@sema-agent/core 7.14.0 → 7.15.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 7.15.0 — 2026-09-11
+
+### Internal — abstraction unification pass over the 7.15.0 merges (no behaviour change; exports +1 type)
+- Added · `ShellGateDoctrine` (`"off" | "classify" | "always"`) is exported from the package root — the one alias behind `TaskSpec.shellGate`, `RiskDescriptor.shellGateDoctrine` and the inherited-gate seat (nine inline spellings retired; the type domain is unchanged).
+- Internal · the shell seat's two provenance bits became one membership set (`shellGatedTools`) read by the park mint, the gate station and the rule-offer factory; the two shell probe seats read the command through one single-read helper and the deny judge's voice through one predicate (`gate:single-mint` row `denyJudgeSpoke`); `tool-defer-gate.ts` joins the runner's machinery stratum. Pins: `test/backlog706-shell-seat-single-spelling.test.ts` (7), the Monitor twin of the durable-descriptor pin in `test/backlog696-…`.
+- Not changed (reviewed, kept) · the sandbox-boundary predicate keeps `toolName.includes("__")` — the separator, not the protocol table's ownership, is the containment fact (a `__`-bearing name mounted after the scan-time reservation is unowned yet uncontained); the containment abstraction (mount-time execution provenance) is ticketed.
+
+### Narrowing — the read boundary is judged on every shell call under every `shellGate` doctrine (#696; P1 design; CC 2.1.250 form: the read boundary is a path-layer property judged on every Bash call, the permission mode disposes only of the residual; sema keeps its deny table — the registered divergence — and its opt-out operand scan; @server @cli @test)
+- **Before.** The read boundary (built-in deny table + roots containment) rode the `shellGate` doctrine's probe: `shellGate` absent / `"off"` mounted NO probe on Bash, so `cat .claude/settings.json` / `cat ~/.ssh/id_rsa` ran with zero asks and the bytes reached the session record while `Read` of the same path refused typed. Two read faces of one process gave two answers about one path, and the shell face's judgment hung on a switch unrelated to the boundary. Three rules: the structured faces always judge; the shell face judges only under `"classify"`; `"always"` absorbs the question into its blanket ask.
+- **After (two rules).** ① Every read face judges the read boundary — structured faces refuse (`read_path_denied`), the shell face gets a MANDATED ask (neither a stored allow rule nor the read-only arm retires it; a person's yes releases the read). ② `shellGate` disposes only of the RESIDUAL shell risk: `"off"` (the default) installs no shape classifier — writes, egress and unknown commands go to the ordinary policy/hook chain; `"classify"` auto-allows a provably read-only in-boundary command and asks for everything else; `"always"` asks for every command. Mechanically: the shell seat (`prepare-hands-readface.ts`, `installShellSeat`) puts Bash and Monitor on the `"maybe"` tier with a probe under EVERY doctrine — `bashReadBoundaryProbe` (new named seat, `src/tools/fs/fs-bash.ts`; export +1) under `"off"`, `bashReversibilityProbe` (= boundary ∘ shape classifier) under `"classify"`; under `"always"` the tier is the mandate and no probe runs. The boundary mandate is one shared function on both seats (`readBoundaryMandate`: deny-listed operand / recursive walk under the deny judge / out-of-root operand). A read face's refusal is ATTRIBUTED (`attributeRefusal`): the face reports one sentence, so the same face is asked again with the deny judge removed and containment opened, and once more with no boundary — a changed or lifted sentence means the boundary objected (mandated), an unchanged sentence that no boundary lifts means the grammar refused (the doctrine's residual), anything else means the walk could not read an operand (a plain fail-closed ask). A loop body reading a deny-listed in-root file — or `cd`-ing into a deny-listed directory — is mandated on both seats (under `"classify"` it was an un-mandated, rule-clearable ask), and a body that also carries a glob does not lose the declared objection. A `~`-rooted operand stays UNRESOLVABLE to the walk (no home is wired into the shell read boundary — deliberately: `NodeExecutionEnv.homeDir` is the host's `os.homedir()` even under a `shellEnv.HOME` override, so resolving `~` against it would vouch a read of a directory the shell never expands to; the adapter's declaration is the contract to fix first, P1 candidate below): the seat answers a plain ask for it, exactly as the classify seat always did — see the next paragraph for what the gate then does with that ask.
+- **BREAKING (behaviour narrowing, one lane).** Under `shellGate` absent / `"off"`, a Bash or Monitor command that reads a deny-listed path (`cat .claude/settings.json`, `cat ~/.ssh/id_rsa`, `head`/`sed -n`/`wc`/`grep` of one), a path outside the session's roots, or a RECURSIVE form whose walk reaches into the root (`grep -r … .`, `find .`, `ls -R`, `du .` — the walk reads the deny-listed files inside the root; the same mandated ask `"classify"` already gave, with cause `shell.recursive_read_unbounded`) goes from ZERO asks to ONE mandated ask (rule-clearable: no; auto-mode classifier: no — the ask is structural). Affected lanes: `permissionMode: "bypassPermissions"` through the shell (server's `shellGateForMode` writes `"off"` for that mode only) and a direct integration that states no `permissionMode` / no `shellGate`. NOT affected: the shell's ordinary lanes — server's `shellGateForMode` writes `"classify"` for every other mode and the cli always passes a mode, so those lanes already asked for exactly these commands. An in-root non-listed read, a no-operand command (`echo`, `pwd`) and every non-reader (`rm`, `curl`, `git`, `npm`) keep zero asks under `"off"`.
+- BREAKING (consequence on the same lane, disclosed, not fixed here — ticket below) · under `shellGate` absent / `"off"`, Bash and Monitor now sit on the `"maybe"` tier, and `gate-lanes.ts` derives a park's safety axis from the STATIC tier: a POLICY or hook ask on Bash (`npm run build` under a `defaultAction:"ask"` policy) that the boundary seat vouched now parks as the non-budgetable `irreversible_ask` kind with `safety.irreversible: true` and the `shell` axis on its descriptor, where it parked as a budgetable `human` ask before (`"classify"` has always parked it this way). A budget resolver auto-approves fewer asks on this lane. The fix (the safety axis read off THIS call's seat judgment rather than the static tier) touches `gate-lanes.ts` and the classify lane and is its own ticket.
+- BREAKING · `RiskDescriptor.shellGateDoctrine` widens from `"classify" | "always"` to the whole `TaskSpec.shellGate` vocabulary `"off" | "classify" | "always"` (a shell-gated durable park under the `"off"` doctrine now persists `"off"` where it used to omit the key); a consumer that pinned the two-member set re-pins.
+- Wire-observable (additive, per-key rows in `docs/wire-consumption/unreleased-696.md`): under `"off"` the tool roster's Bash/Monitor rows carry `irreversibility: "maybe"` + `reversibilityProbe: true`; a Bash/Monitor ask under `"off"` carries `riskAxes.irreversible: true` (the seat tier's reading, as under `"classify"`), grades as the `shell` axis (severity 3, never `irreversible` 4), attributes `tightenedBy: "shell_gate"` / deny `source: "shellGate"`, and its card's `ruleOffersAbsence` reads `"mandated"` / `"shadowed"`.
+- Disclosure text · the `shell-gate-off` config note (phase `config`, classification `shell-gate-off`) now reads "the read boundary is still judged on every command (a deny-listed or out-of-root read asks; the ask is mandated), but no residual shell-risk classifier is installed …" — the previous "no shell safety-axis fold applies" would be false.
+- **Not changed (measured, disclosed — and the headline example's `~` spelling is IN this list).** (i) An operand the walk cannot RESOLVE or DECIDE — `cat ~/.ssh/id_rsa` with no home declared, `cat .s?/x`, `cat *.log` (an unexpanded glob) — gets a plain, un-mandated ask from BOTH probe seats, and the gate's read-only shell arm (7.11.0, a reader of command NAMES: `cat` is read-only) then CLEARS that ask: measured end-to-end at the base commit under `"classify"` and after this change under both doctrines, ZERO asks, the command runs. The `~` spelling of the ticket's own example therefore still runs unasked; the absolute spelling (`cat /Users/<u>/.ssh/id_rsa`) is resolved, declared and mandated. This is baseline behaviour (RB-474's "undecided ⇒ ask" and the `~` fail-closed have been cleared by that arm since 7.11.0), pinned here as a tripwire; the candidate fix — the unread arms joining the mandated family under the `probe_unanswered` doctrine ("the boundary is unknown, which no standing yes may stand in for") — makes every glob read ask un-clearably on the shell's ordinary lanes and is a ruling, not this car's. (ii) The boundary seat's reach is the read faces' reach and nothing wider: a read — deny-listed OR out-of-root — hidden in a shape the faces refuse whole (`cat .claude/settings.json | base64`, `cat /etc/passwd | base64` — an unlisted segment; `echo $(cat x)` — a substitution; `cat $DIR/x` — a variable operand; `env cat ~/.ssh/id_rsa` — a launcher; `/bin/cat /etc/passwd` — a path-prefixed program) is not seen under `"off"` and runs with zero asks; `"classify"` asks for every one of those shapes (as before — mandated where its text-level containment gate recognizes the reader, `env cat` / `/bin/cat` / the piped out-of-root read). The same residual reaches TWO shapes that are plain listed readers: `tail -f <path>` (follow mode) and a special file (`cat /proc/1/environ`) — the compound face refuses them BEFORE it walks their operands, so no structural finding exists for the boundary seat to read: `tail -f /etc/passwd` and `tail -f .claude/settings.json` run with zero asks under `"off"` (Monitor's own idiom is `tail -f`), while `"classify"` mandates them through the text gate. Fix: the compound face keeps walking the listed readers' operands on an availability / special-file refusal and surfaces `readDenied` / `outOfRootRead` beside the `reason` (a scan-form change in `bash-readonly-classifier.ts`; `reason` and the classify verdict unchanged; the second form of #714 — a judge refusing before it walks the operands leaves no finding for a downstream seat to read). The boundary seat deliberately does NOT consult that text-level gate (`classifyOutOfRootReadGate`): it re-scans the command under conservative assumptions that may ADD a mandate to an existing ask but would ORIGINATE false asks on non-readers (`env rm /tmp/cache`, `env echo /etc/passwd`, `pushd . && echo hello` — measured, all zero asks under `"off"`). Closing the in-shape gap is a classifier scan-form change (ticket #663, the two read-only classifiers' unification). `run_in_background` is not the boundary's question (WHEN, not WHERE): a backgrounded in-root read runs under `"off"`; a backgrounded deny-listed read is mandated under both doctrines. The containment judgment is LEXICAL against the CANONICAL roots (the classifier is pure, no I/O — its standing contract): an absolute operand spelled through a symlink alias of the root (macOS `/var/…` for `/private/var/…`, `/tmp/…` for `/private/tmp/…`) reads as out-of-root and asks (mandated) — pre-existing under `"classify"`, now reachable in the `"off"` lane too; two Monitor test fixtures that watched a `tail -f /var/folders/…` path under a canonical root were re-spelled through `realpathSync` (the convention the read-face fixtures already follow). A relative operand resolves against the live tracked cwd and is unaffected.
+- **Review rounds (adversarial, three).** Round 1 — five findings, all reproduced: three same-root (the boundary-only seat consumed the text-level containment gate, which mis-resolved a loop body's `cd`, originated asks on launchers, and let a `cd`-dependent refusal read as grammar) → adopted as one change (structural members + answer-comparison attribution); one ruled out of this car (the adapter's `homeDir` ignores a `shellEnv.HOME` override — the seat therefore takes no home; #712); one ledgered (policy asks park as `irreversible_ask` under `"off"` — static-tier safety axis; #713). Round 2 — two findings: the attribution's remaining blind spot (a deny-listed read masked by a glob in the same loop body; an unmodelled `cd -` after an out-of-root read) → adopted (attribute by the face's sentence, not by presence); the early-refusal residual (`tail -f`, `/proc/…`) → disclosed, #714 second form. Round 3 (narrow, the attribution alone) — approve, no findings.
+- Pins: `test/backlog696-read-boundary-any-doctrine.test.ts` (28 — on the real load path Runner prepare → NodeExecutionEnv → gate: G-a/G-b default-doctrine mandated asks with a clean record and `ruleOffersAbsence` `"shadowed"` under a covering rule (G-e), G-c/G-d/`touch` zero asks, tier-off and open-face controls (G-f), `"always"` asks (G-g), `"classify"` ≡ default on G-a/b/c/e (G-h), Monitor pair, the disclosure text, an unattended default-doctrine run parking durably with `shellGateDoctrine: "off"` on the persisted descriptor; the boundary seat's three answers at the unit face incl. the poll-loop attribution, the deny-plus-glob body, `cd -`, the `~`-without-home form and the two early-refusal tripwires). `test/backlog685-agent-config-read-deny.test.ts` "declared scope" pin flipped (off ⇒ one mandated ask, rule does not clear, control zero asks). Mutations (10, each red ≥1 in the pin set): restore the classify-only probe guard; read the walk's unresolvable refusal as a shape refusal; attribute a refusal by presence alone instead of by the face's sentence; let the text-level containment gate originate asks on the boundary seat; vouch the undecided arm; drop the declared mandate; un-attribute the poll-loop deny; skip the Monitor seat; restore the `!== "off"` doctrine filter on the descriptor.
+
+### Behaviour — deferred tool disclosure is one threshold gate over the engine's candidates; the caller's `deferTools` list stays literal (#695; ruling 「效果与 CC 一致;更差则对齐」; CC 2.1.250 `eDn`/`XD` form for the gate and its measure; @server @cli @test)
+- **Before.** Every remote-protocol tool (MCP and A2A), every `ToolSpec.defer: true` and every self-declared built-in (the shared-memory pair) was deferred UNCONDITIONALLY — on a two-tool MCP server the first request already carried placeholders plus an injected `ToolSearch`. `deferMode: "auto"` was a second, additive arm: it swept the caller's undeclared tools in when the whole inline face (pinned schemas included) exceeded 10% of the context window. Measured on three roster shapes (264 live runs, deepseek-v4-flash), the unconditional arm cost 16–20% more total input than inlining the same tools; CC keeps the identical mechanism behind a 10% threshold measured on the deferrable set.
+- **After (two rules).** ① The caller's list is literal: `TaskSpec.deferTools` names defer on every request and are not measured; `alwaysLoad` (`ToolSpec.alwaysLoad`, `TaskSpec.alwaysLoadTools`, the server's `_meta["anthropic/alwaysLoad"]`) pins inline and is judged first. ② The engine's CANDIDATES — `ToolSpec.defer: true`, every remote-protocol name, self-declared built-ins, and under `deferMode: "auto"` every caller spec — sit behind ONE gate, all or nothing: deferred iff their inlined size (name + description + schema, chars ÷ 3) reaches `floor(contextWindow × 10%)` tokens; below that they ship inline in full and no `ToolSearch` is mounted. Only the candidates are measured — the caller's list, pins and non-candidates weigh nothing (CC `XD()` filter-then-count). `"auto"` is a candidate-WIDENING knob, not a second gate; engine built-ins the deployment did not name are candidates under no setting; a `deferMode` outside `"auto"`/absent refuses `config.defer_mode_invalid` (loud, no fallback). The comparison is `≥` (CC `p >= E`); a zero window is a zero threshold.
+- BREAKING · **the default first request changes shape**: remote-protocol tools, `defer: true` tools and the shared-memory pair ship INLINE (full schema, no `ToolSearch`) whenever their combined inlined size is under 10% of the model's context window — previously they were placeholders on every request. A consumer that pinned "an MCP tool is always a placeholder" / "`ToolSearch` is present whenever an MCP server is configured" re-pins on the threshold (or names the tool in `deferTools`, which is unchanged). `deferMode: "auto"` deployments: the trip measure is now the candidate set only — a face heavy in PINNED or `deferTools` bytes no longer trips the gate.
+- **Rules 8 → 2.** Gone: the four unconditional sources as separate rules, the auto candidate sweep as an extra arm, the inline-face measure, the `window > 0` guard, the strict `>` trip. Left: the literal list (①) and the one gate (②). The gate lives in its own module, `src/core/runner/tool-defer-gate.ts` (`deferralGate` → `{ explicit, gated, gatedChars, thresholdChars, open }`, `classifyDeferred`, `DEFER_THRESHOLD_FRACTION`, `DEFER_MODE_INVALID_CODE`); `tool-disclosure.ts` keeps the placeholder / `ToolSearch` mechanics.
+- **Estimator note (honest reading).** The engine measures chars ÷ 3 (the mid-stream budget constant), not a tokenizer: on the measured `std` roster the 12 declared tools read 11 595 chars ≈ 3 865 estimated tokens against a 3 276-token threshold (32k window) and the gate OPENS, where the live API count of the same tools (2 842 tokens) would keep it shut; `big` (64k) and `fat` (128k) windows stay shut either way. CC's own char fallback (2.5 chars/token) would open too. Pinned as measured in `test/backlog695-defer-gate-alignment.test.ts`.
+- **Review round 1 (adversarial; one REAL finding adopted, one confirmed-and-already-in-hand).** ① The materialized MCP roster also carries the engine's own global resource helpers (`ListMcpResourcesTool` / `ReadMcpResourceTool` / `ReadMcpResourceDirTool`); read as "every name on `mcp.tools`" they entered the remote-candidate set — measured, and deferred when the gate opened (before this change they were deferred unconditionally with the rest). Remote now means a name the protocol table minted (`protocolOf(name)` — `mcp__…` / `a2a__…`), so the helpers are what they are: engine built-ins, never candidates, never measured (pinned on a resource-capable stdio server, gate shut and gate open). ② Ten placeholder-mechanics pins outside the derived set relied on unconditional deferral — re-pinned with the ballast candidate (below).
+- **Review round 2 (adversarial; two REAL test-precondition findings adopted).** ① The registry-exhaustion pin (CC207 P1-4, `tool-disclosure-integration.test.ts`) had gained the ballast as a third placeholder the script never activated, so "every deferred tool activated" was no longer reached — the two tools now defer through the literal `deferTools` list, exhaustion is reached in two selects. ② The RB-414 stale-schema pin (`rb422-deferred-directcall-hardening.test.ts`) had fallen off the placeholder path (a one-tool remote roster sits under the threshold, so the direct-call resolver under test was never exercised) — the remote tool is now on the literal list and its placeholder is asserted before the refresh and immediately before the direct call. Round 2 confirmed the round-1 helper-provenance fix and the gate invariants.
+- **Fail-open reverse check — what still defers below the threshold?** Only the caller's own `deferTools` list (by design: an intentional deferral is not a size question; the shell relies on it to keep `Workflow` out of the model's view). Nothing else: no candidate, no built-in, no undeclared tool.
+- Pins: `test/backlog695-defer-gate-alignment.test.ts` (the three-shape roster: default gate readings per shape, auto widening per shape, auto below its widened threshold, the face-wide-measure mutation guard; real load path with a stdio MCP server: below-threshold inline + no ToolSearch, `deferTools` literal beside an inline sibling, small-window placeholders + `alwaysLoadTools` pin); `test/tool-disclosure.test.ts` (sources, literal list disjoint from candidates, auto widening + measure, candidate-only measure, `≥` boundary both sides, bad value, zero window, invariants, RB-400-a); `test/runner-support-coverage.test.ts`; `test/rb422-deferred-directcall-hardening.test.ts` DD-4 (a pin's bytes never open the gate; small-window control); `test/public-knob-liveness.test.ts` (auto through the Runner). Re-pinned to the gate (small window opens it): `mcp.test.ts` RB-400-a e2e, `shared-memory-mount.test.ts`, `memory-tools-mount.test.ts`, `prepare-defer-classify-transcript.test.ts` (plus the roomy-window inline control), `tool-materialize-static.test.ts`, `policy-name-audit.test.ts`, `deferred-materialize-constrained-decoding.test.ts`, `backlog126-definetool-axis-carry.test.ts`.
+
 ## 7.14.0 — 2026-09-11
 
 ### Narrowing — the agent's own key-bearing settings files are refused on the structured read faces by default (#685; P0; ruling B: the session record stays verbatim, the fix is on the READ face; sema form — CC 2.1.250 has no read-face deny table, the table itself is the registered divergence; @server @cli @test)

package/dist/core/ask-origin.d.ts

@@ -234,8 +234,8 @@ export declare function classifierMayAnswer(origin: AskOrigin): boolean;
  *  · `egress` — the tool's own external-write mark, judged next: it is the tool's declaration even
  *    when the coarse doctrine also installed a shell tier on the same seat;
  *  · `shellGated` + tier `"always"` — the operator's per-call confirmation doctrine
- *    (`"operator_always"`); the classify doctrine installs `"maybe"`, and THOSE asks stay the rule
- *    lane's home turf (`undefined`) — that is the don't-ask-again main case, and the per-call member
+ *    (`"operator_always"`); the shell seat installs `"maybe"` under the off and classify doctrines,
+ *    and THOSE asks stay the rule lane's home turf (`undefined`) — that is the don't-ask-again main case, and the per-call member
  *    above is deliberately the ONLY thing that carves a mandate out of it;
  *  · a tool's OWN `"always"`/`"maybe"` irreversibility tier without the doctrine (`"tool_marks"`).
  *

package/dist/core/checkpoint-store.d.ts

@@ -8,7 +8,7 @@ import type { RepairBundle } from "../agents/repair-loop.js";
 import type { WorkspaceHandle } from "./remote-env.js";
 import type { ConsolidationNote } from "./runner/memory-consolidation.js";
 import type { SessionPermissionRules } from "./session-policy-store.js";
-import type { NestedUsageAccum, TaskResult } from "./types.js";
+import type { NestedUsageAccum, ShellGateDoctrine, TaskResult } from "./types.js";
 import type { ActiveWorktreeSession } from "../internal/harness-types.js";
 /**
  * design/45 — the **durable-checkpoint** primitive: cross-process / resumable `suspend`/`resume`.
@@ -120,10 +120,9 @@ export interface RiskDescriptor {
     /** ToolEmu-style severity tier 1..5 (5 = most severe). The inbox sorts DESC by this. Deterministic — the
      *  pure {@link riskSeverity} of {@link axes}. The ORDERING is what matters (the inbox's triage key). */
     severity: 1 | 2 | 3 | 4 | 5;
-    /** Which safety axes tripped — for `irreversible_ask`, derived from the D-2 {@link SafetyAxis} (+ the
-     *  shell-gate). `shell` marks a coarse shellGate tighten (a bash command gated only because the deployment
-     *  set `shellGate`, with NO explicit per-tool egress/irreversible mark). Empty `{}` for a plain budgetable
-     *  `human` ask. Self-contained so the inbox needn't cross-ref `safetyAxis`. */
+    /** Which safety axes tripped — for `irreversible_ask`, derived from the D-2 {@link SafetyAxis} (+ the shell
+     *  seat). `shell` marks a tighten by the engine's shell seat (read-boundary judge and/or `shellGate` doctrine,
+     *  NO explicit per-tool egress/irreversible mark). Empty `{}` for a plain budgetable `human` ask. */
     axes: {
         egress?: boolean;
         irreversible?: boolean;
@@ -131,12 +130,12 @@ export interface RiskDescriptor {
     };
     /** The tool whose call is gated (mirrors the gate's `toolName`). */
     toolName: string;
-    /** Ruled 2026-08-05 (forensics): the run's resolved shellGate doctrine, present ONLY when this ask
-     *  was minted through the shell gate (coarse `always`, or a `classify` probe that declined to
-     *  auto-allow). Absent for per-tool safety-axis / plain policy asks. Answers "which doctrine was
-     *  live when this gate fired" from the persisted row alone — three artifact layers could not
-     *  answer that in the field. */
-    shellGateDoctrine?: "classify" | "always";
+    /** The run's resolved shellGate doctrine, present ONLY when this ask was minted through the engine's shell
+     *  seat (coarse `always`; a `classify` probe that declined to auto-allow; the read-boundary judge asking under
+     *  `off` — the boundary is judged under every doctrine, so the vocabulary is `TaskSpec.shellGate`'s whole).
+     *  Absent for per-tool safety-axis / plain policy asks. Answers "which doctrine was live when this gate
+     *  fired" from the persisted row alone — three artifact layers could not answer that in the field. */
+    shellGateDoctrine?: ShellGateDoctrine;
     /** A REDACTED, length-capped ONE-LINE summary of the call (the command for a shell gate; a brief key-arg
      *  digest otherwise) for the inbox preview. NEUTRALIZED via
      *  {@link import("./permission-rule-model.js").renderUntrustedCommandText} + length-capped (it is
@@ -406,11 +405,11 @@ export declare function buildRiskDescriptor(input: {
     args: unknown;
     /** The D-2 {@link SafetyAxis} threaded to the mint (egress/irreversible), or `undefined` for a plain ask. */
     safety?: SafetyAxis;
-    /** True ONLY when this is a `bash` call gated coarsely by `shellGate` (no explicit per-tool egress/irreversible
-     *  mark) — drives the `shell` axis + severity-3 coarse grade. */
+    /** True ONLY when this is a shell call whose tier is the engine's shell seat's (read-boundary judge and/or
+     *  `shellGate` doctrine, no explicit per-tool egress/irreversible mark) — drives the `shell` axis + severity 3. */
     shellGated?: boolean;
     /** The resolved doctrine to persist when `shellGated` (see {@link RiskDescriptor.shellGateDoctrine}). */
-    shellGateDoctrine?: "classify" | "always";
+    shellGateDoctrine?: ShellGateDoctrine;
     /** #144: the matched-but-outranked persisted rule to persist (see {@link RiskDescriptor.shadowedRule}). */
     shadowedRule?: string;
     /** backlog #239: the reversibility probe's cause for not clearing this call (see
@@ -1110,7 +1109,7 @@ export interface CheckpointState {
             rev: number;
             rules: SessionPermissionRules;
         }>;
-        shellGate?: "off" | "always" | "classify";
+        shellGate?: ShellGateDoctrine;
         /** The chain's AUTO-MODE INTENT at suspend (data half, same law as `shellGate`): `true` when the
          *  suspended leg was an auto-mode task — its own seat, the bit its live chain carried, or the bit
          *  an earlier suspend of the same chain recorded (carried forward across a re-suspend). A resume

package/dist/core/hooks.d.ts

@@ -1326,9 +1326,10 @@ export interface ToolGateInput {
      */
     onHookError?: (err: unknown) => void;
     /**
-     * design/134 R5: true when this tool's `irreversibility` tier was installed by the COARSE
-     * `TaskSpec.shellGate` doctrine (design/80 D-E `shellGatedBash`/`shellGatedMonitor`), not an explicit
-     * per-tool mark — attributes a tighten-deny to `source:"shellGate"` instead of `"safety"`.
+     * design/134 R5: true when this tool's `irreversibility` tier was installed by the ENGINE'S SHELL SEAT
+     * (the read-boundary judge under every doctrine, plus the `TaskSpec.shellGate` doctrine's residual-risk
+     * classifier — design/80 D-E; the seat's `shellGatedTools` membership), not an explicit per-tool mark —
+     * attributes a tighten-deny to `source:"shellGate"` instead of `"safety"`.
      */
     shellGated?: boolean;
     /**

package/dist/core/runner/contracts.d.ts

@@ -43,7 +43,7 @@ import type { SystemInjectionPriority, TaskNotificationPayload } from "../task-n
 import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
-import type { AgentDefinition, Brain, CompactOutcome, ModelRoles, NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
+import type { AgentDefinition, Brain, CompactOutcome, ModelRoles, NestedUsageAccum, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
 import type { WiringManifest } from "../wiring-manifest.js";
 import type { ActiveSkillFrame } from "./active-skill-scope.js";
 import type { BudgetAxis } from "./assemble-result.js";
@@ -1189,7 +1189,7 @@ export interface InheritedGate {
         rules: SessionPermissionRules;
     }>;
     /** The chain's effective shell-gate doctrine — the child folds it by max-rank with its own spec. */
-    shellGate?: "off" | "always" | "classify";
+    shellGate?: ShellGateDoctrine;
     /**
      * The chain's AUTO-MODE INTENT (`TaskSpec.autoModeRequested`, session-wide like a permission mode):
      * emitted when the spawning task carried the intent itself or inherited it, so an engine-spawned

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -245,7 +245,9 @@ export declare function createRuleOffersOf(cfg: {
     irreversibilityTier: {
         get(name: string): Parameters<typeof persistedRuleMandateOf>[0]["irreversibility"];
     };
-    shellGatedBash: boolean;
+    shellGatedTools: {
+        has(name: string): boolean;
+    };
     taskRoot: string | undefined;
     /** The live tracked-cwd ref (read per call — the relative-cd resolution base, adversarial-review P1/r3). */
     cwdRef: {

package/dist/core/runner/permission-rule-lanes.js

@@ -176,7 +176,7 @@ export function createRuleOffersOf(cfg) {
         if (persistedRuleMandateOf({
             egress: cfg.egressTools.has(toolName),
             irreversibility: cfg.irreversibilityTier.get(toolName),
-            shellGated: cfg.shellGatedBash,
+            shellGated: cfg.shellGatedTools.has(toolName),
             probeMandated: ask?.probeMandated === true,
         }) !== undefined) {
             return { ruleOffersAbsence: "mandated" };

package/dist/core/runner/prepare-defer-classify.d.ts

@@ -28,7 +28,7 @@ export interface PrepareDeferClassifyInput {
     fullShellReachable: boolean;
     /** borrowed-readonly — the resolved prompt profile (`classic` swaps in `descriptionClassic`). */
     promptProfile: "simple" | "classic";
-    /** borrowed-readonly — the resolved model (the classifier's constant-defer arm reads its shape). */
+    /** borrowed-readonly — the resolved model (the deferral gate's threshold reads its context window). */
     model: Model;
     /** borrowed-readonly — the materialized MCP roster; only `tools` is read (protocol names for the
      *  remote-roster arm; `mcpAlwaysLoad` self-declarations, losing to an explicit operator defer). */

package/dist/core/runner/prepare-defer-classify.js

@@ -3,10 +3,12 @@ import { FULL_SHELL_CONTRACT_ID } from "../../tools/fs/index.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
-import { TOOL_SEARCH_NAME, classifyDeferred } from "./tool-disclosure.js";
+import { protocolOf } from "../protocol-table.js";
+import { classifyDeferred } from "./tool-defer-gate.js";
+import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
 import { RosterBuilder } from "../tool-roster.js";
-function explicitlyDeferredMemoryTrio(mounted, roster, deferNames) {
-    return mounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => roster.some((t) => t.name === n) && (deferNames ?? []).includes(n)) : [];
+function explicitlyDeferredMemoryTrio(mounted, roster, callerDeferNames) {
+    return mounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => roster.some((t) => t.name === n) && (callerDeferNames ?? []).includes(n)) : [];
 }
 function memoryGroupRetractionSet(builtinDeferPairNames, engineTrioInPlay) {
     return new Set([...builtinDeferPairNames, ...(engineTrioInPlay ? MEMORY_ENGINE_TOOL_NAMES : [])]);
@@ -39,29 +41,29 @@ export function prepareDeferClassify(input) {
                 roster.replaceAt(i, { ...t, description: t.descriptionClassic });
         }
     }
-    const userToolNames = (spec.tools ?? []).map((t) => t.name);
-    const protocolToolNames = [...mcp.tools.map((t) => t.name), ...a2a.tools.map((t) => t.name)];
+    const protocolToolNames = [...mcp.tools, ...a2a.tools].filter((t) => protocolOf(t.name) !== undefined).map((t) => t.name);
     const mcpAlwaysLoadNames = mcp.tools
         .filter((t) => t.mcpAlwaysLoad === true && !(toolFaceSnapshot.defer ?? []).includes(t.name))
         .map((t) => t.name);
     const classifyDeferredOverFace = (face, builtinDeferNames) => {
+        const mounted = new Set(face.map((t) => t.name));
         const deferredSet = classifyDeferred({
             specs: spec.tools ?? [],
             protocolToolNames,
-            fullTools: face.filter((t) => userToolNames.includes(t.name) || protocolToolNames.includes(t.name)),
+            fullTools: face,
             deferMode: deps.deferMode,
             model,
-            deferNames: [...(toolFaceSnapshot.defer ?? []), ...builtinDeferNames].filter((n) => face.some((t) => t.name === n)),
+            callerDeferNames: (toolFaceSnapshot.defer ?? []).filter((n) => mounted.has(n)),
+            builtinDeferNames: builtinDeferNames.filter((n) => mounted.has(n)),
             alwaysLoadNames: [
                 ASK_USER_QUESTION_TOOL_NAME,
                 ...(toolFaceSnapshot.alwaysLoad ?? []),
                 ...mcpAlwaysLoadNames,
             ],
         });
-        for (const n of [...deferredSet]) {
-            if (!face.some((t) => t.name === n))
+        for (const n of [...deferredSet])
+            if (!mounted.has(n))
                 deferredSet.delete(n);
-        }
         return deferredSet;
     };
     const sharedMemoryPair = sharedMemoryPairMounted ? SHARED_MEMORY_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n)) : [];

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -130,10 +130,9 @@ export interface PrepareGateStationsInput {
     abortController: {
         readonly signal: AbortSignal;
     };
-    /** borrowed-readonly — whether Bash is coarsely shell-gated (the gate's `shellGated` attribution). */
-    shellGatedBash: boolean;
-    /** borrowed-readonly — whether Monitor is coarsely shell-gated (same). */
-    shellGatedMonitor: boolean;
+    /** borrowed-readonly — the shell-seat provenance set: the shell-running tools whose tier is the engine's shell seat's, not a
+     *  deployment mark (the gate's `shellGated` attribution is the gated tool's membership). */
+    shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the auto-mode decider, or undefined (the classifier lane the gate routes a surviving ask through). */
     autoModeDecider: AutoModeDecider | undefined;
     /** borrowed-readonly — the auto-mode denial tracker, or undefined (handed to the gate beside the decider). */

package/dist/core/runner/prepare-gate-stations.js

@@ -42,7 +42,7 @@ function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
     if (askLane !== undefined && parkAsk !== undefined) {
         const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
         const { resolveContentAsk, suspendAsk } = parkAsk;
@@ -119,7 +119,7 @@ export function prepareGateStations(input) {
                         abortSignal: abortController.signal,
                         ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
                         onHookError: notifyHookError,
-                        shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
+                        shellGated: shellGatedTools.has(e.toolName),
                         ...(autoModeDecider ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}) } } : {}),
                         onHeadlessDenialLimit: stopForDenialLimit,
                         onAskUnresolvable: (info) => deliverEngineNotice(deps.onNotice, askUnresolvableNotice({ sessionId, ...info })),

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -1,6 +1,6 @@
 import { type BeforeWriteHook, type CwdRef, type ReadDenyMatcher, type ReadFace } from "../../tools/fs/index.js";
 import { type ReadFileState } from "../../tools/fs/safety.js";
-import type { RunnerDeps, TaskSpec } from "../types.js";
+import type { RunnerDeps, ShellGateDoctrine, TaskSpec } from "../types.js";
 import type { Model } from "../../internal/llm.js";
 import type { AgentTool, ExecutionEnv, WorkspaceState } from "../../internal/harness.js";
 import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
@@ -136,7 +136,7 @@ export interface PrepareHandsReadFaceInput {
     fullShellReachable: boolean;
     /** borrowed-readonly — the MAX-RANK fold of spec.shellGate with the inherited chain's doctrine
      *  (computed in the driver's inherited-gate block); the shellGate fold's doctrine value. */
-    effectiveShellGate: "off" | "classify" | "always";
+    effectiveShellGate: ShellGateDoctrine;
     /** borrowed-readonly — B-1's frozen task-start face snapshot; only `.exclude` is read here (the
      *  Monitor-mount honesty bit for the gh rate-limit hint, #181-F6). */
     toolFaceSnapshot: ToolFaceSnapshot;
@@ -282,12 +282,12 @@ export interface PrepareHandsReadFaceResult {
     /** owned — design/199 件B: the ONE compiled deny judge per prepare (built-ins ∪ deployment ∪
      *  task additions). Undefined ⇔ hands-less (its consumers only exist with hands). */
     readDenyMatcher: ReadDenyMatcher | undefined;
-    /** write-back — "the shellGate doctrine is the SOLE POSITIVE source of Bash's tier" provenance
-     *  bit; the driver's `let` (risk grading + the persisted-rule mandate boundary read it
-     *  call-time). Written ONLY by this phase; false when the fold did not run. */
-    shellGatedBash: boolean;
-    /** write-back — the Monitor twin of the bit above. */
-    shellGatedMonitor: boolean;
+    /** owned — the shell-seat PROVENANCE set: the shell-running tools whose tier the engine's shell seat (read
+     *  boundary + shellGate doctrine) is the SOLE POSITIVE source of — no explicit deployment mark on that name.
+     *  The one seat every consumer reads (risk grading, the gate's tighten attribution, the persisted-rule mandate
+     *  boundary): `shellGatedTools.has(toolName)`. Minted here, never grown afterwards; empty when the seat fold
+     *  did not run (no real writable shell). */
+    shellGatedTools: ReadonlySet<string>;
     /** owned (design/380 rescan C4) — the ENV-HAND tool names, minted AT THE MOUNT: every tool this
      *  phase mounted over the ExecutionEnv (the fs/bash band), later grown by the driver's own env
      *  mounts (Monitor, the worktree pair — the SAME Set identity, mutated at those mount sites).

package/dist/core/runner/prepare-hands-readface.js

@@ -2,7 +2,7 @@ import { emitTrace } from "../trace.js";
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasBackgroundShell } from "../background-shell.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { bashReversibilityProbe, compileReadDeny, createHandsToolkit, deploymentReadFaceClampNotice, pdfModelCapabilitiesOf, resolveReadDenyBuiltins, inheritSessionReadFileState, resolveReadFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
+import { bashReadBoundaryProbe, bashReversibilityProbe, compileReadDeny, createHandsToolkit, deploymentReadFaceClampNotice, pdfModelCapabilitiesOf, resolveReadDenyBuiltins, inheritSessionReadFileState, resolveReadFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
 import { resolveKey, sha256 } from "../../tools/fs/safety.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
@@ -117,8 +117,7 @@ export function resolveHandsLessReadFace(input) {
         attachmentRootCanonical: undefined,
         readDenyMatcher: undefined,
         envHandToolNames: new Set(),
-        shellGatedBash: false,
-        shellGatedMonitor: false,
+        shellGatedTools: new Set(),
         sealReadStateSeat: undefined,
     };
 }
@@ -140,8 +139,7 @@ export async function prepareHandsMount(input) {
     let resolvedReadFace;
     let readDenyAdditionsNormalized = [];
     let handsLessResolvedFace;
-    let shellGatedBash = false;
-    let shellGatedMonitor = false;
+    const shellGatedTools = new Set();
     const additionalRootsCanonical = [];
     const additionalReadRootsCanonical = [];
     let attachmentRootCanonical;
@@ -345,34 +343,35 @@ export async function prepareHandsMount(input) {
         }
         roster.mountAll(band.map((t) => (envHandToolNames.add(t.name), firstPartyOffload(t))), { source: "builtin", mountedBy: "hands" });
         const shellGate = effectiveShellGate;
-        if (shellGate === "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
-            deps.onError?.(new Error(`shell gate doctrine is "off" while a real writable shell (Bash) is mounted — no shell safety-axis ` +
-                `fold applies to this run (commands are adjudicated by the ordinary policy/hook chain only). ` +
-                `Set spec.shellGate to "classify" or "always" if this deployment expects doctrine-gated shell behavior.`), { phase: "config", sessionId, classification: "shell-gate-off" });
-        }
-        if (shellGate !== "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
-            const bashTierBefore = irreversibilityTier.get("Bash");
-            shellGatedBash = !egressTools.has("Bash") && bashTierBefore !== "always" && bashTierBefore !== "maybe";
-            const bashEffectiveTier = shellGate === "always" || bashTierBefore === "always" ? "always" : "maybe";
-            irreversibilityTier.set("Bash", bashEffectiveTier);
-            irreversibleTools.add("Bash");
+        if (!(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
+            if (shellGate === "off") {
+                deps.onError?.(new Error(`shell gate doctrine is "off" while a real writable shell (Bash) is mounted — the read boundary is ` +
+                    `still judged on every command (a deny-listed or out-of-root read asks; the ask is mandated), but no ` +
+                    `residual shell-risk classifier is installed: writes, egress and unknown commands are adjudicated by ` +
+                    `the ordinary policy/hook chain only. Set spec.shellGate to "classify" or "always" if this deployment ` +
+                    `expects doctrine-gated shell behavior.`), { phase: "config", sessionId, classification: "shell-gate-off" });
+            }
             const shellReadBoundary = () => ({
                 roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical],
                 ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}),
                 denyMatch: (p) => readDenyMatcher?.matchPath(p)?.pattern ?? null,
                 ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}),
             });
-            if (shellGate === "classify" && shellGatedBash)
-                reversibilityProbes.set("Bash", bashReversibilityProbe(undefined, shellReadBoundary));
-            if (backgroundTaskToolsActive) {
-                const monitorTierBefore = irreversibilityTier.get("Monitor");
-                shellGatedMonitor = !egressTools.has("Monitor") && monitorTierBefore !== "always" && monitorTierBefore !== "maybe";
-                const monitorEffectiveTier = shellGate === "always" || monitorTierBefore === "always" ? "always" : "maybe";
-                irreversibilityTier.set("Monitor", monitorEffectiveTier);
-                irreversibleTools.add("Monitor");
-                if (shellGate === "classify" && shellGatedMonitor)
-                    reversibilityProbes.set("Monitor", bashReversibilityProbe(undefined, shellReadBoundary));
-            }
+            const installShellSeat = (name) => {
+                const tierBefore = irreversibilityTier.get(name);
+                const seatOwned = !egressTools.has(name) && tierBefore !== "always" && tierBefore !== "maybe";
+                if (seatOwned)
+                    shellGatedTools.add(name);
+                const tier = shellGate === "always" || tierBefore === "always" ? "always" : "maybe";
+                irreversibilityTier.set(name, tier);
+                irreversibleTools.add(name);
+                if (seatOwned && tier === "maybe") {
+                    reversibilityProbes.set(name, shellGate === "classify" ? bashReversibilityProbe(undefined, shellReadBoundary) : bashReadBoundaryProbe(shellReadBoundary));
+                }
+            };
+            installShellSeat("Bash");
+            if (backgroundTaskToolsActive)
+                installShellSeat("Monitor");
         }
     }
     return {
@@ -391,8 +390,7 @@ export async function prepareHandsMount(input) {
         attachmentRootCanonical,
         readDenyMatcher,
         envHandToolNames,
-        shellGatedBash,
-        shellGatedMonitor,
+        shellGatedTools,
         sealReadStateSeat,
     };
 }

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -43,7 +43,7 @@ import type { DelegationContentSafety } from "../memory-engine/delegation-proven
 import type { SessionPermissionRules } from "../session-policy-store.js";
 import type { SessionStore } from "../session.js";
 import { type OnAsk } from "../tool-policy.js";
-import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
+import type { RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
 import type { ActiveSkillScope } from "./active-skill-scope.js";
 import type { InheritedGate, Prepared, PrepareResume, RunInternals, ToolFaceSnapshot } from "./contracts.js";
 import { type StopForDenialLimit } from "./denial-limit-arms.js";
@@ -194,7 +194,7 @@ export interface PrepareInheritedGateResult {
     /** owned — the monotonic governed-provenance bit for this leg. */
     orgGovernedProvenance: boolean;
     /** owned — the spec's own shellGate tightened by the inherited doctrine. */
-    effectiveShellGate: "off" | "classify" | "always";
+    effectiveShellGate: ShellGateDoctrine;
     /** borrowed-mutable — THIS task's own session-rule snapshot for its children's chain. Writers (R-3): the policy-chain
      *  station's session-policy read, once per leg, when a store is wired and the task carries its own sessionId. Read by
      *  `inheritedGateForChildren` at spawn time. */

package/dist/core/runner/prepare-park-ask.d.ts

@@ -25,7 +25,7 @@ import { type CheckpointStore } from "../checkpoint-store.js";
 import type { SessionStore } from "../session.js";
 import { type OnAsk, type ToolCallRequest, type ToolPolicy } from "../tool-policy.js";
 import { type ToolResultStore } from "../tool-result-store.js";
-import type { RunnerDeps, RuntimeCaps, TaskSpec } from "../types.js";
+import type { RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import { type ContentAskBinding } from "./content-ask-bindings.js";
 import type { AskLane, ParkAsk, Prepared, SuspendSaga } from "./contracts.js";
@@ -108,12 +108,11 @@ export interface PrepareParkAskInput {
     maxSuspends: number;
     /** borrowed-mutable — the run-scoped remote-lifecycle failure log. Writer here: a refused `suspendVM` (`push`). */
     remoteEnvFailures: Prepared["remoteEnvFailures"];
-    /** borrowed-readonly — whether Bash is coarsely shell-gated (the risk descriptor's `shellGated`). */
-    shellGatedBash: boolean;
-    /** borrowed-readonly — whether Monitor is coarsely shell-gated (same). */
-    shellGatedMonitor: boolean;
+    /** borrowed-readonly — the shell-seat provenance set: the shell-running tools whose tier is the engine's shell seat's, not a
+     *  deployment mark (the risk descriptor's `shellGated` is the gated tool's membership). */
+    shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the effective shell-gate doctrine persisted on the descriptor. */
-    effectiveShellGate: "off" | "classify" | "always";
+    effectiveShellGate: ShellGateDoctrine;
     /** borrowed-readonly — the EFFECTIVE durable-approval opt-in (the caller's, or the synthesized mandate scope): picks the
      *  gate kind, the scope and the ttl. */
     durableApproval: TaskSpec["durableApproval"];

package/dist/core/runner/prepare-park-ask.js

@@ -22,7 +22,7 @@ class ParkRefusal extends Error {
     }
 }
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -232,8 +232,8 @@ export function prepareParkAsk(input) {
                     ...(shadowedRule !== undefined ? { shadowedRule } : {}),
                     ...(probeReason !== undefined ? { probeReason } : {}),
                     ...(probeCause !== undefined ? { probeCause } : {}),
-                    shellGated: (req.toolName === "Bash" && shellGatedBash) || (req.toolName === "Monitor" && shellGatedMonitor),
-                    ...(effectiveShellGate !== "off" ? { shellGateDoctrine: effectiveShellGate } : {}),
+                    shellGated: shellGatedTools.has(req.toolName),
+                    shellGateDoctrine: effectiveShellGate,
                 });
                 gate =
                     safety !== undefined || realApproval !== undefined

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -78,8 +78,8 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — the caller tools' names, the first-await snapshot (the sandbox boundary predicate: a caller tool
      *  is never contained by the hand tools' env). */
     ownToolNames: ReadonlySet<string>;
-    /** borrowed-readonly — whether the shell tool is under an operator `shellGate:"always"` (the offer factory's mandate term). */
-    shellGatedBash: boolean;
+    /** borrowed-readonly — the shell-seat provenance set (the offer factory's `shellGated` mandate term, read per call). */
+    shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the tracked-cwd seat, read per call by the lanes and the offer factory (never written here). */
     handsCwdRef: CwdRef | undefined;
     /** borrowed-readonly — the compiled read-deny judge, or undefined (the offer factory's directory negative control). */

package/dist/core/runner/prepare-policy-chain.js

@@ -16,7 +16,7 @@ import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedBash, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedTools, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const policy = lockedPreflight.toolPolicy;
     const auditPolicyNames = (auditee) => {
         const nameGroups = toolPolicyNameSets(auditee);
@@ -265,7 +265,7 @@ export async function preparePolicyChain(input) {
         localOwnerDeclared: deps.localOwnerRules === true,
         egressTools,
         irreversibilityTier,
-        shellGatedBash,
+        shellGatedTools,
         taskRoot: taskRootFinal,
         cwdRef: handsCwdRef,
         deniesDirectoryRead: readDenyMatcher !== undefined ? (d) => readDenyMatcher.matchPath(d) !== null : undefined,