@sema-agent/core 7.13.0 → 7.15.0

package/dist/core/runner-deps.d.ts

@@ -1370,15 +1370,22 @@ export interface RunnerDeps {
         removedBytes: number;
     }) => void;
     /**
-     * Deferred-tool disclosure policy (design/36). Default (omitted): deterministic per-tool, so the same
-     * `TaskSpec` always yields the same `tools[]`. The default deferral sources are `ToolSpec.defer === true`,
-     * every REMOTE-PROTOCOL tool name (MCP **and** A2A peer tools), {@link TaskSpec.deferTools}, and built-in
-     * tools that declare their own `defer` (today the shared-memory pair) — minus anything pinned inline by
-     * `ToolSpec.alwaysLoad` / {@link TaskSpec.alwaysLoadTools}. `classifyDeferred`'s own contract is the
-     * single authority if this list ever drifts again. `"auto"`: additionally auto-defer tools when the total
-     * inlined schema size would exceed a fraction of the model's context window. Auto is an explicit opt-in
-     * (council minor #6) because an implicit threshold makes `tools[]` depend on the model/context, which
-     * callers find hard to predict; explicit `defer` flags always win regardless of this setting.
+     * Deferred-tool disclosure policy (design/36). Two rules govern deferral. ① The caller's list is
+     * literal: {@link TaskSpec.deferTools} names defer on every request, `ToolSpec.alwaysLoad` /
+     * {@link TaskSpec.alwaysLoadTools} pins inline on every request (judged first) — neither reads this
+     * knob. ② The engine's own candidates — `ToolSpec.defer === true`, every REMOTE-PROTOCOL tool name
+     * (MCP **and** A2A peer tools), and built-in tools that declare their own `defer` — sit behind ONE
+     * threshold gate, all or nothing: deferred iff their inlined size (name + description + schema; the
+     * candidate set only — the caller's list, pins and non-candidates are not measured) reaches 10% of the
+     * model's context window; below that they ship inline in full and no ToolSearch is mounted.
+     *
+     * `"auto"` is a CANDIDATE-WIDENING knob, not a second gate: it adds every caller spec — undeclared
+     * caller tools included — to the candidate set, measured and decided by the same threshold. Engine
+     * built-ins the deployment did not name are candidates under no setting. An explicit opt-in (council
+     * minor #6) because it makes `tools[]` depend on the caller roster's total weight, which a deployment
+     * with many thin tools may not want. Any other value refuses at prepare (`config.defer_mode_invalid`).
+     * `classifyDeferred` / `deferralGate` in `src/core/runner/tool-disclosure.ts` are the single authority
+     * if this text drifts.
      */
     deferMode?: "auto";
     /**

package/dist/core/runtime-caps.d.ts

@@ -84,6 +84,19 @@ export interface WorkflowGovernanceBaseline {
  * These six are the caps the ENGINE enforces; `allowUltracode`/`allowBypassPermissions` are shell-UX /
  * service-settings-layer concerns (see {@link RunnerDeps.runtimeCapsResolver}).
  */
+/**
+ * #692 C-d — WHICH plane's ratchet denied auto mode, when the resolver knows: the three settings sources
+ * CC 2.1.250's `permissions.disableAutoMode` can come from, as the resolver folds them into the one deny bit
+ * ({@link RuntimeCaps.autoMode} `=== false`). `org` = a managed / organization policy plane; `local` = the
+ * machine's local settings; `settings` = the user's / project's settings file. Read ONLY beside the deny bit
+ * (a source with no denial is a contradiction the value screen refuses as a resolver fault); projected onto
+ * the leg's manifest read face (`WiringManifest.autoMode.deniedSource`) so a shell can say "your organization
+ * turned auto mode off" vs "your settings did" instead of one word for both.
+ */
+export declare const AUTO_MODE_DENY_SOURCES: readonly ["org", "local", "settings"];
+export type AutoModeDenySource = (typeof AUTO_MODE_DENY_SOURCES)[number];
+/** Membership test for {@link AutoModeDenySource}. */
+export declare function isAutoModeDenySource(v: unknown): v is AutoModeDenySource;
 export interface RuntimeCaps {
     /** `false` DENIES workflow self-orchestration for this principal server-side — even on a deployment that is
      *  capable ({@link RunnerDeps.workflowScriptRunner} + governance). The third stage of the workflows gate.
@@ -136,6 +149,14 @@ export interface RuntimeCaps {
      * A denial resolves to a no-op (asks flow the original chain; no warn — the gate, not a mistake).
      */
     autoMode?: boolean;
+    /**
+     * #692 C-d (additive) — WHICH source's ratchet set {@link autoMode} to `false`, when the resolver folded
+     * several ({@link AutoModeDenySource}). Optional: a resolver that does not track sources omits it and the
+     * manifest reads `denied` with no source. Present with `autoMode` not `false`, or spelled outside the set,
+     * is a resolver FAULT (announced through `onError`, the deny bit coined fail-closed, `resolver_fault` on the
+     * manifest) — a source named for a denial that did not happen is a marshalling error, never a fact.
+     */
+    autoModeDenySource?: AutoModeDenySource;
     /**
      * design/383 §3.1 — may this principal declare a session memory-capture OPT-OUT
      * (`TaskSpec.memory.capture: "off"` / the Runner flip verb)? `false` = the deployment REQUIRES

package/dist/core/runtime-caps.js

@@ -1 +1,5 @@
-export {};
+export const AUTO_MODE_DENY_SOURCES = ["org", "local", "settings"];
+const AUTO_MODE_DENY_SOURCE_SET = new Set(AUTO_MODE_DENY_SOURCES);
+export function isAutoModeDenySource(v) {
+    return AUTO_MODE_DENY_SOURCE_SET.has(v);
+}

package/dist/core/task-event.d.ts

@@ -97,7 +97,16 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  *  - `connect_refused` — the attempt got a definite negative about the target itself (nothing accepts
  *    at that address, or the name has no address). This is the class the SHORT retry lane serves.
  *  - `transport`      — any other transport-level failure: a connect timeout, a reset, a mid-stream
- *    tear, a stalled stream. No verdict about the target; the full ladder applies.
+ *    tear. No verdict about the target; the full ladder applies.
+ *  - `stall`          — no failure was observed on the link at all: THIS process cancelled its own
+ *    request because one of its stall watchdogs reached its deadline while the stream produced
+ *    nothing. The distinction from `transport` is WHO GAVE UP, and nothing more: a `transport` frame
+ *    reports something that happened to the call, a `stall` frame reports a local deadline. It is not
+ *    a verdict on the remedy — a blackholed connection (no reset, no close) produces silence, and
+ *    silence is what a watchdog measures, so a `stall` can still turn out to be a network fault; what
+ *    it always tells you truthfully is that the request was cancelled here, at a configured deadline,
+ *    rather than lost out there. Reporting these as `transport` asserted the opposite — that the link
+ *    had dropped — when nothing about the link was known at all.
  *  - `rate_limit`     — the provider asked the caller to slow down.
  *  - `server`         — the provider reported a failure on its own side.
  *  - `http`           — a response the status predicate calls terminal, retried anyway because the
@@ -105,7 +114,7 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  *  - `output_cap`     — not a failure of the connection at all: the request is being re-sent with a
  *    lowered output cap after the provider reported the context limit exceeded (no backoff).
  */
-export type BrainRetryErrClass = "connect_refused" | "transport" | "rate_limit" | "server" | "http" | "output_cap";
+export type BrainRetryErrClass = "connect_refused" | "transport" | "stall" | "rate_limit" | "server" | "http" | "output_cap";
 /** design/99 §E3/§E10 — the payload of a {@link TaskEvent} `status` event (and the brain→runner signal). */
 export interface BrainStatus {
     phase: BrainStatusPhase;

package/dist/core/task-registry-shared.js

@@ -3,6 +3,7 @@ import { summarizeWorkflowRun } from "./workflow-run-store.js";
 import { delimitUntrusted } from "./untrusted-text.js";
 import { boundedRedactedSummary } from "./untrusted-egress.js";
 import { clipWithFilePointer } from "./tool-errors.js";
+import { announceEnvKnob } from "./env-knob-announce.js";
 export function mintCompletionId(target) {
     if (target.completionId === undefined)
         target.completionId = uuidv7();
@@ -61,14 +62,15 @@ const TASK_OUTPUT_DEFAULT_CHARS = 32_000;
 export const TASK_OUTPUT_MAX_CHARS = 160_000;
 const TASK_OUTPUT_MIN_CHARS = 512;
 function taskMaxOutputChars() {
-    const raw = process.env.TASK_MAX_OUTPUT_LENGTH;
-    if (!raw)
+    const rawEnv = process.env.TASK_MAX_OUTPUT_LENGTH;
+    if (rawEnv === undefined || rawEnv.trim() === "")
         return TASK_OUTPUT_DEFAULT_CHARS;
-    if (!/^\d+$/.test(raw.trim()))
-        return TASK_OUTPUT_DEFAULT_CHARS;
-    const n = parseInt(raw.trim(), 10);
-    if (!Number.isFinite(n) || n <= 0)
+    const raw = rawEnv.trim();
+    const n = /^\d+$/.test(raw) ? parseInt(raw, 10) : Number.NaN;
+    if (!Number.isFinite(n) || n <= 0) {
+        announceEnvKnob(`TASK_MAX_OUTPUT_LENGTH=${rawEnv} was ignored — it is not a positive whole number of characters. Using ${TASK_OUTPUT_DEFAULT_CHARS} instead.`);
         return TASK_OUTPUT_DEFAULT_CHARS;
+    }
     return Math.min(Math.max(n, TASK_OUTPUT_MIN_CHARS), TASK_OUTPUT_MAX_CHARS);
 }
 export function clipTaskOutput(s, fullOutputPath) {

package/dist/core/task-result.d.ts

@@ -25,6 +25,14 @@ import type { NestedUsage } from "./tool-spec.js";
  * Orchestrators that map an unexpected `suspended` should map an unexpected `needs_review` the same
  * hard-boundary way (it is, like `suspended`, only safe at the top-level `runTask` boundary).
  */
+/**
+ * Terminal vs waiting. Three words are TERMINAL — the leg is over and nobody is expected to act: `completed`,
+ * `failed`, and `blocked` (the AGENT's own report, through `report_blocked`, that it cannot finish and why —
+ * a self-report, not a pause; it waits for nobody). Two words are WAITING — a person's decision resumes the
+ * same leg through `runner.resume(token, …)`: `suspended` (a durable pre-action approval of a tool call) and
+ * `needs_review` (a durable review pause). The task-registry face spells the two waiting words as `parked`.
+ * A consumer that files `blocked` beside `suspended` is waiting on a decision that never comes.
+ */
 export type TaskStatus = "completed" | "blocked" | "failed" | "suspended" | "needs_review";
 /**
  * RB-439-a — one remote-workspace lifecycle failure, reported as data on {@link TaskResult.remoteEnvFailures}.
@@ -598,6 +606,13 @@ export interface TaskResult {
          * the compaction subtotal). OBSERVE-ONLY (never gates budget). The workflow display is unaffected (its agents
          * fail-on-suspend, never durably resume). A `spentToolCalls` ledger fold is a follow-on. */
         toolCalls?: number;
+        /** #692 C-b (additive): present (`true`) when the usage figures on this face are a LOWER BOUND rather than a
+         *  measurement — at least one model round of the leg reported no usage frame (the brain's `usageMissing`
+         *  mark; the same word the per-turn `turn_end` frame carries), or the result was minted by a host / an
+         *  orchestration lane that never ran a model round it could measure (a refused spawn's journal entry, a
+         *  prepare-time refusal, a synthetic abort). The numeric members stay required and stay what was counted:
+         *  `tokens: 0` beside this key reads "unknown", never "free". Absent ⇔ every round reported usage. */
+        usageMissing?: true;
         /** Prompt (input) tokens that MISSED the prefix cache, summed across the task's turns and normalized
          * across providers (Anthropic already reports `input_tokens` this way; OpenAI/vLLM include the cache
          * in theirs, so the subsets are removed). Mutually exclusive with `cachedTokens`/`cacheWriteTokens*`;

package/dist/core/task-spec.d.ts

@@ -31,6 +31,10 @@ export type ImageInput = {
     url: string;
 };
 /** A single self-contained task with its full configuration. */
+/** The shell-gate doctrine vocabulary — {@link TaskSpec.shellGate}'s value set, and the word the engine persists on a
+ *  shell-gated ask (`RiskDescriptor.shellGateDoctrine`) and folds across a delegation chain (max-rank: `off` <
+ *  `classify` < `always`). One closed set; every seat that names a doctrine spells it through this alias. */
+export type ShellGateDoctrine = "off" | "classify" | "always";
 export interface TaskSpec {
     taskId?: string;
     /** The instruction / latest user message for this turn. */
@@ -400,6 +404,8 @@ export interface TaskSpec {
      * included — `ToolSpec.defer` only covers caller specs): wire names listed here ship as
      * lightweight placeholders (name + one-line hint, schema bytes OFF the cache prefix) and are
      * activated on demand via the injected ToolSearch (design/36 materialization — prefix untouched).
+     * This list is LITERAL — an intentional deferral, deferred on every request regardless of the
+     * deferral gate ({@link RunnerDeps.deferMode}) and not counted toward its threshold.
      * "Default-on but not exposed" = the deployment lists the tool here on requests where no
      * activation source fired (e.g. Workflow unless the user said "workflow"/"ultracode"); omitting
      * the name on a later request mounts it fully (activation = not deferring). Unknown names are
@@ -445,7 +451,7 @@ export interface TaskSpec {
      * direction; CC 220 `alwaysLoad` 对位): names listed here are NEVER deferred — not by
      * `ToolSpec.defer`, not by the MCP constant-defer arm (besides the server's own
      * `_meta["anthropic/alwaysLoad"]` declaration this list is the only channel that keeps a chosen
-     * MCP tool's full schema inlined), not by `deferTools`, not by `deferMode:"auto"`. Unknown names
+     * MCP tool's full schema inlined), not by `deferTools`, not by the deferral gate under any `deferMode`. Unknown names
      * are ignored (the valve only subtracts). Names also in `excludeTools` stay excluded (exclusion
      * wins — an unmounted tool has no schema to keep inline).
      */
@@ -862,7 +868,7 @@ export interface TaskSpec {
      * task config — a resume that omits it leaves the resumed run's SUBSEQUENT `bash` calls ungated (the approved
      * pending call itself runs once, having been adjudicated). Re-pass the same value the original task used.
      */
-    shellGate?: "off" | "always" | "classify";
+    shellGate?: ShellGateDoctrine;
     /**
      * The caller's AUTO-MODE INTENT for this task — the "user turned auto on" half of the classifier
      * arming (CC 2.1.250 polarity: auto mode is something the USER enables at the permission-mode

package/dist/core/terminal-cause.d.ts

@@ -20,7 +20,10 @@ import type { AssertAllKeysHandled } from "./ask-origin.js";
  * the one cause→plane derivation, for the faces that still speak the word.
  *  - `completed` — the run finished (a person's clean halt included — see `TaskResult.haltedByUser`).
  *  - `failed` — a limit, a provider failure, an abort, an invalid output…
- *  - `blocked` — the agent could not finish and said why.
+ *  - `blocked` — the AGENT reported, through `report_blocked`, that it cannot finish, and why. A TERMINAL
+ *    cause: the leg is over and it waits for nobody (nothing to resume, no token). The waiting-on-a-person
+ *    states are the `paused` cause's two status words — `suspended` (a pre-action approval of a tool
+ *    call) and `needs_review` (a review pause); the task-registry face spells both as `parked`.
  *  - `paused` — a durable pause committed a checkpoint and the run is resumable.
  * A `GateOutcome` is the record of ONE gate pass (per call); a `TerminalCause` is the record of ONE run
  * (per leg); a paused run's `gate` and the park row's `gate.kind` are the same word, joined by the token.
@@ -73,7 +76,8 @@ export type TerminalCause = {
     nestedPause?: PausedCause;
 } | {
     kind: "blocked";
-    /** Why the agent could not finish. */
+    /** Why the agent could not finish — the agent's own words from its `report_blocked` call. Terminal: the
+     *  run is over and nobody is being waited on (contrast `paused`, whose token is the resume capability). */
     reason: string;
 } | {
     kind: "paused";

package/dist/core/tool-policy.d.ts

@@ -106,6 +106,27 @@ export interface ToolCallRequest {
  *  deny/ask lane and the person's own allow rules, never over a mandated ask. */
 declare const DECISION_REASONS: readonly ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only"];
 export type DecisionReason = (typeof DECISION_REASONS)[number];
+/** Carry every engine attestation (settlement, classifier cause) from a decision onto a reconstruction of it — the
+ *  seam for the engine's OWN clone sites outside this module (the inherited chain's final-form re-check carries the
+ *  post-rewrite args on a spread of an ancestor's deny). Not re-exported from `src/index.ts`. */
+export declare function carryEngineAttestations(from: object, to: object): void;
+/** Carry a PRECEDING decision's settlement onto a later deny that has none of its own — the veto record (a person's
+ *  yes on the settlement, the refusing layer on the disposition; invariant I3) for the engine's own clone sites,
+ *  where the deny is minted over a decision that already carried an attested approval. A deny that carries its own
+ *  settlement keeps it (the latest resolution wins). Not re-exported from `src/index.ts`. */
+export declare function carryPrecedingSettlement(preceding: object, to: object): void;
+/** Attest that `d` is a deny a classifier station minted for `call` out of a round of the named FORM. */
+export declare function attestClassifierDenyCause<T extends object>(d: T, cause: import("./gate-outcome.js").ClassifierDenyCause, call: {
+    toolCallId: string;
+    toolName: string;
+}): T;
+/** Read the attested classifier cause off a deny FOR the named call (the gate's fold and exit are the
+ *  consumers): a binding to a different call is a replayed object and answers absence. An internal seam
+ *  between engine modules — deliberately NOT re-exported from `src/index.ts`. */
+export declare function classifierDenyCauseOf(d: unknown, call: {
+    toolCallId: string;
+    toolName: string;
+}): import("./gate-outcome.js").ClassifierDenyCause | undefined;
 /** Read the engine-attested settlement off a funneled decision FOR the named call (the gate's exit is the
  *  one consumer): an attestation bound to a different call is a replayed object and answers absence.
  *  Exported for the gate module only — deliberately NOT re-exported from `src/index.ts` (an internal seam
@@ -209,15 +230,6 @@ export type PermissionResult = {
      *  same safe direction as `matchedAskRule`); it cannot state a window of its own, because the
      *  route it would be a window for has not been chosen yet. */
     denialLimitFallback?: import("./auto-mode.js").UnarmedDenialLimitFallback;
-    /** #616 (additive): the classifier-unavailable FACT on an ASK — `cause` is the verdict's own word
-     *  ({@link import("./auto-mode.js").AutoModeUnavailableCause}). Since #661 the ENGINE no longer writes
-     *  it here: an `unavailable` verdict is a DENY (the deny arm's member above), never an ask handed to a
-     *  person. The member stays on the ask arm as display metadata a policy may self-declare on its own
-     *  ask (nothing reads it to decide anything); the carry stations still copy it onto the approval
-     *  request and the durable row when present. Retirement candidate for the next wire window. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
     /** #144 disclosure (additive): a persisted allow rule MATCHED this call but could not clear the
      *  ask, because the ask is MANDATED (operator shellGate:"always", or the tool's own
      *  egress/irreversibility marks) rather than a classifier's hesitation — "allow rules silence
@@ -287,21 +299,18 @@ export type PermissionResult = {
      *  exclusions; an approval surface may render the card by it. Optional on the TYPE only because a
      *  decision is caller-composable; every ask the gate hands to its resolver carries it. */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** #688 C3 (additive): WHICH mechanism stands behind an `origin: "rule_store_unavailable"` — one word from
+     *  {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS} (`store`: the wired store could not be read;
+     *  `call`: the call could not be read against the person's rows — the lexer's sentence is in `message`).
+     *  ENGINE-STAMPED at the same single stamp point as `origin`, from the gate's own lane read; a policy's
+     *  self-declared value is overwritten or removed there. Present ⇔ the origin is `rule_store_unavailable`.
+     *  Carried onto the approval request and the durable row beside the origin word. */
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
 } | {
     action: "deny";
     updatedInput?: unknown;
     message?: string;
     decisionReason?: DecisionReason;
-    /** #661 (additive): this deny is the classifier's UNAVAILABILITY — the auto-mode classifier was consulted
-     *  and could not run, and the call is refused with a sentence that says so (CC 2.1.250 `Ze.unavailable` ⇒
-     *  `deny`, `x1t`). `cause` is the verdict's own word ({@link import("./auto-mode.js").AutoModeUnavailableCause}).
-     *  ENGINE-STAMPED beside `decisionReason: "classifier"` at the classifier stations (the gate's own and the
-     *  inherited-lane arms) on an `unavailable` verdict only; a `block` and a `parse_error` deny carry nothing
-     *  here. Read by the deny observer's payload ({@link import("./hooks.js").PermissionDeniedPayload}) and by
-     *  nothing that decides. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
 };
 /**
  * design/252 G-2 — WHY a piece of rule-provenance evidence is not on an ask.
@@ -1157,15 +1166,12 @@ export interface AskRequest {
      *  that forwards a decision's member here does not compile, which is the point: the window is the
      *  route's fact, and forwarding it silently is how a configured window becomes a wait with none. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
-    /** #616 (additive) — present ⇔ the auto-mode classifier was consulted on this ask and could not run (see
-     *  the {@link PermissionResult} ask-arm member of the same name): the card's "asked because the
-     *  classifier was unavailable" fact, with the verdict's own cause word. Absent on every ask the classifier
-     *  answered, was not eligible for, or was not wired for — read presence, never absence. Filled by the
-     *  carry stations from the decision, never a caller/worker-settable field; the durable park row carries
-     *  the same member (`PendingAction.tool_approval.classifierUnavailable`). */
-    readonly classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** #688 C3 (additive) — the wire twin of the {@link PermissionResult} ask-arm member of the same name: which
+     *  mechanism stands behind an `origin: "rule_store_unavailable"` (`store` / `call`,
+     *  {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS}). Present ⇔ that origin; a consumer that
+     *  renders "the rule store is unreachable" vs "this command could not be read against your rules" branches
+     *  here, never on the message text. Filled by the gate's own carry station from the engine-stamped decision. */
+    readonly ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /** (additive) WHICH AUTHORITY raised this ask — the wire twin of the {@link PermissionResult} ask-arm
      *  member of the same name, one word from the closed {@link import("./ask-origin.js").AskOrigin} set.
      *  The gate's own mint station copies the engine-stamped word; the three inherited-lane stations

package/dist/core/tool-policy.js

@@ -29,6 +29,32 @@ function transferEngineSettlement(from, to) {
     const v = ENGINE_SETTLEMENTS.get(from);
     if (v !== undefined)
         ENGINE_SETTLEMENTS.set(to, v);
+    const c = CLASSIFIER_DENY_CAUSES_SEAT.get(from);
+    if (c !== undefined)
+        CLASSIFIER_DENY_CAUSES_SEAT.set(to, c);
+}
+export function carryEngineAttestations(from, to) {
+    transferEngineSettlement(from, to);
+}
+export function carryPrecedingSettlement(preceding, to) {
+    if (ENGINE_SETTLEMENTS.get(to) !== undefined)
+        return;
+    const v = ENGINE_SETTLEMENTS.get(preceding);
+    if (v !== undefined)
+        ENGINE_SETTLEMENTS.set(to, v);
+}
+const CLASSIFIER_DENY_CAUSES_SEAT = new WeakMap();
+export function attestClassifierDenyCause(d, cause, call) {
+    CLASSIFIER_DENY_CAUSES_SEAT.set(d, { cause, toolCallId: call.toolCallId, toolName: call.toolName });
+    return d;
+}
+export function classifierDenyCauseOf(d, call) {
+    if (typeof d !== "object" || d === null)
+        return undefined;
+    const v = CLASSIFIER_DENY_CAUSES_SEAT.get(d);
+    if (v === undefined || v.toolCallId !== call.toolCallId || v.toolName !== call.toolName)
+        return undefined;
+    return v.cause;
 }
 export function engineSettlementOf(d, call) {
     if (typeof d !== "object" || d === null)
@@ -400,7 +426,6 @@ export function combinePolicies(...policies) {
             let ruleAskText;
             let probeMandateSeen = false;
             let fallbackSeen;
-            let classifierUnavailableSeen;
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
@@ -410,6 +435,8 @@ export function combinePolicies(...policies) {
                     }
                     if (settledAllow !== undefined && ENGINE_SETTLEMENTS.get(out) === undefined) {
                         const owned = out === d ? { ...d } : out;
+                        if (owned !== d)
+                            transferEngineSettlement(d, owned);
                         transferEngineSettlement(settledAllow, owned);
                         return owned;
                     }
@@ -431,16 +458,13 @@ export function combinePolicies(...policies) {
                     probeMandateSeen = true;
                 if (d.action === "ask" && d.denialLimitFallback !== undefined && fallbackSeen === undefined)
                     fallbackSeen = d.denialLimitFallback;
-                if (d.action === "ask" && d.classifierUnavailable !== undefined && classifierUnavailableSeen === undefined)
-                    classifierUnavailableSeen = d.classifierUnavailable;
             }
             if (asked) {
                 const merged = rewrite?.updatedInput;
                 const withRuleAsk = ruleAskText !== undefined && asked.matchedAskRule === undefined ? { ...asked, matchedAskRule: ruleAskText } : asked;
                 const withMark = probeMandateSeen && withRuleAsk.probeMandated !== true ? { ...withRuleAsk, probeMandated: true } : withRuleAsk;
                 const withFallback = fallbackSeen !== undefined && withMark.denialLimitFallback === undefined ? { ...withMark, denialLimitFallback: fallbackSeen, requiresRealApproval: true } : withMark;
-                const withFact = classifierUnavailableSeen !== undefined && withFallback.classifierUnavailable === undefined ? { ...withFallback, classifierUnavailable: { cause: classifierUnavailableSeen.cause } } : withFallback;
-                return merged !== undefined ? { ...withFact, updatedInput: merged } : withFact;
+                return merged !== undefined ? { ...withFallback, updatedInput: merged } : withFallback;
             }
             const allowed = rewrite ?? ALLOW;
             if (settledAllow === undefined)

package/dist/core/tool-roster.js

@@ -208,6 +208,8 @@ export function schemaKeyBoundProblem(schema) {
     return undefined;
 }
 export function rosterMemberBoundProblem(m) {
+    if (typeof m.name !== "string")
+        return { code: "config.tool_roster_bound", message: `tool has no string name (got ${m.name === null ? "null" : typeof m.name}); every roster row is keyed by a string \`name\`` };
     const over = (label, value, bound) => `${label} ${JSON.stringify(value.slice(0, 40) + "…")} is ${value.length} characters; the roster's bound is ${bound}`;
     const of = (text) => `tool ${JSON.stringify(m.name.slice(0, 40))}: ${text}`;
     if (m.name.length > TOOL_WIRE_NAME_MAX_CHARS)

package/dist/core/tool-spec.d.ts

@@ -363,9 +363,12 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      *  for this tool — it is not a "threshold so low that everything offloads". */
     offloadThresholdChars?: number;
     /**
-     * Deferred disclosure (design/36): when `true`, this tool is NOT inlined with its full JSON Schema in
-     * every request. It appears as a lightweight placeholder (`{name, one-line hint, empty params}`) so
-     * the model knows it exists. Activation is a DISCLOSURE fact (has the model seen the schema?), not an
+     * Deferred disclosure (design/36): when `true`, this tool is a CANDIDATE of the engine's deferral gate.
+     * When the gate opens (the candidate set's inlined size reaching 10% of the model's context window; see
+     * {@link RunnerDeps.deferMode}) it is NOT inlined with its full JSON Schema: it appears as a lightweight
+     * placeholder (`{name, one-line hint, empty params}`) so the model knows it exists; when the gate stays
+     * shut it ships inline in full. (A caller that wants a tool deferred on every request names it in
+     * {@link TaskSpec.deferTools} — that list is literal.) Activation is a DISCLOSURE fact (has the model seen the schema?), not an
      * execution precondition: the model activates the tool via the injected ToolSearch, or by making a call
      * whose arguments already match the real parameters (see {@link TaskSpec.deferSelfResolve}, on by
      * default). Where the schema then lands depends on {@link TaskSpec.toolMaterializeStrategy} — the next
@@ -386,7 +389,7 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * `alwaysLoad`, declared per MCP tool via `_meta["anthropic/alwaysLoad"]`, whose `isDeferredTool`
      * checks it before every deferral arm): `true` pins this tool's full schema inline in every
      * request — it is never deferred, regardless of its own {@link defer}, {@link TaskSpec.deferTools},
-     * or `deferMode:"auto"`. The deferral sources only ever ADD; this is the explicit subtract valve.
+     * or the deferral gate. The deferral sources only ever ADD; this is the explicit subtract valve.
      * Exclusion still wins ({@link TaskSpec.excludeTools} unmounts — nothing left to keep inline).
      */
     alwaysLoad?: boolean;
@@ -1077,19 +1080,20 @@ export interface ToolExecuteContext {
         ttlMs?: number;
     };
     /**
-     * Ruled 2026-08-04 — the host run set {@link TaskSpec.checkpointStore} to `"disabled"` (the per-run
-     * off switch for the durable machine). Runner-filled, read-only, NEVER a model/tool argument; absent
-     * on every other run, so a deployment that does not use the off switch sees no change at all.
+     * The host run's RESOLVED checkpoint seat, for its children — the store object the run parks in (the ONE value
+     * `resolveCheckpointStore(spec, deps)` produced), or the word `"disabled"` when the caller disarmed the run.
+     * Runner-filled, read-only, NEVER a model/tool argument. ABSENT when the tool runs outside a Runner task and
+     * when the host has no seat at all (unset spec, no deployment store): nothing to inherit, so the child's own
+     * door resolves its runner's deployment — a split child-execution runner may carry a store the host has none of.
      *
-     * A delegation tool MUST copy `checkpointStore: "disabled"` onto every child spec it builds (sync,
-     * background and fork alike). Without that copy the off switch is a ONE-LEVEL guarantee: the child
-     * runs on the same Runner, so it resolves `RunnerDeps.checkpointStore` on its own and re-arms every
-     * suspend leg the parent just disarmed — a machine-started run would then park in its subtree, which
-     * is exactly the permanently-pending checkpoint the null exists to make impossible. Same discipline
-     * as `principal` (inherit verbatim down the delegation tree off the trusted seat), and strictly a
-     * capability REMOVAL, so it can never widen a child.
-     */
-    checkpointStoreDisabledForChildren?: true;
+     * A delegation tool copies this seat VERBATIM onto every child spec it builds (sync, background and fork
+     * alike) — one rule: a store the parent resolved at SPEC level reaches the child (a child that re-resolved
+     * `RunnerDeps.checkpointStore` on its own found no store on a deployment that wires it per task, and its ask
+     * fell to the fail-closed deny while the parent could park), and `"disabled"` presses on the whole subtree (a
+     * capability REMOVAL, never re-armed one level down by a deployment store — a machine-started run must not
+     * park in its subtree). Same discipline as `principal`: inherit verbatim off the trusted seat.
+     */
+    checkpointStoreForChildren?: import("./checkpoint-store.js").CheckpointStore | "disabled";
     /**
      * design/99 (nested-subagent live observability): the host run's stable taskId (`spec.taskId ?? sessionId`),
      * filled by the Runner. A delegation tool (`createSubagentTool`) reads it AT SPAWN TIME and threads it into the

package/dist/core/types.d.ts

@@ -12,7 +12,7 @@
 import type { AgentTool, ThinkingLevel, ToolInputValidationContext, ToolInputVerdict } from "../internal/harness.js";
 import type { Model, StreamFn } from "../internal/llm.js";
 export type { ModelRef, ModelRole, RoleSpec, ModelRoles, Brain } from "./model-seat.js";
-export type { StaleToolResultOffloadOptions, ImageInput, TaskSpec } from "./task-spec.js";
+export type { StaleToolResultOffloadOptions, ImageInput, TaskSpec, ShellGateDoctrine } from "./task-spec.js";
 export type { ToolEffect, ToolContentOrigin, ReversibilityVerdict, ToolSpec, ToolReturn, NestedUsage, NestedUsageAccum, ToolExecuteContext } from "./tool-spec.js";
 export type { BeforeWriteRequest, BeforeWriteResult, BeforeWriteHook, TrackEditRequest, TrackEditResult, TrackFileEditHook, FileEditedNotice, FileEditedHook, HandsBandOptions } from "./hands-band.js";
 export type { AgentDefinition, SkillManifest, SkillSpec } from "./agent-definition.js";
@@ -22,7 +22,8 @@ export type { TaskStatus, RemoteEnvFailureNote, EffectiveMemoryScopes, TaskResul
 export type { TerminalCause, PausedCause } from "./terminal-cause.js";
 export type { TaskEventIdentity, BrainStatusPhase, BrainRetryErrClass, BrainStatus, ToolActivity, HumanInputSource, HumanInputDelivery, DelegationTaskType, TaskEvent, HumanInputEvent, CompactOutcome } from "./task-event.js";
 export type { TaskStream } from "./task-stream.js";
-export type { WorkflowGovernanceBaseline, RuntimeCaps } from "./runtime-caps.js";
+export type { WorkflowGovernanceBaseline, RuntimeCaps, AutoModeDenySource } from "./runtime-caps.js";
+export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegation-frames.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";

package/dist/core/types.js

@@ -1,2 +1,3 @@
+export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, undrainedUserInputNotices } from "./engine-notice.js";

package/dist/core/wiring-manifest.d.ts

@@ -74,6 +74,18 @@ export type ParkLaneReason = "no_checkpoint_store" | "no_durable_approval_opt_in
  */
 export declare const AUTO_MODE_ARM_REASONS: readonly ["armed", "no_intent", "no_face", "denied", "resolver_fault"];
 export type AutoModeArmReason = (typeof AUTO_MODE_ARM_REASONS)[number];
+/**
+ * The leg's auto-mode arming FACT as the manifest carries it: `armed ⇔ reason === "armed"`; `deniedSource` (#692 C-d,
+ * additive) is present only beside a STATED `denied` and names which settings plane's ratchet turned auto mode off
+ * ({@link import("./runtime-caps.js").AUTO_MODE_DENY_SOURCES}: `org` / `local` / `settings`) — the resolver's
+ * own word, carried through, never inferred; a `denied` with no source is a resolver that does not track sources,
+ * and a `resolver_fault` never carries one (the screen strips a source it refused).
+ */
+export interface AutoModeArmFact {
+    armed: boolean;
+    reason: AutoModeArmReason;
+    deniedSource?: import("./runtime-caps.js").AutoModeDenySource;
+}
 /**
  * One declared MCP server's materialization result for THIS leg — the per-server connection-state
  * read face on {@link WiringManifest.mcp}. `status` is the connect-time verdict of this leg's
@@ -242,10 +254,7 @@ export interface WiringManifest {
      * round is a deny that says so, and the next round is classified afresh), so there is no session-level
      * breaker face here and nothing about availability enters {@link configFingerprint}.
      */
-    autoMode?: {
-        armed: boolean;
-        reason: AutoModeArmReason;
-    };
+    autoMode?: AutoModeArmFact;
     /**
      * EFFECTIVE half only, and ALWAYS present on an engine-minted effective manifest (the `autoMode`
      * posture: every leg has an answer — an empty array is "this leg declared no servers", absence is
@@ -333,11 +342,9 @@ export interface WiringFacts {
         restore: string;
     };
     /** Effective half only — see {@link WiringManifest.autoMode}; the static half has no leg to arm.
-     *  `armed` must agree with `reason` (`armed ⇔ reason === "armed"`); a contradicting pair is refused. */
-    autoMode?: {
-        armed: boolean;
-        reason: AutoModeArmReason;
-    };
+     *  `armed` must agree with `reason` (`armed ⇔ reason === "armed"`); a contradicting pair is refused, and so
+     *  is a `deniedSource` beside any reason but `denied` or spelled outside its closed set. */
+    autoMode?: AutoModeArmFact;
     /** Effective half only — see {@link WiringManifest.mcp}; the static half materializes nothing.
      *  Copied entry-wise onto the manifest (the caller's array is never aliased). */
     mcp?: readonly WiringManifestMcpEntry[];

package/dist/core/wiring-manifest.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { canonicalize } from "./canonical-json.js";
 import { resolveCheckpointStore } from "./checkpoint-store.js";
 import { isLiveQuestionFace } from "./ask-question.js";
+import { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export const AUTO_MODE_ARM_REASONS = ["armed", "no_intent", "no_face", "denied", "resolver_fault"];
 export function resolveDeclaredDurability(store, storeName) {
     const declared = store?.durability;
@@ -68,10 +69,14 @@ function deriveParkLane(facts) {
     return { capable: true, effective: unresolved ? "unresolved" : false, reasons, ...durability };
 }
 function readAutoModeFact(fact) {
-    if (!AUTO_MODE_ARM_REASONS.includes(fact.reason) || fact.armed !== (fact.reason === "armed")) {
-        throw new Error(`the auto-mode wiring fact is inconsistent (armed=${String(fact.armed)}, reason=${JSON.stringify(fact.reason)}) — armed must hold exactly when reason is "armed", and reason must be one of ${AUTO_MODE_ARM_REASONS.join("|")}`);
+    const { armed, reason, deniedSource } = fact;
+    if (!AUTO_MODE_ARM_REASONS.includes(reason) || armed !== (reason === "armed")) {
+        throw new Error(`the auto-mode wiring fact is inconsistent (armed=${String(armed)}, reason=${JSON.stringify(reason)}) — armed must hold exactly when reason is "armed", and reason must be one of ${AUTO_MODE_ARM_REASONS.join("|")}`);
     }
-    return { armed: fact.armed, reason: fact.reason };
+    if (deniedSource !== undefined && (reason !== "denied" || !isAutoModeDenySource(deniedSource))) {
+        throw new Error(`the auto-mode wiring fact is inconsistent (reason=${JSON.stringify(reason)}, deniedSource=${JSON.stringify(deniedSource)}) — deniedSource may stand only beside reason "denied", as one of ${AUTO_MODE_DENY_SOURCES.join("|")}`);
+    }
+    return { armed, reason, ...(deniedSource !== undefined ? { deniedSource } : {}) };
 }
 export function deriveWiringManifest(facts) {
     if (facts.half === "static" && facts.leg !== undefined) {