/approval-card request. */
     matchedAskRule?: string;
+    /** design/252 G-2 (additive): the RULE-PROVENANCE evidence behind this ask — see
+     *  {@link AskRuleEvidence}. ENGINE-STAMPED inside the gate, once, after the org layer and the
+     *  persisted-rule lane have both spoken; a policy that self-declares it is overwritten there
+     *  (the member is a record of what the ENGINE's own governance layers did, so a layer's claim
+     *  about itself is not evidence). Carried onto the approval request by the gate's own ask mint
+     *  site. Display/reconciliation metadata, never adjudication input. */
+    ruleEvidence?: AskRuleEvidence;
 } | {
     action: "deny";
     updatedInput?: unknown;
     message?: string;
     decisionReason?: DecisionReason;
     settledBy?: ApprovalSettledBy;
+    approver?: string;
 };
+/**
+ * design/252 G-2 — WHY a piece of rule-provenance evidence is not on an ask.
+ *
+ * The vocabulary exists because a bare `undefined` reads the same for facts that are opposite: "no
+ * governance layer is wired here, so there is nothing to name" and "the layer ran and we could not
+ * read what it said" are not the same audit answer, and collapsing them is how an evidence chain
+ * comes to be reconstructed as "nothing governed this call". Every member of {@link AskRuleEvidence}
+ * therefore ships as a value OR a named absence, never as silence.
+ *
+ *  - `"not_wired"` — the lane does not exist on this leg (an ungoverned deployment, no rule store).
+ *    The field cannot apply; nothing was lost.
+ *  - `"not_adjudicated"` — the lane exists but this call never reached it (an exempt tool, a call
+ *    the rule grammar cannot describe). Applicable in principle, skipped in fact.
+ *  - `"unavailable"` — the lane was consulted and could not read its source. The evidence is LOST,
+ *    not absent, and this is the one member of the vocabulary that means an auditor should treat the
+ *    chain as broken rather than empty.
+ *  - `"no_match"` — consulted, readable, and nothing spoke for this call. A real negative answer.
+ *  - `"not_reported"` — the supplying seam answered without the identity (a foreign overlay/store
+ *    implementation, or one written before the identity was projected). Evidence lost at the seam.
+ */
+export type AskEvidenceAbsence = "not_wired" | "not_adjudicated" | "unavailable" | "no_match" | "not_reported";
+/** The closed set above, for runtime domain checks at the seams that accept a caller-supplied value. */
+export declare const ASK_EVIDENCE_ABSENCE_VALUES: readonly AskEvidenceAbsence[];
+/**
+ * design/252 G-2 — the machine-reconcilable provenance of the governance decision behind ONE ask.
+ *
+ * WHAT THIS IS: a PROJECTION of identity keys the engine's governance layers already hold — the org
+ * snapshot's `revision`, the personal rule's add `dot`s — onto the surface a consumer can actually
+ * read. It performs no new judgment and changes no verdict; removing it would leave every decision
+ * byte-identical. The prose channels ({@link PermissionResult}'s ask `message`,
+ * {@link AskRequest.persistedRuleShadowed}) say the same things to a PERSON; those are sanitized,
+ * capped, display-shaped strings, and reconciling a decision against a published policy revision by
+ * regexing them is not an audit trail. This member is the machine's copy.
+ *
+ * WHAT THIS IS NOT: an authority channel. Nothing in the engine reads it back to decide anything, and
+ * a host that ignores it entirely is governed exactly as before.
+ *
+ * ABSENCE DISCIPLINE (the reason each member has a `…Absent` twin): see {@link AskEvidenceAbsence}.
+ * Exactly one of each pair is present — a member and its absence reason are never both set, and never
+ * both missing, on evidence the engine stamped.
+ */
+export interface AskRuleEvidence {
+    /** The org snapshot `revision` this call was adjudicated against — the published-policy version an
+     *  auditor reconciles the decision against. Absent ⇒ {@link orgRevisionAbsent} names why. */
+    readonly orgRevision?: number;
+    /** Present iff {@link orgRevision} is not. `"unavailable"` here is the load-bearing one: the org
+     *  layer spoke, its answer was "this deployment cannot see the organization's rules", and the ask
+     *  in hand is the fail-closed tighten that followed — not an ask any published rule asked for. */
+    readonly orgRevisionAbsent?: AskEvidenceAbsence;
+    /** The org rule that spoke for this call, verbatim as published (org rules are administrator
+     *  authored and are relayed unmodified — the prose channel's copy is the same text). Absent ⇒
+     *  {@link orgRuleAbsent} names why. */
+    readonly orgRule?: string;
+    /** Present iff {@link orgRule} is not. */
+    readonly orgRuleAbsent?: AskEvidenceAbsence;
+    /** The add dots of the PERSONAL allow rule that matched this call but did not clear the ask (the
+     *  #144 shadowed arm). The dots are the rule's durable identity — unlike
+     *  {@link AskRequest.persistedRuleShadowed}, which is a sanitized, length-capped DISPLAY value and
+     *  deliberately not an identity channel. A rule is a set of adds (concurrent approvals on one text
+     *  each redeem their own dot), so this is an array by construction: render/reconcile the entries as
+     *  data, never re-derive one scalar id by joining them. Absent ⇒ {@link personalRuleDotsAbsent}. */
+    readonly personalRuleDots?: readonly import("./permission-rule-model.js").RuleDot[];
+    /** Present iff {@link personalRuleDots} is not. */
+    readonly personalRuleDotsAbsent?: AskEvidenceAbsence;
+}
 /** The human/model-readable text of a decision. */
 export declare function decisionText(d: PermissionResult): string | undefined;
 /**
@@ -682,6 +784,15 @@ export interface AskRequest {
      *  structure: render the entries as data, never re-derive structure by splitting or joining them.
      *  The durable park route carries the same value as `RiskDescriptor.probeCause`. */
     readonly probeCause?: import("./checkpoint-store.js").ProbeCause;
+    /** design/252 G-2: the RULE-PROVENANCE evidence behind this ask — the org snapshot revision and the
+     *  matched rules' own identity keys, each present as a value or as a named absence (see
+     *  {@link AskRuleEvidence}). Present on EVERY ask the engine mints, so a consumer never has to tell a
+     *  missing field from a field that means something: the gate's own mint site fills it from what its
+     *  layers did, and the three INHERITED-lane sites — which present an ANCESTOR policy's decision, from
+     *  upstream of both lanes — fill it with an all-`"not_adjudicated"` record rather than a fabricated
+     *  revision. Optional on the TYPE only because a deployment may invoke its approver directly.
+     *  RECONCILIATION metadata, never adjudication input. */
+    readonly ruleEvidence?: AskRuleEvidence;
     toolCallId: string;
     /** The (post-rewrite) args the tool would run with. */
     args: unknown;
@@ -859,12 +970,26 @@ export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal)
  *    domain the durable leg enforces pre-CAS for the same field), a THROWING read is a fail-closed
  *    deny naming the true cause (never a raw rejection out of the gate), and the empty string reads
  *    as absent (truthiness, the durable consumer's own read).
+ *
+ * `approver` (design/252 G-7) — the ATTRIBUTION seat: the identifier the approval channel reports for
+ * the party that ended this wait. Core does not authenticate it, compare it, or read it back to decide
+ * anything; it transcribes it onto the settlement observation next to `settledBy`, so an audit that can
+ * already say "a person ended this wait" can also say which one, without core growing an identity
+ * surface it deliberately does not have. Read the two together: `settledBy:"timeout"` with an
+ * `approver` names the queue whose window elapsed, NOT someone who refused.
+ * Screened, not trusted (see {@link screenApproverAttribution}): a non-string, an over-long value or one
+ * carrying control characters is a loud fail-closed refusal at {@link resolveAsk}, the same posture this
+ * seam takes for every other out-of-contract value — and the same reason, since a defective attribution
+ * that were quietly dropped would leave a settlement looking unattributed rather than misreported. It is
+ * carried on the arms where the CALLER settled something (its allow, its human/timeout deny) and never
+ * on an end the engine produced (an abort, a throw, an unclonable edit): nobody approved those.
  */
 export type AskOutcome = boolean | "unavailable" | {
     allow: boolean;
     updatedInput?: unknown;
     settledBy?: Extract<ApprovalSettledBy, "human" | "timeout">;
     reason?: string;
+    approver?: string;
 };
 /**
  * ruled 2026-08-04 — forward an approver into a delegated child, stamping every ask it raises with the