@sema-agent/core 5.50.0 → 5.52.0

package/CHANGELOG.md

@@ -1,5 +1,120 @@
 # Changelog
 
+## 5.52.0 — 2026-08-21
+
+### Added
+- **The rejection boundary holds against pre-accepted engine injections** (#370 terminal form):
+  the harness grows ONE provenance gate every engine-authored injection judges against — new
+  engine steers/followUps refuse at entry during a halt, and frames accepted BEFORE the rejection
+  landed are held at drain (delayed, never destroyed: queued user input drains past them, and once
+  the user's turn spends the halt they deliver at the next boundary; a run that ends first parks
+  payload frames per session losslessly). Caller-relayed steers state
+  `UserMessageProvenance.callerAuthored` (additive) at their one mint seam, so the gate's failure
+  direction can never mis-gate user input. `task.user_steer_undrained` no longer counts
+  payload-less engine advisories as lost user steers.
+- **The nine-code resolution vocabulary reaches every deny lane**: `AskDenyResolution` +
+  `isAskDenyResolution` + `ASK_DENY_RESOLUTION_VALUES` exported from the package root (the
+  settledBy precedent); the `createApprovalPolicy` legacy lane and the inherited-ancestor
+  delegation fold now classify on `tool_end.resolution` via a module-private attestation carrier
+  (WeakMap sidecar, call-bound, fold-transferred) — a foreign policy still cannot forge or replay
+  a code, and the public deny wording is byte-unchanged.
+- **The memory session-account close discloses standing deferrals** (#369): a harvest with
+  `deferred` rejection rows that actually closes the account emits one warnings line naming the
+  deferred seats; a refused close reports its outcome UNKNOWN honestly. The two-ledger canon is
+  written at four seats: the projection-debt ledger lives on the HARVEST timeline, orthogonal to
+  the session open/close ledger (writes never cross; reads cross one way).
+- **The bare-mark echo observation seat** (`<outlet>.mark_echo`): failure arms that fence but do
+  not defuse (MCP tool errors, WebFetch non-2xx, WebSearch backend errors) now count a naked mark
+  value riding to the model — count-only, zero model-facing byte changes; the count is an upper
+  bound by contract.
+- **Reasoning reports consume the wire's own request facts** (#367): the anthropic budget arm
+  reports the cap-wins facts of the request the engine SELECTED (minter-reports form, via a
+  brain→runner sink); a leg whose hard output cap deleted the thinking block now reports the drop
+  on both faces instead of a full graded gradient. `reasoning.resolved` may re-emit once per leg
+  when the verdict changes (deduplicated; single-frame runs unchanged).
+
+### Fixed
+- The operator-continuation verb's `access` argument is the WHOLE row-reach identity: unspecified
+  axes no longer backfill from the mount (which WIDENED reach); a mount-only parent pair is
+  unreachable by construction. Disclosed behavior difference: a parent-paired direct continuation
+  without `senderName` now attributes to "main" instead of an internal task id.
+- `createWebFetchTool`'s product-form ctx limitation documented at the factory (defuse/counts
+  need the enrichCtx/spec mount forms).
+- Pre-release scan disposition (fixed in-tree before publish): the continuation verb's identity
+  strip also dropped the mount sessionId as the SESSION RETAIN LEDGER key — an owner-declared
+  access could reach a session-scoped retained child yet get a false `resume.retain_off`. The
+  key now rides a ledger-only options seat (`sessionRetainLedgerKey`, never a predicate axis):
+  reach is still exactly the declared access; the store route is restored.
+
+### Notes
+- Standing residuals ticketed: #372 (withdrawn-seat provenance whitewash, reproduced, design
+  adjudication), #373 (twelve long-lived-map leak risks, store-domain batch), #374 (unsigned
+  thinking replay vs strict gateways), #375 (in-session tool-schema drift vs prompt cache,
+  awaiting break-cadence data).
+
+## 5.51.0 — 2026-08-21
+
+### Added
+- **A parent-thread BARE human rejection is a control-flow boundary** (#210; CC 223 anchor
+  `$Vo`/`cancelAndAbort`): after the person rejects a tool call with no note, the same assistant
+  batch's later side-effecting siblings no longer execute — never-started calls settle as coded
+  results (`details.{error,code}: "gate.batch_halted"`, known-not-executed wording,
+  `rejectedToolCallId`/`rejectedToolName` attached), already-executing calls finish and settle
+  honestly, and the run ends awaiting user input. Sequential, partitioned-preflight and in-stream
+  pipelines all consume ONE judgment seat; delegated children (forks included), reject-WITH-note,
+  and every non-human deny keep today's posture byte-for-byte. Engine continuation lanes
+  (stop-gate pushback, final-verify, attachment/batch-context steer, limit-approach, LSP
+  diagnostics, task notifications — the last parks losslessly) cannot revive a halted run; user
+  steer/followUp can — they ARE the awaited input. Additive faces: `TaskResult.haltedOnUserRejection`,
+  `tool_execution_end.notExecuted`, `BeforeToolCallResult.haltRemaining`. Containment form (no
+  abort teardown) is a registered cc-parity divergence.
+- **Every ask-resolution deny names its arm** (#127): `AskDenyResolution` nine-code closed set
+  (human_refused/window_expired/no_approver/blanket_allow_refused/approver_unavailable/
+  task_aborted/presentation_failed/approver_error/approver_contract) minted where each arm
+  states its own fact, carried as `PermissionDeniedPayload.resolution` (distinct from `source`)
+  onto the `tool_end` frame. Existing deny wording byte-unchanged; the gate captures only at its
+  own ask-resolution seats, so a policy cannot forge a code.
+- **`defineTool` carries the declared safety axes onto its product** (#126):
+  egress/irreversibility/reversibilityProbe/offload/offloadThresholdChars now survive into a
+  product-form `TaskSpec.tools` entry — a declared egress/irreversible tool fed as a finished
+  product previously auto-allowed with no door sounding. Declaration-takes-effect (behavior
+  narrowing): such declarations now really gate, and a product-form `egress:true+effect:"read"`
+  contradiction refuses prepare loudly. A ToolSpec-key completeness table makes the next
+  silently-dropped key a compile error.
+- **Review sampling is tail-inclusive** (#287): the spawn review reads objective+systemPrompt
+  through the layered head/interior/tail sample (12k budget, gap markers), and the auto-mode
+  classifier's 48k action block reads head-half + declared-middle + tail-half — a two-stage
+  payload (benign head, real instructions past the cut) no longer evades review. Bounds unchanged.
+- **The reversibilityProbe wait is always finite** (#128): absent `approvalTimeoutMs` falls to a
+  30s default (elapse takes the existing fail-closed tighten-to-ask arm), garbage values refuse
+  loudly to the same default, explicit 0 stays honored; a throwing/timed-out probe now reaches
+  `onHookError`/`onError(phase:"hook")` instead of being swallowed.
+- **`details.code` twins for the SendMessage admission and stop/poll families**: the five
+  admission codes (rate_limited/duplicate/hop_loop/hop_runaway/queue_full) and the stop family
+  (not_local/parked_pending_approval/park_resume_won/park_arbiter_unreachable) carry the machine
+  twin beside `error` at all nine mint sites; `UnifiedTaskOutput` grows the additive `code` seat.
+- **`mcp.revocation_probe_failed` forwarding guidance**: the seat contract and notice directory
+  now state the dedup unit precisely (once per MATERIALIZATION — a resume re-materializes and may
+  re-announce), no session attribution, operator audience by the `NOTICE_AUDIENCE` default; plus
+  an in-flight-not-chased pin (a revocation racing an already-dispatched call never retracts it).
+
+### Changed
+- Behavior narrowing (named): post-rejection siblings from "executed as usual" to "settle
+  un-executed"; a bare human rejection no longer re-invokes the model to narrate it
+  (`TaskResult.result` may be empty text); product-form tool declarations now really gate (#126).
+
+### Notes
+- Residuals ticketed, not shipped silently: a pre-rejection harness-accepted engine steer still
+  drains past the boundary (#370, single-choke harness steer entry proposed); delegated-child
+  denies fold through policy without a resolution code (observed on #370).
+- Pre-release merged-code scan dispositions (three confirmed, fixed in-tree before publish):
+  a human-halted boundary no longer DRAINS the LSP diagnostics registry (drain is a consuming
+  read — pending now survives for the continuation, the frame defers with it); `defineTool` also
+  carries `defer`/`alwaysLoad` (the defer classification reads them off spec.tools entries — a
+  product's declared deferral silently inlined its schema, and a declared inline pin lost to
+  `TaskSpec.deferTools`); the probe-deadline guard refuses values above setTimeout's 2^31-1
+  ceiling loudly (the silent ~1ms clamp it claimed to close).
+
 ## 5.50.0 — 2026-08-21
 
 ### Added

package/dist/agents/send-message-tool.d.ts

@@ -20,6 +20,12 @@ export interface SendMessageToolOptions {
     owner?: string;
     scope?: string;
     sessionId?: string;
+    /** SESSION RETAIN LEDGER key only — never an access axis. `sessionId` above wears two hats
+     *  (row-reach predicate axis AND the process-global retain-ledger map key); a caller that must
+     *  strip the predicate axes (the continuation verb: access IS the identity) still needs the
+     *  ledger route, because the ledger is a STORE seat consulted for an already-gated row by its
+     *  own toolUseId — routing through it cannot widen reach. Consulted after ctx/options sessionId. */
+    sessionRetainLedgerKey?: string;
     /** Completion-notify sink for the resumed run. The Runner mount wires the SENDING run's own
      *  notification injector here (its runtask-wrapped `injectTaskNotification`), so the completion
      *  notice lands in the sender's live injection queue at a turn boundary; a direct mount may wire a
@@ -185,13 +191,18 @@ export interface AgentContinuationReceipt {
  * clear-terminal-payload erases the durable mark; the model-facing tool NEVER softens).
  *
  * Authorization is three-layered and this verb owns only the first: ① the same
- * `canAccessAgentRecord` row predicate the tool runs (an out-of-scope handle reads not_found —
- * non-leaking); ② "this really is an explicit human instruction" is the DEPLOYMENT's obligation —
+ * `canAccessAgentRecord` row predicate the tool runs, against the caller's `access` argument and
+ * NOTHING ELSE (an out-of-scope handle reads not_found — non-leaking); ② "this really is an explicit
+ * human instruction" is the DEPLOYMENT's obligation —
  * the same trust seat that stamps `stopSource:"user"` on the stop side (a server exposes this only
  * through a verified interactive-user principal endpoint, never to unattended machine clients); ③ the model
  * tool face has no such parameter (the bit travels on a module-private symbol — zero forgeable
  * surface from arguments).
  *
+ * ACCESS TOTALITY: the `access` argument is the WHOLE row-reach identity of the call — a partially
+ * specified one leaves the axes it omits UNDECLARED (default-deny), never backfilled from the mount.
+ * See the identity-strip note in the body for why that has to be spelled at the options seat too.
+ *
  * Store-conditional like every continuation face: with no durable stores wired the live-gate waiver
  * still works for same-process handles, and the durable leg refuses honestly.
  */

package/dist/agents/send-message-tool.js

@@ -132,7 +132,7 @@ export function createSendMessageTool(opts) {
                         : reason === "hop_loop"
                             ? `this message has already passed through ${whoLabel} too many times (a forwarding loop) — stop relaying it; act on it or drop it.`
                             : `this message's forwarding chain is too long (runaway relay) — stop relaying it; act on it or drop it.`;
-                return { content: `Message not sent: ${text}`, details: { error: reason, to }, isError: true };
+                return { content: `Message not sent: ${text}`, details: { error: reason, code: reason, to }, isError: true };
             };
             if (normalizeAgentName(to) === "main") {
                 if (opts.uplink && senderId !== undefined) {
@@ -217,7 +217,7 @@ export function createSendMessageTool(opts) {
                 if (row.status === "parked") {
                     return {
                         content: `Message not sent: ${whoT3} is parked on a pending approval — it resumes when the approval is decided (durable approval inbox), not by message delivery. Send again after it resumes.`,
-                        details: { error: "parked_pending_approval", to },
+                        details: { error: "parked_pending_approval", code: "parked_pending_approval", to },
                         isError: true,
                     };
                 }
@@ -257,7 +257,7 @@ export function createSendMessageTool(opts) {
                 if (boxFull) {
                     const queueFullReceipt = (guidance) => ({
                         content: `Message not sent: ${whoT3}'s mailbox is at its queued-message limit (${admissionConfig.maxQueuedPeerMessages}) — the message was NOT queued. ${guidance} ${DEDUP_RETRY_NOTE}`,
-                        details: { error: "queue_full", to },
+                        details: { error: "queue_full", code: "queue_full", to },
                         isError: true,
                     });
                     if (!opts.registry.beginDurableClaim(handle)) {
@@ -601,7 +601,7 @@ export function createSendMessageTool(opts) {
                     if (delivered.reason === "queue_full") {
                         return {
                             content: `Message not sent: ${who} is still starting up and its startup message buffer is full — resend in a moment. ${DEDUP_RETRY_NOTE}`,
-                            details: { error: "queue_full", to },
+                            details: { error: "queue_full", code: "queue_full", to },
                             isError: true,
                         };
                     }
@@ -609,7 +609,7 @@ export function createSendMessageTool(opts) {
                     if (nowRow?.status === "parked") {
                         return {
                             content: `Message not sent: ${who} is parked on a pending approval — it resumes when the approval is decided, not by message delivery. Send again after it resumes. ${DEDUP_RETRY_NOTE}`,
-                            details: { error: "parked_pending_approval", to },
+                            details: { error: "parked_pending_approval", code: "parked_pending_approval", to },
                             isError: true,
                         };
                     }
@@ -638,7 +638,7 @@ export function createSendMessageTool(opts) {
                 }
             }
             const runLedger = ctx.subagentRetain ?? opts.retain;
-            const smLedgerSessionId = ctx.sessionId ?? opts.sessionId;
+            const smLedgerSessionId = ctx.sessionId ?? opts.sessionId ?? opts.sessionRetainLedgerKey;
             const sessionLedger = smLedgerSessionId !== undefined ? getSessionRetainLedger(smLedgerSessionId) : undefined;
             const knows = (l) => l !== undefined && row.toolUseId !== undefined && (l.get(row.toolUseId) !== undefined || l.wasEvicted(row.toolUseId));
             const siblingLedger = opts.siblingRetain;
@@ -746,9 +746,15 @@ export function createSendMessageTool(opts) {
     }, opts.enrichCtx !== undefined ? { enrichCtx: opts.enrichCtx } : {});
 }
 export function createAgentContinuationVerb(opts) {
+    const { owner: _mo, scope: _ms, sessionId: _msid, parentTaskId: _mpt, parentSessionId: _mps, ...mountWithoutIdentity } = opts;
+    const mountLedgerKey = opts.sessionId;
     return async (handle, content, access, o) => {
         const tool = createSendMessageTool({
-            ...opts,
+            ...mountWithoutIdentity,
+            ...(mountLedgerKey !== undefined ? { sessionRetainLedgerKey: mountLedgerKey } : {}),
+            ...(access.owner !== undefined ? { owner: access.owner } : {}),
+            ...(access.scope !== undefined ? { scope: access.scope } : {}),
+            ...(access.sessionId !== undefined ? { sessionId: access.sessionId } : {}),
             enrichCtx: (base) => {
                 const enriched = {
                     ...base,

package/dist/agents/subagent.js

@@ -110,14 +110,14 @@ export function layeredReviewSample(text, budget = HANDBACK_REVIEW_SAMPLE_BUDGET
         return { text, readChars: total, totalChars: total, sampled: false, gaps: 0 };
     return { text: out, readChars, totalChars: total, sampled: true, gaps };
 }
-function reviewCoverageNote(fields) {
+function reviewCoverageNote(fields, author = "the child's own writing") {
     const sampled = fields.filter((f) => f.sample.sampled);
     if (sampled.length === 0)
         return undefined;
     return (sampled
         .map((f) => `${f.field}: the classifier was shown ${f.sample.readChars} of ${f.sample.totalChars} characters (UTF-16 code units) ` +
         `(layered head/middle/tail sample; the ${f.sample.gaps} skipped span(s) are marked in place as ` +
-        `"[… N chars not shown …]" — any further such marker in the text is the child's own writing, not this sampler's)`)
+        `"[… N chars not shown …]" — any further such marker in the text is ${author}, not this sampler's)`)
         .join("; ") + " — the unshown spans were NOT reviewed; treat them as unknown, not as benign.");
 }
 const HANDBACK_ASK_MESSAGE = "Subagent has finished and is handing back control to the main agent. Review the subagent's work and flag if any action may violate security policy.";
@@ -2028,14 +2028,26 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 const spawnToolsNote = spawnToolNames.length > 0
                     ? spawnToolNames.join(", ")
                     : "(none explicitly listed — but if this deployment gave the child a real execution environment, it likely also has the standard file/shell tools: Read/Edit/Write/Bash/Grep/Glob)";
+                const objectiveSample = layeredReviewSample(prompt);
+                const systemPromptSample = childSystemPrompt != null ? layeredReviewSample(childSystemPrompt) : undefined;
+                const spawnCoverage = reviewCoverageNote([
+                    { field: "objective", sample: objectiveSample },
+                    ...(systemPromptSample ? [{ field: "systemPrompt", sample: systemPromptSample }] : []),
+                ], "the delegating agent's own writing");
+                const objectiveDisplay = layeredReviewSample(prompt, 2_000, 2);
                 const spawnVerdict = await ctx.autoModeReview.decider
                     .decide({
                     req: {
                         toolName: wantsFork ? "Agent(fork)" : "Agent",
-                        args: { objective: prompt.slice(0, 2_000), tools: spawnToolNames, systemPrompt: childSystemPrompt?.slice(0, 2_000) },
+                        args: {
+                            objective: objectiveSample.text,
+                            tools: spawnToolNames,
+                            systemPrompt: systemPromptSample?.text,
+                            ...(spawnCoverage ? { reviewCoverage: spawnCoverage } : {}),
+                        },
                         toolCallId: ctx.toolCallId,
                     },
-                    askMessage: `Reviewing a sub-agent about to be spawned. Objective: ${prompt.slice(0, 2000)}${prompt.length > 2000 ? "…" : ""}\nTools available to it: ${spawnToolsNote}`,
+                    askMessage: `Reviewing a sub-agent about to be spawned. Objective: ${objectiveDisplay.text}\nTools available to it: ${spawnToolsNote}`,
                 }, ctx.signal)
                     .catch(() => ({ kind: "unavailable", cause: "error" }));
                 if (ctx.signal?.aborted) {

package/dist/brain/anthropic.js

@@ -3,7 +3,7 @@ import { BrainError } from "./errors.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
 import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
-import { emitBrainTelemetry } from "./status-sink.js";
+import { emitBrainTelemetry, reportReasoningWireFacts } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, modelSupportsVision, sendableImages } from "./media-degrade.js";
 import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders, stripAuthHeaders, takeHeaderCasefold } from "./request-params.js";
 import { MIN_THINKING_TOKENS, budgetCapSkipsThinking, declaredEffortLevels, reasoningBudgetShare, reasoningRequestCarried, resolveEffort } from "./reasoning.js";
@@ -260,13 +260,15 @@ export function createAnthropicBrain(config = {}) {
                 if (options?.temperature !== undefined && anthCompat.supportsTemperature !== false) {
                     body.temperature = options.temperature;
                 }
+                let builtReasoningFacts;
                 if (reasoningRequestCarried(model, options?.reasoning)) {
                     if (anthCompat.thinkingMode === "adaptive") {
                         body.thinking = { type: "adaptive" };
                     }
                     else {
                         const hardCap = overrides?.maxOutputTokens !== undefined || options?.maxTokens !== undefined;
-                        if (budgetCapSkipsThinking(body.max_tokens, hardCap)) {
+                        builtReasoningFacts = { outputCapTokens: body.max_tokens, hardOutputCap: hardCap };
+                        if (budgetCapSkipsThinking(builtReasoningFacts.outputCapTokens, builtReasoningFacts.hardOutputCap)) {
                             body.thinking = undefined;
                             delete body.thinking;
                         }
@@ -333,6 +335,8 @@ export function createAnthropicBrain(config = {}) {
                         thinkingRequested = builtThinkingRequested;
                         sentMaxTokens = builtMaxTokens;
                         sentMaxTokensLane = builtMaxTokensLane;
+                        if (builtReasoningFacts !== undefined)
+                            reportReasoningWireFacts(builtReasoningFacts);
                     },
                 };
             },

package/dist/brain/reasoning.d.ts

@@ -109,8 +109,16 @@ export declare function budgetCapSkipsThinking(outputCapTokens: number, hardCap:
  * request build that a per-leg eager resolution cannot: the resolved output cap and whether it is a
  * HARD bound. Supplied ⇒ the anthropic budget arm mirrors the wire's cap-wins skip
  * ({@link budgetCapSkipsThinking}); absent ⇒ the budget arm reports the cap-blind gradient it always
- * did (the eager per-leg trace/result mint has no request facts — a capped request's per-attempt skip
- * is visible only to a caller that passes them).
+ * did (an eager mint that has not yet seen a request has no facts).
+ *
+ * Who supplies them, and why it is never the reporting caller's own arithmetic: the adapter
+ * that BUILT the request reports the pair it judged, through the runner's reasoning-wire-facts sink
+ * (`status-sink.ts`), from its `onCommitted` hook so a speculatively-built request the overflow
+ * recovery declined can never be reported as sent. A consumer re-deriving the cap would have to
+ * re-implement the adapter's precedence chain (engine override > caller `options.maxTokens` >
+ * `model.maxTokens` > brain-construction default) — a second source of truth for a number only the
+ * minter can state. The runner then re-resolves with them: the skip and its report stay ONE predicate
+ * reading ONE set of facts.
  */
 export interface ReasoningWireFacts {
     /** The request's resolved output cap (the wire `max_tokens` at the moment the thinking arm judges). */

package/dist/brain/request-params.d.ts

@@ -45,10 +45,26 @@ export declare function stripAuthHeaders(headers: Record<string, string>): void;
  * deployment — is byte-identical on the wire).
  *
  * EXEMPT: the auth carriers (`authorization` / `x-api-key`, any case) pass through with the exact
- * legacy spread semantics (same-spelling override only, no case-fold dedup) — their case handling is
- * {@link stripAuthHeaders}' pinned jurisdiction (the per-call-replaces flow and the
- * header-only ANTHROPIC_AUTH_TOKEN shape, which must survive under its own capital-A spelling), and
- * this layer must not become a second, subtly different auth authority.
+ * legacy spread semantics (same-spelling override only, no case-fold dedup), so that
+ * {@link stripAuthHeaders} stays the ONE authority over auth spelling and this layer never becomes a
+ * second, subtly different one.
+ *
+ * RE-RULED, because the exemption used to be justified by a reason that does not hold: the
+ * note claimed it protected "the header-only ANTHROPIC_AUTH_TOKEN shape, which must survive under its
+ * own capital-A spelling". Dedup would not endanger that shape — it keeps the WINNER'S spelling, and a
+ * lone `Authorization` has nothing to be deduped against, so it survives either way; nor does the
+ * per-call-replaces flow depend on the exemption, since {@link stripAuthHeaders} already deletes every
+ * spelling present. Measured, not reasoned: `mergeHeaders({Authorization:A},{authorization:B})` keeps
+ * BOTH, and the platform `Headers` fold sends `authorization: A, B`.
+ *
+ * STATED RESIDUAL (deliberately not fixed here): a deployment that spells the SAME auth carrier two
+ * ways across two layers therefore ships both, comma-folded — the very disease this function fixed
+ * for every other header. It is held, not denied, on severity: no server accepts a comma-joined
+ * credential, so the failure is a LOUD 401 attributable to the misconfiguration, whereas the
+ * non-auth case this function exists for produced a silently WRONG value (`X-Tenant: a, b` — neither
+ * writer's, the later layer's documented override defeated). Tightening it changes which credential
+ * reaches the wire, so it belongs in a window that discloses an auth-face behavior change, not in one
+ * whose subject is the reasoning knob.
  */
 /**
  * #343 (review r4) — assign a STRUCTURAL locked header under its canonical lowercase name, deleting

package/dist/brain/status-sink.d.ts

@@ -1,4 +1,5 @@
 import type { BrainRetryErrClass, BrainStatus } from "../core/types.js";
+import type { ReasoningWireFacts } from "./reasoning.js";
 /** Run `fn` with a per-task brain-status sink in scope. ALS propagates it through the async brain calls
  *  inside `fn` (the harness's prompt → brain.stream → connect/retry loop), so {@link emitBrainStatus}
  *  reaches THIS task's sink and nothing else. */
@@ -60,3 +61,58 @@ export type BrainTelemetry = {
 export declare function runWithBrainTelemetry<T>(emit: (t: BrainTelemetry) => void, fn: () => Promise<T>): Promise<T>;
 /** Report a brain-layer fallback/telemetry event to the active per-task sink, if any. */
 export declare function emitBrainTelemetry(t: BrainTelemetry): void;
+/**
+ * Run `fn` with a per-task REASONING-WIRE-FACTS sink in scope — the THIRD brain→runner ALS channel,
+ * same decoupling contract as its two siblings (no brain-interface field, no per-call option, no-op
+ * outside the scope, an emit must never change a call's outcome).
+ *
+ * What it carries and WHY it is a channel rather than a runner-side computation: the reporting
+ * resolver's cap-wins arm ({@link import("./reasoning.js").budgetCapSkipsThinking}) needs facts that
+ * belong to ONE outgoing request — the output cap that actually reached the wire and whether it was a
+ * HARD bound. The runner's per-leg eager mint cannot know them without re-deriving the adapter's own
+ * cap precedence chain (engine override > caller `options.maxTokens` > `model.maxTokens` >
+ * brain-construction default), i.e. without standing up a SECOND source of truth that a deployment's
+ * own brain, a construction-time default, or a per-attempt engine override would silently desync. So
+ * the MINTER reports the facts it judged — the same law `SSERequest.outputCapTokens` already states
+ * for the overflow recovery ("what the adapter actually put on the wire", never what a consumer
+ * infers) — and the resolver stays the single predicate both faces read.
+ *
+ * REVOKED ON SETTLEMENT, unlike its two siblings, because this sink WRITES to a seat that is later
+ * read into a returned value instead of pushing an advisory frame. `AsyncLocalStorage.run` does not
+ * revoke the store from async resources created inside `fn`: a brain call the engine ABANDONED (the
+ * brain-call guardrail's whole purpose) keeps the scope alive in its own continuation and can call
+ * `observe` long after the task settled — mutating a resolution whose `TaskResult` has already been
+ * assembled and handed back, and emitting a trace correction after the task's terminal. The scope
+ * therefore carries a liveness flag cleared when `fn`'s promise settles, which is also the "freeze
+ * before result assembly" boundary: assembly runs after the brain-driving call resolves, so a report
+ * that could still land is exactly one that arrives before the freeze.
+ *
+ * Passing a NO-OP `observe` is the documented way to SHIELD a nested internal brain call (compaction
+ * summary, side query): it installs a fresh innermost scope for the duration, so the inner call's
+ * reports are swallowed instead of restating the outer leg's posture — the same shape the status sink
+ * uses for the same reason ("background/internal brain calls are not surfaced").
+ */
+export declare function runWithReasoningWireFacts<T>(observe: (f: ReasoningWireFacts) => void, fn: () => Promise<T>): Promise<T>;
+/**
+ * Report the reasoning wire facts of the request the engine has SELECTED to send, to the active
+ * per-task sink, if any.
+ *
+ * Call it from the adapter's `onCommitted` hook, never from `buildRequest`: the context-overflow
+ * recovery builds candidate requests speculatively and may decline them, and a declined candidate's
+ * facts would otherwise be reported against a request that was never sent (the exact hazard
+ * `onCommitted` exists for).
+ *
+ * Precisely what that buys, since the hook's own summary ("becomes the one that is sent") is a shade
+ * stronger than its position: the engine calls it immediately after choosing a request and BEFORE the
+ * attempt loop's abort check and `doFetch`, so a call aborted before its first connect can still have
+ * reported. The distinction that matters here is nonetheless the one the hook does guarantee — a
+ * DECLINED candidate never reports, so the facts always belong to the request the adapter's decision
+ * was made about. The residual (a selected-but-never-connected request on an aborting leg) describes
+ * the posture that leg was about to run under, and is not worth moving a hook three adapters share
+ * their own diagnostics attribution on.
+ *
+ * Fire-and-forget and swallow-guarded like its siblings — an observability fact must never turn a
+ * settled brain call into a failure — and inert once its scope has settled (see
+ * {@link runWithReasoningWireFacts}).
+ */
+export declare function reportReasoningWireFacts(facts: ReasoningWireFacts): void;

package/dist/brain/status-sink.js

@@ -21,3 +21,19 @@ export function emitBrainTelemetry(t) {
     catch {
     }
 }
+const reasoningFactsSinkStore = new AsyncLocalStorage();
+export function runWithReasoningWireFacts(observe, fn) {
+    const scope = { observe, live: true };
+    return reasoningFactsSinkStore.run(scope, fn).finally(() => {
+        scope.live = false;
+    });
+}
+export function reportReasoningWireFacts(facts) {
+    try {
+        const sink = reasoningFactsSinkStore.getStore();
+        if (sink?.live === true)
+            sink.observe(facts);
+    }
+    catch {
+    }
+}

package/dist/core/auto-mode-prompt.js

@@ -49,6 +49,14 @@ function excerpt(text, cap) {
         return text;
     return `${text.slice(0, cap)} [… ${text.length - cap} chars truncated]`;
 }
+function excerptTailInclusive(text, cap) {
+    if (text.length <= cap)
+        return text;
+    const half = Math.floor(cap / 2);
+    const marker = ` [… ${text.length - 2 * half} chars not shown …] `;
+    const out = `${text.slice(0, half)}${marker}${text.slice(text.length - half)}`;
+    return out.length >= text.length ? text : out;
+}
 function renderEntry(m, cap) {
     if (m.role === "user") {
         const raw = typeof m.content === "string" ? m.content : m.content.map((c) => (c.type === "text" ? c.text : `[${c.type}]`)).join("\n");
@@ -102,5 +110,5 @@ export function renderAutoModeWindow(messages, options) {
 export function renderAutoModeAction(input) {
     const ask = input.askMessage ? `\npermission gate: ${input.askMessage}` : "";
     return (`\n## New action to classify (the agent's most recent action — evaluate THIS)\n\n` +
-        `[tool_call] ${input.req.toolName} ${excerpt(JSON.stringify(input.req.args ?? {}), 48_000)}${ask}\n`);
+        `[tool_call] ${input.req.toolName} ${excerptTailInclusive(JSON.stringify(input.req.args ?? {}), 48_000)}${ask}\n`);
 }

package/dist/core/hooks.d.ts

@@ -198,6 +198,13 @@ export interface PermissionDeniedPayload {
     reason: string;
     /** Which gate source produced the deny (our `decision_reason_type` analog). */
     source: PermissionDeniedSource;
+    /** The ask resolver's own deny-arm classification, carried BESIDE `source` (two different
+     *  questions: `source` names which LAYER raised the gate; this names HOW the ask resolution
+     *  refused — a person's no vs a timeout vs headless vs an approver contract violation …). Present
+     *  only on a deny that came through an ask resolution AND whose word passed the closed-vocabulary
+     *  screen; a policy's direct deny, a hook deny, and the crash/plan-mode/compliance emissions carry
+     *  none. See {@link import("./tool-policy.js").AskDenyResolution}. */
+    resolution?: import("./tool-policy.js").AskDenyResolution;
 }
 /**
  * 1.256 复审 MED-1 — observe-only payload isolation for {@link Hooks.permissionDenied}: clone the tool
@@ -606,6 +613,14 @@ export interface ToolGateResult {
      * and no post-tool hook can write.
      */
     settledBy?: import("./tool-policy.js").ApprovalSettledBy;
+    /**
+     * The ask resolver's deny-arm classification (see {@link import("./tool-policy.js").AskDenyResolution}),
+     * present only on a BLOCK whose deny came through an ask resolution and passed the closed-vocabulary
+     * screen at the deny exit (a self-declared word on a policy's own deny is dropped there, never
+     * forwarded). Rides beside {@link settledBy} to the caller's per-call sideband and the call's
+     * `tool_end` frame — the machine-readable "why was this refused" a consumer classifies on.
+     */
+    resolution?: import("./tool-policy.js").AskDenyResolution;
     /**
      * design/252 G-7 — WHOSE settlement that was: the identifier the approval channel reported, carried
      * out verbatim beside {@link settledBy}. This layer authenticates nothing and compares nothing; the
@@ -915,7 +930,10 @@ export interface ToolGateInput {
      * probe cannot widen anything through this member.
      */
     reversibilityProbe?: (args: unknown) => import("./types.js").ReversibilityVerdict | Promise<import("./types.js").ReversibilityVerdict>;
-    /** design/77 §4: deadline (ms) for {@link reversibilityProbe}; on timeout the gate fails closed to `ask`. */
+    /** design/77 §4: deadline (ms) for {@link reversibilityProbe}; on timeout the gate fails closed to `ask`.
+     *  ABSENT ⇒ a bounded default applies (30s — the probe wait is never unbounded, even with no
+     *  {@link abortSignal}); a non-finite/negative value is refused loudly (via {@link onHookError}) to
+     *  that same default, never silently reinterpreted. `0` is honored as written (immediate deadline). */
     approvalTimeoutMs?: number;
     /** design/77 §4: the task abort signal — bounds {@link reversibilityProbe} by the task's real deadline
      *  (timeout/cancel) in addition to {@link approvalTimeoutMs}; an abort while probing fails closed to `ask`. */
@@ -937,6 +955,11 @@ export interface ToolGateInput {
      * this one carries the exception object itself to whoever runs the deployment, because a crashing hook is
      * a bug someone has to fix and the model-facing summary is bounded/sanitized. Never affects the outcome
      * (a throwing sink is swallowed).
+     *
+     * ALSO fired for a {@link reversibilityProbe} that threw or timed out (same species — a
+     * deployment-supplied callback failing while the gate holds the fail-closed line) and for a
+     * malformed {@link approvalTimeoutMs} refused to the bounded default. A task-abort rejection
+     * mid-probe is NOT reported (normal cancellation, not a defect).
      */
     onHookError?: (err: unknown) => void;
     /**

package/dist/core/hooks.js

@@ -1,4 +1,4 @@
-import { decisionText, describeThrown, refuseOutOfContractDecision } from "./tool-policy.js";
+import { coreMintedResolutionOf, decisionText, describeThrown, isAskDenyResolution, refuseOutOfContractDecision } from "./tool-policy.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { mintSystemReminder } from "./reminder-mint.js";
@@ -269,6 +269,7 @@ function withProbeTimeout(p, ms, signal) {
         p.then((v) => done(resolve, v), (err) => done(reject, err));
     });
 }
+const DEFAULT_PROBE_TIMEOUT_MS = 30_000;
 export function persistedRuleMandateOf(marks) {
     return marks.egress === true
         ? "tool_marks"
@@ -293,6 +294,7 @@ export async function runToolGate(input) {
     const preToolContext = [];
     let hookAsk;
     let parkFailed;
+    let askDenyResolution;
     const notifier = createSafeNotifier(input.onNotifyError !== undefined ? { onError: input.onNotifyError } : undefined);
     if (preToolUse) {
         let r;
@@ -373,8 +375,20 @@ export async function runToolGate(input) {
         if (input.irreversibility === "maybe" && input.reversibilityProbe) {
             let reversible = false;
             const probeArgs = policyRewrite !== undefined ? policyRewrite : currentInput;
+            const suppliedProbeMs = input.approvalTimeoutMs;
+            let probeTimeoutMs;
+            if (suppliedProbeMs === undefined) {
+                probeTimeoutMs = DEFAULT_PROBE_TIMEOUT_MS;
+            }
+            else if (Number.isFinite(suppliedProbeMs) && suppliedProbeMs >= 0 && suppliedProbeMs <= 2_147_483_647) {
+                probeTimeoutMs = suppliedProbeMs;
+            }
+            else {
+                probeTimeoutMs = DEFAULT_PROBE_TIMEOUT_MS;
+                traceHookCrash(input, new Error(`approvalTimeoutMs must be a non-negative finite number no greater than 2147483647 (got ${String(suppliedProbeMs)}) — the reversibilityProbe deadline falls back to the ${DEFAULT_PROBE_TIMEOUT_MS}ms default`), notifier);
+            }
             try {
-                const verdict = await withProbeTimeout(Promise.resolve(input.reversibilityProbe(probeArgs)), input.approvalTimeoutMs, input.abortSignal);
+                const verdict = await withProbeTimeout(Promise.resolve(input.reversibilityProbe(probeArgs)), probeTimeoutMs, input.abortSignal);
                 reversible = verdict?.reversible === true;
                 if (!reversible) {
                     const raw = verdict?.reason;
@@ -383,8 +397,10 @@ export async function runToolGate(input) {
                     probeCause = normalizeProbeCause(verdict?.cause);
                 }
             }
-            catch {
+            catch (err) {
                 reversible = false;
+                if (input.abortSignal?.aborted !== true)
+                    traceHookCrash(input, err, notifier);
             }
             tighten = !reversible;
         }
@@ -671,6 +687,8 @@ export async function runToolGate(input) {
             const resolved = await resolveAsk(decision, req);
             if (resolved.action !== "ask" && resolved.approver !== undefined)
                 resolvedApprover = resolved.approver;
+            if (resolved.action === "deny" && isAskDenyResolution(resolved.resolution))
+                askDenyResolution = resolved.resolution;
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
                 const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined);
@@ -771,6 +789,8 @@ export async function runToolGate(input) {
                     const rr = await resolveAsk({ ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) }, { toolName, args: editArgs, toolCallId });
                     resolvedApprover = rr.action !== "ask" ? rr.approver : undefined;
                     if (rr.action !== "allow") {
+                        if (rr.action === "deny" && isAskDenyResolution(rr.resolution))
+                            askDenyResolution = rr.resolution;
                         editDenied = rr;
                         if (!orgRaisedThisRound)
                             denySource = "policy";
@@ -807,8 +827,9 @@ export async function runToolGate(input) {
         if (decision.updatedInput !== undefined) {
             currentInput = decision.updatedInput;
         }
+        const denyResolution = askDenyResolution ?? coreMintedResolutionOf(decision, { toolCallId, toolName });
         if (input.permissionDenied) {
-            await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(input.identity !== undefined ? { identity: input.identity } : {}) }), "toolGate.permissionDenied");
+            await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(denyResolution !== undefined ? { resolution: denyResolution } : {}), ...(input.identity !== undefined ? { identity: input.identity } : {}) }), "toolGate.permissionDenied");
         }
         const denySettledBy = decision.settledBy;
         const denyApprover = denySettledBy !== undefined ? resolvedApprover : undefined;
@@ -816,6 +837,7 @@ export async function runToolGate(input) {
             block: true,
             reason: formatHookFeedback(denyReason, input.reminderMark),
             ...(denySettledBy !== undefined ? { settledBy: denySettledBy } : {}),
+            ...(denyResolution !== undefined ? { resolution: denyResolution } : {}),
             ...(denyApprover !== undefined ? { approver: denyApprover } : {}),
             preToolContext,
         };