@sema-agent/core 7.0.2 → 7.2.0

package/dist/core/runner/prepare-task.js

@@ -1,7 +1,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { resolve as resolveFsPath } from "node:path";
-import { AgentHarness, DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, estimateContextTokens, readCompactionActiveTools, summaryOutputBudgetTokens } from "../../internal/harness.js";
+import { AgentHarness, DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, estimateContextTokens, isSyntheticApiErrorMessage, readCompactionActiveTools, summaryOutputBudgetTokens } from "../../internal/harness.js";
 const PROMPT_HASH_SALT = randomBytes(16);
 import { sanitizeCompactionSettings } from "../auto-compaction.js";
 import { projectStaleToolResults, resolveStaleToolResultOffload } from "./compaction-call-options.js";
@@ -23,7 +23,8 @@ import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { askApproverIdentity, carriesBidiControls, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOfLayer, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
-import { findAdmittingRule, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
+const DIRECTORY_RULE_TOOL = "Read";
+import { directoryRuleAdmits, eligiblePersisted, findAdmittingRule, lexicalNormalAbsolutePathOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { normalizePersistedRule } from "../permission-rule-store.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
@@ -76,7 +77,7 @@ import { capAggregateToolResults } from "../tool-result-budget.js";
 import { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "../media-byte-cap.js";
 import { dropOrphanToolResults, guardBudget, insertTrimNotice, trimToBudget } from "../context-guard.js";
 import { StubExecutionEnv } from "../stub-env.js";
-import { hasDestroy, isIsolated, isRemoteExecutionEnv, isSuspendable, missingRestoreSurface } from "../remote-env.js";
+import { hasDestroy, isIsolated, isRemoteExecutionEnv, isSuspendable, missingRestoreSurface, RemoteExecutionError } from "../remote-env.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { createTaskOutputTool, createTaskStopTool, defaultTaskRegistry } from "../task-registry.js";
@@ -662,6 +663,144 @@ export function batchContextAt(messages, currentId) {
     const completedCallIds = batch.filter((id) => id !== currentId && resolved.has(id));
     return { batchToolCallIds: batch, completedCallIds };
 }
+function composeCallSignal(runSignal, callSignal) {
+    return callSignal !== undefined ? AbortSignal.any([runSignal, callSignal]) : runSignal;
+}
+function lateAskSettlementObserver(args) {
+    return (late) => {
+        if (late.kind === "approve") {
+            deliverEngineNotice(args.onNotice, {
+                code: "task.late_approval",
+                message: `an approval for "${args.toolName}" was not consumed: a run or turn interrupt released the ask wait, ` +
+                    `so the tool did NOT run and the approval was not honored (an unconsumed answer is the approver ` +
+                    `releasing its wait, never a verdict).`,
+                detail: {
+                    toolName: args.toolName,
+                    toolCallId: args.toolCallId,
+                    sessionId: args.sessionId,
+                    runId: args.runId,
+                    ...(args.taskId !== undefined ? { taskId: args.taskId } : {}),
+                },
+            });
+            return;
+        }
+        args.onError?.(late.error, { phase: "hook", sessionId: args.sessionId });
+    };
+}
+function askGrantShapeOf(args) {
+    try {
+        return JSON.stringify(args ?? null);
+    }
+    catch {
+        return undefined;
+    }
+}
+function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision, req) {
+    if (decision.decisionReason !== undefined && decision.decisionReason !== "rule")
+        return undefined;
+    const grant = grants.get(req.toolCallId);
+    if (grant === undefined || askApproverIdentity(grant.approver) !== askApproverIdentity(onAsk) || grant.argsJson !== askGrantShapeOf(req.args))
+        return undefined;
+    grants.delete(req.toolCallId);
+    humanReviewRef.count += 1;
+    humanReviewRef.totalWaitMs += grant.waitMs;
+    const toolArg = primaryActivityArg(req.args);
+    humanReviewRef.gates.push({
+        kind: "human",
+        waitMs: grant.waitMs,
+        decision: "allow",
+        toolName: req.toolName,
+        ...(toolArg !== undefined ? { toolArg } : {}),
+    });
+    return { action: "allow", presentedInput: grant.presented };
+}
+function raceSettlementAgainstSignal(p, signal) {
+    const settled = p.then((value) => ({ tag: "value", value }), (error) => ({ tag: "threw", error }));
+    if (signal.aborted)
+        return Promise.resolve({ tag: "aborted" });
+    return new Promise((resolve) => {
+        let done = false;
+        const finish = (r) => {
+            if (done)
+                return;
+            done = true;
+            signal.removeEventListener("abort", onAbortEvent);
+            resolve(r);
+        };
+        const onAbortEvent = () => finish({ tag: "aborted" });
+        signal.addEventListener("abort", onAbortEvent, { once: true });
+        void settled.then(finish);
+    });
+}
+const PARK_COMPENSATION_TIMEOUT_MS = 30_000;
+export async function compensateUnparkedPause(remoteEnv, snapshotId, io) {
+    const boundCtl = new AbortController();
+    const boundTimer = setTimeout(() => boundCtl.abort(), io.boundMs);
+    const bound = boundCtl.signal;
+    let phase = "resumeVM";
+    let restoreAttempts = 1;
+    let vmRunning = false;
+    const work = (async () => {
+        const { outcome: back, attempts: backAttempts } = await restoreWorkspaceWithRetry(remoteEnv, snapshotId, { abortSignal: bound }, (attempt) => (restoreAttempts = attempt));
+        if (!back.ok) {
+            io.noteFailure(remoteEnvFailureNote("resumeVM", back.error, backAttempts));
+            io.disclose(back.error);
+            return { ok: false, reason: `resumeVM failed (${back.error.code}) while compensating an unparked pause` };
+        }
+        vmRunning = true;
+        if (bound.aborted) {
+            return { ok: false, reason: "resumeVM settled only after the decision bound" };
+        }
+        phase = "postResumeInit";
+        const init = await remoteEnv.postResumeInit({ abortSignal: bound });
+        if (!init.ok) {
+            io.noteFailure(remoteEnvFailureNote("postResumeInit", init.error, 1));
+            io.disclose(init.error);
+            return { ok: false, reason: `postResumeInit failed (${init.error.code}) while compensating an unparked pause` };
+        }
+        return { ok: true };
+    })();
+    const raced = await raceSettlementAgainstSignal(work, bound);
+    clearTimeout(boundTimer);
+    if (raced.tag === "value")
+        return raced.value;
+    if (raced.tag === "threw") {
+        io.noteFailure(remoteEnvFailureNote(phase, raced.error instanceof RemoteExecutionError
+            ? raced.error
+            : new RemoteExecutionError("unknown", `the pause compensation's ${phase} call threw: ${raced.error instanceof Error ? raced.error.message : String(raced.error)}`), phase === "resumeVM" ? restoreAttempts : 1));
+        io.disclose(raced.error);
+        return {
+            ok: false,
+            reason: "the pause compensation threw (adapter contract violation; the deployment's error face carries the exception)",
+        };
+    }
+    const timedOut = new RemoteExecutionError("timeout", `the pause compensation's ${phase} call did not settle within the ${io.boundMs}ms decision bound`);
+    io.noteFailure(remoteEnvFailureNote(phase, timedOut, phase === "resumeVM" ? restoreAttempts : 1));
+    io.disclose(timedOut);
+    const destroyOwnerlessLate = () => {
+        io.disclose(new Error(`park compensation settled after its ${io.boundMs}ms decision bound: the VM is running with no run ` +
+            `left to own it — destroying the env (an ownerless running VM must not linger; the run already took ` +
+            `the fail-closed arm when the bound fired)`));
+        void Promise.resolve()
+            .then(() => remoteEnv.destroy())
+            .catch((destroyErr) => io.disclose(destroyErr));
+    };
+    void work.then((late) => {
+        if (vmRunning) {
+            destroyOwnerlessLate();
+            return;
+        }
+        void late;
+    }, (lateErr) => {
+        io.disclose(lateErr);
+        if (vmRunning)
+            destroyOwnerlessLate();
+    });
+    return {
+        ok: false,
+        reason: `the pause compensation did not settle within ${io.boundMs}ms — treated as failed (a late-restored VM is destroyed; a late restore failure is disclosed)`,
+    };
+}
 function raceAbort(p, signal, onAbort) {
     if (signal.aborted)
         return Promise.resolve(onAbort());
@@ -818,6 +957,87 @@ function persistedRuleHitOf(admitting) {
         ? undefined
         : { rules: admitting.map((r) => ({ rule: r.rule, dots: r.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) })) };
 }
+function directoryRuleLaneAnswer(table, args, ctx) {
+    const filePath = args?.file_path;
+    if (typeof filePath !== "string" || filePath === "")
+        return undefined;
+    const spelled = filePath.startsWith("/") ? filePath : `${(ctx.liveCwd ?? ctx.root ?? "").replace(/\/+$/, "")}/${filePath}`;
+    const target = lexicalNormalAbsolutePathOf(spelled);
+    if (target === undefined)
+        return undefined;
+    const hit = table.find((r) => eligiblePersisted(r, { tool: DIRECTORY_RULE_TOOL, cwd: ctx.root, sessionId: ctx.sessionId }) && directoryRuleAdmits(r, target));
+    return hit !== undefined ? persistedRuleHitOf([hit]) : undefined;
+}
+function makeRuleOffersOf(cfg) {
+    return (toolName, args, ask) => {
+        if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
+            return {};
+        if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
+            return {};
+        const closedDoor = (() => {
+            if (ask?.requiresRealApproval === true)
+                return "mandated";
+            if (ask?.persistedRuleShadowed !== undefined)
+                return "shadowed";
+            if (ask?.decisionReason === "hook")
+                return "mandated";
+            if (ask?.matchedAskRule !== undefined)
+                return "shadowed";
+            if (ask?.inheritedUnresolved === true)
+                return "mandated";
+            if (ask?.ancestorResolved === true)
+                return "mandated";
+            return undefined;
+        })();
+        if (closedDoor !== undefined)
+            return { ruleOffersAbsence: closedDoor };
+        if (persistedRuleMandateOf({
+            egress: cfg.egressTools.has(toolName),
+            irreversibility: cfg.irreversibilityTier.get(toolName),
+            shellGated: cfg.shellGatedBash,
+            probeMandated: ask?.probeMandated === true,
+        }) !== undefined) {
+            return { ruleOffersAbsence: "mandated" };
+        }
+        const command = args?.command;
+        if (typeof command !== "string")
+            return { ruleOffersAbsence: "lane_cannot_speak" };
+        const offers = suggestRulesForCommand(command, {
+            ...(ask?.segmentCoverage !== undefined ? { coverage: ask.segmentCoverage } : {}),
+            ...(cfg.taskRoot !== undefined ? { scope: { kind: "project", root: cfg.taskRoot }, cwd: cfg.taskRoot } : {}),
+            ...(cfg.cwdRef?.current !== undefined ? { execCwd: cfg.cwdRef.current } : {}),
+            ...(cfg.deniesDirectoryRead !== undefined ? { deniesDirectoryRead: cfg.deniesDirectoryRead } : {}),
+        });
+        return offers.length > 0
+            ? { ruleOffers: offers, ...(cfg.cwdRef?.current !== undefined ? { execCwd: cfg.cwdRef.current } : {}) }
+            : { ruleOffersAbsence: "lane_cannot_speak" };
+    };
+}
+function makeOrgAdjudicationLane(overlay, questionToolMounted, onRevisionDefect) {
+    if (overlay === undefined)
+        return undefined;
+    return {
+        adjudicate: async (req) => {
+            if (req.toolName === ASK_USER_QUESTION_TOOL_NAME && questionToolMounted)
+                return { status: "available" };
+            let resolution;
+            try {
+                resolution = await overlay.resolve();
+            }
+            catch (err) {
+                return { status: "unavailable", disclosures: [`the org rule overlay threw: ${err instanceof Error ? err.message : String(err)}`] };
+            }
+            if (resolution.status === "unavailable")
+                return { status: "unavailable", disclosures: resolution.disclosures };
+            const revisionCell = orgRevisionEvidenceOf(resolution, onRevisionDefect);
+            const command = req.args?.command;
+            if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
+                return { status: "available", ...revisionCell };
+            const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
+            return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
+        },
+    };
+}
 function cwdConflictsRestoreError(requestedCwd) {
     const e = new Error(`RunInternals.requestedCwd ("${requestedCwd}") cannot be combined with a checkpoint workspace restore — ` +
         `the restored workspace's own mount path is authoritative for the task root, so a requested cwd on this leg ` +
@@ -1666,7 +1886,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(am.onBreakerOpen !== undefined ? { onBreakerOpen: am.onBreakerOpen } : {}),
                 classify: async (input, signal) => {
                     const ctx = await session.buildContext();
-                    const known = ctx.messages.filter((m) => m.role === "user" || m.role === "assistant" || m.role === "toolResult");
+                    const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) &&
+                        (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
                     const userPrompt = renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
                     const classifierAuth = await spec.getApiKeyAndHeaders?.(classifierModel);
                     const response = await classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
@@ -1985,10 +2206,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         handsLessResolvedFace = handsReadFace.handsLessResolvedFace;
         shellGatedBash = handsReadFace.shellGatedBash;
         shellGatedMonitor = handsReadFace.shellGatedMonitor;
-        if (backgroundTaskToolsActive || workflowToolsActive) {
-            toolEffects.set("TaskOutput", "read");
-            toolEffects.set("TaskStop", "write");
-            tools.push(firstPartyOffload(createTaskOutputTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore, notificationWired: internals?.onTaskNotification !== undefined, oneShot: spec.oneShot, toolResultStore: offloadStore })), firstPartyOffload(createTaskStopTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore })));
+        const delegationSurfaceActive = backgroundTaskToolsActive || workflowToolsActive;
+        if (delegationSurfaceActive || internals?.parentNotify !== undefined) {
+            if (delegationSurfaceActive) {
+                toolEffects.set("TaskOutput", "read");
+                toolEffects.set("TaskStop", "write");
+                tools.push(firstPartyOffload(createTaskOutputTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore, notificationWired: internals?.onTaskNotification !== undefined, oneShot: spec.oneShot, toolResultStore: offloadStore })), firstPartyOffload(createTaskStopTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore })));
+            }
             if (runnerSelf && !(spec.tools ?? []).some((t) => t.name === SEND_MESSAGE_TOOL_NAME)) {
                 toolEffects.set(SEND_MESSAGE_TOOL_NAME, "write");
                 axisExplicitNegatives.set(SEND_MESSAGE_TOOL_NAME, { ...axisExplicitNegatives.get(SEND_MESSAGE_TOOL_NAME), egress: false });
@@ -2018,7 +2242,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     owner: hostTaskId,
                     scope: taskScope,
                     ...(sessionId !== undefined ? { sessionId } : {}),
-                    ...(internals?.onTaskNotification !== undefined ? { notify: internals.onTaskNotification } : {}), ...(spec.oneShot !== undefined ? { oneShot: spec.oneShot } : {}),
+                    ...(internals?.onTaskNotification !== undefined ? { notify: internals.onTaskNotification } : {}), ...(spec.oneShot !== undefined ? { oneShot: spec.oneShot } : {}), retrievalToolMounted: delegationSurfaceActive,
                     ...(internals?.onSubagentSpawn !== undefined ? { sink: internals.onSubagentSpawn } : {}),
                     ...(internals?.parentNotify !== undefined
                         ? { uplink: internals.parentNotify, ...(internals.parentPeerRef !== undefined ? { uplinkRecipient: internals.parentPeerRef } : {}) }
@@ -2043,7 +2267,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         detail: { handle, ...(scope !== undefined ? { scope } : {}) },
                     }),
                 })));
-                if (!(spec.tools ?? []).some((t) => t.name === AGENT_TRANSCRIPT_TOOL_NAME)) {
+                if (delegationSurfaceActive && !(spec.tools ?? []).some((t) => t.name === AGENT_TRANSCRIPT_TOOL_NAME)) {
                     tools.push(firstPartyOffload(createAgentTranscriptTool({
                         runner: runnerSelf,
                         registry: defaultTaskRegistry,
@@ -3487,14 +3711,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             return true;
         };
         const inheritedAskGrants = new Map();
-        const askGrantShapeOf = (args) => {
-            try {
-                return JSON.stringify(args ?? null);
-            }
-            catch {
-                return undefined;
-            }
-        };
         const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs) => {
             if (typeof approver !== "function")
                 return;
@@ -3615,10 +3831,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const anonymous = spec.principal === undefined || spec.principal === "";
                     if (anonymous && !localOwnerDeclared)
                         return undefined;
-                    if (req.toolName !== PERSISTED_RULE_TOOL)
-                        return undefined;
-                    const command = req.args?.command;
-                    if (typeof command !== "string")
+                    if (req.toolName !== PERSISTED_RULE_TOOL && req.toolName !== DIRECTORY_RULE_TOOL)
                         return undefined;
                     let listed;
                     try {
@@ -3638,76 +3851,32 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         return { unreadable: true };
                     }
                     const table = await spliceSessionOverlayRows(deps.sessionPermissionRules, sessionId, listed.rules, deps.tracer, hostTaskId);
-                    const admitting = findAdmittingRule(table, { tool: req.toolName, command, cwd: root, sessionId });
+                    if (req.toolName === DIRECTORY_RULE_TOOL) {
+                        return directoryRuleLaneAnswer(table, req.args, { root, sessionId, liveCwd: handsCwdRef?.current });
+                    }
+                    const command = req.args?.command;
+                    if (typeof command !== "string")
+                        return undefined;
+                    const admitting = findAdmittingRule(table, { tool: req.toolName, command, cwd: root, sessionId, ...(handsCwdRef?.current !== undefined ? { execCwd: handsCwdRef.current } : {}) });
                     if (admitting !== undefined)
                         return persistedRuleHitOf(admitting);
-                    const coverage = segmentCoverageOf(command, { persisted: table }, { tool: req.toolName, cwd: root, sessionId });
+                    const coverage = segmentCoverageOf(command, { persisted: table }, { tool: req.toolName, cwd: root, sessionId, ...(handsCwdRef?.current !== undefined ? { execCwd: handsCwdRef.current } : {}) });
                     return coverage !== undefined ? { segmentCoverage: coverage } : undefined;
                 },
             };
         })();
-        const permissionRuleOrgLane = (() => {
-            const overlay = deps.permissionRuleOrg;
-            if (overlay === undefined)
-                return undefined;
-            return {
-                adjudicate: async (req) => {
-                    if (req.toolName === ASK_USER_QUESTION_TOOL_NAME && questionToolMounted)
-                        return { status: "available" };
-                    let resolution;
-                    try {
-                        resolution = await overlay.resolve();
-                    }
-                    catch (err) {
-                        return { status: "unavailable", disclosures: [`the org rule overlay threw: ${err instanceof Error ? err.message : String(err)}`] };
-                    }
-                    if (resolution.status === "unavailable")
-                        return { status: "unavailable", disclosures: resolution.disclosures };
-                    const revisionCell = orgRevisionEvidenceOf(resolution, (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }));
-                    const command = req.args?.command;
-                    if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
-                        return { status: "available", ...revisionCell };
-                    const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
-                    return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
-                },
-            };
-        })();
-        const ruleOffersOf = (toolName, args, ask) => {
-            if (permissionRuleLane === undefined || toolName !== PERSISTED_RULE_TOOL)
-                return {};
-            if ((spec.principal === undefined || spec.principal === "") && deps.localOwnerRules !== true)
-                return {};
-            const closedDoor = (() => {
-                if (ask?.requiresRealApproval === true)
-                    return "mandated";
-                if (ask?.persistedRuleShadowed !== undefined)
-                    return "shadowed";
-                if (ask?.decisionReason === "hook")
-                    return "mandated";
-                if (ask?.matchedAskRule !== undefined)
-                    return "shadowed";
-                if (ask?.inheritedUnresolved === true)
-                    return "mandated";
-                if (ask?.ancestorResolved === true)
-                    return "mandated";
-                return undefined;
-            })();
-            if (closedDoor !== undefined)
-                return { ruleOffersAbsence: closedDoor };
-            if (persistedRuleMandateOf({
-                egress: egressTools.has(toolName),
-                irreversibility: irreversibilityTier.get(toolName),
-                shellGated: shellGatedBash,
-                probeMandated: ask?.probeMandated === true,
-            }) !== undefined) {
-                return { ruleOffersAbsence: "mandated" };
-            }
-            const command = args?.command;
-            if (typeof command !== "string")
-                return { ruleOffersAbsence: "lane_cannot_speak" };
-            const offers = suggestRulesForCommand(command, ask?.segmentCoverage !== undefined ? { coverage: ask.segmentCoverage } : undefined);
-            return offers.length > 0 ? { ruleOffers: offers } : { ruleOffersAbsence: "lane_cannot_speak" };
-        };
+        const permissionRuleOrgLane = makeOrgAdjudicationLane(deps.permissionRuleOrg, questionToolMounted, (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }));
+        const ruleOffersOf = makeRuleOffersOf({
+            laneArmed: permissionRuleLane !== undefined,
+            principal: spec.principal,
+            localOwnerDeclared: deps.localOwnerRules === true,
+            egressTools,
+            irreversibilityTier,
+            shellGatedBash,
+            taskRoot: taskRootFinal,
+            cwdRef: handsCwdRef,
+            deniesDirectoryRead: readDenyMatcher !== undefined ? (d) => readDenyMatcher.matchPath(d) !== null : undefined,
+        });
         const frozenClassifierExcluded = (d) => d.decisionReason === "hook" || d.matchedAskRule !== undefined;
         const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal, ancestorDecider) => {
             let editArgs = edit;
@@ -4159,14 +4328,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             });
         }
         if (effectivePolicy || hooks?.preToolUse || egressTools.size > 0 || irreversibleTools.size > 0 || resourceSuspendEligible || platformSuspendArmed || spec.enablePlanMode === true) {
+            const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
             const adjudicate = effectivePolicy
-                ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}) }, abortController.signal)), abortController.signal, () => ({
-                    action: "deny",
-                    message: "policy check aborted (task timed out or cancelled)",
-                }))
+                ? (req, callSignal) => {
+                    const signal = composedCallSignal(callSignal);
+                    return raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}) }, signal)), signal, () => ({
+                        action: "deny",
+                        message: "policy check aborted (task timed out or cancelled)",
+                    }));
+                }
                 : undefined;
             const approvalPreviewOf = (toolName, args) => resolveApprovalPreview(tools, toolName, args);
-            const resolveAskBound = async (decision, req) => {
+            const resolveAskBound = async (decision, req, callSignal) => {
                 if (inheritedUnavailableAsks.delete(req.toolCallId)) {
                     return {
                         action: "deny",
@@ -4177,23 +4350,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         approverUnavailable: true,
                     };
                 }
-                if (decision.decisionReason === undefined || decision.decisionReason === "rule") {
-                    const grant = inheritedAskGrants.get(req.toolCallId);
-                    if (grant !== undefined && askApproverIdentity(grant.approver) === askApproverIdentity(onAsk) && grant.argsJson === askGrantShapeOf(req.args)) {
-                        inheritedAskGrants.delete(req.toolCallId);
-                        humanReviewRef.count += 1;
-                        humanReviewRef.totalWaitMs += grant.waitMs;
-                        const toolArg = primaryActivityArg(req.args);
-                        humanReviewRef.gates.push({
-                            kind: "human",
-                            waitMs: grant.waitMs,
-                            decision: "allow",
-                            toolName: req.toolName,
-                            ...(toolArg !== undefined ? { toolArg } : {}),
-                        });
-                        return { action: "allow", presentedInput: grant.presented };
-                    }
-                }
+                const grantReuse = consumeInheritedAskGrant(inheritedAskGrants, onAsk, humanReviewRef, decision, req);
+                if (grantReuse !== undefined)
+                    return grantReuse;
                 const t0 = now();
                 const resolved = await resolveAsk({
                     toolName: req.toolName,
@@ -4212,9 +4371,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
                     ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
                     ...(decision.action === "ask" && decision.ruleEvidence !== undefined ? { ruleEvidence: decision.ruleEvidence } : {}),
-                }, onAsk, abortController.signal);
+                }, onAsk, composedCallSignal(callSignal), lateAskSettlementObserver({ toolName: req.toolName, toolCallId: req.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
                 const waitMs = Math.max(0, now() - t0);
-                if (resolved.approverUnavailable !== true) {
+                if (resolved.approverUnavailable !== true && resolved.resolution !== "task_aborted") {
                     humanReviewRef.count += 1;
                     humanReviewRef.totalWaitMs += waitMs;
                     const toolArg = primaryActivityArg(req.args);
@@ -4325,11 +4484,33 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 placementRootSessionId: stampPlacementRootSessionId(placementRootResolved),
                 externalContentTarget: externalContentTargetActive ? true : undefined,
             });
-            const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
+            const compensatePausedVM = (remoteEnv, snapshotId) => compensateUnparkedPause(remoteEnv, snapshotId, {
+                boundMs: PARK_COMPENSATION_TIMEOUT_MS,
+                noteFailure: (note) => remoteEnvFailures.push(note),
+                disclose: (err) => {
+                    try {
+                        deps.onError?.(err, { phase: "config", sessionId });
+                    }
+                    catch {
+                    }
+                },
+            });
+            const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle, cutSignal) => {
                 if (!checkpointStore)
-                    return { ok: false };
+                    return { tag: "absent" };
                 if (memoryEngineSession)
                     await memoryEngineSession.harvest("checkpoint");
+                if (cutSignal?.aborted) {
+                    if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
+                        const back = await compensatePausedVM(remoteEnv, remoteHandle.snapshotId);
+                        if (!back.ok) {
+                            abortController.abort();
+                            void harness.abort();
+                            return { tag: "compensation_failed", reason: back.reason };
+                        }
+                    }
+                    return { tag: "cut" };
+                }
                 const announceCommittedScreeningPark = () => {
                     const committedCount = cp.state.inheritedGate?.parentConstraintCount;
                     if (cp.state.inheritedGate?.requiresParentConstraint === true &&
@@ -4367,7 +4548,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 try {
                     await checkpointStore.put(token, cp);
                     announceCommittedScreeningPark();
-                    return { ok: true };
+                    return { tag: "committed" };
                 }
                 catch (putErr) {
                     deps.onError?.(putErr, { phase: "config", sessionId });
@@ -4383,7 +4564,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         catch {
                         }
                         announceCommittedScreeningPark();
-                        return { ok: true };
+                        return { tag: "committed" };
                     }
                     if (confirmed === "unknown") {
                         const unknownReason = "the approval checkpoint's state cannot be established (the store rejected the write and then could not be read back; a committed-but-unacknowledged row may exist) — the run is stopped rather than continued past an approval whose durable record is unknown";
@@ -4398,29 +4579,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         abortController.abort();
                         void harness.abort();
-                        return { ok: false, reason: unknownReason };
+                        return { tag: "unknown", reason: unknownReason };
                     }
                     const reason = "the approval checkpoint could not be persisted (the store rejected the write; the deployment's error face carries the store's own message)";
                     if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
-                        const { outcome: back, attempts: backAttempts } = await restoreWorkspaceWithRetry(remoteEnv, remoteHandle.snapshotId, {
-                            abortSignal: abortController.signal,
-                        });
-                        if (back.ok) {
-                            const init = await remoteEnv.postResumeInit();
-                            if (init.ok)
-                                return { ok: false, reason };
-                            remoteEnvFailures.push(remoteEnvFailureNote("postResumeInit", init.error, 1));
-                            deps.onError?.(init.error, { phase: "config", sessionId });
-                        }
-                        else {
-                            remoteEnvFailures.push(remoteEnvFailureNote("resumeVM", back.error, backAttempts));
-                            deps.onError?.(back.error, { phase: "config", sessionId });
-                        }
+                        const back = await compensatePausedVM(remoteEnv, remoteHandle.snapshotId);
+                        if (back.ok)
+                            return { tag: "absent", reason };
                         abortController.abort();
                         void harness.abort();
-                        return { ok: false, reason };
+                        return { tag: "compensation_failed", reason };
                     }
-                    return { ok: false, reason };
+                    return { tag: "absent", reason };
                 }
             };
             const suspendLoopCapHit = (count, cap, detail) => {
@@ -4502,7 +4672,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(spec.durableApproval !== undefined ? { durableApproval: { ...spec.durableApproval } } : {}),
                     ...(spec.principal ? { principal: spec.principal } : {}),
                 };
-                if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).ok)
+                if ((await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).tag !== "committed")
                     return false;
                 publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
                 try {
@@ -4588,7 +4758,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...(spec.principal ? { principal: spec.principal } : {}),
                         ...(spec.durableApproval !== undefined ? { durableApproval: { ...spec.durableApproval } } : {}),
                     };
-                    if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).ok)
+                    if ((await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).tag !== "committed")
                         return false;
                     publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
                     try {
@@ -4602,7 +4772,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     return true;
                 }
                 : undefined;
-            const resolveContentAsk = async (req) => {
+            const resolveContentAsk = async (req, callSignal) => {
+                const contentAskSignal = composedCallSignal(callSignal);
                 if (!contentAskRoutable(req.toolCallId) || liveQuestionFace === undefined || mountedQuestionTool === undefined) {
                     return { kind: "unavailable", parkDeclined: false };
                 }
@@ -4633,7 +4804,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (contentAskBindings.size >= CONTENT_ASK_BINDING_CAP && !contentAskBindings.has(req.toolCallId)) {
                     return { kind: "unavailable", parkDeclined: true };
                 }
-                if (abortController.signal.aborted) {
+                if (contentAskSignal.aborted) {
                     return { kind: "delivery_failure", code: "question.aborted", presentedInput: retained };
                 }
                 try {
@@ -4644,8 +4815,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         sourceTaskId: sessionId,
                         boundInputHash: boundInputHashOf(retained),
                         deliveryId,
-                    }, abortController.signal))();
-                    const settlement = await raceAbort(facePromise.then((outcome) => ({ tag: "outcome", outcome }), (error) => ({ tag: "threw", error })), abortController.signal, () => ({ tag: "aborted" }));
+                    }, contentAskSignal))();
+                    const settlement = await raceAbort(facePromise.then((outcome) => ({ tag: "outcome", outcome }), (error) => ({ tag: "threw", error })), contentAskSignal, () => ({ tag: "aborted" }));
                     if (settlement.tag === "aborted") {
                         void facePromise.then((late) => {
                             if (classifyQuestionOutcome(late).shape !== "answered")
@@ -4673,7 +4844,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     bindOutcome({ kind: "failed", error }, retainedQuestionsHash);
                     return {
                         kind: "delivery_failure",
-                        code: settlement.tag === "aborted" || abortController.signal.aborted ? "question.aborted" : "question.human_channel_failed",
+                        code: settlement.tag === "aborted" || contentAskSignal.aborted ? "question.aborted" : "question.human_channel_failed",
                         presentedInput: retained,
                     };
                 }
@@ -4683,7 +4854,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated) => {
+                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, callSignal) => {
                     const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
@@ -4691,6 +4862,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         !inheritedUnavailableAsks.has(req.toolCallId)) {
                         return undefined;
                     }
+                    const cutSignal = composedCallSignal(callSignal);
                     let token;
                     let gate;
                     let cp;
@@ -4726,13 +4898,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             if (!presented.ok) {
                                 throw new ParkRefusal(`the stored form of "${req.toolName}"'s arguments could not be presented for re-adjudication (${describeThrown(presented.cause)})`, { cause: presented.cause });
                             }
-                            const reprojected = refuseOutOfContractDecision(await basePolicyForResumeEdit.check({
+                            const reprojectedRaced = await raceSettlementAgainstSignal(Promise.resolve(basePolicyForResumeEdit.check({
                                 toolName: req.toolName,
                                 args: presented.value,
                                 toolCallId: req.toolCallId,
                                 budget: budgetSnapshot,
                                 ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}),
-                            }, abortController.signal));
+                            }, cutSignal)), cutSignal);
+                            if (reprojectedRaced.tag === "aborted")
+                                return undefined;
+                            if (reprojectedRaced.tag === "threw")
+                                throw reprojectedRaced.error;
+                            const reprojected = refuseOutOfContractDecision(reprojectedRaced.value);
                             const demanded = reprojected.updatedInput !== undefined ? tryCloneArgs(reprojected.updatedInput) : undefined;
                             const rewroteTheFiledValue = reprojected.updatedInput !== undefined &&
                                 !(demanded?.ok === true &&
@@ -4763,7 +4940,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         const { messages } = await session.buildContext();
                         const { batchToolCallIds, completedCallIds } = batchContextAt(messages, req.toolCallId);
-                        if (abortController.signal.aborted) {
+                        if (cutSignal.aborted) {
                             return undefined;
                         }
                         if (suspendLoopCapHit(suspendChainBase(), maxSuspends, ` for tool "${req.toolName}" — likely a resume/restart loop.`))
@@ -4771,12 +4948,20 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         if (remoteEnv !== undefined) {
                             if (hasBackgroundShell(remoteEnv))
                                 await sweepBackgroundShells(remoteEnv, defaultTaskRegistry);
-                            const snap = await remoteEnv.suspendVM({ abortSignal: abortController.signal });
+                            const snap = await remoteEnv.suspendVM({ abortSignal: cutSignal });
                             if (!snap.ok) {
                                 remoteEnvFailures.push(remoteEnvFailureNote("suspendVM", snap.error, 1));
                                 throw new Error(`suspendVM failed (${snap.error.code}): ${snap.error.message}`, { cause: snap.error });
                             }
                             remoteHandle = { ...remoteEnv.workspaceHandle(), snapshotId: snap.value };
+                            if (cutSignal.aborted) {
+                                const back = await compensatePausedVM(remoteEnv, snap.value);
+                                if (!back.ok) {
+                                    abortController.abort();
+                                    void harness.abort();
+                                }
+                                return undefined;
+                            }
                         }
                         else if (parkOnlyRemoteEnv !== undefined) {
                             if (hasBackgroundShell(parkOnlyRemoteEnv) && spec.retainBackgroundProcesses !== true)
@@ -4882,16 +5067,31 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         };
                     }
                     catch (err) {
-                        deps.onError?.(err, { phase: "config", sessionId });
-                        return {
-                            parkFailed: err instanceof ParkRefusal
-                                ? err.message
-                                : "the durable approval park could not be prepared (the deployment's error face carries the exception)",
-                        };
+                        const cutWon = cutSignal.aborted;
+                        const preselected = cutWon
+                            ? undefined
+                            : {
+                                parkFailed: err instanceof ParkRefusal
+                                    ? err.message
+                                    : "the durable approval park could not be prepared (the deployment's error face carries the exception)",
+                            };
+                        try {
+                            deps.onError?.(err, { phase: "config", sessionId });
+                        }
+                        catch {
+                        }
+                        return preselected;
                     }
-                    const committed = await commitSuspendSaga(token, cp, remoteEnv, remoteHandle);
-                    if (!committed.ok) {
-                        return committed.reason !== undefined ? { parkFailed: committed.reason } : undefined;
+                    const committed = await commitSuspendSaga(token, cp, remoteEnv, remoteHandle, cutSignal);
+                    if (committed.tag !== "committed") {
+                        if (committed.tag === "cut")
+                            return undefined;
+                        if (committed.tag === "absent") {
+                            if (cutSignal.aborted)
+                                return undefined;
+                            return committed.reason !== undefined ? { parkFailed: committed.reason } : undefined;
+                        }
+                        return { parkFailed: committed.reason };
                     }
                     publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, cp.scope, remoteHandle, cp.checkpointId, cp.pendingAction);
                     try {
@@ -4956,6 +5156,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         result = await runToolGate({
                             onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
                             event: e,
+                            ...(e.signal !== undefined ? { callSignal: e.signal } : {}),
                             identity: hookIdentity,
                             reminderMark,
                             preToolUse: ownGatePreToolUse,