@sema-agent/core 5.50.0 → 5.52.0

package/dist/core/runner/runtask.js

@@ -21,7 +21,7 @@ import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { resolveReasoning } from "../../brain/reasoning.js";
 import { readDegradation } from "../../brain/degrading.js";
-import { runWithBrainTelemetry, runWithStatusSink } from "../../brain/status-sink.js";
+import { runWithBrainTelemetry, runWithReasoningWireFacts, runWithStatusSink } from "../../brain/status-sink.js";
 import { expandTiers, resolveModel, resolveTaskModel } from "../roles.js";
 import { runSideQuery } from "../side-query.js";
 import { generatePromptSuggestions } from "./prompt-suggestions.js";
@@ -141,7 +141,7 @@ function resumeDecisionWasNegative(resume) {
 }
 const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
     "NOT executed on resume. If you still need it, issue it again now.";
-function toolEndBodyFrom(result, isError, settledBy, approver) {
+function toolEndBodyFrom(result, isError, settledBy, approver, resolution) {
     const o = toolOutputFrom(result);
     const st = structuredFrom(result);
     const det = isError ? result?.details : undefined;
@@ -154,6 +154,7 @@ function toolEndBodyFrom(result, isError, settledBy, approver) {
         ...(typeof code === "string" ? { errorCode: code } : {}),
         ...(settledBy !== undefined ? { settledBy } : {}),
         ...(approver !== undefined ? { approver } : {}),
+        ...(resolution !== undefined ? { resolution } : {}),
     };
 }
 export function reconciledToolEndBody(orphan) {
@@ -487,6 +488,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             rs.counters.approachNoticesSent < LIMIT_APPROACH_DEFAULT_THRESHOLDS.length &&
             prepared.suspendForResource === undefined &&
             rs.turn.lastTurnHadToolCalls &&
+            prepared.batchHaltRef.current === undefined &&
             !boundarySteered &&
             !prepared.abortController.signal.aborted) {
             const thresholds = approachCfg?.at ?? LIMIT_APPROACH_DEFAULT_THRESHOLDS;
@@ -534,7 +536,10 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             }
             emitTrace(rs.telemetry.tracer, () => ({ kind: "review.dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
         }
-        if (prepared.lspDiagnostics && !prepared.lspDiagnostics.registry.isEmpty() && !prepared.abortController.signal.aborted) {
+        if (prepared.lspDiagnostics &&
+            !prepared.lspDiagnostics.registry.isEmpty() &&
+            !prepared.abortController.signal.aborted &&
+            prepared.batchHaltRef.current === undefined) {
             const files = prepared.lspDiagnostics.registry.drain(prepared.lspDiagnostics.runIdent);
             if (files.length > 0) {
                 queue.push({ type: "diagnostics", files, isNew: true, ...ident() });
@@ -550,6 +555,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             rs.attach.sizeGuidelineState !== undefined ||
             rs.attach.attachState !== undefined) &&
             !boundarySteered &&
+            prepared.batchHaltRef.current === undefined &&
             rs.counters.finalVerifyInjections === 0 &&
             !prepared.abortController.signal.aborted) {
             const due = [];
@@ -780,7 +786,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                 }
             }
         }
-        if (attachmentsPayload !== undefined || batchContextBlock !== undefined) {
+        if ((attachmentsPayload !== undefined || batchContextBlock !== undefined) && prepared.batchHaltRef.current === undefined) {
             const payload = attachmentsPayload !== undefined && batchContextBlock !== undefined ? `${attachmentsPayload}\n${batchContextBlock}` : (attachmentsPayload ?? batchContextBlock);
             void prepared.harness.steer(payload, { engineMinted: true }).catch(() => { });
         }
@@ -1293,7 +1299,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                 reduceToolEnd(rs.attach.attachState, det);
         }
         if (postToolBatchHook !== undefined) {
-            if (prepared.blockedToolCalls.delete(event.toolCallId)) {
+            if (prepared.blockedToolCalls.delete(event.toolCallId) || event.notExecuted === true) {
                 batchArgs?.delete(event.toolCallId);
             }
             else {
@@ -1338,7 +1344,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
             toolName: event.toolName,
             ...(toolLabels.get(event.toolName) !== undefined ? { label: toolLabels.get(event.toolName) } : {}),
             isError: event.isError,
-            ...toolEndBodyFrom(event.result, event.isError, settlement?.settledBy, settlement?.approver),
+            ...toolEndBodyFrom(event.result, event.isError, settlement?.settledBy, settlement?.approver, settlement?.resolution),
             ...ident(),
         });
         announceWorkspaceMove();
@@ -1549,7 +1555,7 @@ export class Runner {
         });
     }
     sideQuery(spec) {
-        return runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles });
+        return runWithReasoningWireFacts(() => { }, () => runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles }));
     }
     runTaskStream(spec, resume, internals) {
         if (resume !== undefined && (typeof resume !== "object" || resume.outcome === undefined)) {
@@ -1822,7 +1828,7 @@ export class Runner {
                         }
                     }
                     try {
-                        await h.harness.steer(payload, { provenance: "engine-note", ...(actor !== undefined ? { actor } : {}) });
+                        await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, ...(actor !== undefined ? { actor } : {}) });
                         noteAccepted(h);
                         return;
                     }
@@ -1833,7 +1839,7 @@ export class Runner {
                     const birthDeadline = Date.now() + READY_TIMEOUT_MS;
                     while (resultValue === undefined && !h.loop.ended && Date.now() < birthDeadline) {
                         try {
-                            await h.harness.steer(payload, { provenance: "engine-note", ...(actor !== undefined ? { actor } : {}) });
+                            await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, ...(actor !== undefined ? { actor } : {}) });
                             noteAccepted(h);
                             return;
                         }
@@ -2006,7 +2012,7 @@ export class Runner {
         };
         const unsubscribeTaskNotifications = taskNotificationQueue.subscribe((item) => {
             queue.push({ type: "task_notification", notification: item.payload, ...notificationIdent() });
-            if (notificationHarness) {
+            if (notificationHarness && prepared.batchHaltRef.current === undefined) {
                 const xml = renderTaskNotificationXml(item.payload);
                 const deliver = notificationHarness.steer(xml, { provenance: "engine-note", enginePayload: item.payload });
                 void deliver.then(() => item.onDisposition?.("queued"), () => {
@@ -2089,6 +2095,7 @@ export class Runner {
             for (const p of payloads)
                 this.pendingSessionNotifications.pend(notificationSessionId, p);
         };
+        prepared.harness.engineInjectionsHeld = () => prepared.batchHaltRef.current !== undefined;
         prepared.harness.onUndrainedUserInputs = (counts) => {
             for (const notice of undrainedUserInputNotices(counts, spec.taskId)) {
                 deliverEngineNotice(this.deps.onNotice, notice);
@@ -2490,25 +2497,48 @@ export class Runner {
                 ts: Date.now(),
             }));
         }
-        const reasoningResolution = prepared.thinking && prepared.thinking !== "off" ? resolveReasoning(prepared.thinking, prepared.model) : undefined;
-        if (taskIdRef && reasoningResolution !== undefined)
-            taskIdRef.effectiveReasoning = reasoningResolution;
-        if (reasoningResolution !== undefined) {
+        let reasoningResolution = prepared.thinking && prepared.thinking !== "off" ? resolveReasoning(prepared.thinking, prepared.model) : undefined;
+        const publishReasoningResolution = (r) => {
+            reasoningResolution = r;
+            if (taskIdRef)
+                taskIdRef.effectiveReasoning = r;
             emitTrace(rs.telemetry.tracer, () => ({
                 kind: "reasoning.resolved",
                 version: 1,
                 taskId: rs.telemetry.taskId,
                 model: prepared.model.id,
-                requested: reasoningResolution.requested,
-                effective: reasoningResolution.effective,
-                graded: reasoningResolution.graded,
-                clamped: reasoningResolution.clamped,
-                format: reasoningResolution.format,
-                endpoint: reasoningResolution.endpoint,
-                ...(reasoningResolution.dropped === true ? { dropped: true } : {}),
+                requested: r.requested,
+                effective: r.effective,
+                graded: r.graded,
+                clamped: r.clamped,
+                format: r.format,
+                endpoint: r.endpoint,
+                ...(r.dropped === true ? { dropped: true } : {}),
                 ts: Date.now(),
             }));
-        }
+        };
+        if (reasoningResolution !== undefined)
+            publishReasoningResolution(reasoningResolution);
+        let reasoningFactsConsumed = false;
+        const observeReasoningWireFacts = (facts) => {
+            if (reasoningFactsConsumed)
+                return;
+            reasoningFactsConsumed = true;
+            if (prepared.thinking === undefined || prepared.thinking === "off")
+                return;
+            const next = resolveReasoning(prepared.thinking, prepared.model, facts);
+            const current = reasoningResolution;
+            if (current !== undefined &&
+                current.effective === next.effective &&
+                current.graded === next.graded &&
+                current.clamped === next.clamped &&
+                current.format === next.format &&
+                current.endpoint === next.endpoint &&
+                current.dropped === next.dropped) {
+                return;
+            }
+            publishReasoningResolution(next);
+        };
         const effectiveTimeoutMs = spec.limits?.maxWalltimeMs;
         const walltimeMonotonicDeadline = effectiveTimeoutMs !== undefined ? rs.telemetry.taskStartMonotonic + effectiveTimeoutMs : undefined;
         rs.counters.walltimeSyncBackstopFired = false;
@@ -2576,7 +2606,7 @@ export class Runner {
                         }
                         : { kind: "vision.placeholder", version: 1, taskId: rs.telemetry.taskId, count: t.count, ts: Date.now() });
         };
-        const withBrainSinks = (fn) => runWithStatusSink(statusEmit, () => runWithBrainTelemetry(telemetryEmit, fn));
+        const withBrainSinks = (fn) => runWithStatusSink(statusEmit, () => runWithBrainTelemetry(telemetryEmit, () => runWithReasoningWireFacts(observeReasoningWireFacts, fn)));
         const toolLabels = new Map(prepared.tools.flatMap((t) => (t.label !== undefined && t.label !== t.name ? [[t.name, t.label]] : [])));
         for (const orphan of prepared.wakeRecovered) {
             queue.push({ type: "tool_end", toolCallId: orphan.toolCallId, toolName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), isError: true, ...reconciledToolEndBody(orphan), ...ident() });
@@ -2619,9 +2649,9 @@ export class Runner {
         const compactionBrain = {
             stream: this.deps.brain.stream,
             complete: async (m, c, o) => {
-                const msg = await runWithStatusSink(() => { }, async () => this.deps.brain.complete
+                const msg = await runWithStatusSink(() => { }, async () => await runWithReasoningWireFacts(() => { }, async () => this.deps.brain.complete
                     ? await this.deps.brain.complete(m, c, o)
-                    : await (await Promise.resolve(this.deps.brain.stream(m, c, o))).result());
+                    : await (await Promise.resolve(this.deps.brain.stream(m, c, o))).result()));
                 recordCompactionUsage(m, msg);
                 return msg;
             },
@@ -2698,7 +2728,7 @@ export class Runner {
         if (stopHook || finalVerificationOn) {
             let consecutiveBlocks = 0;
             prepared.harness.setStopGate(async () => {
-                if (prepared.abortController.signal.aborted || prepared.suspendRef.token !== undefined)
+                if (prepared.abortController.signal.aborted || prepared.suspendRef.token !== undefined || prepared.batchHaltRef.current !== undefined)
                     return [];
                 if (finalVerificationOn &&
                     (rs.counters.finalVerifyInjections === 0 || (rs.counters.finalVerifyInjections === 1 && rs.counters.groundingSignalPreR9 && !rs.counters.groundingSignalPostR9)) &&
@@ -3480,6 +3510,7 @@ export class Runner {
                 model: prepared.model.id,
                 unpricedSpend: rs.telemetry.unpricedSpend,
                 rewindNotes: prepared.rewindNotes,
+                haltedOnUserRejection: prepared.batchHaltRef.current !== undefined,
                 strandedHumanAnswers,
                 remoteEnvFailures: prepared.remoteEnvFailures,
                 effectiveReadFace: prepared.effectiveReadFace,

package/dist/core/task-registry-agent.js

@@ -1402,7 +1402,7 @@ export async function stopBackgroundAgentLane(core, handle) {
         if (arbiter === undefined) {
             return {
                 content: `${handle.id} is parked on a pending approval — stop it by deciding (deny/expire) the pending approval in the durable approval inbox.`,
-                details: { task_id: handle.id, type: "background_agent", status: "parked", retrieval_status: "not_ready", error: "parked_pending_approval" },
+                details: { task_id: handle.id, type: "background_agent", status: "parked", retrieval_status: "not_ready", error: "parked_pending_approval", code: "parked_pending_approval" },
             };
         }
         let stopWon = false;
@@ -1467,13 +1467,13 @@ export async function stopBackgroundAgentLane(core, handle) {
         if (arbiterUnreachable) {
             return {
                 content: `${handle.id} was not stopped: the approval arbitration store was unreachable — the row stays parked; retry the stop.`,
-                details: { task_id: handle.id, type: "background_agent", status: handle.status, retrieval_status: "not_ready", error: "park_arbiter_unreachable" },
+                details: { task_id: handle.id, type: "background_agent", status: handle.status, retrieval_status: "not_ready", error: "park_arbiter_unreachable", code: "park_arbiter_unreachable" },
                 isError: true,
             };
         }
         return {
             content: `${handle.id} was not stopped: its pending approval was already consumed (a resume won the arbitration).`,
-            details: { task_id: handle.id, type: "background_agent", status: handle.status, retrieval_status: "not_ready", error: "park_resume_won" },
+            details: { task_id: handle.id, type: "background_agent", status: handle.status, retrieval_status: "not_ready", error: "park_resume_won", code: "park_resume_won" },
             isError: true,
         };
     }

package/dist/core/task-registry-shared.d.ts

@@ -32,6 +32,12 @@ export interface UnifiedTaskOutput {
     retrieval_status: TaskRetrievalStatus;
     content?: string;
     error?: string;
+    /** Machine twin of {@link error}, same token, present exactly where `error` names a coded refusal
+     *  (`not_local`/`parked_pending_approval`/`park_resume_won`/`park_arbiter_unreachable`): the wire
+     *  errorCode lift reads `details.code`, and an error-only refusal is unclassifiable on tool_end
+     *  frames. Distinct from {@link errorCode}, which carries a FAILED child's own result taxonomy —
+     *  this key classifies THIS poll/stop answer itself. Additive. */
+    code?: string;
     /** RB-386② ([2090]) — machine-readable failure code on a FAILED background_agent row's poll
      *  details (the child's TaskResult.errorCode taxonomy — brain codes / `limit.*` / `budget.*` …).
      *  Additive; absent on non-failed rows, on rows whose failure carried no code, and on other lanes. */

package/dist/core/task-registry.js

@@ -861,6 +861,7 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
                             status: "running",
                             retrieval_status: "not_ready",
                             error: "not_local",
+                            code: "not_local",
                         },
                     };
                 }
@@ -898,6 +899,7 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
                         status: run.status,
                         retrieval_status: "success",
                         error: "not_local",
+                        code: "not_local",
                     },
                 };
             }
@@ -922,8 +924,8 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
                         type: "background_agent",
                         status: row.status,
                         retrieval_status: row.status === "parked" ? "not_ready" : "success",
-                        ...(row.status === "running" ? { error: "not_local" } : {}),
-                        ...(row.status === "parked" ? { error: "parked_pending_approval" } : {}),
+                        ...(row.status === "running" ? { error: "not_local", code: "not_local" } : {}),
+                        ...(row.status === "parked" ? { error: "parked_pending_approval", code: "parked_pending_approval" } : {}),
                     },
                 };
             }

package/dist/core/tool-policy.d.ts

@@ -1057,6 +1057,46 @@ export declare function tryCloneArgs<T>(v: T): {
  * text they let through. Not part of the package's public surface.
  */
 export declare function describeThrown(err: unknown): string;
+/**
+ * The deny-arm classification a {@link resolveAsk} refusal carries — MINTED at the composing arm
+ * (the minter reports the fact; no consumer re-derives it from message text, which is exactly the
+ * inference this closed set exists to end). One word per family of arms:
+ *  - `"human_refused"` — a person answered no (the boolean false fold and the object arm's
+ *    allow-false, noted or bare — the note fact rides {@link ResolvedAsk.humanRefusalNote});
+ *  - `"window_expired"` — the approver's own window elapsed (the timeout-settled deny);
+ *  - `"no_approver"` — headless auto-deny (no approver wired, or the deny posture string);
+ *  - `"blanket_allow_refused"` — a blanket allow posture met a `requiresRealApproval` ask;
+ *  - `"approver_unavailable"` — the approver answered the ROUTING question "nobody reachable"
+ *    (the G1 marker's fail-closed carry — the gate may re-route it to a durable park instead);
+ *  - `"task_aborted"` — the task's own signal ended the wait (pre-wait and mid-wait arms);
+ *  - `"presentation_failed"` — the args/edit could not be safely presented or adopted (unclonable);
+ *  - `"approver_error"` — the approver callback threw;
+ *  - `"approver_contract"` — the approver returned something outside the contract (non-boolean
+ *    allow, out-of-vocabulary settlement word, unreadable members, a timeout-settled allow, a
+ *    non-string or unreadable reason, an out-of-contract truthy, a refused attribution).
+ */
+export type AskDenyResolution = "human_refused" | "window_expired" | "no_approver" | "blanket_allow_refused" | "approver_unavailable" | "task_aborted" | "presentation_failed" | "approver_error" | "approver_contract";
+/** The closed set above, for runtime domain checks at the seams that accept a caller-supplied value
+ *  (the `APPROVAL_SETTLED_BY_VALUES` precedent: the word crosses process boundaries on `tool_end`,
+ *  so a consumer enumerating or validating it must not hand-roll the vocabulary). */
+export declare const ASK_DENY_RESOLUTION_VALUES: readonly AskDenyResolution[];
+/** Closed-vocabulary guard for {@link AskDenyResolution} — the screen every carrier runs before it
+ *  files or forwards the word (a policy layer could self-declare the member on its own deny; an
+ *  out-of-vocabulary word is dropped by the carriers, never coerced or forwarded). */
+export declare function isAskDenyResolution(v: unknown): v is AskDenyResolution;
+/** Read the engine-attested resolution off a funneled decision (the gate's single deny exit is the
+ *  one consumer), FOR the named call: an attestation bound to a different toolCallId/toolName is a
+ *  replayed object, not this call's settlement — the reader answers absence (the safe direction; the
+ *  public `settledBy`/message on such an object were always the policy's own to state). A present
+ *  word is an engine settlement site's own attestation for THIS object and THIS call — no foreign
+ *  policy can reach the sidecar. The vocabulary screen is a belt (the typed stamp is the only
+ *  writer). Exported for the gate module only — deliberately NOT re-exported from `src/index.ts`
+ *  (the {@link refuseOutOfContractDecision} precedent: an internal seam between engine modules, not
+ *  a facility deployments call). */
+export declare function coreMintedResolutionOf(d: unknown, call: {
+    toolCallId: string;
+    toolName: string;
+}): AskDenyResolution | undefined;
 /**
  * A {@link resolveAsk} result: always a TERMINAL `allow`/`deny` (never `ask`). `approverUnavailable`
  * is the out-of-band G1 three-value marker: the live approver returned `"unavailable"` for this ask —
@@ -1071,6 +1111,20 @@ export type ResolvedAsk = PermissionResult & {
      *  differ from the approved one (shown == executed, by construction). Set only on the
      *  function-approver path (string modes present nothing). */
     presentedInput?: unknown;
+    /** Present exactly when this deny is a PERSON's refusal (`settledBy: "human"`) that carried the
+     *  decider's own note (the object arm's `reason`, screened and non-empty). Its ABSENCE on a human
+     *  deny is the structural fact that the refusal was BARE — a "no" with no direction attached —
+     *  which is the arm the runner treats as a control-flow boundary for the issuing batch (a bare
+     *  "no" on the parent thread halts the remaining same-message tool calls; a refusal WITH a note
+     *  gives the model direction to adapt to, so the turn continues). Never derived from message
+     *  text; stamped only at the composing arm. Not stamped on the timeout deny (nobody answered)
+     *  or on any engine-produced fail-closed refusal. */
+    humanRefusalNote?: true;
+    /** The deny-arm classification (see {@link AskDenyResolution}) — present on every deny this
+     *  resolver composes, absent on every allow. Carried by the gate to its block exit, the
+     *  permission-denied observer payload and the settlement sideband (thence the call's `tool_end`
+     *  frame), so a consumer classifies a refusal by code instead of parsing its text. */
+    resolution?: AskDenyResolution;
 };
 /**
  * Resolve an `ask` decision to a terminal `allow`/`deny` via {@link OnAsk}. Centralizes the headless

package/dist/core/tool-policy.js

@@ -271,37 +271,37 @@ export function createApprovalPolicy(opts) {
             }
             if (need.has(toolName)) {
                 if (signal?.aborted) {
-                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" };
+                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" }, "task_aborted", req);
                 }
                 let ok;
                 try {
                     ok = await withTimeout(Promise.resolve(opts.approve(req, signal)), opts.approvalTimeoutMs, () => DEADLINE_ELAPSED);
                 }
                 catch (err) {
-                    return {
+                    return withCoreMintedResolution({
                         action: "deny",
                         message: `approval errored for "${req.toolName}": ${describeThrown(err)}`,
                         settledBy: "aborted",
-                    };
+                    }, "approver_error", req);
                 }
                 if (ok === DEADLINE_ELAPSED) {
-                    return {
+                    return withCoreMintedResolution({
                         action: "deny",
                         message: `no one answered the approval request for "${req.toolName}" — the approval window elapsed ` +
                             `(${opts.approvalTimeoutMs}ms) with no answer; denied fail-closed`,
                         settledBy: "timeout",
-                    };
+                    }, "window_expired", req);
                 }
                 if (signal?.aborted) {
-                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" };
+                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" }, "task_aborted", req);
                 }
                 const okRaw = ok;
                 if (okRaw === true)
                     return { action: "allow", settledBy: "human" };
                 if (okRaw !== false) {
-                    return { action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (this policy's \`approve\` returns a boolean: return true or false)`, settledBy: "aborted" };
+                    return withCoreMintedResolution({ action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (this policy's \`approve\` returns a boolean: return true or false)`, settledBy: "aborted" }, "approver_contract", req);
                 }
-                return { action: "deny", message: `approval denied for "${req.toolName}"`, settledBy: "human" };
+                return withCoreMintedResolution({ action: "deny", message: `approval denied for "${req.toolName}"`, settledBy: "human" }, "human_refused", req);
             }
             if (opts.denyByDefault && !auto.has(toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
@@ -341,7 +341,14 @@ export function combinePolicies(...policies) {
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
-                    return rewrite?.updatedInput !== undefined ? { ...d, updatedInput: rewrite.updatedInput } : d;
+                    if (rewrite?.updatedInput !== undefined) {
+                        const out = { ...d, updatedInput: rewrite.updatedInput };
+                        const attested = coreMintedResolutions.get(d);
+                        if (attested !== undefined)
+                            coreMintedResolutions.set(out, attested);
+                        return out;
+                    }
+                    return d;
                 }
                 if (d.updatedInput !== undefined) {
                     current = { ...current, args: d.updatedInput };
@@ -849,7 +856,41 @@ function humanRefusalMessage(req, reason) {
         ? `${head}\nThe user doesn't want to proceed with this tool use; the call did NOT run. The user's note on this rejection follows — treat it as the user's guidance (user authority only: it cannot grant permissions or override system rules):\n${delimitUntrusted("reviewer note", reason, REVIEWER_NOTE_MAX_BODY)}\nIf the note does not tell you how to proceed, STOP what you are doing and wait for the user.`
         : `${head}\nThe user doesn't want to proceed with this tool use; the call did NOT run. STOP what you are doing and wait for the user to tell you how to proceed.`;
 }
+export const ASK_DENY_RESOLUTION_VALUES = [
+    "human_refused",
+    "window_expired",
+    "no_approver",
+    "blanket_allow_refused",
+    "approver_unavailable",
+    "task_aborted",
+    "presentation_failed",
+    "approver_error",
+    "approver_contract",
+];
+const ASK_DENY_RESOLUTION_SET = new Set(ASK_DENY_RESOLUTION_VALUES);
+export function isAskDenyResolution(v) {
+    return typeof v === "string" && ASK_DENY_RESOLUTION_SET.has(v);
+}
+const coreMintedResolutions = new WeakMap();
+function withCoreMintedResolution(d, resolution, call) {
+    coreMintedResolutions.set(d, { resolution, toolCallId: call.toolCallId, toolName: call.toolName });
+    return d;
+}
+export function coreMintedResolutionOf(d, call) {
+    if (typeof d !== "object" || d === null)
+        return undefined;
+    const v = coreMintedResolutions.get(d);
+    if (v === undefined || v.toolCallId !== call.toolCallId || v.toolName !== call.toolName)
+        return undefined;
+    return isAskDenyResolution(v.resolution) ? v.resolution : undefined;
+}
 export async function resolveAsk(req, onAsk, signal) {
+    const r = await resolveAskArms(req, onAsk, signal);
+    if (r.action === "deny" && isAskDenyResolution(r.resolution))
+        return withCoreMintedResolution(r, r.resolution, req);
+    return r;
+}
+async function resolveAskArms(req, onAsk, signal) {
     if (onAsk === "allow") {
         if (req.requiresRealApproval === true) {
             return {
@@ -858,6 +899,7 @@ export async function resolveAsk(req, onAsk, signal) {
                     `judgment was applied) — this decision requires an actual auto-mode classifier verdict or a ` +
                     `real approval callback, neither of which a blanket bypass can provide: ${req.message}`,
                 decisionReason: "mode",
+                resolution: "blanket_allow_refused",
             };
         }
         return { action: "allow", decisionReason: "mode" };
@@ -867,10 +909,12 @@ export async function resolveAsk(req, onAsk, signal) {
             action: "deny",
             message: `approval required for "${req.toolName}" but no approver is wired (headless auto-deny): ${req.message}`,
             decisionReason: "mode",
+            resolution: "no_approver",
         };
     }
     if (signal?.aborted) {
-        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode", settledBy: "aborted" };
+        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode",
+            resolution: "task_aborted", settledBy: "aborted" };
     }
     const presented = tryCloneArgs(req.args);
     if (!presented.ok) {
@@ -878,6 +922,7 @@ export async function resolveAsk(req, onAsk, signal) {
             action: "deny",
             message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${presented.reason}) — denied fail-closed`,
             decisionReason: "mode",
+            resolution: "presentation_failed",
             settledBy: "aborted",
         };
     }
@@ -889,6 +934,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 action: "deny",
                 message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${approverView.reason}) — denied fail-closed`,
                 decisionReason: "mode",
+                resolution: "presentation_failed",
                 settledBy: "aborted",
             };
         }
@@ -899,11 +945,13 @@ export async function resolveAsk(req, onAsk, signal) {
             action: "deny",
             message: `approval errored for "${req.toolName}": ${describeThrown(err)}`,
             decisionReason: "mode",
+            resolution: "approver_error",
             settledBy: "aborted",
         };
     }
     if (signal?.aborted) {
-        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode", settledBy: "aborted" };
+        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode",
+            resolution: "task_aborted", settledBy: "aborted" };
     }
     if (ok === "unavailable") {
         return {
@@ -911,6 +959,7 @@ export async function resolveAsk(req, onAsk, signal) {
             message: `approval required for "${req.toolName}" but the approver reported unavailable (no reachable ` +
                 `operator for this ask) and no durable approval gate is armed — denied fail-closed: ${req.message}`,
             decisionReason: "mode",
+            resolution: "approver_unavailable",
             settledBy: "aborted",
             approverUnavailable: true,
         };
@@ -931,6 +980,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 action: "deny",
                 message: `the approver's outcome for "${req.toolName}" could not be read (${describeThrown(err)}) — denied fail-closed`,
                 decisionReason: "mode",
+                resolution: "approver_contract",
                 settledBy: "aborted",
             };
         }
@@ -940,6 +990,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 message: `the approver for "${req.toolName}" returned an object whose allow is not a boolean ` +
                     `(got ${allowed === null ? "null" : typeof allowed}) — a verdict is exactly true or false; denied fail-closed`,
                 decisionReason: "mode",
+                resolution: "approver_contract",
                 settledBy: "aborted",
             };
         }
@@ -949,6 +1000,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 message: `the approver for "${req.toolName}" reported settledBy "${typeof supplied === "string" ? containThrownText(supplied) : supplied === null ? "null" : typeof supplied}", which is outside what a synchronous ` +
                     `approver may self-report — it is exactly "human" or "timeout" (or omitted); denied fail-closed`,
                 decisionReason: "mode",
+                resolution: "approver_contract",
                 settledBy: "aborted",
             };
         }
@@ -958,6 +1010,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 action: "deny",
                 message: `the approver for "${req.toolName}" reported an attribution this seam refuses: ${attribution.defect}; denied fail-closed`,
                 decisionReason: "mode",
+                resolution: "approver_contract",
                 settledBy: "aborted",
             };
         }
@@ -968,6 +1021,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 message: `the approver for "${req.toolName}" returned an allow settled by "timeout" — an elapsed approval window cannot be ` +
                     `what approved a call; denied fail-closed (report timeout with allow:false, or allow with settledBy "human"/omitted)`,
                 decisionReason: "mode",
+                resolution: "approver_contract",
                 settledBy: "timeout",
             };
         }
@@ -981,6 +1035,7 @@ export async function resolveAsk(req, onAsk, signal) {
                         message: `the approver for "${req.toolName}" attached a reason that is not a plain string ` +
                             `(got ${suppliedReason === null ? "null" : typeof suppliedReason}) — a deny note is the decider's plain text; denied fail-closed`,
                         decisionReason: "mode",
+                        resolution: "approver_contract",
                         settledBy: "aborted",
                     };
                 }
@@ -991,6 +1046,7 @@ export async function resolveAsk(req, onAsk, signal) {
                     action: "deny",
                     message: `the approver for "${req.toolName}" attached a reason that could not be read (${describeThrown(err)}) — denied fail-closed`,
                     decisionReason: "mode",
+                    resolution: "approver_contract",
                     settledBy: "aborted",
                 };
             }
@@ -1000,7 +1056,9 @@ export async function resolveAsk(req, onAsk, signal) {
                     ? `approval for "${req.toolName}" was not answered before the approver's own window elapsed: ${req.message}${reasonText !== undefined ? `\nReviewer note:\n${delimitUntrusted("reviewer note", reasonText, REVIEWER_NOTE_MAX_BODY)}` : ""}`
                     : humanRefusalMessage(req, reasonText),
                 decisionReason: "mode",
+                resolution: supplied === "timeout" ? "window_expired" : "human_refused",
                 settledBy: supplied === "timeout" ? "timeout" : "human",
+                ...(supplied !== "timeout" && reasonText !== undefined ? { humanRefusalNote: true } : {}),
                 ...attributionCell,
             };
         }
@@ -1012,6 +1070,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 action: "deny",
                 message: `the approved edit for "${req.toolName}" is not safely clonable (${edit.reason}) — denied fail-closed`,
                 decisionReason: "mode",
+                resolution: "presentation_failed",
                 settledBy: "aborted",
             };
         }
@@ -1025,8 +1084,9 @@ export async function resolveAsk(req, onAsk, signal) {
             action: "deny",
             message: `the approver for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (return true, false, "unavailable", or the {allow} object)`,
             decisionReason: "mode",
+            resolution: "approver_contract",
             settledBy: "aborted",
         };
     }
-    return { action: "deny", message: humanRefusalMessage(req), decisionReason: "mode", settledBy: "human" };
+    return { action: "deny", message: humanRefusalMessage(req), decisionReason: "mode", resolution: "human_refused", settledBy: "human" };
 }

package/dist/core/tools.js

@@ -46,6 +46,13 @@ export function defineTool(spec, options) {
         ...(spec.isConcurrencySafe ? { isConcurrencySafe: spec.isConcurrencySafe } : {}),
         ...(spec.effect ? { effect: spec.effect } : {}),
         ...(spec.contentOrigin ? { contentOrigin: spec.contentOrigin } : {}),
+        ...(spec.egress ? { egress: true } : {}),
+        ...(spec.irreversibility !== undefined ? { irreversibility: spec.irreversibility } : {}),
+        ...(spec.reversibilityProbe ? { reversibilityProbe: spec.reversibilityProbe } : {}),
+        ...(spec.offload !== undefined ? { offload: spec.offload } : {}),
+        ...(spec.offloadThresholdChars !== undefined ? { offloadThresholdChars: spec.offloadThresholdChars } : {}),
+        ...(spec.defer !== undefined ? { defer: spec.defer } : {}),
+        ...(spec.alwaysLoad !== undefined ? { alwaysLoad: spec.alwaysLoad } : {}),
         ...(spec.prepareArguments ? { prepareArguments: spec.prepareArguments } : {}),
         ...(spec.approvalPreview ? { approvalPreview: spec.approvalPreview } : {}),
         execute: async (toolCallId, rawParams, signal) => {