@sema-agent/core 7.12.0 → 7.14.0

package/dist/core/gate-lanes.d.ts

@@ -48,46 +48,6 @@ export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
     reason?: string;
     coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
 };
-/**
- * The mandate provenance of one call, judged from the SAME mark inputs the gate is driven with —
- * the single source for "could a persisted allow rule clear this ask?". Allow rules silence the
- * classifier's questions, never a mandated one, and this predicate is the mandated-family half of
- * that boundary (the real-approval/governance half rides the decision's own `requiresRealApproval`
- * bit, which the org layer stamps):
- *  · `probeMandated` — this CALL's own reversibility probe declared its demotion STRUCTURAL
- *    (`"probe_mandate"`), judged FIRST because it is the only per-call member here: the three below
- *    are properties of the TOOL and are true of every call on the seat, so a mandate that is true of
- *    this one call must not be shadowed by the tier that happens to carry it (#502: the built-in
- *    shell probe raises it for a listed reader naming a path outside the session's roots — a boundary
- *    the deployment declared, which is exactly what the classify tier alone cannot say);
- *  · `egress` — the tool's own external-write mark, judged next: it is the tool's declaration even
- *    when the coarse doctrine also installed a shell tier on the same seat;
- *  · `shellGated` + tier `"always"` — the operator's per-call confirmation doctrine
- *    (`"operator_always"`); the classify doctrine installs `"maybe"`, and THOSE asks stay the rule
- *    lane's home turf (`undefined`) — that is the don't-ask-again main case, and the per-call member
- *    above is deliberately the ONLY thing that carves a mandate out of it;
- *  · a tool's OWN `"always"`/`"maybe"` irreversibility tier without the doctrine (`"tool_marks"`).
- *
- * Two consumers, one derivation: the gate's silencing arm (a matching rule is disclosed as shadowed
- * instead of clearing the ask) and the runner's suggestion factory (a mandated ask offers no
- * "stop asking me this" option — a rule minted from it would never clear it). A drift between the
- * two would let a card offer a rule the lane then refuses to honor. The per-call member reaches both
- * the same way every other per-call fact does: the gate stamps it on the surviving ask, the
- * synchronous sites read it off the decision they spread, and the park leg threads its own parameter.
- */
-export declare function persistedRuleMandateOf(marks: {
-    egress?: boolean;
-    shellGated?: boolean;
-    irreversibility?: "never" | "maybe" | "always";
-    /** #502: the surviving ask's engine-stamped `probeMandated` — see
-     *  {@link import("./types.js").ReversibilityVerdict.mandated}. */
-    probeMandated?: boolean;
-    /** The pass's own record that the probe was consulted and did not answer (`GatePass.probeUnanswered`):
-     *  the boundary is unknown, which no standing yes may stand in for. The runner's suggestion factory does
-     *  not see the pass and never passes it — a card may offer a rule the lane then discloses as shadowed
-     *  (loud, never a silent override), the same drift window the `matchedAskRule` conjunct already has. */
-    probeUnanswered?: boolean;
-}): "operator_always" | "tool_marks" | "probe_mandate" | "probe_unanswered" | undefined;
 /**
  * Run the lanes over the pass: the org layer over the fold's verdict, then — for a surviving ask — the rewrite
  * merge, the rule lane, the stamp, the classifier, the sandbox leg, the parks, the content lane, the resolution

package/dist/core/gate-lanes.js

@@ -1,5 +1,5 @@
-import { decisionText, describeThrown } from "./tool-policy.js";
-import { askOriginOf, classifierMayAnswer } from "./ask-origin.js";
+import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, describeThrown } from "./tool-policy.js";
+import { askOriginOf, classifierMayAnswer, persistedRuleMandateOf, probeBoundaryMandate } from "./ask-origin.js";
 import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { isRuleBehavior } from "./permission-rule-model.js";
@@ -144,21 +144,6 @@ export function normalizePersistedRuleHit(hit) {
         return {};
     return { hit: { behavior, rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
 }
-export function persistedRuleMandateOf(marks) {
-    return marks.probeMandated === true
-        ? "probe_mandate"
-        : marks.probeUnanswered === true
-            ? "probe_unanswered"
-            : marks.egress === true
-                ? "tool_marks"
-                : marks.shellGated === true
-                    ? marks.irreversibility === "always"
-                        ? "operator_always"
-                        : undefined
-                    : marks.irreversibility === "always" || marks.irreversibility === "maybe"
-                        ? "tool_marks"
-                        : undefined;
-}
 function parkWith(suspendAsk, parkArgs, carry) {
     return suspendAsk(...parkArgs, carry);
 }
@@ -235,6 +220,7 @@ export async function runGateLanes(pass) {
         if (behavior === "deny") {
             orgTightenCount += 1;
             pass.deniedBy = "org";
+            pass.denyCause = undefined;
             return { decision: { action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON }, org: undefined };
         }
         if (decided.action === "deny")
@@ -257,6 +243,7 @@ export async function runGateLanes(pass) {
     };
     const orgAnswer = await applyOrgLayer(pass.decision, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput);
     pass.decision = orgAnswer.decision;
+    const ruleStoreUnreadableOf = (lane) => lane?.unreadable === true ? (lane.reason !== undefined ? "call" : "store") : undefined;
     const readPersistedRules = async (req) => {
         let pendingHit;
         try {
@@ -274,6 +261,8 @@ export async function runGateLanes(pass) {
         pass.decision = tightened.decision;
         if (tightened.tightened === "deny")
             pass.deniedBy = "persisted_rule";
+        if (tightened.tightened === "deny")
+            pass.denyCause = undefined;
     }
     if (pass.decision.action === "ask") {
         pass.decision = { ...pass.decision };
@@ -353,9 +342,10 @@ export async function runGateLanes(pass) {
                 };
             }
         }
-        const originFacts = askOriginFacts(orgAnswer.org, laneAnswer?.unreadable === true ? "unavailable" : undefined);
+        const originFacts = askOriginFacts(orgAnswer.org, ruleStoreUnreadableOf(laneAnswer));
         if (pass.decision.action === "ask") {
-            const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
+            const { ruleStoreUnreadable: _selfDeclared, ...unstamped } = pass.decision;
+            const stamped = { ...unstamped, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}), ...(originFacts.ruleStore !== undefined ? { ruleStoreUnreadable: originFacts.ruleStore } : {}) };
             pass.decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
         }
         if (allowLayerMayClear() && pass.decision.action === "ask" && persistedRuleMandate === undefined && pass.decision.matchedAskRule === undefined && pass.req.toolName === COMMAND_RULE_TOOL) {
@@ -375,7 +365,7 @@ export async function runGateLanes(pass) {
         }
         if (pass.decision.action === "ask")
             ledger.supersede();
-        if (input.autoMode && pass.decision.action === "ask" && pass.decision.origin !== undefined && classifierMayAnswer(pass.decision.origin)) {
+        if (input.autoMode && pass.decision.action === "ask" && pass.decision.origin !== undefined && classifierMayAnswer(pass.decision.origin) && !probeBoundaryMandate(persistedRuleMandate)) {
             const verdict = await input.autoMode.decider
                 .decide({ req: pass.req, askMessage: decisionText(pass.decision) }, input.abortSignal)
                 .catch(() => ({ kind: "unavailable", cause: "error" }));
@@ -389,12 +379,11 @@ export async function runGateLanes(pass) {
                 };
             }
             else if (verdict.kind === "unavailable") {
-                pass.decision = {
+                pass.decision = attestClassifierDenyCause({
                     action: "deny",
                     message: classifierUnavailableDenyMessage(toolName, verdict.cause),
                     decisionReason: "classifier",
-                    classifierUnavailable: { cause: verdict.cause },
-                };
+                }, "unavailable", pass.req);
             }
             else {
                 const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
@@ -411,15 +400,18 @@ export async function runGateLanes(pass) {
                     pass.decision = { ...fallbackAsk, origin: askOriginOf(fallbackAsk, originFacts) };
                 }
                 else {
-                    pass.decision = {
+                    const denied = {
                         action: "deny",
                         message: verdict.kind === "block" ? `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : reason,
                         decisionReason: "classifier",
                     };
+                    pass.decision = verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", pass.req) : denied;
                 }
             }
-            if (pass.decision.action === "deny")
+            if (pass.decision.action === "deny") {
                 pass.deniedBy = "classifier";
+                pass.denyCause = classifierDenyCauseOf(pass.decision, pass.req);
+            }
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&
@@ -431,6 +423,7 @@ export async function runGateLanes(pass) {
             pass.hookAsk === undefined &&
             input.egress !== true &&
             input.peerMessage !== true &&
+            !probeBoundaryMandate(persistedRuleMandate) &&
             input.sandboxAdmission.boundaryCapable !== true) {
             const recorded = input.sandboxAdmission.askClassesOf(toolCallId);
             const admissible = recorded !== undefined && recorded.length > 0 && recorded.every((r) => r.cls === "sandbox_local");
@@ -460,7 +453,7 @@ export async function runGateLanes(pass) {
             ...(callSignal !== undefined ? { signal: callSignal } : {}),
             ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
             ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
-            ...(d.action === "ask" && d.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: d.classifierUnavailable.cause } } : {}),
+            ...(d.action === "ask" && d.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: d.ruleStoreUnreadable } : {}),
         });
         if (suspendAsk && pass.decision.action === "ask") {
             const parkArgs = [pass.req, pass.currentInput, safety, undefined, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.persistedRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
@@ -628,6 +621,7 @@ export async function runGateLanes(pass) {
                         if (recheck.action === "deny" && refusedBy !== undefined) {
                             editDenied = recheck;
                             pass.deniedBy = refusedBy;
+                            pass.denyCause = ledger.causeOf(recheck);
                             break;
                         }
                     }
@@ -644,7 +638,7 @@ export async function runGateLanes(pass) {
                     let editRuleStore;
                     if (input.persistedRules !== undefined && toolName !== ASK_USER_QUESTION_TOOL_NAME) {
                         const editLane = await readPersistedRules({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
-                        editRuleStore = editLane.unreadable === true ? "unavailable" : undefined;
+                        editRuleStore = ruleStoreUnreadableOf(editLane);
                         const editTightened = applyPersistedTightening(recheck, editLane);
                         recheck = editTightened.decision;
                         if (editTightened.tightened === "deny")
@@ -665,9 +659,10 @@ export async function runGateLanes(pass) {
                         editArgs = recheck.updatedInput;
                         editRewrittenSinceHuman = true;
                     }
-                    const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                    const { ruleStoreUnreadable: _selfDeclaredOnEdit, ...recheckUnstamped } = recheck;
+                    const editAskSnapshot = { ...recheckUnstamped, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
                     markedThisRound = undefined;
-                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org, editRuleStore)) };
+                    const editAskDecision = { ...editAskSnapshot, ...(editRuleStore !== undefined ? { ruleStoreUnreadable: editRuleStore } : {}), origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org, editRuleStore)) };
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     ledger.fromResolved(rr, editAskDecision, toolName);

package/dist/core/gate-outcome.d.ts

@@ -153,12 +153,49 @@ export declare const DENIED_BY_MAY_VETO: {
 };
 /** Compile-time fence: `never` while every deny layer has a veto row. */
 export type VetoTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedBy, keyof typeof DENIED_BY_MAY_VETO>>;
-/** The final disposition of a gate pass. */
+/**
+ * The FORM of an auto-mode classifier deny — the one structural position a consumer branches on when a
+ * deny came through the classifier station. The classifier ends a round three ways, and until this
+ * member the wire carried the three as one layer word plus prose:
+ *  - `unavailable` — the classifier could not run (the model leg threw / rejected / ran past the cap):
+ *    a fail-closed refusal that SAYS SO — the call may simply be retried later (CC 2.1.250 `x1t`);
+ *  - `parse_error` — the classifier answered outside its verdict contract: blocked for safety, counted by
+ *    the denial limit like a ruling (CC 2.1.250 `Ure`);
+ *  - ABSENT beside `deniedBy: "classifier"` — the classifier's own RULING (a `<block>yes` verdict).
+ * The WHY behind an `unavailable` (error vs timeout) is not a branching fact: the deny sentence spells it
+ * and the `auto_mode.classified` trace frame carries it (`cause: "error" | "timeout"`).
+ */
+export declare const CLASSIFIER_DENY_CAUSES: readonly ["unavailable", "parse_error"];
+export type ClassifierDenyCause = (typeof CLASSIFIER_DENY_CAUSES)[number];
+/** Membership test for {@link ClassifierDenyCause}. */
+export declare function isClassifierDenyCause(v: unknown): v is ClassifierDenyCause;
+/** Which deny layers a classifier cause may stand beside: the gate's own classifier station (`classifier`),
+ *  and an ANCESTOR's frozen classifier reached through the inherited policy chain, whose deny the child's
+ *  gate attributes to the chain (`policy`, station row 14) — the cause is attested by the station that
+ *  minted the deny, so the word beside it is whichever layer word the child's ledger assigns. */
+export declare const DENIED_BY_MAY_CARRY_CAUSE: {
+    readonly policy: true;
+    readonly hook: false;
+    readonly org: false;
+    readonly persisted_rule: false;
+    readonly classifier: true;
+    readonly plan_mode: false;
+    readonly compliance: false;
+    readonly write_protection: false;
+    readonly ask_resolution: false;
+};
+/** Compile-time fence: `never` while every deny layer has a cause row. */
+export type CauseTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedBy, keyof typeof DENIED_BY_MAY_CARRY_CAUSE>>;
+/** The final disposition of a gate pass. `cause` is present exactly when the deny came out of an auto-mode
+ *  classifier round that did not RULE ({@link ClassifierDenyCause}); a ruling block and every non-classifier
+ *  deny carry none. Invariant I5 ({@link screenGateOutcome}): a cause stands only beside a layer word in
+ *  {@link DENIED_BY_MAY_CARRY_CAUSE}. */
 export type GateDisposition = {
     kind: "allowed";
 } | {
     kind: "denied";
     deniedBy: DeniedBy;
+    cause?: ClassifierDenyCause;
 };
 /**
  * The WHOLE record of one tool-gate pass: the final disposition, plus — when this pass settled an ask —
@@ -173,7 +210,9 @@ export type GateDisposition = {
  *  I3  `settlement.kind === "human_allowed"` ∧ `disposition.kind === "denied"` ⇒ `deniedBy` is a veto
  *      layer ({@link DENIED_BY_MAY_VETO}) — a person approved, a later re-check refused; the approver stays
  *      on the settlement (it is not the approver's refusal);
- *  I4  `disposition.kind === "allowed"` ⇒ `settlement` absent or `human_allowed`.
+ *  I4  `disposition.kind === "allowed"` ⇒ `settlement` absent or `human_allowed`;
+ *  I5  `disposition.cause` present ⇒ a member of {@link CLASSIFIER_DENY_CAUSES} beside a layer word
+ *      {@link DENIED_BY_MAY_CARRY_CAUSE} admits (the classifier station, or the inherited chain's `policy`).
  * Nothing here is read out of an ABSENCE: an ordinary allow with no ask is `{ disposition: { kind: "allowed" } }`,
  * a direct policy deny is `{ disposition: { kind: "denied", deniedBy: "policy" } }`, and neither carries a
  * settlement because neither settled one.
@@ -184,7 +223,7 @@ export interface GateOutcome {
     origin?: AskOrigin;
 }
 /**
- * The one invariant screen for a {@link GateOutcome} (I1–I4 above, plus the shape of each member). Runs
+ * The one invariant screen for a {@link GateOutcome} (I1–I5 above, plus the shape of each member). Runs
  * where an outcome enters a wire face — the engine's settlement sideband before the `tool_end` frame, and
  * the decide lane before a durable row is resolved. Returns the defects as sentences (an empty list is a
  * clean record); the caller decides the fail-loud form (report + withhold, or refuse), never silently

package/dist/core/gate-outcome.js

@@ -47,6 +47,22 @@ export const DENIED_BY_MAY_VETO = {
     write_protection: true,
     ask_resolution: false,
 };
+export const CLASSIFIER_DENY_CAUSES = ["unavailable", "parse_error"];
+const CLASSIFIER_DENY_CAUSE_SET = new Set(CLASSIFIER_DENY_CAUSES);
+export function isClassifierDenyCause(v) {
+    return CLASSIFIER_DENY_CAUSE_SET.has(v);
+}
+export const DENIED_BY_MAY_CARRY_CAUSE = {
+    policy: true,
+    hook: false,
+    org: false,
+    persisted_rule: false,
+    classifier: true,
+    plan_mode: false,
+    compliance: false,
+    write_protection: false,
+    ask_resolution: false,
+};
 export function screenGateOutcome(g) {
     const defects = [];
     const d = g.disposition;
@@ -67,5 +83,11 @@ export function screenGateOutcome(g) {
     }
     if (d.kind === "allowed" && s !== undefined && s.kind !== "human_allowed")
         defects.push(`I4: an allowed disposition cannot carry a "${s.kind}" settlement`);
+    if (d.kind === "denied" && d.cause !== undefined) {
+        if (!isClassifierDenyCause(d.cause))
+            defects.push(`disposition.cause "${String(d.cause)}" is outside the closed set`);
+        else if (isDeniedBy(d.deniedBy) && !DENIED_BY_MAY_CARRY_CAUSE[d.deniedBy])
+            defects.push(`I5: a classifier cause cannot stand beside deniedBy "${d.deniedBy}"`);
+    }
     return defects;
 }

package/dist/core/governance-codes.d.ts

@@ -104,7 +104,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -141,6 +141,7 @@ export const ENGINE_NOTICE_CODES = [
     "task.turn_interrupted",
     "task.halt_unconsumed",
     "task.late_approval",
+    "task.interrupt_unconsumed",
     "memory.capture_opted_out",
     "memory.capture_optout_unpersisted",
     "tool_result.offload_put_failed",
@@ -159,10 +160,11 @@ const NOTICE_AUDIENCE_TABLE = {
     "steering.parked_input_blocked": "user",
     "task.halt_unconsumed": "user",
     "task.late_approval": "user",
+    "task.interrupt_unconsumed": "user",
     "config.durable_gate_unavailable": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
-    "memory.consolidation_withheld": "user",
+    "memory.consolidation_withheld": "operator",
     "delegation.ask_unresolvable": "user",
     "config.autocompact_window_clamped": "operator",
     "config.env_timeout_discarded": "operator",

package/dist/core/hooks.d.ts

@@ -2,10 +2,10 @@ import type { ActorAssertion, DocumentContent, ImageContent, TextContent } from
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallFace, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
 import type { GateOutcome } from "./gate-outcome.js";
-export { normalizeOrgGateVerdict, normalizePersistedRuleHit, persistedRuleMandateOf } from "./gate-lanes.js";
+export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
-import { type AutoModeDenialTracker } from "./auto-mode.js";
+import type { AutoModeDenialTracker } from "./auto-mode.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
 /**
@@ -411,12 +411,6 @@ export interface PermissionDeniedPayload {
      * settled none.
      */
     gate: GateOutcome;
-    /** #661 (additive): present ⇔ this deny is the auto-mode classifier's UNAVAILABILITY (`deniedBy: "classifier"`
-     *  with the verdict's cause word) — the structured half of the deny text's "the classifier is temporarily
-     *  unavailable" sentence. A classifier BLOCK or parse-failure deny carries no member here. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
     /** {@link HookSeatSignal} — this invocation's own abort signal. On an OBSERVATION seat the deny has
      *  already happened and nothing this callback does can change it, so the signal says exactly one
      *  thing: stop reading, nobody is waiting for your answer any more. */
@@ -1676,12 +1670,9 @@ export interface AskCarry {
     /** The surviving ask's engine-stamped origin word ({@link import("./ask-origin.js").AskOrigin}), persisted
      *  on the row so a durable card is rendered by the same word the synchronous card is. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
-    /** #616: the surviving ask's classifier-unavailable fact (the classifier was consulted on this ask and could
-     *  not run — `cause` is the verdict's word), persisted on the row so a durable card says why it is asking
-     *  exactly as the synchronous card does. Absent ⇒ the classifier answered, was not eligible, or was not wired. */
-    readonly classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** #688 C3: the mechanism behind an `origin: "rule_store_unavailable"` (`store` / `call`), persisted on the row
+     *  so a durable card says the same thing the synchronous card does. */
+    readonly ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
 }
 /** What a durable row persists of an {@link AskCarry}: the fallback member COPIED (the row never aliases
  *  the gate's object; its window is already `0` — the gate's carry mint is the one writer of that
@@ -1690,9 +1681,7 @@ export interface AskCarry {
 export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
     origin?: import("./ask-origin.js").AskOrigin;
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
 };
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant

package/dist/core/hooks.js

@@ -2,11 +2,10 @@ import { decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
 import { createSettlementLedger, engineFailClosedExit, hookDenyExit, traceHookCrash } from "./runner/gate-exit.js";
 import { runGateFold } from "./gate-fold.js";
 import { runGateLanes } from "./gate-lanes.js";
-export { normalizeOrgGateVerdict, normalizePersistedRuleHit, persistedRuleMandateOf } from "./gate-lanes.js";
+export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
-import { isAskOrigin } from "./ask-origin.js";
-import { isAutoModeUnavailableCause } from "./auto-mode.js";
+import { isAskOrigin, isRuleStoreUnreadable } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -235,10 +234,12 @@ export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash, timeo
 export function askCarryRowMembers(carry) {
     if (carry === undefined)
         return {};
+    const origin = carry.origin;
+    const ruleStoreUnreadable = carry.ruleStoreUnreadable;
     return {
         ...(carry.denialLimitFallback !== undefined ? { denialLimitFallback: { ...carry.denialLimitFallback } } : {}),
-        ...(isAskOrigin(carry.origin) ? { origin: carry.origin } : {}),
-        ...(isAutoModeUnavailableCause(carry.classifierUnavailable?.cause) ? { classifierUnavailable: { cause: carry.classifierUnavailable.cause } } : {}),
+        ...(isAskOrigin(origin) ? { origin } : {}),
+        ...(isRuleStoreUnreadable(ruleStoreUnreadable) ? { ruleStoreUnreadable } : {}),
     };
 }
 export async function runToolGate(input) {
@@ -308,6 +309,7 @@ export async function runToolGate(input) {
         hookAsk: undefined,
         parkFailed: undefined,
         deniedBy: undefined,
+        denyCause: undefined,
         decision: { action: "allow" },
         tightenedBy: undefined,
         policyRewrite: undefined,

package/dist/core/mcp.d.ts

@@ -330,8 +330,9 @@ export declare const MCP_TOOL_TIMEOUT_DEFAULT_MS = 100000000;
  */
 export declare const MCP_ENV_MS_MIN = 1000;
 export declare const MCP_ENV_MS_MAX = 2147483647;
-/** Test seam: the announcement de-dupes per process, so a test asserting the line must be able to clear
- *  the ledger. Never called by production code. */
+/** Test seam kept under the name its callers already use; the ledger it clears is the shared one
+ *  ({@link __resetEnvKnobAnnouncements} — the MCP knobs are not a family of their own, they are
+ *  process-level env knobs like the output-length pair). Never called by production code. */
 export declare function __resetMcpEnvAnnouncements(): void;
 /** Resolve the per-call tool timeout in ms (env `MCP_TOOL_TIMEOUT`, else the large default). Exported for tests. */
 export declare function mcpToolTimeoutMs(): number;

package/dist/core/mcp.js

@@ -1,4 +1,5 @@
 import { redactSecrets } from "./untrusted-egress.js";
+import { announceEnvKnob, __resetEnvKnobAnnouncements } from "./env-knob-announce.js";
 import { MCP_NAMESPACE } from "./protocol-table.js";
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName, normalizeNameSegment } from "./protocol-naming.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -38,7 +39,7 @@ function mcpMaxOutputTokens() {
         return MCP_OUTPUT_TOKENS_DEFAULT;
     const n = parseWholeNumber(raw);
     if (n === undefined || n <= 0) {
-        announceMcpEnvKnob(`MAX_MCP_OUTPUT_TOKENS=${rawEnv} was ignored — it is not a positive whole number of tokens. Using ${MCP_OUTPUT_TOKENS_DEFAULT} instead.`);
+        announceEnvKnob(`MAX_MCP_OUTPUT_TOKENS=${rawEnv} was ignored — it is not a positive whole number of tokens. Using ${MCP_OUTPUT_TOKENS_DEFAULT} instead.`);
         return MCP_OUTPUT_TOKENS_DEFAULT;
     }
     return n;
@@ -132,15 +133,8 @@ function parseWholeNumber(raw) {
         return parseInt(raw.replace(ENV_GROUP_SEPARATORS_RE, ""), 10);
     return undefined;
 }
-const announcedMcpEnvKnobs = new Set();
-function announceMcpEnvKnob(line) {
-    if (announcedMcpEnvKnobs.has(line))
-        return;
-    announcedMcpEnvKnobs.add(line);
-    console.warn(line);
-}
 export function __resetMcpEnvAnnouncements() {
-    announcedMcpEnvKnobs.clear();
+    __resetEnvKnobAnnouncements();
 }
 function parseEnvMs(name) {
     const rawEnv = process.env[name];
@@ -151,12 +145,12 @@ function parseEnvMs(name) {
         return undefined;
     const n = parseWholeNumber(raw);
     if (n === undefined || n <= 0) {
-        announceMcpEnvKnob(`${name}=${rawEnv} was ignored — it is not a positive whole number of milliseconds. Using the built-in default instead.`);
+        announceEnvKnob(`${name}=${rawEnv} was ignored — it is not a positive whole number of milliseconds. Using the built-in default instead.`);
         return undefined;
     }
     const clamped = Math.min(Math.max(n, MCP_ENV_MS_MIN), MCP_ENV_MS_MAX);
     if (clamped !== n) {
-        announceMcpEnvKnob(`${name}=${rawEnv} is outside the range this runtime can honor (${MCP_ENV_MS_MIN}..${MCP_ENV_MS_MAX} ms). Using ${clamped}ms instead.`);
+        announceEnvKnob(`${name}=${rawEnv} is outside the range this runtime can honor (${MCP_ENV_MS_MIN}..${MCP_ENV_MS_MAX} ms). Using ${clamped}ms instead.`);
     }
     return clamped;
 }

package/dist/core/memory-engine/engine.d.ts

@@ -1663,8 +1663,8 @@ export declare class MemoryEngine {
      * @returns the rejection to report, or `undefined` when the index is clean/absent.
      */
     private gateDerivedIndex;
-    /** Names of read-only sibling scope dirs directly under the writable root (excluded from scans). */
-    private readonlyDirNamesUnderRoot;
+    /** Names of read-only sibling scope dirs directly under the writable root (excluded from scans; public since #691 — the runner refuses to admit a writable root that contains another scope's directory to the file tools' allowlist). */
+    readonlyDirNamesUnderRoot(handle: MemorySessionHandle): Set<string>;
     /** Projection write: reads the target to skip a no-op, then writes — the same check-then-use shape
      *  as the containment restores, so it takes the same no-follow write. A link at a projection path
      *  is never a supported layout (the harvest scan refuses symlinked entry files outright), and this

package/dist/core/runner/advertised-writable-dirs.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The advertised-writable-directory seat — ONE rule for every directory the prompt tells the model
+ * it may write with the file tools:
+ *
+ *   a directory the prompt advertises as writable is a directory the root fence ADMITS; the same
+ *   admission decides the hole and the teaching, so a directory the fence cannot admit is neither
+ *   opened nor taught, and the skip is announced.
+ *
+ * Two advertisers share it: the deployment's scratchpad (`TaskSpec.envFacts.scratchpadDir`, spoken
+ * by the `# Environment` block) and the memory engine's write root (spoken by the `# Memory`
+ * instruction, "write to it directly with the Write tool"). Before this seat each advertiser judged
+ * on its own: the scratchpad opened its hole in the hands phase, the memory instruction checked only
+ * that a `Write` tool was mounted — and the fence refused the very path the instruction named
+ * (`path_not_in_root`), a contradictory gate that taught the model to route around the tools.
+ *
+ * Admission = fail-closed canonicalization through the SAME ExecutionEnv the fence judges with (a
+ * raw or dangling entry is never admitted — the ancestor-canonicalize fallback would let a symlinked
+ * prefix carry writes outside every root). An advertiser that OWNS its directory's creation may ask
+ * for materialization on a DEFINITIVE `not_found` (the exclusive-create marker, so a concurrently
+ * planted path is never written through); an advertiser whose directory is created elsewhere passes
+ * no marker and an absent directory narrows.
+ *
+ * Reverse check (the seat's own invariant): nothing enters `roots` except through `admit`, and every
+ * caller of `admit` is an advertiser deciding its advertisement off the returned verdict — so there is
+ * no directory the fence opens that the prompt does not advertise, and none the prompt advertises
+ * that the fence refuses.
+ */
+import type { ExecutionEnv } from "../../internal/harness.js";
+export interface AdvertisedWritableDir {
+    /** The directory as the advertisement spells it. */
+    path: string;
+    /** Who advertises it — names the skip line and the trace. */
+    advertiser: "scratchpad" | "memory";
+    /**
+     * How the directory comes to exist when the env reports it absent. The advertiser that owns the
+     * directory's creation supplies the marker file name for the atomic exclusive-create
+     * materialization (parent dirs created like writeFile; a marker that already exists — planted
+     * concurrently, symlink or not — is never written through; an env without an exclusive primitive
+     * narrows instead of emulating one with an overwriting write). An advertiser whose directory is
+     * created elsewhere (the memory engine materializes its own root) passes nothing — absent narrows.
+     */
+    materializeMarker?: string;
+    /**
+     * The canonical spelling the advertiser's OWN gates key on, when it has one (the memory engine keys its
+     * write gate and its harvest boundary on `MemorySessionHandle.writableRoot`). A fence that resolves the
+     * directory to a different canonical path would admit writes those gates never see — such a mismatch is
+     * a skip, announced with both spellings, never an admission.
+     */
+    expectCanonical?: string;
+}
+/** The skip announcement — the one loud outlet for a directory that was advertised but could not be admitted. */
+export type AdvertisedWritableDirSkipped = (dir: AdvertisedWritableDir, reason: string) => void;
+export declare class AdvertisedWritableDirs {
+    private readonly env;
+    private readonly onSkipped;
+    private readonly admitted;
+    private readonly verdicts;
+    constructor(env: ExecutionEnv, onSkipped: AdvertisedWritableDirSkipped);
+    /** The admitted roots, CANONICAL, in admission order, deduplicated. The hands phase folds this list into the
+     *  write-capable containment allowlist before the toolkit compiles; it is not a live view after that. */
+    get roots(): readonly string[];
+    /** What became of an advertiser's directory: admitted, skipped (announced), or never asked (the advertiser
+     *  had nothing to advertise, or decided not to). The prompt side reads this to withhold an advertisement. */
+    verdictOf(advertiser: AdvertisedWritableDir["advertiser"]): "admitted" | "skipped" | "not-asked";
+    /**
+     * Admit one advertised directory. TRUE ⇔ the fence will admit writes under it (its canonical form is on
+     * {@link roots}); FALSE ⇔ it was skipped (announced through the seat's outlet) and the advertiser must not
+     * advertise it. The env's answers are Result-shaped, so the judgment itself never throws; the skip outlet is
+     * the caller's own sink (`deps.onError` in the driver) and is deliberately not guarded here — every phase
+     * lets that sink's own exceptions propagate, and a seat that swallowed them would hide the deployment's bug.
+     */
+    admit(dir: AdvertisedWritableDir): Promise<boolean>;
+    private judge;
+}