@sema-agent/core 7.13.0 → 7.15.0

package/dist/core/runner/denial-limit-arms.js

@@ -1,5 +1,6 @@
 import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
+import { attestClassifierDenyCause } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { askOriginOf, classifierMayAnswer, probeMandatedAsk } from "../ask-origin.js";
@@ -62,15 +63,14 @@ function fallbackCarry(fallback, liveApprover, tracker) {
 export function gateAskCarry(decision, liveApprover, tracker) {
     return {
         ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
+        ...(decision.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: decision.ruleStoreUnreadable } : {}),
         ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
-        ...(decision.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: decision.classifierUnavailable.cause } } : {}),
     };
 }
 export function inheritedAskCarry(judged, liveApprover, tracker) {
     return {
         origin: judged.origin,
         ...fallbackCarry(judged.fallback, liveApprover, tracker),
-        ...(judged.ask.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: judged.ask.classifierUnavailable.cause } } : {}),
     };
 }
 export async function judgeInheritedClassifier(opts) {
@@ -89,21 +89,19 @@ export async function judgeInheritedClassifier(opts) {
     if (verdict.kind === "unavailable") {
         return {
             kind: "deny",
-            result: { action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier", classifierUnavailable: { cause: verdict.cause } },
+            result: attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req),
         };
     }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
     const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
     const tracked = autoMode.denialTracking?.recordBlock();
     if (tracked?.limitReached !== true) {
-        return {
-            kind: "deny",
-            result: {
-                action: "deny",
-                message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
-                decisionReason: "classifier",
-            },
+        const denied = {
+            action: "deny",
+            message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
+            decisionReason: "classifier",
         };
+        return { kind: "deny", result: verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied };
     }
     const fallback = tracked.fallback;
     const minted = { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };

package/dist/core/runner/gate-exit.d.ts

@@ -21,7 +21,7 @@
  * the reminder envelope and the text helpers. Its `import type` edges up to `hooks.ts` name the gate's public
  * contract (`ToolGateInput`, `ToolGateResult`, the observer payload), which stays declared there.
  */
-import { type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
+import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
 import type { AskOrigin, AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import type { SafeNotifier } from "../safe-notify.js";
@@ -32,10 +32,13 @@ export interface SettledAsk {
     settlement: Settlement;
     origin: AskOrigin;
 }
-/** The facts a gate pass hands the mint. `deniedBy` is present exactly when the pass refused; `settled`
- *  exactly when the pass consumed an ask's settlement (a person's yes that was later vetoed included). */
+/** The facts a gate pass hands the mint. `deniedBy` is present exactly when the pass refused; `cause` only
+ *  beside it, when the refusing round was a classifier round that did not rule (the station's attestation,
+ *  read once by the fold or the classifier step); `settled` exactly when the pass consumed an ask's
+ *  settlement (a person's yes that was later vetoed included). */
 export interface GateExitFacts {
     deniedBy?: DeniedBy;
+    cause?: ClassifierDenyCause;
     settled?: SettledAsk;
 }
 /**
@@ -80,6 +83,10 @@ export interface SettlementLedger {
      *  for an attested refusal, `policy` otherwise — a veto when a yes rides the settlement); undefined
      *  for an allow or an ask. */
     fromDecision(decision: PermissionResult): DeniedBy | undefined;
+    /** Read a deny's attested classifier CAUSE for this call (an inherited station's `unavailable` /
+     *  `parse_error` round travelling through an ancestor wrapper into this fold); undefined for a ruling
+     *  block, a non-classifier deny, an allow or an ask. */
+    causeOf(decision: PermissionResult): ClassifierDenyCause | undefined;
     /** A surviving ask supersedes whatever an earlier decision settled. */
     supersede(): void;
 }
@@ -208,6 +215,11 @@ export interface GatePass {
      *  that ended as a refusal). The exit mints the outcome from it beside the ledger's `settled`; a refusal
      *  that reaches the exit without it is an engine defect and the mint throws. */
     deniedBy: DeniedBy | undefined;
+    /** borrowed-mutable — the FORM of the classifier round behind a deny (`unavailable` / `parse_error`), written
+     *  beside `deniedBy` by the gate's own classifier step (its attestation, read once) or by the fold / the
+     *  re-check when an inherited station's attested deny arrives through the chain; undefined for a ruling
+     *  block and every non-classifier deny. The exit mints `GateDisposition.cause` from it. */
+    denyCause: ClassifierDenyCause | undefined;
     /** borrowed-mutable — the standing verdict. The no-policy default until the adjudication station writes the
      *  policy's answer; then rewritten by every station that changes the verdict (fold, tightens, org, rule
      *  lane, stamp, classifier, sandbox, content lane, resolution, edit chain). */

package/dist/core/runner/gate-exit.js

@@ -1,11 +1,11 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
-import { decisionText, engineSettlementOf } from "../tool-policy.js";
+import { classifierDenyCauseOf, decisionText, engineSettlementOf } from "../tool-policy.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
 export function mintGateOutcome(facts) {
     const settlement = facts.settled !== undefined ? Object.freeze({ ...facts.settled.settlement, who: Object.freeze({ ...facts.settled.settlement.who }) }) : undefined;
     const outcome = Object.freeze({
-        disposition: Object.freeze(facts.deniedBy !== undefined ? { kind: "denied", deniedBy: facts.deniedBy } : { kind: "allowed" }),
+        disposition: Object.freeze(facts.deniedBy !== undefined ? { kind: "denied", deniedBy: facts.deniedBy, ...(facts.cause !== undefined ? { cause: facts.cause } : {}) } : { kind: "allowed" }),
         ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
     });
     const defects = screenGateOutcome(outcome);
@@ -50,6 +50,9 @@ export function createSettlementLedger(call) {
                 return undefined;
             return attested !== undefined && SETTLEMENT_IS_REFUSAL[attested.settlement.kind] ? "ask_resolution" : "policy";
         },
+        causeOf(decision) {
+            return decision.action === "deny" ? classifierDenyCauseOf(decision, call) : undefined;
+        },
         supersede() {
             settled = undefined;
         },
@@ -102,7 +105,7 @@ export async function exitGate(pass) {
         }
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
-        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
+        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
         await notifyPermissionDenied({
             toolName,
             input: cloneObserverInput(pass.currentInput),
@@ -110,7 +113,6 @@ export async function exitGate(pass) {
             reason: denyReason,
             gate,
             ...(input.identity !== undefined ? { identity: input.identity } : {}),
-            ...(pass.decision.action === "deny" && pass.decision.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: pass.decision.classifierUnavailable.cause } } : {}),
         });
         return {
             block: true,

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -245,7 +245,9 @@ export declare function createRuleOffersOf(cfg: {
     irreversibilityTier: {
         get(name: string): Parameters<typeof persistedRuleMandateOf>[0]["irreversibility"];
     };
-    shellGatedBash: boolean;
+    shellGatedTools: {
+        has(name: string): boolean;
+    };
     taskRoot: string | undefined;
     /** The live tracked-cwd ref (read per call — the relative-cd resolution base, adversarial-review P1/r3). */
     cwdRef: {

package/dist/core/runner/permission-rule-lanes.js

@@ -176,7 +176,7 @@ export function createRuleOffersOf(cfg) {
         if (persistedRuleMandateOf({
             egress: cfg.egressTools.has(toolName),
             irreversibility: cfg.irreversibilityTier.get(toolName),
-            shellGated: cfg.shellGatedBash,
+            shellGated: cfg.shellGatedTools.has(toolName),
             probeMandated: ask?.probeMandated === true,
         }) !== undefined) {
             return { ruleOffersAbsence: "mandated" };

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -25,28 +25,33 @@ import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type AutoModeDecider, type AutoModeDenialTracker } from "../auto-mode.js";
+import { type CheckpointSeat } from "../checkpoint-seat.js";
 import { type ComplianceCapability } from "../compliance.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { StoredSession } from "../session.js";
 import type { OnAsk } from "../tool-policy.js";
 import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
-import type { AutoModeArmReason } from "../wiring-manifest.js";
+import type { AutoModeArmFact } from "../wiring-manifest.js";
+import type { AssertAllKeysHandled } from "../ask-origin.js";
 import type { ReadFace } from "../../tools/fs/index.js";
 import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
 import { RosterBuilder } from "../tool-roster.js";
 export interface PrepareCapsAndWorkflowInput {
     /** borrowed-readonly — the REBOUND spec, whole: the roster map reads `tools`; the mounts read `enableBlockedReport`,
-     *  `enablePlanMode`, `interactiveTools`, `checkpointStore`; the caps/compliance stations read `principal`, `selfOrchestration`,
+     *  `enablePlanMode`, `interactiveTools`; the caps/compliance stations read `principal`, `selfOrchestration`,
      *  `enableFork`, `getApiKeyAndHeaders`; the Workflow mount forwards `oneShot`, `handsReadOnly`, `interactiveTools`. The
      *  self-orchestration predicate takes the whole spec. Never mutated. */
     spec: TaskSpec;
     /** borrowed-readonly — the deployment seats, whole: `runtimeCapsResolver`, `compliancePostureResolver`, `onError`, `onNotice`,
-     *  `autoMode`, `brain`, `models`, `checkpointStore` (the plan-pair face), and the Workflow mount's dozen deps (`workflowScriptRunner`,
+     *  `autoMode`, `brain`, `models`, and the Workflow mount's dozen deps (`workflowScriptRunner`,
      *  `workflowGovernanceBaseline`, `workflowRunStore`, `workflowJournalStore`, `workflowScriptStore`, `builtinWorkflows`,
      *  `onWorkflowAgentSpawn`, `workflowCompletionNotifier`, `workflowLimits`, `agents`, `builtinAgents`, `onBackgroundChildEvent`).
      *  The self-orchestration predicate takes the whole record. */
     deps: RunnerDeps;
+    /** borrowed-readonly — the seat this run hands its children (`checkpointSeatOf`, minted once by the driver right after the
+     *  config doors): the plan-pair face reads the store it names, the Workflow mount hands the seat itself to its children. */
+    checkpointSeat: CheckpointSeat | undefined;
     /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
      *  `onTaskNotification`, `workflowDepth`, and the capture-floor getter reads `memoryCaptureAncestors`. */
     internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume"> | undefined;
@@ -145,7 +150,8 @@ export interface PrepareCapsAndWorkflowResult {
     /** owned — the observers grant (`allowObservers === true`, explicit opt-in). */
     observersActive: boolean;
     /** owned — the arming outcome as a closed reason (the manifest's auto-mode face). */
-    autoModeArmReason: AutoModeArmReason;
+    /** #529 / #692 C-d — the leg's auto-mode arming fact (`armed` ⇔ `reason === "armed"`; `deniedSource` only beside a STATED `denied`). */
+    autoModeArmReason: AutoModeArmFact;
     /** owned — the armed classifier, or undefined when any arming arm failed. */
     autoModeDecider: AutoModeDecider | undefined;
     /** owned — the denial tracker built beside the decider (same face, same arming). */
@@ -162,5 +168,29 @@ export interface PrepareCapsAndWorkflowResult {
         current: () => WorkflowSizeGuideline;
     } | undefined;
 }
+/**
+ * The resolved-caps value screen (the caps-side twin of `refuseInvalidAutoModeSeat`): the arming arm reads
+ * `autoMode !== false`, so a resolver that returns a MARSHALLED value — a non-boolean member (`"false"`,
+ * `0`, `null`) or a non-record container (`false`, `"false"`, `[]`; the resolver is an HTTP-backed seam the
+ * type system does not validate at runtime) — would pass a value meant as a denial straight into arming.
+ * Either shape is treated as a disclosed resolver fault: announced through onError (phase config), and
+ * coined fail-closed — a bad MEMBER to `autoMode:false` (the rest of the record kept), a bad CONTAINER to
+ * the same degrade object the resolver-throw arm uses (every `!== false`-gated cap denied), with
+ * `faulted` raised so the posture-keyed consumers read it as an outage, not as a verdict. `undefined`, or
+ * a record whose `autoMode` is `undefined`/`true`/`false`, passes untouched (byte-identical).
+ */
+/** The supported capability keys, fenced total over {@link RuntimeCaps}: a key added to the type without a row here
+ *  is a red build, so the snapshot below can never silently drop a new restriction. */
+declare const RUNTIME_CAP_KEYS: {
+    readonly allowWorkflows: true;
+    readonly allowFork: true;
+    readonly allowObservers: true;
+    readonly forceDurableGate: true;
+    readonly autoMode: true;
+    readonly autoModeDenySource: true;
+    readonly allowMemoryOptOut: true;
+};
+export type RuntimeCapKeysCoverEveryCap = AssertAllKeysHandled<Exclude<keyof RuntimeCaps, keyof typeof RUNTIME_CAP_KEYS>>;
 /** The M4 phase body — prepareTask's caps-and-workflow stretch, verbatim (see the module header). */
 export declare function prepareCapsAndWorkflow(input: PrepareCapsAndWorkflowInput): Promise<PrepareCapsAndWorkflowResult>;
+export {};

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -10,7 +10,7 @@ import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
 import { AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "../auto-mode-defaults.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
 import { createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
-import { resolveCheckpointStore } from "../checkpoint-store.js";
+import { checkpointStoreOfSeat } from "../checkpoint-seat.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, resolveComplianceDenies } from "../compliance.js";
 import { createPresentPlanTool, createEnterPlanModeTool } from "../present-plan-tool.js";
 import { resolveTaskModel } from "../roles.js";
@@ -19,6 +19,7 @@ import { defaultTaskRegistry } from "../task-registry.js";
 import { emitTrace } from "../trace.js";
 import { defineTool, isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
 const MOUNT_REMEDY = "author it as a plain-object ToolSpec (own `name` and `execute`), hand the defineTool product itself, or wrap a product through the supported wrapper form (a fresh object re-stamped with `stampDefineToolBrand` whose rebind re-wraps the rebound product)";
+import { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "../runtime-caps.js";
 import { derivedRouteFallsBack } from "./derived-route-fallback.js";
 import { REPORT_FINDINGS_TOOL_NAME, createReportBlockedTool, createReportFindingsTool } from "./synthetic-tools.js";
 function classifierReplyText(reply) {
@@ -42,6 +43,24 @@ function assembleParentCaptureState(o, i, ctl, ancestors) {
     });
     return o instanceof Promise || i instanceof Promise ? Promise.all([o, i]).then(([ov, iv]) => build(ov, iv)) : build(o, i);
 }
+const RUNTIME_CAP_KEYS = {
+    allowWorkflows: true,
+    allowFork: true,
+    allowObservers: true,
+    forceDurableGate: true,
+    autoMode: true,
+    autoModeDenySource: true,
+    allowMemoryOptOut: true,
+};
+function snapshotRuntimeCaps(record) {
+    const out = {};
+    for (const key of Object.keys(RUNTIME_CAP_KEYS)) {
+        const v = record[key];
+        if (v !== undefined)
+            out[key] = v;
+    }
+    return out;
+}
 function screenAutoModeCap(caps, onError, sessionId) {
     if (caps === undefined)
         return { caps, faulted: false };
@@ -49,7 +68,20 @@ function screenAutoModeCap(caps, onError, sessionId) {
         onError?.(new Error(`runtimeCapsResolver returned a non-record value (${JSON.stringify(caps)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain). Return a RuntimeCaps object or undefined.`), { phase: "config", sessionId });
         return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
     }
-    const record = caps;
+    let record;
+    try {
+        record = snapshotRuntimeCaps(caps);
+    }
+    catch (err) {
+        onError?.(new Error(`runtimeCapsResolver's record threw while being read (${err instanceof Error ? err.message : String(err)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain).`), { phase: "config", sessionId });
+        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
+    }
+    const { autoMode, autoModeDenySource } = record;
+    if (autoModeDenySource !== undefined && (!isAutoModeDenySource(autoModeDenySource) || autoMode !== false)) {
+        onError?.(new Error(`runtimeCapsResolver returned autoModeDenySource=${JSON.stringify(autoModeDenySource)} beside autoMode=${JSON.stringify(autoMode)} — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Name a source only beside autoMode:false, and only one of ${AUTO_MODE_DENY_SOURCES.join("|")}.`), { phase: "config", sessionId });
+        const { autoModeDenySource: _refused, ...rest } = record;
+        return { caps: { ...rest, autoMode: false }, faulted: true };
+    }
     if (record.autoMode === undefined || typeof record.autoMode === "boolean")
         return { caps: record, faulted: false };
     onError?.(new Error(`runtimeCapsResolver returned a non-boolean autoMode (${JSON.stringify(record.autoMode)}) — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Return true, false, or omit the key.`), { phase: "config", sessionId });
@@ -67,17 +99,20 @@ function mintPersistedArming(am, laneRule, classifierSystemPrompt, onError, sess
     }
     return arming;
 }
-function autoModeArmReasonOf(intent, facePresent, capsAutoMode, capsFaulted) {
+function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     if (!intent)
-        return "no_intent";
+        return { armed: false, reason: "no_intent" };
     if (!facePresent)
-        return "no_face";
-    if (capsAutoMode === false)
-        return capsFaulted ? "resolver_fault" : "denied";
-    return "armed";
+        return { armed: false, reason: "no_face" };
+    if (caps?.autoMode === false) {
+        if (capsFaulted)
+            return { armed: false, reason: "resolver_fault" };
+        return { armed: false, reason: "denied", ...(caps.autoModeDenySource !== undefined ? { deniedSource: caps.autoModeDenySource } : {}) };
+    }
+    return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const { spec, deps, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
@@ -112,7 +147,7 @@ export async function prepareCapsAndWorkflow(input) {
         roster.mount(createReportFindingsTool(), { source: "builtin", mountedBy: "always" });
     }
     if (spec.enablePlanMode === true && spec.interactiveTools !== false) {
-        const planReviewFace = resolveCheckpointStore(spec, deps) !== undefined;
+        const planReviewFace = checkpointStoreOfSeat(checkpointSeat) !== undefined;
         if (spec.interactiveTools === true || planReviewFace) {
             roster.mount(defineTool(createPresentPlanTool(requestReview)), { source: "builtin", mountedBy: "optional" });
             if (planReviewFace) {
@@ -173,7 +208,7 @@ export async function prepareCapsAndWorkflow(input) {
     let autoModeDecider;
     let autoModeDenialTracking;
     let autoModeArming;
-    const autoModeArmReason = autoModeArmReasonOf(autoModeIntent, deps.autoMode !== undefined, runtimeCaps?.autoMode, runtimeCapsFaulted);
+    const autoModeArmReason = autoModeArmReasonOf(autoModeIntent, deps.autoMode !== undefined, runtimeCaps, runtimeCapsFaulted);
     if (autoModeIntent && deps.autoMode !== undefined && runtimeCaps?.autoMode !== false) {
         const am = deps.autoMode;
         let classifierModel;
@@ -297,7 +332,7 @@ export async function prepareCapsAndWorkflow(input) {
             },
             ...(spec.handsReadOnly === true ? { parentHandsReadOnly: true } : {}), ...(spec.interactiveTools === false ? { parentInteractiveTools: false } : {}),
             onNotice: deps.onNotice,
-            parentCheckpointStoreDisabled: spec.checkpointStore === "disabled",
+            ...(checkpointSeat !== undefined ? { parentCheckpointStore: checkpointSeat } : {}),
             parentCenterArtifactDigest: () => input.centerAdoption()?.artifact.artifactDigest,
             parentCenterSourceRevision: () => input.centerAdoption()?.sourceRevision,
             ...(forwardEvent ? { forwardEvent } : {}),

package/dist/core/runner/prepare-defer-classify.d.ts

@@ -28,7 +28,7 @@ export interface PrepareDeferClassifyInput {
     fullShellReachable: boolean;
     /** borrowed-readonly — the resolved prompt profile (`classic` swaps in `descriptionClassic`). */
     promptProfile: "simple" | "classic";
-    /** borrowed-readonly — the resolved model (the classifier's constant-defer arm reads its shape). */
+    /** borrowed-readonly — the resolved model (the deferral gate's threshold reads its context window). */
     model: Model;
     /** borrowed-readonly — the materialized MCP roster; only `tools` is read (protocol names for the
      *  remote-roster arm; `mcpAlwaysLoad` self-declarations, losing to an explicit operator defer). */

package/dist/core/runner/prepare-defer-classify.js

@@ -3,10 +3,12 @@ import { FULL_SHELL_CONTRACT_ID } from "../../tools/fs/index.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
-import { TOOL_SEARCH_NAME, classifyDeferred } from "./tool-disclosure.js";
+import { protocolOf } from "../protocol-table.js";
+import { classifyDeferred } from "./tool-defer-gate.js";
+import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
 import { RosterBuilder } from "../tool-roster.js";
-function explicitlyDeferredMemoryTrio(mounted, roster, deferNames) {
-    return mounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => roster.some((t) => t.name === n) && (deferNames ?? []).includes(n)) : [];
+function explicitlyDeferredMemoryTrio(mounted, roster, callerDeferNames) {
+    return mounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => roster.some((t) => t.name === n) && (callerDeferNames ?? []).includes(n)) : [];
 }
 function memoryGroupRetractionSet(builtinDeferPairNames, engineTrioInPlay) {
     return new Set([...builtinDeferPairNames, ...(engineTrioInPlay ? MEMORY_ENGINE_TOOL_NAMES : [])]);
@@ -39,29 +41,29 @@ export function prepareDeferClassify(input) {
                 roster.replaceAt(i, { ...t, description: t.descriptionClassic });
         }
     }
-    const userToolNames = (spec.tools ?? []).map((t) => t.name);
-    const protocolToolNames = [...mcp.tools.map((t) => t.name), ...a2a.tools.map((t) => t.name)];
+    const protocolToolNames = [...mcp.tools, ...a2a.tools].filter((t) => protocolOf(t.name) !== undefined).map((t) => t.name);
     const mcpAlwaysLoadNames = mcp.tools
         .filter((t) => t.mcpAlwaysLoad === true && !(toolFaceSnapshot.defer ?? []).includes(t.name))
         .map((t) => t.name);
     const classifyDeferredOverFace = (face, builtinDeferNames) => {
+        const mounted = new Set(face.map((t) => t.name));
         const deferredSet = classifyDeferred({
             specs: spec.tools ?? [],
             protocolToolNames,
-            fullTools: face.filter((t) => userToolNames.includes(t.name) || protocolToolNames.includes(t.name)),
+            fullTools: face,
             deferMode: deps.deferMode,
             model,
-            deferNames: [...(toolFaceSnapshot.defer ?? []), ...builtinDeferNames].filter((n) => face.some((t) => t.name === n)),
+            callerDeferNames: (toolFaceSnapshot.defer ?? []).filter((n) => mounted.has(n)),
+            builtinDeferNames: builtinDeferNames.filter((n) => mounted.has(n)),
             alwaysLoadNames: [
                 ASK_USER_QUESTION_TOOL_NAME,
                 ...(toolFaceSnapshot.alwaysLoad ?? []),
                 ...mcpAlwaysLoadNames,
             ],
         });
-        for (const n of [...deferredSet]) {
-            if (!face.some((t) => t.name === n))
+        for (const n of [...deferredSet])
+            if (!mounted.has(n))
                 deferredSet.delete(n);
-        }
         return deferredSet;
     };
     const sharedMemoryPair = sharedMemoryPairMounted ? SHARED_MEMORY_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n)) : [];

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -19,7 +19,7 @@
  * gate-machinery block, kept as the block's one guard here); the `tool_result` station keys off the hook record alone, as
  * it always did.
  *
- * Every station this file holds is a `denySource` / settlement WRITE site the decomposition's next slice maps onto one
+ * Every station this file holds is a `deniedBy` / settlement WRITE site the decomposition's next slice maps onto one
  * gate outcome; nothing here changes a word, a source or an order — the stations are moved, not re-adjudicated.
  */
 import type { AgentHarness, AgentTool } from "../../internal/harness.js";
@@ -130,10 +130,9 @@ export interface PrepareGateStationsInput {
     abortController: {
         readonly signal: AbortSignal;
     };
-    /** borrowed-readonly — whether Bash is coarsely shell-gated (the gate's `shellGated` attribution). */
-    shellGatedBash: boolean;
-    /** borrowed-readonly — whether Monitor is coarsely shell-gated (same). */
-    shellGatedMonitor: boolean;
+    /** borrowed-readonly — the shell-seat provenance set: the shell-running tools whose tier is the engine's shell seat's, not a
+     *  deployment mark (the gate's `shellGated` attribution is the gated tool's membership). */
+    shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the auto-mode decider, or undefined (the classifier lane the gate routes a surviving ask through). */
     autoModeDecider: AutoModeDecider | undefined;
     /** borrowed-readonly — the auto-mode denial tracker, or undefined (handed to the gate beside the decider). */

package/dist/core/runner/prepare-gate-stations.js

@@ -42,7 +42,7 @@ function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
     if (askLane !== undefined && parkAsk !== undefined) {
         const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
         const { resolveContentAsk, suspendAsk } = parkAsk;
@@ -119,7 +119,7 @@ export function prepareGateStations(input) {
                         abortSignal: abortController.signal,
                         ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
                         onHookError: notifyHookError,
-                        shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
+                        shellGated: shellGatedTools.has(e.toolName),
                         ...(autoModeDecider ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}) } } : {}),
                         onHeadlessDenialLimit: stopForDenialLimit,
                         onAskUnresolvable: (info) => deliverEngineNotice(deps.onNotice, askUnresolvableNotice({ sessionId, ...info })),

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -1,8 +1,9 @@
 import { type BeforeWriteHook, type CwdRef, type ReadDenyMatcher, type ReadFace } from "../../tools/fs/index.js";
 import { type ReadFileState } from "../../tools/fs/safety.js";
-import type { RunnerDeps, TaskSpec } from "../types.js";
+import type { RunnerDeps, ShellGateDoctrine, TaskSpec } from "../types.js";
 import type { Model } from "../../internal/llm.js";
 import type { AgentTool, ExecutionEnv, WorkspaceState } from "../../internal/harness.js";
+import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import type { StoredSession } from "../session.js";
 import type { IrreversibilityTier, PrepareResume, ReversibilityProbes, RunInternals, ToolFaceSnapshot } from "./contracts.js";
 import { RosterBuilder } from "../tool-roster.js";
@@ -135,7 +136,7 @@ export interface PrepareHandsReadFaceInput {
     fullShellReachable: boolean;
     /** borrowed-readonly — the MAX-RANK fold of spec.shellGate with the inherited chain's doctrine
      *  (computed in the driver's inherited-gate block); the shellGate fold's doctrine value. */
-    effectiveShellGate: "off" | "classify" | "always";
+    effectiveShellGate: ShellGateDoctrine;
     /** borrowed-readonly — B-1's frozen task-start face snapshot; only `.exclude` is read here (the
      *  Monitor-mount honesty bit for the gh rate-limit hint, #181-F6). */
     toolFaceSnapshot: ToolFaceSnapshot;
@@ -161,13 +162,18 @@ export interface PrepareHandsReadFaceInput {
      *  when no file restore ran. Fail-closed by construction — dropping a read record only ever
      *  produces refusals. */
     restoredFilePaths?: readonly string[];
-    /** borrowed-readonly — (ref cell; the REF itself is never replaced) design/138 S2-C late-bound memory
-     *  write gate: the band's beforeWrite closure reads `.current` call-time; prepareMemory (driver,
-     *  after this phase) installs the gate — the one writer; this phase only reads. Declared in the driver because the SAME ref feeds
-     *  prepareMemory. */
+    /** borrowed-readonly — (ref cell; the REF itself is never replaced) design/138 S2-C memory write gate:
+     *  the band's beforeWrite closure reads `.current` call-time; prepareMemory (driver, BEFORE this phase
+     *  since #691 — the memory root must be known before the toolkit compiles) installs the gate — the one
+     *  writer; this phase only reads. Declared in the driver because the SAME ref feeds prepareMemory. */
     memoryWriteGateRef: {
         current?: BeforeWriteHook;
     };
+    /** borrowed-mutable — #691: the advertised-writable-directory seat (see its module header for the one
+     *  rule). Present on the hands leg only (a fence exists). The memory phase, which runs BEFORE this one,
+     *  has already admitted its write root through it; this phase admits the deployment's scratchpad and
+     *  folds `roots` into the write-capable containment allowlist before the toolkit compiles. */
+    advertisedWritableDirs?: AdvertisedWritableDirs;
     /** borrowed-readonly — the driver's per-tool offload wrapper (design/158 posture + policy); the
      *  band rides through it exactly as caller/MCP tools do. */
     firstPartyOffload: (tool: AgentTool) => AgentTool;
@@ -276,12 +282,12 @@ export interface PrepareHandsReadFaceResult {
     /** owned — design/199 件B: the ONE compiled deny judge per prepare (built-ins ∪ deployment ∪
      *  task additions). Undefined ⇔ hands-less (its consumers only exist with hands). */
     readDenyMatcher: ReadDenyMatcher | undefined;
-    /** write-back — "the shellGate doctrine is the SOLE POSITIVE source of Bash's tier" provenance
-     *  bit; the driver's `let` (risk grading + the persisted-rule mandate boundary read it
-     *  call-time). Written ONLY by this phase; false when the fold did not run. */
-    shellGatedBash: boolean;
-    /** write-back — the Monitor twin of the bit above. */
-    shellGatedMonitor: boolean;
+    /** owned — the shell-seat PROVENANCE set: the shell-running tools whose tier the engine's shell seat (read
+     *  boundary + shellGate doctrine) is the SOLE POSITIVE source of — no explicit deployment mark on that name.
+     *  The one seat every consumer reads (risk grading, the gate's tighten attribution, the persisted-rule mandate
+     *  boundary): `shellGatedTools.has(toolName)`. Minted here, never grown afterwards; empty when the seat fold
+     *  did not run (no real writable shell). */
+    shellGatedTools: ReadonlySet<string>;
     /** owned (design/380 rescan C4) — the ENV-HAND tool names, minted AT THE MOUNT: every tool this
      *  phase mounted over the ExecutionEnv (the fs/bash band), later grown by the driver's own env
      *  mounts (Monitor, the worktree pair — the SAME Set identity, mutated at those mount sites).