@sema-agent/core 5.34.0 → 5.36.0

package/dist/core/runner/git-status-frame.js

@@ -0,0 +1,212 @@
+import { createHash } from "node:crypto";
+import { GIT_SNAPSHOT_CC_PREAMBLE, buildGitSnapshot } from "../../prompts/default.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { engineRegionCovers, protectGitFrame } from "../context-guard.js";
+import { gitFrameContextVisible } from "../../internal/harness.js";
+export const GIT_STATUS_FRAME_FORMAT_VERSION = 1;
+export const GIT_STATUS_FRAME_PREAMBLE = "This is the git status observed while preparing this request. When the visible snapshot changes it will be re-sent in a later message — the most recent git status frame supersedes earlier ones.";
+export const GIT_STATUS_UNAVAILABLE_BODY = "Git status is currently unavailable; the most recent git status frame above may be stale.";
+export const GIT_STATUS_NON_REPO_BODY = "The working directory is no longer a git repository; earlier git status frames no longer apply.";
+export const GIT_STATUS_ECHO_PREVIEW = {
+    full: "git status updated",
+    degraded: "git status updated (degraded: branch and dirtiness only)",
+    unavailable: "git status unavailable",
+    "non-repo": "git status: no longer a git repository",
+};
+function toWellFormedText(s) {
+    const native = s.toWellFormed;
+    if (typeof native === "function")
+        return native.call(s);
+    return s.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "�");
+}
+export function renderGitStatusFrameBody(outcome) {
+    switch (outcome.kind) {
+        case "full": {
+            const body = outcome.snapshot.startsWith(GIT_SNAPSHOT_CC_PREAMBLE)
+                ? GIT_STATUS_FRAME_PREAMBLE + outcome.snapshot.slice(GIT_SNAPSHOT_CC_PREAMBLE.length)
+                : `${GIT_STATUS_FRAME_PREAMBLE}\n\n${outcome.snapshot}`;
+            return toWellFormedText(body);
+        }
+        case "degraded": {
+            const lines = [GIT_STATUS_FRAME_PREAMBLE];
+            lines.push(`Current branch: ${inlineUntrusted(outcome.branch ?? "HEAD")}`);
+            if (outcome.dirty !== undefined) {
+                lines.push(`Git working tree: ${outcome.dirty ? "has uncommitted changes" : "clean"}`);
+            }
+            return toWellFormedText(lines.join("\n\n"));
+        }
+        case "unavailable":
+            return GIT_STATUS_UNAVAILABLE_BODY;
+        case "non-repo":
+            return GIT_STATUS_NON_REPO_BODY;
+    }
+}
+export function hashGitStatusFrame(kind, body, canonicalRoot) {
+    return `sha256:${createHash("sha256")
+        .update(`${GIT_STATUS_FRAME_FORMAT_VERSION}\u0000${canonicalRoot}\u0000${kind}\u0000${body}`)
+        .digest("hex")}`;
+}
+export function resolveGitStatusFrame(outcome, canonicalRoot, degradedMaterial) {
+    const body = renderGitStatusFrameBody(outcome);
+    const resolved = {
+        kind: outcome.kind,
+        body,
+        hash: hashGitStatusFrame(outcome.kind, body, canonicalRoot),
+    };
+    if (outcome.kind === "full") {
+        const shrunkBody = renderGitStatusFrameBody({ kind: "degraded", ...(degradedMaterial ?? {}) });
+        resolved.shrunk = { body: shrunkBody, hash: hashGitStatusFrame("degraded", shrunkBody, canonicalRoot) };
+    }
+    return resolved;
+}
+export async function probeGitStatusLane(args) {
+    const { executionEnv, envFacts, handsEnabled, taskRoot, onDegrade } = args;
+    const ref = {};
+    if (!handsEnabled)
+        return ref;
+    let outcome;
+    if (envFacts.isGitRepo === true) {
+        const SEP = "@@SEMA_ENV_GIT_SPLIT@@";
+        outcome = {
+            kind: "degraded",
+            ...(envFacts.gitBranch !== undefined ? { branch: envFacts.gitBranch } : {}),
+            ...(envFacts.gitDirty !== undefined ? { dirty: envFacts.gitDirty } : {}),
+        };
+        try {
+            const snap = await executionEnv.exec(`(m=$(git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null); m=\${m#origin/}; for s in "$m" main master; do if [ -n "$s" ] && git show-ref --verify --quiet "refs/remotes/origin/$s"; then echo "$s"; break; fi; done) || true; echo "${SEP}"; (git config user.name 2>/dev/null || true); echo "${SEP}"; gs=$(git --no-optional-locks status --short) || exit 41; printf '%s\\n' "$gs"; echo "${SEP}"; gl=$(git --no-optional-locks log --oneline -n 5) || exit 42; printf '%s\\n' "$gl"`, { cwd: envFacts.cwd, timeout: 10 });
+            if (snap.ok && snap.value.exitCode === 0) {
+                const parts = snap.value.stdout.split(`${SEP}\n`);
+                if (parts.length === 4) {
+                    outcome = {
+                        kind: "full",
+                        snapshot: buildGitSnapshot({
+                            branch: envFacts.gitBranch ?? "HEAD",
+                            mainBranch: parts[0].trim() || "main",
+                            ...(parts[1].trim() ? { userName: parts[1].trim() } : {}),
+                            status: parts[2],
+                            log: parts[3],
+                        }),
+                    };
+                }
+                else {
+                    onDegrade(`sentinel mis-split (${parts.length} sections, expected 4)`);
+                }
+            }
+            else {
+                onDegrade(snap.ok
+                    ? snap.value.exitCode === 41
+                        ? "git status failed (exit 41)"
+                        : snap.value.exitCode === 42
+                            ? "git log failed (exit 42)"
+                            : `git exited ${snap.value.exitCode}`
+                    : `exec failed: ${snap.error.message}`);
+            }
+        }
+        catch (err) {
+            onDegrade(err instanceof Error ? err.message : String(err));
+        }
+    }
+    else if (envFacts.isGitRepo === false) {
+        outcome = { kind: "non-repo" };
+    }
+    else {
+        outcome = { kind: "unavailable" };
+    }
+    const rootRaw = envFacts.gitWorktreeRoot ?? envFacts.cwd ?? taskRoot;
+    let canonicalRoot = rootRaw;
+    try {
+        const c = await executionEnv.canonicalPath(rootRaw);
+        if (c.ok)
+            canonicalRoot = c.value;
+    }
+    catch {
+    }
+    ref.canonicalRoot = canonicalRoot;
+    ref.frame = resolveGitStatusFrame(outcome, canonicalRoot, {
+        ...(envFacts.gitBranch !== undefined ? { branch: envFacts.gitBranch } : {}),
+        ...(envFacts.gitDirty !== undefined ? { dirty: envFacts.gitDirty } : {}),
+    });
+    return ref;
+}
+export function applyGitFrameGuard(args) {
+    const { before, trimmed, budgetTokens, ref, charsPerToken, onDegrade } = args;
+    if (ref.protectedText === undefined)
+        return trimmed;
+    const guarded = protectGitFrame(before, trimmed, budgetTokens, {
+        protectedText: ref.protectedText,
+        ...(ref.frame?.kind === "full" && ref.frame.shrunk !== undefined && ref.wrappedShrink !== undefined ? { substitute: ref.wrappedShrink } : {}),
+    }, charsPerToken);
+    if (guarded.action === "over_budget") {
+        ref.terminalCode = "irreducible_core_over_budget";
+        throw Object.assign(new Error("irreducible core over budget: the compaction summary plus the git status frame alone exceed the request budget — no trim can produce an honest request"), { code: "irreducible_core_over_budget" });
+    }
+    if (guarded.action === "shrunk" && !ref.overBudgetShrunk) {
+        ref.overBudgetShrunk = true;
+        if (ref.announced !== undefined)
+            ref.announced = { ...ref.announced, pending: true };
+        onDegrade("git status frame degraded under budget pressure: the full snapshot no longer fits the request budget — requests carry the branch+dirty residual; the degraded view will be re-announced");
+    }
+    return guarded.messages;
+}
+export function newestEngineGitFrame(branch) {
+    const positiveHead = `<system-reminder>\n${GIT_STATUS_FRAME_PREAMBLE}`;
+    const tombUnits = [`<system-reminder>\n${GIT_STATUS_UNAVAILABLE_BODY}\n</system-reminder>`, `<system-reminder>\n${GIT_STATUS_NON_REPO_BODY}\n</system-reminder>`];
+    const topLevel = (text, at) => {
+        if (at === 0)
+            return true;
+        const before = text.slice(0, at).replace(/\n+$/, "");
+        return before === "" || before.endsWith("</system-reminder>");
+    };
+    const allTopLevel = (text, needle, m) => {
+        const out = [];
+        for (let at = text.indexOf(needle); at !== -1; at = text.indexOf(needle, at + 1)) {
+            if (topLevel(text, at) && engineRegionCovers(m, at, needle.length))
+                out.push(at);
+        }
+        return out;
+    };
+    for (let i = branch.length - 1; i >= 0; i--) {
+        const entry = branch[i];
+        if (entry === undefined || entry.type !== "message")
+            continue;
+        const m = entry.message;
+        if (m.role !== "user")
+            continue;
+        const c = m.content;
+        const text = typeof c === "string" ? c : Array.isArray(c) && c.length >= 1 && c[0].type === "text" ? (c[0].text ?? "") : undefined;
+        if (text === undefined)
+            continue;
+        let best;
+        for (const at of allTopLevel(text, positiveHead, m)) {
+            if (best === undefined || at > best.at)
+                best = { at, positive: true };
+        }
+        for (const unit of tombUnits) {
+            for (const at of allTopLevel(text, unit, m)) {
+                if (best === undefined || at > best.at)
+                    best = { at, positive: false };
+            }
+        }
+        if (best !== undefined)
+            return { entryId: entry.id, positive: best.positive };
+    }
+    return undefined;
+}
+export function stripGitStatusUnits(text) {
+    const head = `<system-reminder>\n${GIT_STATUS_FRAME_PREAMBLE}`;
+    const close = "</system-reminder>";
+    let out = text;
+    for (let at = out.indexOf(head); at !== -1; at = out.indexOf(head)) {
+        const end = out.indexOf(close, at);
+        if (end === -1)
+            break;
+        if (out.slice(at + head.length, end).includes("<system-reminder>"))
+            break;
+        out = out.slice(0, at) + out.slice(end + close.length);
+    }
+    return out;
+}
+export function branchCarriesVisiblePositiveGitFrame(branch) {
+    const newest = newestEngineGitFrame(branch);
+    return newest !== undefined && newest.positive && gitFrameContextVisible(branch, newest.entryId);
+}

package/dist/core/runner/prepare-acquire-reconcile.d.ts

@@ -40,6 +40,12 @@ export interface PrepareAcquireReconcileInput {
      *  {@link import("./prepare-safety-scan.js").PrepareSafetyScanResult}); reconcile classifies an
      *  orphaned call's retry-safety by it. */
     toolEffects: Map<string, ToolEffect>;
+    /** borrowed-readonly — design/252 G-6 sibling: the durable-park TOPOLOGY gap sentence for this
+     *  deployment (`durableParkGapFor`), or `undefined` when the topology is whole / does not apply.
+     *  Read ONLY on the fail-loud missing-session path below, where it turns a symptom into a named
+     *  absent seat; nothing in the phase's control flow depends on it. Computed by the driver (which
+     *  holds `deps`) rather than here, keeping this slice's input the narrow Pick its contract says. */
+    durableParkGap?: string;
 }
 /** The phase's outputs (design/238 相 API 规则件 four-class form). All five are fresh bindings —
  *  the driver destructures them into consts, so a consumer moved ahead of this call is a lexical

package/dist/core/runner/prepare-acquire-reconcile.js

@@ -39,7 +39,8 @@ export async function prepareAcquireReconcile(input) {
         }
         catch (err) {
             if (spec.requireExistingSession && err?.code === "not_found") {
-                const e = new Error(`requireExistingSession: session "${spec.sessionId}" does not exist — refusing a silent fresh run (design/114 Phase3)`);
+                const e = new Error(`requireExistingSession: session "${spec.sessionId}" does not exist — refusing a silent fresh run (design/114 Phase3)` +
+                    (input.durableParkGap !== undefined ? `. Note the assembly: ${input.durableParkGap}` : ""));
                 e.code = "resume.session_not_found";
                 throw e;
             }

package/dist/core/runner/prepare-task.d.ts

@@ -17,6 +17,7 @@ import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-de
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
 import { type OutputRef, type BlockedRef, type SkillListingEntry } from "./synthetic-tools.js";
 import type { MemoryEngine } from "../memory-engine/engine.js";
+import { type GitStatusLaneRef } from "./git-status-frame.js";
 import { type ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { ToolDisclosureManifest } from "../trace.js";
 import type { TaskNotificationPayload } from "../task-notification.js";
@@ -169,9 +170,14 @@ export interface Prepared {
      *  emits; the tool_result-side delete in prepare-task never fires for immediate results). */
     blockedToolCalls: Set<string>;
     /**
-     * What ended the approval a gated call was waiting on, keyed by tool-call id — written ONLY by the
-     * tool gate, at the one exit where an ask resolved, and read once when that call's `tool_end` frame
-     * is minted (the reader deletes on read; a call the gate never settled has no entry).
+     * WHAT ended the approval a gated call was waiting on and — design/252 G-7 — WHOSE settlement it
+     * was, keyed by tool-call id: written ONLY by the tool gate, at the one exit where an ask resolved,
+     * and read once when that call's `tool_end` frame is minted (the reader deletes on read; a call the
+     * gate never settled has no entry, and an entry never names neither fact).
+     *
+     * ONE record rather than two parallel maps because they are one observation: an attribution without
+     * the settlement kind beside it is unreadable ("alice" — approved? her window elapsed?), and two maps
+     * keyed alike are two chances to drain one and leak the other.
      *
      * It is a sideband and not a field on the tool RESULT because a result is not a trustworthy carrier
      * for this: `details` is arbitrary tool-authored data that post-tool hooks may also replace, so a
@@ -180,7 +186,10 @@ export interface Prepared {
      * adjudicating layer can write. Same reason the entries are keyed by CALL id: the gate adjudicated
      * that exact call, and the frame that reads it is that call's own.
      */
-    approvalSettledBy: Map<string, import("../tool-policy.js").ApprovalSettledBy>;
+    approvalSettlement: Map<string, {
+        settledBy?: import("../tool-policy.js").ApprovalSettledBy;
+        approver?: string;
+    }>;
     /** Summed usage of nested sub-runs (sub-agents) spawned by this task's tools. */
     nestedStats: NestedUsageAccum;
     /** RB-430-a: prepare-time rewind disclosures (conversation-only branch / no snapshot backend / no file
@@ -739,6 +748,12 @@ export interface Prepared {
         skills?: readonly string[];
         models?: readonly string[];
     };
+    /** env-tail migration (#254 shape) — the git-status frame lane's run-local state: this leg's
+     *  resolved frame (probe outcome rendered + hashed at prepare), the announced `(kind, hash)`
+     *  mirror the checkpoint serializer reads, the trim-protection slot the request-build context
+     *  handler matches on, and the re-assert closure the compaction landing + boundary retry call.
+     *  Always present (empty object on a hands-less leg — the lane is then out of scope). */
+    gitStatusRef: GitStatusLaneRef;
     /** G1 通告层 — narrow post-compact getter over the process task registry: THIS run's visible
      *  pending/running background tasks (same owner/scope/session identity the TaskOutput/TaskStop tools
      *  use), as a bounded display projection (id/description/status — never handles/env/abort). Called by
@@ -1236,6 +1251,15 @@ export interface RunInternals {
      * stamping. TRUSTED run-scoped channel (never a {@link TaskSpec} field).
      */
     delegationTaskType?: import("../types.js").DelegationTaskType;
+    /**
+     * #258 — the registry row's stop-cycle generation this run executes as (fresh spawn = 1, a
+     * revival's bumped counter), threaded by the BACKGROUND delegation lanes from the registry's own
+     * `cycleSeq` so every `task_progress` tick the run mints carries it as `seq` (same axis as
+     * `TaskNotificationPayload.seq` / `BackgroundChildEvent.seq`). Absent for runs with no `a*` row
+     * (sync children, workflow agents, top-level) — same absence-is-a-fact posture as
+     * {@link delegationTaskType} above. TRUSTED run-scoped channel (never a TaskSpec field).
+     */
+    cycleSeq?: number;
     /** δ 批 [1498]⑦/A-3 — the ROOT host session of the whole delegation tree (fixed point: the
      *  spawner passes its own `ctx.rootSessionId ?? ctx.sessionId`, so depth 1 gets the host session
      *  and every deeper level inherits it verbatim). `parentSessionId` is the IMMEDIATE spawner —

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,7 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
@@ -56,7 +56,8 @@ import { limitConfigError, prepareConfigDoors } from "./prepare-config-doors.js"
 import { NAMESPACED_NAME_SHAPES, prepareSafetyScan } from "./prepare-safety-scan.js";
 import { prepareAcquireReconcile } from "./prepare-acquire-reconcile.js";
 import { prepareWorkspaceRestore, rebaseWorkspacePath, remoteEnvFailureNote, restoreWorkspaceWithRetry } from "./prepare-workspace-restore.js";
-import { defaultPromptProvider, buildEnvironmentContext, buildGitSnapshot, formatLocalDate, isValidTimeZone, PROJECT_CONTEXT_FRAMING } from "../../prompts/default.js";
+import { defaultPromptProvider, buildEnvironmentContext, formatLocalDate, isValidTimeZone, PROJECT_CONTEXT_FRAMING } from "../../prompts/default.js";
+import { applyGitFrameGuard, probeGitStatusLane } from "./git-status-frame.js";
 import { assemblePrompt } from "../../prompt-assembly/assemble.js";
 import { auditToolCollisions, getToolContract, projectToolManifest } from "../../prompt-assembly/tool-catalog.js";
 import { resolveEpochAgainstBundled } from "../../prompt-assembly/epoch.js";
@@ -88,6 +89,7 @@ import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
 import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
+import { durableParkGapFor } from "../park-selfcheck.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "../usage-window-store.js";
 import { deliverEngineNotice } from "../types.js";
 const announcedMaterializeEnv = new Set();
@@ -192,6 +194,46 @@ async function forgetQuietly(sessions, sessionId) {
     catch {
     }
 }
+function screenGateSettlement(result, settling) {
+    const defects = [];
+    const reportedBy = result.settledBy;
+    let settledBy;
+    if (reportedBy !== undefined) {
+        if (!isApprovalSettledBy(reportedBy) || (!settling && reportedBy !== "human")) {
+            defects.push(`a tool-gate settlement reported settledBy "${String(reportedBy)}" on ${settling ? "a blocked" : "an executing"} call — ` +
+                `it is one of "human" / "timeout" / "aborted", and only "human" can be the source of a call that runs; the frame carries no source`);
+        }
+        else
+            settledBy = reportedBy;
+    }
+    const attribution = screenApproverAttribution(result.approver);
+    if (attribution.defect !== undefined) {
+        defects.push(`a tool-gate settlement reported an attribution this engine refuses: ${attribution.defect}; the frame carries no approver`);
+    }
+    const record = {
+        ...(settledBy !== undefined ? { settledBy } : {}),
+        ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}),
+    };
+    return { ...(settledBy !== undefined || attribution.approver !== undefined ? { record } : {}), defects };
+}
+function inheritedAskRuleEvidence(deps) {
+    const org = deps.permissionRuleOrg === undefined ? "not_wired" : "not_adjudicated";
+    const personal = deps.permissionRuleStore === undefined ? "not_wired" : "not_adjudicated";
+    return Object.freeze({ orgRevisionAbsent: org, orgRuleAbsent: org, personalRuleDotsAbsent: personal });
+}
+function orgRevisionEvidenceOf(resolution, onDefect) {
+    const reported = resolution.revision;
+    if (reported === undefined)
+        return {};
+    if (typeof reported === "number" && Number.isFinite(reported))
+        return { revision: reported };
+    onDefect(`the org rule overlay reported revision ${JSON.stringify(reported)} — a snapshot revision is a finite number; ` +
+        `the adjudication stands, but the ask carries no revision evidence for this call`);
+    return {};
+}
+function persistedRuleHitOf(admitting) {
+    return admitting === undefined ? undefined : { rule: admitting.rule, dots: admitting.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) };
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
@@ -204,7 +246,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         e.code = "resume.session_not_found";
         throw e;
     }
-    const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects });
+    const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
     const hostTaskId = spec.taskId ?? sessionId;
     if (compModel !== undefined) {
@@ -1834,38 +1876,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             catch {
             }
-            if (envFacts.isGitRepo === true) {
-                const SEP = "@@SEMA_ENV_GIT_SPLIT@@";
-                try {
-                    const snap = await executionEnv.exec(`(m=$(git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null); m=\${m#origin/}; for s in "$m" main master; do if [ -n "$s" ] && git show-ref --verify --quiet "refs/remotes/origin/$s"; then echo "$s"; break; fi; done) || true; echo "${SEP}"; (git config user.name 2>/dev/null || true); echo "${SEP}"; gs=$(git --no-optional-locks status --short) || exit 41; printf '%s\\n' "$gs"; echo "${SEP}"; gl=$(git --no-optional-locks log --oneline -n 5) || exit 42; printf '%s\\n' "$gl"`, { cwd: envFacts.cwd, timeout: 10 });
-                    if (snap.ok && snap.value.exitCode === 0) {
-                        const parts = snap.value.stdout.split(`${SEP}\n`);
-                        if (parts.length === 4) {
-                            envFacts.gitSnapshot = buildGitSnapshot({
-                                branch: envFacts.gitBranch ?? "HEAD",
-                                mainBranch: parts[0].trim() || "main",
-                                ...(parts[1].trim() ? { userName: parts[1].trim() } : {}),
-                                status: parts[2],
-                                log: parts[3],
-                            });
-                        }
-                    }
-                    else {
-                        const reason = snap.ok
-                            ? snap.value.exitCode === 41
-                                ? "git status failed (exit 41)"
-                                : snap.value.exitCode === 42
-                                    ? "git log failed (exit 42)"
-                                    : `git exited ${snap.value.exitCode}`
-                            : `exec failed: ${snap.error.message}`;
-                        deps.onError?.(new Error(`env git snapshot skipped — ${reason}`), { phase: "degraded", sessionId, classification: "env-git-snapshot" });
-                    }
-                }
-                catch (err) {
-                    deps.onError?.(new Error(`env git snapshot skipped — ${err instanceof Error ? err.message : String(err)}`), { phase: "degraded", sessionId, classification: "env-git-snapshot" });
-                }
-            }
         }
+        const gitStatusRef = await probeGitStatusLane({
+            executionEnv,
+            envFacts,
+            handsEnabled,
+            taskRoot: taskRootFinal,
+            onDegrade: (reason) => deps.onError?.(new Error(`env git snapshot degraded — ${reason}`), { phase: "degraded", sessionId, classification: "env-git-snapshot" }),
+        });
         if (toolFaceSnapshot.exclude !== undefined && toolFaceSnapshot.exclude.length > 0) {
             const excluded = new Set(toolFaceSnapshot.exclude);
             for (let i = tools.length - 1; i >= 0; i--)
@@ -2778,6 +2796,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return {};
             return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
         };
+        const inheritedAskEvidence = inheritedAskRuleEvidence(deps);
         const permissionRuleLane = (() => {
             const provider = deps.permissionRuleStore;
             const localOwnerDeclared = deps.localOwnerRules === true;
@@ -2817,9 +2836,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             message: err instanceof Error ? err.message : String(err),
                             ts: Date.now(),
                         }));
-                        return undefined;
+                        return { unreadable: true };
                     }
-                    return findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root })?.rule;
+                    return persistedRuleHitOf(findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root }));
                 },
             };
         })();
@@ -2840,11 +2859,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                     if (resolution.status === "unavailable")
                         return { status: "unavailable", disclosures: resolution.disclosures };
+                    const revisionCell = orgRevisionEvidenceOf(resolution, (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }));
                     const command = req.args?.command;
                     if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
-                        return { status: "available" };
+                        return { status: "available", ...revisionCell };
                     const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
-                    return verdict === undefined ? { status: "available" } : { status: "available", verdict };
+                    return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
                 },
             };
         })();
@@ -2926,6 +2946,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...riskAxesOf(creq.toolName),
                     ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     ...(re.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: re.persistedRuleShadowed } : {}),
+                    ruleEvidence: inheritedAskEvidence,
                 }, onAskOf, csignal ?? abortController.signal);
                 if (rr.action !== "allow")
                     return rr;
@@ -3011,6 +3032,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...riskAxesOf(creq.toolName),
                             ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                             ...(first.action === "ask" && first.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: first.persistedRuleShadowed } : {}),
+                            ruleEvidence: inheritedAskEvidence,
                         }, pc.onAsk, csignal ?? abortController.signal);
                         const askWaitMs = Math.max(0, now() - askT0);
                         if (resolved.action === "deny" && resolved.approverUnavailable === true) {
@@ -3098,6 +3120,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...riskAxesOf(creq.toolName),
                             ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                             ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
+                            ruleEvidence: inheritedAskEvidence,
                         }, pc.onAsk, csignal ?? abortController.signal);
                         const askWaitMs = Math.max(0, now() - askT0);
                         if (resolved.action === "deny" && resolved.approverUnavailable === true) {
@@ -3239,7 +3262,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const preToolContexts = new Map();
         const blockedToolCalls = new Set();
-        const approvalSettledBy = new Map();
+        const approvalSettlement = new Map();
         const blockedTracked = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure || hooks?.postToolBatch);
         const restoreSurfaceGap = ownedEnv !== undefined && isRemoteExecutionEnv(ownedEnv) && ownedEnv.capabilities.suspendable ? missingRestoreSurface(ownedEnv) : [];
         const incompleteSuspendAdapter = restoreSurfaceGap.length > 0 ? restoreSurfaceGap : undefined;
@@ -3413,6 +3436,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
                     ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
                     ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
+                    ...(decision.action === "ask" && decision.ruleEvidence !== undefined ? { ruleEvidence: decision.ruleEvidence } : {}),
                 }, onAsk, abortController.signal);
                 const waitMs = Math.max(0, now() - t0);
                 if (resolved.approverUnavailable !== true) {
@@ -3530,6 +3554,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...(announcedListingsRef.models !== undefined ? { models: [...announcedListingsRef.models] } : {}),
                     }
                     : undefined,
+                gitAnnouncement: gitStatusRef.announced !== undefined ? { ...gitStatusRef.announced } : undefined,
                 delegationProvenance: internals?.delegationProvenance !== undefined ? { ...internals.delegationProvenance.ref.current } : undefined,
             });
             const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
@@ -4230,17 +4255,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     if (blockedTracked && (result.block || result.suspend)) {
                         blockedToolCalls.add(e.toolCallId);
                     }
-                    const reported = result.settledBy;
-                    if (reported !== undefined) {
-                        const settling = result.block === true;
-                        if (!isApprovalSettledBy(reported) || (!settling && reported !== "human")) {
-                            deps.onError?.(new Error(`a tool-gate settlement reported settledBy "${String(reported)}" on ${settling ? "a blocked" : "an executing"} call — ` +
-                                `it is one of "human" / "timeout" / "aborted", and only "human" can be the source of a call that runs; the frame carries no source`), { phase: "config", sessionId });
-                        }
-                        else {
-                            approvalSettledBy.set(e.toolCallId, reported);
-                        }
-                    }
+                    const settlement = screenGateSettlement(result, result.block === true);
+                    for (const defect of settlement.defects)
+                        deps.onError?.(new Error(defect), { phase: "config", sessionId });
+                    if (settlement.record !== undefined)
+                        approvalSettlement.set(e.toolCallId, settlement.record);
                     return result.block
                         ? { block: true, reason: result.reason }
                         : result.updatedInput !== undefined
@@ -4347,6 +4366,20 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ts: Date.now(),
                 }));
             }
+            trimmed = applyGitFrameGuard({
+                before: edited,
+                trimmed,
+                budgetTokens: guardAt,
+                ref: gitStatusRef,
+                charsPerToken,
+                onDegrade: (message) => {
+                    try {
+                        deps.onError?.(new Error(message), { phase: "degraded", sessionId, classification: "env-git-snapshot" });
+                    }
+                    catch {
+                    }
+                },
+            });
             const swept = dropOrphanToolResults(trimmed);
             if (swept.dropped.length > 0) {
                 try {
@@ -4363,7 +4396,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     mediaCapped !== capped ||
                     edited !== mediaCapped ||
                     trimDroppedMessages ||
-                    swept.dropped.length > 0;
+                    swept.dropped.length > 0 ||
+                    gitStatusRef.overBudgetShrunk === true;
             return { messages: swept.messages };
         });
         const cacheBreakDetector = deps.cacheBreakDetection === false ? undefined : new CacheBreakDetector();
@@ -4552,7 +4586,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.d.ts

@@ -80,13 +80,18 @@ declare function toolEndBodyFrom(result: unknown, isError: boolean,
  *  a parameter and never derived from `result`: a tool's own `details` (which post-tool hooks may
  *  also replace) is writable by layers that adjudicate nothing, so reading provenance out of it would
  *  let a failing tool claim a person approved it. Omitted ⇒ this call settled no approval. */
-settledBy?: ApprovalSettledBy): {
+settledBy?: ApprovalSettledBy, 
+/** design/252 G-7 — WHOSE settlement, from the same caller and the same channel as `settledBy`, and
+ *  for the same reason it is a parameter: an attribution read out of a tool's own result would let a
+ *  tool name the person who approved it. Omitted ⇒ this call's settlement named nobody. */
+approver?: string): {
     output?: unknown;
     truncated?: boolean;
     totalChars?: number;
     structured?: unknown;
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
+    approver?: string;
 };
 /**
  * scan-1/A1 — the BODY of the synthetic `tool_end` that closes a reconcile-recovered orphan. ONE