@sema-agent/core 7.13.0 → 7.14.0

package/dist/core/hooks.js

@@ -5,8 +5,7 @@ import { runGateLanes } from "./gate-lanes.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
-import { isAskOrigin } from "./ask-origin.js";
-import { isAutoModeUnavailableCause } from "./auto-mode.js";
+import { isAskOrigin, isRuleStoreUnreadable } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -235,10 +234,12 @@ export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash, timeo
 export function askCarryRowMembers(carry) {
     if (carry === undefined)
         return {};
+    const origin = carry.origin;
+    const ruleStoreUnreadable = carry.ruleStoreUnreadable;
     return {
         ...(carry.denialLimitFallback !== undefined ? { denialLimitFallback: { ...carry.denialLimitFallback } } : {}),
-        ...(isAskOrigin(carry.origin) ? { origin: carry.origin } : {}),
-        ...(isAutoModeUnavailableCause(carry.classifierUnavailable?.cause) ? { classifierUnavailable: { cause: carry.classifierUnavailable.cause } } : {}),
+        ...(isAskOrigin(origin) ? { origin } : {}),
+        ...(isRuleStoreUnreadable(ruleStoreUnreadable) ? { ruleStoreUnreadable } : {}),
     };
 }
 export async function runToolGate(input) {
@@ -308,6 +309,7 @@ export async function runToolGate(input) {
         hookAsk: undefined,
         parkFailed: undefined,
         deniedBy: undefined,
+        denyCause: undefined,
         decision: { action: "allow" },
         tightenedBy: undefined,
         policyRewrite: undefined,

package/dist/core/mcp.d.ts

@@ -330,8 +330,9 @@ export declare const MCP_TOOL_TIMEOUT_DEFAULT_MS = 100000000;
  */
 export declare const MCP_ENV_MS_MIN = 1000;
 export declare const MCP_ENV_MS_MAX = 2147483647;
-/** Test seam: the announcement de-dupes per process, so a test asserting the line must be able to clear
- *  the ledger. Never called by production code. */
+/** Test seam kept under the name its callers already use; the ledger it clears is the shared one
+ *  ({@link __resetEnvKnobAnnouncements} — the MCP knobs are not a family of their own, they are
+ *  process-level env knobs like the output-length pair). Never called by production code. */
 export declare function __resetMcpEnvAnnouncements(): void;
 /** Resolve the per-call tool timeout in ms (env `MCP_TOOL_TIMEOUT`, else the large default). Exported for tests. */
 export declare function mcpToolTimeoutMs(): number;

package/dist/core/mcp.js

@@ -1,4 +1,5 @@
 import { redactSecrets } from "./untrusted-egress.js";
+import { announceEnvKnob, __resetEnvKnobAnnouncements } from "./env-knob-announce.js";
 import { MCP_NAMESPACE } from "./protocol-table.js";
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName, normalizeNameSegment } from "./protocol-naming.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -38,7 +39,7 @@ function mcpMaxOutputTokens() {
         return MCP_OUTPUT_TOKENS_DEFAULT;
     const n = parseWholeNumber(raw);
     if (n === undefined || n <= 0) {
-        announceMcpEnvKnob(`MAX_MCP_OUTPUT_TOKENS=${rawEnv} was ignored — it is not a positive whole number of tokens. Using ${MCP_OUTPUT_TOKENS_DEFAULT} instead.`);
+        announceEnvKnob(`MAX_MCP_OUTPUT_TOKENS=${rawEnv} was ignored — it is not a positive whole number of tokens. Using ${MCP_OUTPUT_TOKENS_DEFAULT} instead.`);
         return MCP_OUTPUT_TOKENS_DEFAULT;
     }
     return n;
@@ -132,15 +133,8 @@ function parseWholeNumber(raw) {
         return parseInt(raw.replace(ENV_GROUP_SEPARATORS_RE, ""), 10);
     return undefined;
 }
-const announcedMcpEnvKnobs = new Set();
-function announceMcpEnvKnob(line) {
-    if (announcedMcpEnvKnobs.has(line))
-        return;
-    announcedMcpEnvKnobs.add(line);
-    console.warn(line);
-}
 export function __resetMcpEnvAnnouncements() {
-    announcedMcpEnvKnobs.clear();
+    __resetEnvKnobAnnouncements();
 }
 function parseEnvMs(name) {
     const rawEnv = process.env[name];
@@ -151,12 +145,12 @@ function parseEnvMs(name) {
         return undefined;
     const n = parseWholeNumber(raw);
     if (n === undefined || n <= 0) {
-        announceMcpEnvKnob(`${name}=${rawEnv} was ignored — it is not a positive whole number of milliseconds. Using the built-in default instead.`);
+        announceEnvKnob(`${name}=${rawEnv} was ignored — it is not a positive whole number of milliseconds. Using the built-in default instead.`);
         return undefined;
     }
     const clamped = Math.min(Math.max(n, MCP_ENV_MS_MIN), MCP_ENV_MS_MAX);
     if (clamped !== n) {
-        announceMcpEnvKnob(`${name}=${rawEnv} is outside the range this runtime can honor (${MCP_ENV_MS_MIN}..${MCP_ENV_MS_MAX} ms). Using ${clamped}ms instead.`);
+        announceEnvKnob(`${name}=${rawEnv} is outside the range this runtime can honor (${MCP_ENV_MS_MIN}..${MCP_ENV_MS_MAX} ms). Using ${clamped}ms instead.`);
     }
     return clamped;
 }

package/dist/core/memory-engine/engine.d.ts

@@ -1663,8 +1663,8 @@ export declare class MemoryEngine {
      * @returns the rejection to report, or `undefined` when the index is clean/absent.
      */
     private gateDerivedIndex;
-    /** Names of read-only sibling scope dirs directly under the writable root (excluded from scans). */
-    private readonlyDirNamesUnderRoot;
+    /** Names of read-only sibling scope dirs directly under the writable root (excluded from scans; public since #691 — the runner refuses to admit a writable root that contains another scope's directory to the file tools' allowlist). */
+    readonlyDirNamesUnderRoot(handle: MemorySessionHandle): Set<string>;
     /** Projection write: reads the target to skip a no-op, then writes — the same check-then-use shape
      *  as the containment restores, so it takes the same no-follow write. A link at a projection path
      *  is never a supported layout (the harvest scan refuses symlinked entry files outright), and this

package/dist/core/runner/advertised-writable-dirs.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The advertised-writable-directory seat — ONE rule for every directory the prompt tells the model
+ * it may write with the file tools:
+ *
+ *   a directory the prompt advertises as writable is a directory the root fence ADMITS; the same
+ *   admission decides the hole and the teaching, so a directory the fence cannot admit is neither
+ *   opened nor taught, and the skip is announced.
+ *
+ * Two advertisers share it: the deployment's scratchpad (`TaskSpec.envFacts.scratchpadDir`, spoken
+ * by the `# Environment` block) and the memory engine's write root (spoken by the `# Memory`
+ * instruction, "write to it directly with the Write tool"). Before this seat each advertiser judged
+ * on its own: the scratchpad opened its hole in the hands phase, the memory instruction checked only
+ * that a `Write` tool was mounted — and the fence refused the very path the instruction named
+ * (`path_not_in_root`), a contradictory gate that taught the model to route around the tools.
+ *
+ * Admission = fail-closed canonicalization through the SAME ExecutionEnv the fence judges with (a
+ * raw or dangling entry is never admitted — the ancestor-canonicalize fallback would let a symlinked
+ * prefix carry writes outside every root). An advertiser that OWNS its directory's creation may ask
+ * for materialization on a DEFINITIVE `not_found` (the exclusive-create marker, so a concurrently
+ * planted path is never written through); an advertiser whose directory is created elsewhere passes
+ * no marker and an absent directory narrows.
+ *
+ * Reverse check (the seat's own invariant): nothing enters `roots` except through `admit`, and every
+ * caller of `admit` is an advertiser deciding its advertisement off the returned verdict — so there is
+ * no directory the fence opens that the prompt does not advertise, and none the prompt advertises
+ * that the fence refuses.
+ */
+import type { ExecutionEnv } from "../../internal/harness.js";
+export interface AdvertisedWritableDir {
+    /** The directory as the advertisement spells it. */
+    path: string;
+    /** Who advertises it — names the skip line and the trace. */
+    advertiser: "scratchpad" | "memory";
+    /**
+     * How the directory comes to exist when the env reports it absent. The advertiser that owns the
+     * directory's creation supplies the marker file name for the atomic exclusive-create
+     * materialization (parent dirs created like writeFile; a marker that already exists — planted
+     * concurrently, symlink or not — is never written through; an env without an exclusive primitive
+     * narrows instead of emulating one with an overwriting write). An advertiser whose directory is
+     * created elsewhere (the memory engine materializes its own root) passes nothing — absent narrows.
+     */
+    materializeMarker?: string;
+    /**
+     * The canonical spelling the advertiser's OWN gates key on, when it has one (the memory engine keys its
+     * write gate and its harvest boundary on `MemorySessionHandle.writableRoot`). A fence that resolves the
+     * directory to a different canonical path would admit writes those gates never see — such a mismatch is
+     * a skip, announced with both spellings, never an admission.
+     */
+    expectCanonical?: string;
+}
+/** The skip announcement — the one loud outlet for a directory that was advertised but could not be admitted. */
+export type AdvertisedWritableDirSkipped = (dir: AdvertisedWritableDir, reason: string) => void;
+export declare class AdvertisedWritableDirs {
+    private readonly env;
+    private readonly onSkipped;
+    private readonly admitted;
+    private readonly verdicts;
+    constructor(env: ExecutionEnv, onSkipped: AdvertisedWritableDirSkipped);
+    /** The admitted roots, CANONICAL, in admission order, deduplicated. The hands phase folds this list into the
+     *  write-capable containment allowlist before the toolkit compiles; it is not a live view after that. */
+    get roots(): readonly string[];
+    /** What became of an advertiser's directory: admitted, skipped (announced), or never asked (the advertiser
+     *  had nothing to advertise, or decided not to). The prompt side reads this to withhold an advertisement. */
+    verdictOf(advertiser: AdvertisedWritableDir["advertiser"]): "admitted" | "skipped" | "not-asked";
+    /**
+     * Admit one advertised directory. TRUE ⇔ the fence will admit writes under it (its canonical form is on
+     * {@link roots}); FALSE ⇔ it was skipped (announced through the seat's outlet) and the advertiser must not
+     * advertise it. The env's answers are Result-shaped, so the judgment itself never throws; the skip outlet is
+     * the caller's own sink (`deps.onError` in the driver) and is deliberately not guarded here — every phase
+     * lets that sink's own exceptions propagate, and a seat that swallowed them would hide the deployment's bug.
+     */
+    admit(dir: AdvertisedWritableDir): Promise<boolean>;
+    private judge;
+}

package/dist/core/runner/advertised-writable-dirs.js

@@ -0,0 +1,48 @@
+export class AdvertisedWritableDirs {
+    env;
+    onSkipped;
+    admitted = [];
+    verdicts = new Map();
+    constructor(env, onSkipped) {
+        this.env = env;
+        this.onSkipped = onSkipped;
+    }
+    get roots() {
+        return this.admitted;
+    }
+    verdictOf(advertiser) {
+        return this.verdicts.get(advertiser) ?? "not-asked";
+    }
+    async admit(dir) {
+        const ok = await this.judge(dir);
+        this.verdicts.set(dir.advertiser, ok ? "admitted" : "skipped");
+        return ok;
+    }
+    async judge(dir) {
+        if (!dir.path || !dir.path.trim()) {
+            this.onSkipped(dir, "empty path");
+            return false;
+        }
+        let c = await this.env.canonicalPath(dir.path);
+        if (!c.ok && c.error.code === "not_found" && dir.materializeMarker !== undefined) {
+            const marker = await this.env.joinPath([dir.path, dir.materializeMarker]);
+            const exclusiveCreate = this.env.writeFileExclusive?.bind(this.env);
+            if (marker.ok && exclusiveCreate) {
+                const w = await exclusiveCreate(marker.value, "");
+                if (w.ok || w.error.code === "already_exists")
+                    c = await this.env.canonicalPath(dir.path);
+            }
+        }
+        if (!c.ok) {
+            this.onSkipped(dir, `${c.error.code}: ${c.error.message}`);
+            return false;
+        }
+        if (dir.expectCanonical !== undefined && c.value !== dir.expectCanonical) {
+            this.onSkipped(dir, `the execution environment resolves it to ${c.value} while the advertiser's gates key on ${dir.expectCanonical} — a fence hole those gates cannot see is not opened`);
+            return false;
+        }
+        if (!this.admitted.includes(c.value))
+            this.admitted.push(c.value);
+        return true;
+    }
+}

package/dist/core/runner/assemble-result.d.ts

@@ -18,6 +18,11 @@ export interface Stats {
      *  it fails the type check instead of silently reporting a total short by its own leg. */
     totalInputTokens: number;
     costMicroUsd: number;
+    /** #692 C-b — present (`true`) when at least one model round of this leg reported NO usage frame (the brain's
+     *  own `usageMissing` mark on the assistant message: an aborted / errored / usage-less provider reply). The
+     *  numeric fields stay required and stay what was COUNTED — with this key present they are a LOWER BOUND,
+     *  not a measurement ("0 is unknown, not free"). Absent ⇔ every round reported usage. */
+    usageMissing?: true;
     nested?: NestedUsage;
     /** Post-task memory-consolidation usage (design/41); set after the result is assembled. Kept out of
      *  the budget gate (`overBudget` reads `costMicroUsd`/`tokens`, never this). */

package/dist/core/runner/denial-limit-arms.d.ts

@@ -1,8 +1,8 @@
-import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type AutoModeUnavailableCause, type DenialLimitFallback, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback } from "../auto-mode.js";
+import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type DenialLimitFallback, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback } from "../auto-mode.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
-import type { PermissionResult, ResolvedAsk, ToolCallRequest } from "../tool-policy.js";
+import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
-import { type AskOrigin } from "../ask-origin.js";
+import { type AskOrigin, type RuleStoreUnreadable } from "../ask-origin.js";
 import type { Prepared } from "./contracts.js";
 /**
  * #548 — the classifier DENIAL-LIMIT arms of the tool gate's inherited (delegation) lane, extracted
@@ -83,14 +83,12 @@ export type InheritedAsk = Extract<PermissionResult, {
 }>;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
- *  they spell themselves: the ask's origin word, its denial-limit fallback and a policy-declared
- *  classifier-unavailable fact (#616; the engine's own fact rides the DENY since #661). */
+ *  they spell themselves: the ask's origin word and its denial-limit fallback. */
 export interface AskRequestCarry {
     origin?: AskOrigin;
+    /** #688 C3: rides only from the gate's OWN station (the inherited stations' facts never read a rule store). */
+    ruleStoreUnreadable?: RuleStoreUnreadable;
     denialLimitFallback?: DenialLimitFallback;
-    classifierUnavailable?: {
-        readonly cause: AutoModeUnavailableCause;
-    };
 }
 /** The GATE's own mint station: both members are read off the surviving decision, which is the gate's
  *  OWN snapshot (its stamp point spreads the policy's object and stamps the word onto the copy), so the
@@ -124,7 +122,7 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
  *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
 /** `ask` is the incoming ask unchanged (the caller's own object); an UNAVAILABLE round never reaches this arm —
- *  it is a `deny` carrying `classifierUnavailable: { cause }` (#661). */
+ *  it is a `deny` whose attested cause reads `unavailable` (#661). */
  | {
     kind: "resolve";
     ask: A;

package/dist/core/runner/denial-limit-arms.js

@@ -1,5 +1,6 @@
 import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
+import { attestClassifierDenyCause } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { askOriginOf, classifierMayAnswer, probeMandatedAsk } from "../ask-origin.js";
@@ -62,15 +63,14 @@ function fallbackCarry(fallback, liveApprover, tracker) {
 export function gateAskCarry(decision, liveApprover, tracker) {
     return {
         ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
+        ...(decision.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: decision.ruleStoreUnreadable } : {}),
         ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
-        ...(decision.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: decision.classifierUnavailable.cause } } : {}),
     };
 }
 export function inheritedAskCarry(judged, liveApprover, tracker) {
     return {
         origin: judged.origin,
         ...fallbackCarry(judged.fallback, liveApprover, tracker),
-        ...(judged.ask.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: judged.ask.classifierUnavailable.cause } } : {}),
     };
 }
 export async function judgeInheritedClassifier(opts) {
@@ -89,21 +89,19 @@ export async function judgeInheritedClassifier(opts) {
     if (verdict.kind === "unavailable") {
         return {
             kind: "deny",
-            result: { action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier", classifierUnavailable: { cause: verdict.cause } },
+            result: attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req),
         };
     }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
     const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
     const tracked = autoMode.denialTracking?.recordBlock();
     if (tracked?.limitReached !== true) {
-        return {
-            kind: "deny",
-            result: {
-                action: "deny",
-                message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
-                decisionReason: "classifier",
-            },
+        const denied = {
+            action: "deny",
+            message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
+            decisionReason: "classifier",
         };
+        return { kind: "deny", result: verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied };
     }
     const fallback = tracked.fallback;
     const minted = { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };

package/dist/core/runner/gate-exit.d.ts

@@ -21,7 +21,7 @@
  * the reminder envelope and the text helpers. Its `import type` edges up to `hooks.ts` name the gate's public
  * contract (`ToolGateInput`, `ToolGateResult`, the observer payload), which stays declared there.
  */
-import { type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
+import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
 import type { AskOrigin, AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import type { SafeNotifier } from "../safe-notify.js";
@@ -32,10 +32,13 @@ export interface SettledAsk {
     settlement: Settlement;
     origin: AskOrigin;
 }
-/** The facts a gate pass hands the mint. `deniedBy` is present exactly when the pass refused; `settled`
- *  exactly when the pass consumed an ask's settlement (a person's yes that was later vetoed included). */
+/** The facts a gate pass hands the mint. `deniedBy` is present exactly when the pass refused; `cause` only
+ *  beside it, when the refusing round was a classifier round that did not rule (the station's attestation,
+ *  read once by the fold or the classifier step); `settled` exactly when the pass consumed an ask's
+ *  settlement (a person's yes that was later vetoed included). */
 export interface GateExitFacts {
     deniedBy?: DeniedBy;
+    cause?: ClassifierDenyCause;
     settled?: SettledAsk;
 }
 /**
@@ -80,6 +83,10 @@ export interface SettlementLedger {
      *  for an attested refusal, `policy` otherwise — a veto when a yes rides the settlement); undefined
      *  for an allow or an ask. */
     fromDecision(decision: PermissionResult): DeniedBy | undefined;
+    /** Read a deny's attested classifier CAUSE for this call (an inherited station's `unavailable` /
+     *  `parse_error` round travelling through an ancestor wrapper into this fold); undefined for a ruling
+     *  block, a non-classifier deny, an allow or an ask. */
+    causeOf(decision: PermissionResult): ClassifierDenyCause | undefined;
     /** A surviving ask supersedes whatever an earlier decision settled. */
     supersede(): void;
 }
@@ -208,6 +215,11 @@ export interface GatePass {
      *  that ended as a refusal). The exit mints the outcome from it beside the ledger's `settled`; a refusal
      *  that reaches the exit without it is an engine defect and the mint throws. */
     deniedBy: DeniedBy | undefined;
+    /** borrowed-mutable — the FORM of the classifier round behind a deny (`unavailable` / `parse_error`), written
+     *  beside `deniedBy` by the gate's own classifier step (its attestation, read once) or by the fold / the
+     *  re-check when an inherited station's attested deny arrives through the chain; undefined for a ruling
+     *  block and every non-classifier deny. The exit mints `GateDisposition.cause` from it. */
+    denyCause: ClassifierDenyCause | undefined;
     /** borrowed-mutable — the standing verdict. The no-policy default until the adjudication station writes the
      *  policy's answer; then rewritten by every station that changes the verdict (fold, tightens, org, rule
      *  lane, stamp, classifier, sandbox, content lane, resolution, edit chain). */

package/dist/core/runner/gate-exit.js

@@ -1,11 +1,11 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
-import { decisionText, engineSettlementOf } from "../tool-policy.js";
+import { classifierDenyCauseOf, decisionText, engineSettlementOf } from "../tool-policy.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
 export function mintGateOutcome(facts) {
     const settlement = facts.settled !== undefined ? Object.freeze({ ...facts.settled.settlement, who: Object.freeze({ ...facts.settled.settlement.who }) }) : undefined;
     const outcome = Object.freeze({
-        disposition: Object.freeze(facts.deniedBy !== undefined ? { kind: "denied", deniedBy: facts.deniedBy } : { kind: "allowed" }),
+        disposition: Object.freeze(facts.deniedBy !== undefined ? { kind: "denied", deniedBy: facts.deniedBy, ...(facts.cause !== undefined ? { cause: facts.cause } : {}) } : { kind: "allowed" }),
         ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
     });
     const defects = screenGateOutcome(outcome);
@@ -50,6 +50,9 @@ export function createSettlementLedger(call) {
                 return undefined;
             return attested !== undefined && SETTLEMENT_IS_REFUSAL[attested.settlement.kind] ? "ask_resolution" : "policy";
         },
+        causeOf(decision) {
+            return decision.action === "deny" ? classifierDenyCauseOf(decision, call) : undefined;
+        },
         supersede() {
             settled = undefined;
         },
@@ -102,7 +105,7 @@ export async function exitGate(pass) {
         }
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
-        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
+        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
         await notifyPermissionDenied({
             toolName,
             input: cloneObserverInput(pass.currentInput),
@@ -110,7 +113,6 @@ export async function exitGate(pass) {
             reason: denyReason,
             gate,
             ...(input.identity !== undefined ? { identity: input.identity } : {}),
-            ...(pass.decision.action === "deny" && pass.decision.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: pass.decision.classifierUnavailable.cause } } : {}),
         });
         return {
             block: true,

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -25,28 +25,33 @@ import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type AutoModeDecider, type AutoModeDenialTracker } from "../auto-mode.js";
+import { type CheckpointSeat } from "../checkpoint-seat.js";
 import { type ComplianceCapability } from "../compliance.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { StoredSession } from "../session.js";
 import type { OnAsk } from "../tool-policy.js";
 import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
-import type { AutoModeArmReason } from "../wiring-manifest.js";
+import type { AutoModeArmFact } from "../wiring-manifest.js";
+import type { AssertAllKeysHandled } from "../ask-origin.js";
 import type { ReadFace } from "../../tools/fs/index.js";
 import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
 import { RosterBuilder } from "../tool-roster.js";
 export interface PrepareCapsAndWorkflowInput {
     /** borrowed-readonly — the REBOUND spec, whole: the roster map reads `tools`; the mounts read `enableBlockedReport`,
-     *  `enablePlanMode`, `interactiveTools`, `checkpointStore`; the caps/compliance stations read `principal`, `selfOrchestration`,
+     *  `enablePlanMode`, `interactiveTools`; the caps/compliance stations read `principal`, `selfOrchestration`,
      *  `enableFork`, `getApiKeyAndHeaders`; the Workflow mount forwards `oneShot`, `handsReadOnly`, `interactiveTools`. The
      *  self-orchestration predicate takes the whole spec. Never mutated. */
     spec: TaskSpec;
     /** borrowed-readonly — the deployment seats, whole: `runtimeCapsResolver`, `compliancePostureResolver`, `onError`, `onNotice`,
-     *  `autoMode`, `brain`, `models`, `checkpointStore` (the plan-pair face), and the Workflow mount's dozen deps (`workflowScriptRunner`,
+     *  `autoMode`, `brain`, `models`, and the Workflow mount's dozen deps (`workflowScriptRunner`,
      *  `workflowGovernanceBaseline`, `workflowRunStore`, `workflowJournalStore`, `workflowScriptStore`, `builtinWorkflows`,
      *  `onWorkflowAgentSpawn`, `workflowCompletionNotifier`, `workflowLimits`, `agents`, `builtinAgents`, `onBackgroundChildEvent`).
      *  The self-orchestration predicate takes the whole record. */
     deps: RunnerDeps;
+    /** borrowed-readonly — the seat this run hands its children (`checkpointSeatOf`, minted once by the driver right after the
+     *  config doors): the plan-pair face reads the store it names, the Workflow mount hands the seat itself to its children. */
+    checkpointSeat: CheckpointSeat | undefined;
     /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
      *  `onTaskNotification`, `workflowDepth`, and the capture-floor getter reads `memoryCaptureAncestors`. */
     internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume"> | undefined;
@@ -145,7 +150,8 @@ export interface PrepareCapsAndWorkflowResult {
     /** owned — the observers grant (`allowObservers === true`, explicit opt-in). */
     observersActive: boolean;
     /** owned — the arming outcome as a closed reason (the manifest's auto-mode face). */
-    autoModeArmReason: AutoModeArmReason;
+    /** #529 / #692 C-d — the leg's auto-mode arming fact (`armed` ⇔ `reason === "armed"`; `deniedSource` only beside a STATED `denied`). */
+    autoModeArmReason: AutoModeArmFact;
     /** owned — the armed classifier, or undefined when any arming arm failed. */
     autoModeDecider: AutoModeDecider | undefined;
     /** owned — the denial tracker built beside the decider (same face, same arming). */
@@ -162,5 +168,29 @@ export interface PrepareCapsAndWorkflowResult {
         current: () => WorkflowSizeGuideline;
     } | undefined;
 }
+/**
+ * The resolved-caps value screen (the caps-side twin of `refuseInvalidAutoModeSeat`): the arming arm reads
+ * `autoMode !== false`, so a resolver that returns a MARSHALLED value — a non-boolean member (`"false"`,
+ * `0`, `null`) or a non-record container (`false`, `"false"`, `[]`; the resolver is an HTTP-backed seam the
+ * type system does not validate at runtime) — would pass a value meant as a denial straight into arming.
+ * Either shape is treated as a disclosed resolver fault: announced through onError (phase config), and
+ * coined fail-closed — a bad MEMBER to `autoMode:false` (the rest of the record kept), a bad CONTAINER to
+ * the same degrade object the resolver-throw arm uses (every `!== false`-gated cap denied), with
+ * `faulted` raised so the posture-keyed consumers read it as an outage, not as a verdict. `undefined`, or
+ * a record whose `autoMode` is `undefined`/`true`/`false`, passes untouched (byte-identical).
+ */
+/** The supported capability keys, fenced total over {@link RuntimeCaps}: a key added to the type without a row here
+ *  is a red build, so the snapshot below can never silently drop a new restriction. */
+declare const RUNTIME_CAP_KEYS: {
+    readonly allowWorkflows: true;
+    readonly allowFork: true;
+    readonly allowObservers: true;
+    readonly forceDurableGate: true;
+    readonly autoMode: true;
+    readonly autoModeDenySource: true;
+    readonly allowMemoryOptOut: true;
+};
+export type RuntimeCapKeysCoverEveryCap = AssertAllKeysHandled<Exclude<keyof RuntimeCaps, keyof typeof RUNTIME_CAP_KEYS>>;
 /** The M4 phase body — prepareTask's caps-and-workflow stretch, verbatim (see the module header). */
 export declare function prepareCapsAndWorkflow(input: PrepareCapsAndWorkflowInput): Promise<PrepareCapsAndWorkflowResult>;
+export {};

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -10,7 +10,7 @@ import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
 import { AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "../auto-mode-defaults.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
 import { createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
-import { resolveCheckpointStore } from "../checkpoint-store.js";
+import { checkpointStoreOfSeat } from "../checkpoint-seat.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, resolveComplianceDenies } from "../compliance.js";
 import { createPresentPlanTool, createEnterPlanModeTool } from "../present-plan-tool.js";
 import { resolveTaskModel } from "../roles.js";
@@ -19,6 +19,7 @@ import { defaultTaskRegistry } from "../task-registry.js";
 import { emitTrace } from "../trace.js";
 import { defineTool, isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
 const MOUNT_REMEDY = "author it as a plain-object ToolSpec (own `name` and `execute`), hand the defineTool product itself, or wrap a product through the supported wrapper form (a fresh object re-stamped with `stampDefineToolBrand` whose rebind re-wraps the rebound product)";
+import { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "../runtime-caps.js";
 import { derivedRouteFallsBack } from "./derived-route-fallback.js";
 import { REPORT_FINDINGS_TOOL_NAME, createReportBlockedTool, createReportFindingsTool } from "./synthetic-tools.js";
 function classifierReplyText(reply) {
@@ -42,6 +43,24 @@ function assembleParentCaptureState(o, i, ctl, ancestors) {
     });
     return o instanceof Promise || i instanceof Promise ? Promise.all([o, i]).then(([ov, iv]) => build(ov, iv)) : build(o, i);
 }
+const RUNTIME_CAP_KEYS = {
+    allowWorkflows: true,
+    allowFork: true,
+    allowObservers: true,
+    forceDurableGate: true,
+    autoMode: true,
+    autoModeDenySource: true,
+    allowMemoryOptOut: true,
+};
+function snapshotRuntimeCaps(record) {
+    const out = {};
+    for (const key of Object.keys(RUNTIME_CAP_KEYS)) {
+        const v = record[key];
+        if (v !== undefined)
+            out[key] = v;
+    }
+    return out;
+}
 function screenAutoModeCap(caps, onError, sessionId) {
     if (caps === undefined)
         return { caps, faulted: false };
@@ -49,7 +68,20 @@ function screenAutoModeCap(caps, onError, sessionId) {
         onError?.(new Error(`runtimeCapsResolver returned a non-record value (${JSON.stringify(caps)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain). Return a RuntimeCaps object or undefined.`), { phase: "config", sessionId });
         return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
     }
-    const record = caps;
+    let record;
+    try {
+        record = snapshotRuntimeCaps(caps);
+    }
+    catch (err) {
+        onError?.(new Error(`runtimeCapsResolver's record threw while being read (${err instanceof Error ? err.message : String(err)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain).`), { phase: "config", sessionId });
+        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
+    }
+    const { autoMode, autoModeDenySource } = record;
+    if (autoModeDenySource !== undefined && (!isAutoModeDenySource(autoModeDenySource) || autoMode !== false)) {
+        onError?.(new Error(`runtimeCapsResolver returned autoModeDenySource=${JSON.stringify(autoModeDenySource)} beside autoMode=${JSON.stringify(autoMode)} — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Name a source only beside autoMode:false, and only one of ${AUTO_MODE_DENY_SOURCES.join("|")}.`), { phase: "config", sessionId });
+        const { autoModeDenySource: _refused, ...rest } = record;
+        return { caps: { ...rest, autoMode: false }, faulted: true };
+    }
     if (record.autoMode === undefined || typeof record.autoMode === "boolean")
         return { caps: record, faulted: false };
     onError?.(new Error(`runtimeCapsResolver returned a non-boolean autoMode (${JSON.stringify(record.autoMode)}) — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Return true, false, or omit the key.`), { phase: "config", sessionId });
@@ -67,17 +99,20 @@ function mintPersistedArming(am, laneRule, classifierSystemPrompt, onError, sess
     }
     return arming;
 }
-function autoModeArmReasonOf(intent, facePresent, capsAutoMode, capsFaulted) {
+function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     if (!intent)
-        return "no_intent";
+        return { armed: false, reason: "no_intent" };
     if (!facePresent)
-        return "no_face";
-    if (capsAutoMode === false)
-        return capsFaulted ? "resolver_fault" : "denied";
-    return "armed";
+        return { armed: false, reason: "no_face" };
+    if (caps?.autoMode === false) {
+        if (capsFaulted)
+            return { armed: false, reason: "resolver_fault" };
+        return { armed: false, reason: "denied", ...(caps.autoModeDenySource !== undefined ? { deniedSource: caps.autoModeDenySource } : {}) };
+    }
+    return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const { spec, deps, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
@@ -112,7 +147,7 @@ export async function prepareCapsAndWorkflow(input) {
         roster.mount(createReportFindingsTool(), { source: "builtin", mountedBy: "always" });
     }
     if (spec.enablePlanMode === true && spec.interactiveTools !== false) {
-        const planReviewFace = resolveCheckpointStore(spec, deps) !== undefined;
+        const planReviewFace = checkpointStoreOfSeat(checkpointSeat) !== undefined;
         if (spec.interactiveTools === true || planReviewFace) {
             roster.mount(defineTool(createPresentPlanTool(requestReview)), { source: "builtin", mountedBy: "optional" });
             if (planReviewFace) {
@@ -173,7 +208,7 @@ export async function prepareCapsAndWorkflow(input) {
     let autoModeDecider;
     let autoModeDenialTracking;
     let autoModeArming;
-    const autoModeArmReason = autoModeArmReasonOf(autoModeIntent, deps.autoMode !== undefined, runtimeCaps?.autoMode, runtimeCapsFaulted);
+    const autoModeArmReason = autoModeArmReasonOf(autoModeIntent, deps.autoMode !== undefined, runtimeCaps, runtimeCapsFaulted);
     if (autoModeIntent && deps.autoMode !== undefined && runtimeCaps?.autoMode !== false) {
         const am = deps.autoMode;
         let classifierModel;
@@ -297,7 +332,7 @@ export async function prepareCapsAndWorkflow(input) {
             },
             ...(spec.handsReadOnly === true ? { parentHandsReadOnly: true } : {}), ...(spec.interactiveTools === false ? { parentInteractiveTools: false } : {}),
             onNotice: deps.onNotice,
-            parentCheckpointStoreDisabled: spec.checkpointStore === "disabled",
+            ...(checkpointSeat !== undefined ? { parentCheckpointStore: checkpointSeat } : {}),
             parentCenterArtifactDigest: () => input.centerAdoption()?.artifact.artifactDigest,
             parentCenterSourceRevision: () => input.centerAdoption()?.sourceRevision,
             ...(forwardEvent ? { forwardEvent } : {}),

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -19,7 +19,7 @@
  * gate-machinery block, kept as the block's one guard here); the `tool_result` station keys off the hook record alone, as
  * it always did.
  *
- * Every station this file holds is a `denySource` / settlement WRITE site the decomposition's next slice maps onto one
+ * Every station this file holds is a `deniedBy` / settlement WRITE site the decomposition's next slice maps onto one
  * gate outcome; nothing here changes a word, a source or an order — the stations are moved, not re-adjudicated.
  */
 import type { AgentHarness, AgentTool } from "../../internal/harness.js";