@sema-agent/core 5.37.0 → 5.38.0

package/dist/core/checkpoint-store.d.ts

@@ -1034,6 +1034,27 @@ export interface CheckpointState {
      * with a recorder armed; ABSENT on an unarmed leg AND on an older checkpoint — the resume side reads
      * absence-on-an-armed-child fail-closed as `incomplete`. */
     delegationProvenance?: import("./memory-engine/delegation-provenance.js").DelegationProvenanceAggregate;
+    /**
+     * #281 件B follow-up — `true` iff the suspended leg ran as a DELEGATED CHILD (the trusted
+     * `RunInternals.isDelegatedChild` fact, read off the leg's own minted
+     * {@link import("./runner/prepare-task.js").Prepared.hookIdentity} so a re-suspend chain carries it
+     * forward). Without it a deps-only resume (`resume(token, outcome, config)` — no trusted internals
+     * re-supplied) re-minted the resumed leg's identity with `isDelegatedChild: false`, so the
+     * delegation-lifecycle observer's emission gate stayed shut and the resumed leg emitted NEITHER
+     * frame — a deployment watching only that seat saw a human-approved delegation frozen at its
+     * park-leg `"suspended"` terminal forever. Live internals still win when re-supplied (the in-engine
+     * resume lanes all do); the checkpoint key is the fallback for the deps-only leg. Only this ONE
+     * axis persists — `insideFork`/`agentName`/`parentToolCallId` stay internals-only, honestly absent
+     * on a deps-only resume rather than guessed; the accepted residue of the absent `insideFork` is
+     * that a FORK child resumed deps-only reads as a plain delegated child on the non-fork consumer
+     * facet (subagent persona/context trim) — documented here rather than fixed with a new
+     * persistence axis. Schema ADDITION (additive, old readers ignore it —
+     * the Q5 posture; no version movement): an older worker resuming a newer row keeps the pre-key
+     * behavior, and an older row without the key resumes frame-less by documented honest absence
+     * (see {@link import("./types.js").DelegationLifecycleEvent}). Absent = the leg was not a
+     * delegated child (never `false` — presence-coded like the other monotonic bits here).
+     */
+    isDelegatedChild?: true;
 }
 /**
  * {@link CheckpointState} with **every** field made required-PRESENT, while each value keeps its original
@@ -2099,7 +2120,11 @@ export interface CheckpointStore {
      * a real pin is the in-memory `TtlSessionStore` (single-instance / tests), where an un-released pin
      * keeps an abandoned suspended session in the cache until process exit. v1 leaves the runner without an
      * auto-reaper (the service owns the TTL worker); a reaper over the in-memory store should track and
-     * `unpin` the expired sessions itself if that leak matters for its deployment.
+     * `unpin` the expired sessions itself if that leak matters for its deployment. This no-unpin posture
+     * is LOCAL to this live-path `reap`: the managed-retention contract's `expireCheckpoints`
+     * ({@link import("./retention.js").ManagedRetentionCapability}) deliberately closes the reap/unpin
+     * split — a retention-terminal row has its pin released BY that method, so pin release stays
+     * exactly-once per row (each row is terminated by exactly one of the two lanes).
      */
     reap(scope: string, cutoff: number): Promise<number>;
     /**

package/dist/core/hooks.d.ts

@@ -2,6 +2,7 @@ import type { DocumentContent, ImageContent, TextContent } from "../internal/llm
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
 import { type AskClass } from "./ask-class.js";
+import type { WiringLegKind } from "./wiring-manifest.js";
 /**
  * In-process hook seam (design/37) — a provider-agnostic interception layer modeled on CC's hooks,
  * kept process-internal (no shell/HTTP executors, no settings files). The original tool-call trio:
@@ -67,7 +68,10 @@ export interface Hooks {
      */
     preToolUseObservational?: true;
     postToolUse?(toolName: string, input: unknown, output: HookToolOutput, ctx: HookToolContext): PostToolUseResult | undefined | Promise<PostToolUseResult | undefined>;
-    userPromptSubmit?(prompt: string): UserPromptSubmitResult | undefined | Promise<UserPromptSubmitResult | undefined>;
+    userPromptSubmit?(prompt: string, 
+    /** #281 件A (additive): the run/leg identity envelope — an implementation declaring only
+     *  `(prompt)` keeps working. Always supplied on the engine's emission. */
+    ctx?: UserPromptSubmitContext): UserPromptSubmitResult | undefined | Promise<UserPromptSubmitResult | undefined>;
     /**
      * roadmap #5 (CC 198 Stop hook, :473831-): runs when the agent WOULD OTHERWISE END its run (no
      * more tool calls, steering and follow-up queues dry). Return `{ block: reason }` to PUSH BACK —
@@ -106,7 +110,11 @@ export interface Hooks {
      */
     postToolBatch?(batch: PostToolBatchCall[], meta?: {
         injectedThisTurn: "final_verification" | "finalize";
-    }): PostToolBatchResult | undefined | Promise<PostToolBatchResult | undefined>;
+    }, 
+    /** #281 件A (additive): the run/leg identity envelope, on its OWN parameter — `meta`'s presence
+     *  is an existing signal ("the engine injected at this boundary") that must not become
+     *  always-true just because identity rides along. Always supplied on the engine's emission. */
+    ctx?: PostToolBatchContext): PostToolBatchResult | undefined | Promise<PostToolBatchResult | undefined>;
     /**
      * design/134 (CC PreCompact parity): runs before each compaction, AFTER the trigger gate and a
      * valid cut point are confirmed (so every preCompact corresponds to a compaction that would
@@ -177,6 +185,10 @@ export interface Hooks {
 export type PermissionDeniedSource = "policy" | "hook" | "safety" | "shellGate" | "planMode" | "classifier" | "org";
 /** The payload a {@link Hooks.permissionDenied} callback observes (CC-exact fields + `source`). */
 export interface PermissionDeniedPayload {
+    /** #281 件A — the run/leg identity envelope. Present on every ENGINE emission (the gate's single
+     *  deny exit, the hook-crash intercept, the plan-mode and compliance denies); absent only when a
+     *  host drives {@link runToolGate} without `ToolGateInput.identity`. */
+    identity?: HookInvocationIdentity;
     toolName: string;
     /** The FINAL (post-hook-rewrite / post-policy-rewrite) args the chain adjudicated — what would have
      *  executed; not necessarily the model's original args. */
@@ -198,6 +210,9 @@ export interface PermissionDeniedPayload {
 export declare function cloneObserverInput(input: unknown): unknown;
 /** Context for {@link Hooks.stopFailure} — aligned with the TaskResult error face (observe-only). */
 export interface StopFailureContext {
+    /** #281 件A — the run/leg identity envelope (always present on the engine's emission; the seat is
+     *  optional only because the envelope's whole contract is). See {@link HookInvocationIdentity}. */
+    identity?: HookInvocationIdentity;
     /** Human-readable error message (the assembled `errorMessage`; any `[code]` prefix already stripped). */
     error: string;
     /** Machine-readable kind — the assembled `errorCode` lifted from the brain's `[code]` prefix
@@ -242,6 +257,10 @@ export interface PostToolBatchResult {
 }
 /** Context for {@link Hooks.preCompact} (design/134). */
 export interface PreCompactContext {
+    /** #281 件A — the run/leg identity envelope. Present when the Runner drives the compaction (its
+     *  wrapper injects it); honestly absent when a deployment drives the compaction module directly
+     *  (presence law arm 3 on {@link HookInvocationIdentity}). */
+    identity?: HookInvocationIdentity;
     /** "auto" = threshold-triggered; "manual" = /compact; "forced" = promptTooLong recovery or
      *  trim-pressure propagation (block is ignored on forced — the compaction is not optional). */
     trigger: "auto" | "manual" | "forced";
@@ -260,6 +279,8 @@ export interface PreCompactResult {
 }
 /** Context for {@link Hooks.postCompact} (design/134, observe-only). */
 export interface PostCompactContext {
+    /** #281 件A — same presence law as {@link PreCompactContext.identity}. */
+    identity?: HookInvocationIdentity;
     trigger: "auto" | "manual" | "forced";
     /** The conversation summary the compaction produced (CC `compact_summary` parity). */
     summary: string;
@@ -268,6 +289,11 @@ export interface PostCompactContext {
 }
 /** Context for the {@link Hooks.stop} hook (CC `stop_hook_active` parity). */
 export interface StopHookContext {
+    /** #281 件A — the run/leg identity envelope. The load-bearing member for THIS seat: a process-level
+     *  `deps.hooks.stop` fires in root, delegated-child and resume legs alike, and previously could not
+     *  tell which run it was being asked to end (matrix row 10/13 residual). Always present on the
+     *  engine's stop-gate emission. */
+    identity?: HookInvocationIdentity;
     /** True when this run is already continuing because a previous stop() blocked — check it and
      *  return success (undefined) once your condition can't be improved, or you will loop to the cap. */
     stopHookActive: boolean;
@@ -394,10 +420,94 @@ export interface HookEnvCapabilities {
  *    {@link createCwdReader} carries the one live read under the same rules.
  */
 export declare function createHookEnvCapabilities(env: ExecutionEnv): HookEnvCapabilities;
+/**
+ * #281 件A — the UNIFIED IDENTITY ENVELOPE every hook invocation can carry (`ctx.identity`): which
+ * run, which leg, and where in the delegation tree the hook is firing. The CC analog is
+ * `createBaseHookInput`'s per-event base fields; the members here are sema's OWN identity facts
+ * (session/leg/delegation axes), not a transcription of CC's field names.
+ *
+ * WHY: `deps.hooks` is PROCESS-level — one `stop`/`preToolUse`/`permissionDenied` seat serves the
+ * root run, every delegated child and every resume leg at once, and before this envelope none of
+ * those invocations could say which leg they belonged to. Additive: every seat is
+ * `identity?: HookInvocationIdentity`, so a consumer that never reads it sees nothing new.
+ *
+ * PRESENCE LAW (which invocations carry it — stated here once, referenced per seat):
+ *  · PRESENT on every ENGINE-driven invocation of every hook seat: the tool gate's PreToolUse
+ *    screenings (phase 1 + the approval-edit re-screen), postToolUse / postToolUseFailure,
+ *    postToolBatch, userPromptSubmit, stop, stopFailure, preCompact / postCompact (the Runner's
+ *    wrapper injects it), and every engine `permissionDenied` emission (gate deny exit, hook-crash
+ *    intercept, plan-mode deny, compliance deny). The engine mints ONE frozen envelope per prepared
+ *    leg ({@link mintHookInvocationIdentity} — single mint home) and every station reuses it.
+ *  · HONESTLY ABSENT (no fabrication) at exactly four places, each structurally unable to know:
+ *     1. a HOST driving the exported {@link runToolGate} directly without supplying
+ *        `ToolGateInput.identity` — the engine cannot know a leg it is not running;
+ *     2. an inherited PreToolUse screening face riding a DESCENDANT's constraint fold
+ *        ({@link createPreToolUseConstraintPolicy}) — the fold consumes it as a `ToolPolicy`, whose
+ *        request shape carries no leg identity, and stamping the INSTALL-site leg would name the
+ *        wrong run;
+ *     3. a deployment driving the compaction module directly with its own `preCompact`/`postCompact`
+ *        options — those contexts are built below the runner, which is where the envelope lives;
+ *     4. the PRE-CAS durable-resume observation of a declared-observational PreToolUse face
+ *        (resumeStream's edited-args leg) — it runs BEFORE the resume leg prepares, so the leg's
+ *        envelope does not exist yet, and minting a partial one off the checkpoint would guess at
+ *        the delegation axes (the row persists `isDelegatedChild` alone; `insideFork`/`agentName`/
+ *        `parentToolCallId` are internals-only, and a wrong guess is worse than an honest
+ *        absence). The SAME face is re-consulted with full identity by the resumed leg's own gate.
+ *
+ * CONSUMER NOTE — the minted object is FROZEN and carries a NULL PROTOTYPE (same rule and same
+ * trade as {@link HookEnvCapabilities}: absence must be a fact about this object, not about what
+ * `Object.prototype` happens to hold). Read members directly (`identity.agentName`), test presence
+ * with `in` or `!== undefined`; do NOT call inherited methods on it — `identity.hasOwnProperty(...)`
+ * or implicit string coercion would throw, exactly as on the env capability face.
+ */
+export interface HookInvocationIdentity {
+    /** The run's session id (uuid domain) — the same key `TaskResult.sessionId` reports. */
+    readonly sessionId: string;
+    /** The run's unified task id (`spec.taskId ?? sessionId` — the value TaskEvent's `sourceTaskId`
+     *  and `task_progress` frames key on). Equal to {@link sessionId} when no task id was declared. */
+    readonly taskId: string;
+    /** Which prepared leg this invocation belongs to — the wiring manifest's own `leg.kind`
+     *  derivation, verbatim ({@link WiringLegKind}: `"root" | "child" | "resume"`). NOTE the fork
+     *  lane's legs read `"child"` here like any other delegation; {@link insideFork} is the
+     *  fork-lane discriminator. */
+    readonly legKind: WiringLegKind;
+    /** RB-204 delegation fact, verbatim: `true` iff this leg runs as a delegated child (every core
+     *  spawn lane — sync/steer/background/fork/workflow — sets it; a top-level run reads `false`). */
+    readonly isDelegatedChild: boolean;
+    /** Present (`true`) iff this leg IS a forked child (`Agent(subagent_type:"fork")` — the
+     *  design/110 trusted internals fact). Absent everywhere else. */
+    readonly insideFork?: true;
+    /** The delegated child's display name, when one was threaded at spawn (taskName / agent-type).
+     *  UNTRUSTED display text (model-chosen) — already single-line-bounded at mint (same
+     *  `inlineUntrusted` treatment as the `task_progress` name lane); never an identity key. */
+    readonly agentName?: string;
+    /** The spawning Agent tool call's own id, when this leg runs under one — the delegation-chain
+     *  position anchor ({@link import("./types.js").TaskEvent}'s `parentToolCallId` twin). Absent on
+     *  a top-level run and on a directly-started workflow child (no launching tool call — no id is
+     *  fabricated). */
+    readonly parentToolCallId?: string;
+}
+/**
+ * #281 件A — the ONE construction home of {@link HookInvocationIdentity} (domain-lexicon: one mint
+ * site; the runner calls it once per prepared leg and every hook station reuses the same object).
+ * Frozen AND null-prototype: the envelope is handed to arbitrarily many deployment callbacks, and a
+ * hook mutating `ctx.identity` must not rewrite what a later hook (or the delegation-lifecycle
+ * observer) reads. The null prototype is the {@link createHookEnvCapabilities} rule applied to the
+ * other absence-signaling face this module mints — "absent member" must be a fact about THIS object,
+ * and a frozen object with an ordinary prototype still answers `insideFork`/`agentName` reads (and
+ * `in` probes) from `Object.prototype`, so a prototype write elsewhere in the process could hand
+ * every leg a delegation axis the mint never stamped (codex r1). `agentName` is sanitized here — it
+ * is the only member whose value a model influences.
+ */
+export declare function mintHookInvocationIdentity(facts: HookInvocationIdentity): HookInvocationIdentity;
 /** Identifying context passed to tool hooks. */
 export interface HookToolContext {
     toolCallId: string;
     toolName: string;
+    /** #281 件A — the run/leg identity envelope; see {@link HookInvocationIdentity} for the presence
+     *  law (present on engine-driven gates; absent on a host-driven gate without
+     *  `ToolGateInput.identity` and on the delegation-fold twin). */
+    identity?: HookInvocationIdentity;
     /**
      * The read-only path-resolution face over the env the hands run against (see
      * {@link HookEnvCapabilities} for the why, and for why it is capabilities rather than the env object).
@@ -450,6 +560,18 @@ export interface PostToolUseResult {
     /** Appended to the result as a `<system-reminder>` the model can read. */
     additionalContext?: string;
 }
+/** #281 件A — the context of a {@link Hooks.userPromptSubmit} invocation (second parameter,
+ *  additive). Carries only the identity envelope today; an object so later additions stay additive. */
+export interface UserPromptSubmitContext {
+    /** The run/leg identity envelope — see {@link HookInvocationIdentity} for the presence law. */
+    identity?: HookInvocationIdentity;
+}
+/** #281 件A — the context of a {@link Hooks.postToolBatch} invocation (third parameter, additive —
+ *  deliberately NOT folded into `meta`, whose presence already means "the engine injected here"). */
+export interface PostToolBatchContext {
+    /** The run/leg identity envelope — see {@link HookInvocationIdentity} for the presence law. */
+    identity?: HookInvocationIdentity;
+}
 /** A UserPromptSubmit hook result: block the submission, or inject context ahead of the prompt. */
 export interface UserPromptSubmitResult {
     /** Block submission entirely; the task fails with this model-readable reason. */
@@ -672,6 +794,11 @@ export interface ToolGateInput {
         toolName: string;
         input: Record<string, unknown>;
     };
+    /** #281 件A — the run/leg identity envelope, put verbatim on every {@link HookToolContext} this
+     *  gate call builds and on every {@link PermissionDeniedPayload} it emits. The Runner supplies its
+     *  per-leg mint; a host driving the gate directly may omit it, and the contexts then carry no
+     *  identity (honest absence — this layer never fabricates a leg). */
+    identity?: HookInvocationIdentity;
     preToolUse?: Hooks["preToolUse"];
     /** The read-only env capability face put on every {@link HookToolContext} this gate call
      *  builds ({@link HookEnvCapabilities}). Built ONCE per task by the runner (after the env is minted) and

package/dist/core/hooks.js

@@ -78,6 +78,18 @@ export function createHookEnvCapabilities(env) {
     }
     return Object.freeze(face);
 }
+const IDENTITY_AGENT_NAME_MAX = 80;
+export function mintHookInvocationIdentity(facts) {
+    return Object.freeze(Object.assign(Object.create(null), {
+        sessionId: facts.sessionId,
+        taskId: facts.taskId,
+        legKind: facts.legKind,
+        isDelegatedChild: facts.isDelegatedChild,
+        ...(facts.insideFork === true ? { insideFork: true } : {}),
+        ...(facts.agentName !== undefined ? { agentName: inlineUntrusted(facts.agentName.slice(0, 320), IDENTITY_AGENT_NAME_MAX) } : {}),
+        ...(facts.parentToolCallId !== undefined ? { parentToolCallId: facts.parentToolCallId } : {}),
+    }));
+}
 export function formatHookFeedback(text) {
     return `<system-reminder>\n${text}\n</system-reminder>`;
 }
@@ -270,7 +282,12 @@ export function persistedRuleMandateOf(marks) {
 export async function runToolGate(input) {
     const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
     const { toolCallId, toolName } = event;
-    const hookCtx = () => ({ toolCallId, toolName, ...(input.hookEnv !== undefined ? { env: input.hookEnv } : {}) });
+    const hookCtx = () => ({
+        toolCallId,
+        toolName,
+        ...(input.hookEnv !== undefined ? { env: input.hookEnv } : {}),
+        ...(input.identity !== undefined ? { identity: input.identity } : {}),
+    });
     let currentInput = event.input;
     const preToolContext = [];
     let hookAsk;
@@ -285,7 +302,7 @@ export async function runToolGate(input) {
             const reason = preToolUseCrashReason(`this call to "${toolName}"`, err);
             traceHookCrash(input, err, notifier);
             if (input.permissionDenied) {
-                await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, source: "hook" }), "toolGate.permissionDenied");
+                await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, source: "hook", ...(input.identity !== undefined ? { identity: input.identity } : {}) }), "toolGate.permissionDenied");
             }
             return { block: true, reason: formatHookFeedback(reason), preToolContext };
         }
@@ -741,7 +758,7 @@ export async function runToolGate(input) {
             currentInput = decision.updatedInput;
         }
         if (input.permissionDenied) {
-            await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource }), "toolGate.permissionDenied");
+            await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(input.identity !== undefined ? { identity: input.identity } : {}) }), "toolGate.permissionDenied");
         }
         const denySettledBy = decision.settledBy;
         const denyApprover = denySettledBy !== undefined ? resolvedApprover : undefined;

package/dist/core/runner/prepare-config-doors.d.ts

@@ -107,6 +107,10 @@ export interface PrepareConfigDoorsResult {
         exclude: readonly string[] | undefined;
         defer: readonly string[] | undefined;
         alwaysLoad: readonly string[] | undefined;
+        /** design/277 — the model-gate restore selector ({@link TaskSpec.restoreGatedTools}), fourth
+         *  seat of the same frozen task-start snapshot: the gate decision and the delegation carrier
+         *  read THIS, never the live spec. */
+        restoreGated: readonly string[] | true | undefined;
     };
     /** owned — the profile half of the RB-50 single decision point (model-independent by contract). */
     promptProfile: "simple" | "classic";
@@ -127,6 +131,19 @@ export interface PrepareConfigDoorsResult {
     compModel: Model | undefined;
     /** owned — the mitigations half of the RB-50 decision point (model-family fact). */
     fableMitigations: boolean;
+    /** owned, frozen — design/277 model-gate DISCLOSURE data (the application itself already
+     *  happened on {@link spec}: its `tools` is the survivor rebind when anything was removed).
+     *  prepareTask emits the notices from this after the doors return (the onNotice station);
+     *  the doors stay side-effect-free on the announcement axis. */
+    modelGate: {
+        /** gate-class → removed wire names (sorted, unique); empty map = nothing removed. */
+        removedByClass: ReadonlyMap<string, readonly string[]>;
+        /** stamped classes with no merged-table row (inert tags, fail-open — announce material). */
+        unknownClasses: readonly string[];
+        /** a not-in-force `SEMA_TOOL_MODEL_GATE` value outside the closed set (discard-announce
+         *  material; the in-force arm never lands here — it throws at the door). */
+        discardedEnvRaw: string | undefined;
+    };
     /** owned — validated deployment governance windows (undefined = ungoverned). */
     usageWindows: readonly UsageWindow[] | undefined;
     /** owned, out-param cell — created EMPTY here; the brain-call wiring later installs into

package/dist/core/runner/prepare-config-doors.js

@@ -4,6 +4,7 @@ import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { preflightLockedConfig } from "../locked-config.js";
 import { assertRetentionCapability } from "../retention.js";
 import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
+import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeamForm, resolveQuestionSeam } from "../wiring-manifest.js";
 const TASK_LIMIT_KEY_DICT = {
@@ -73,7 +74,7 @@ export function resolveTaskLimits(limits) {
     return limits;
 }
 export function isFableFamilyModelId(id) {
-    const tail = id.toLowerCase().split("/").pop() ?? "";
+    const tail = modelIdTail(id);
     return /^claude-fable-\d/.test(tail) || /^claude-mythos-5(?!\d)/.test(tail);
 }
 export function resolveModelPromptTraits(model, spec, internals) {
@@ -85,10 +86,16 @@ export function resolveModelPromptTraits(model, spec, internals) {
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;
     let spec = input.spec;
+    assertRestoreGatedToolsValue(spec.restoreGatedTools);
     const toolFaceSnapshot = {
         exclude: spec.excludeTools ? Object.freeze([...spec.excludeTools]) : undefined,
         defer: spec.deferTools ? Object.freeze([...spec.deferTools]) : undefined,
         alwaysLoad: spec.alwaysLoadTools ? Object.freeze([...spec.alwaysLoadTools]) : undefined,
+        restoreGated: spec.restoreGatedTools === true
+            ? true
+            : spec.restoreGatedTools !== undefined
+                ? Object.freeze([...spec.restoreGatedTools])
+                : undefined,
     };
     const promptProfile = resolveModelPromptTraits({ id: "" }, spec, internals).promptProfile;
     if (spec.resumeAt !== undefined) {
@@ -223,11 +230,34 @@ export function prepareConfigDoors(input) {
             throw e;
         }
         const perTask = spec.agents;
-        spec = { ...spec, tools: pool.map((t) => (typeof t.withAgents === "function" ? t.withAgents(perTask) : t)) };
+        spec = {
+            ...spec,
+            tools: pool.map((t) => {
+                if (typeof t.withAgents !== "function")
+                    return t;
+                const rebuilt = t.withAgents(perTask);
+                return t.modelGate !== undefined && rebuilt.modelGate === undefined ? { ...rebuilt, modelGate: t.modelGate } : rebuilt;
+            }),
+        };
     }
     const resolvedRole = resolveTaskModel(spec, deps);
     const model = resolvedRole.model;
     const fableMitigations = resolveModelPromptTraits(model, spec, internals).fableMitigations;
+    const gateDecision = applyToolModelGate({
+        tools: spec.tools,
+        modelId: model.id,
+        depsSeat: deps.toolModelGate,
+        restoreGated: toolFaceSnapshot.restoreGated,
+        envRaw: process.env.SEMA_TOOL_MODEL_GATE,
+    });
+    if (gateDecision.survivors !== undefined) {
+        spec = { ...spec, tools: gateDecision.survivors };
+    }
+    const modelGate = Object.freeze({
+        removedByClass: gateDecision.removedByClass,
+        unknownClasses: gateDecision.unknownClasses,
+        discardedEnvRaw: gateDecision.discardedEnvRaw,
+    });
     const thinking = spec.thinking ?? resolvedRole.thinking ?? model.defaultThinking;
     const compModel = spec.compactionModel
         ? resolveModel(spec.compactionModel, deps.models)
@@ -243,6 +273,7 @@ export function prepareConfigDoors(input) {
         thinking,
         compModel,
         fableMitigations,
+        modelGate,
         usageWindows,
         brainCallGuardrailRef,
         brainCallGuardrailMs,

package/dist/core/runner/prepare-task.d.ts

@@ -11,7 +11,7 @@ import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { OnAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import { type ActiveSkillFrame } from "./active-skill-scope.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
-import { type Hooks, type OrgGateVerdict } from "../hooks.js";
+import { type Hooks, type HookInvocationIdentity, type OrgGateVerdict } from "../hooks.js";
 import type { RecoveredOrphan } from "../session-reconcile.js";
 import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-detector.js";
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
@@ -29,8 +29,14 @@ import { type WiringManifest } from "../wiring-manifest.js";
 import type { ActiveWorktreeSession, AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
 import type { NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
-/** Test seam (mirrors `__resetBashTimeoutAnnouncements`): never called by production code. */
+/** Test seam (mirrors `__resetToolModelGateAnnouncements`): never called by production code.
+ *  Re-arms BOTH arms (a WeakMap has no clear — it is re-minted). */
 export declare function __resetMaterializeEnvAnnouncements(): void;
+/** Test seam (mirrors `__resetMaterializeEnvAnnouncements`): never called by production code.
+ *  Re-arms BOTH arms (a WeakMap has no clear — it is re-minted). Deliberately UNLIKE the read-face
+ *  seam below (console latch only): tests here legitimately reuse ONE sink across prepares to pin
+ *  the per-sink dedup itself, so the seam must be able to re-arm a still-referenced sink. */
+export declare function __resetToolModelGateAnnouncements(): void;
 /** Test seam (mirrors `__resetMalformedNoticeSeatAnnouncement`): never called by production code.
  *  Deliberately asymmetric — it resets only the console latch: the WeakSet arm needs no seam
  *  because a test resets it by minting a fresh sink function (identity IS the ledger key), while
@@ -279,6 +285,15 @@ export interface Prepared {
      * model/tool interaction. Host/operator plane — never enters model context.
      */
     wiringManifest: WiringManifest;
+    /**
+     * #281 件A — this leg's frozen identity envelope, minted ONCE in prepare beside the wiring
+     * manifest (same leg derivation, one mint — {@link mintHookInvocationIdentity}). Every hook
+     * station runtask drives (stop/stopFailure/userPromptSubmit/postToolBatch, the compaction
+     * wrapper) and the 件B delegation-lifecycle observer read THIS object; prepare's own stations
+     * (the tool gate, the post-tool contexts) close over the same const. Always present — a prepared
+     * leg always knows its identity.
+     */
+    hookIdentity: HookInvocationIdentity;
     promptManifest: {
         constitution: "core" | "replaced" | "provider-assembled";
         blocks: Array<{