@sema-agent/core 7.14.0 → 7.16.0

package/dist/core/runner/prepare-boundary-parks.d.ts

@@ -1,15 +1,15 @@
 /**
- * design/390 §1.2 M19 (boundary parks) — prepareTask's three BOUNDARY-FAMILY park lanes, verbatim from the driver's
+ * PrepareTask's three BOUNDARY-FAMILY park lanes, verbatim from the driver's
  * gate-machinery block: the ONE resource mint (`mintResourceSuspend`) behind the task-axis `suspendForResource` (exposed
  * under the caller's `resourceSuspend` opt-in) and the infrastructure `suspendForPlatformLimit` (exposed on durable infra
  * alone), and the `plan_review` mint behind `suspendForReview` (exposed with a checkpoint store). Every mint reuses the
  * suspend saga's serializer, commit saga, loop cap and env split — this phase adds no second copy of any of them. The
- * interface is the dependency list the segment had implicitly (design/238 R-1); the three lanes used to be forward-declared
+ * interface is the dependency list the segment had implicitly; the three lanes used to be forward-declared
  * `let`s at task scope, assigned inside the block, so the driver's Prepared could expose them — they are this phase's
  * Result now, and the driver binds them as consts.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the mints run at a turn boundary), so the
- * phase adds no yield between the suspend saga before it and the park closure after it (design/390 §1.5). Read-stability
+ * phase adds no yield between the suspend saga before it and the park closure after it. Read-stability
  * of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * The lanes exist exactly when the saga does (the ask lane's presence law) — an absent saga answers three absent lanes,

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -1,12 +1,12 @@
 /**
- * design/390 §1.2 M4 — prepareTask's CAPS-AND-WORKFLOW phase, verbatim from the driver: the caller-tool roster
+ * PrepareTask's CAPS-AND-WORKFLOW phase, verbatim from the driver: the caller-tool roster
  * map (the defineTool-product branch and the rich-ctx wrap through the large-result wrapper), the ReportBlocked /
  * ReportFindings / plan-pair mounts, the per-principal runtime caps resolve with its fail-closed degrade and value
  * screen, the compliance posture veto with its two refusal codes, the fork verdict and the observers grant, the
  * auto-mode arming (classifier model, lane rule, decider + denial tracker + persisted recipe) with its manifest
  * reason, the self-orchestration gate with its governance note, and the Workflow mount with its size-guideline
  * seat. The three arming helpers and the parent-capture-state join moved with the segment (only this phase calls
- * them). The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * them). The interface is the dependency list the segment had implicitly.
  *
  * ASYNC PHASE: the segment awaits the two resolvers, the classifier route pre-flight and the Workflow factory,
  * exactly where the driver awaited them; the roster map and the synthetic mounts before the first of those awaits
@@ -14,7 +14,7 @@
  * (`@contract prepare.deps-read-stable`).
  *
  * THE ROSTER IS MINTED HERE (`tools`): every later phase that mounts pushes into this same array — the writer table
- * lives on {@link Prepared.tools} (design/238 R-3). LATE-BOUND SEATS: the Workflow mount's call-time getters read
+ * lives on {@link Prepared.tools}. LATE-BOUND SEATS: the Workflow mount's call-time getters read
  * three facts later stations resolve (the memory session, the center adoption, the hands mount's deny additions);
  * each enters as a getter on the Input and is read exactly where the driver's getter read the variable.
  */
@@ -130,7 +130,7 @@ export interface PrepareCapsAndWorkflowInput {
     }>;
 }
 export interface PrepareCapsAndWorkflowResult {
-    /** owned — THE run's roster BUILDER (design/388: the mount array is private to it; `Prepared.tools` is its read face,
+    /** owned — THE run's roster BUILDER (the mount array is private to it; `Prepared.tools` is its read face,
      *  whose JSDoc carries the writer table). Minted here from the caller's tools; every later mount goes through its verbs.
      *  Writers here: the caller mounts, then the ReportBlocked, ReportFindings, ExitPlanMode, EnterPlanMode and Workflow mounts. */
     roster: RosterBuilder;
@@ -150,7 +150,7 @@ export interface PrepareCapsAndWorkflowResult {
     /** owned — the observers grant (`allowObservers === true`, explicit opt-in). */
     observersActive: boolean;
     /** owned — the arming outcome as a closed reason (the manifest's auto-mode face). */
-    /** #529 / #692 C-d — the leg's auto-mode arming fact (`armed` ⇔ `reason === "armed"`; `deniedSource` only beside a STATED `denied`). */
+    /** The leg's auto-mode arming fact (`armed` ⇔ `reason === "armed"`; `deniedSource` only beside a STATED `denied`). */
     autoModeArmReason: AutoModeArmFact;
     /** owned — the armed classifier, or undefined when any arming arm failed. */
     autoModeDecider: AutoModeDecider | undefined;

package/dist/core/runner/prepare-config-doors.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/238 B-1 (P0 相位抽取) — prepareTask's config-doors phase: the synchronous stretch from the
+ * PrepareTask's config-doors phase: the synchronous stretch from the
  * tool-face snapshot freeze through model/thinking/compaction-model resolution. The inputs are
  * exactly the fields of {@link PrepareConfigDoorsInput} (the original extraction slice — spec, deps,
  * sessions, the resume/internals seats); the outputs are the fields of
@@ -14,7 +14,7 @@
  * `prepare-task-phase-pins` microtask-latch tests.
  *
  * Throws pass through unchanged: every `config.*` / `resume_at.*` refusal here is a DELIBERATE
- * at-the-door rejection (design/99 §E18 — a throw before acquisition needs no cleanup), and the
+ * at-the-door rejection (a throw before acquisition needs no cleanup), and the
  * interaction-posture door's `deps.onError` disclosure (call order and payload) is part of the
  * contract. The per-task agents rebind returns a REBOUND spec (shallow copy, only `tools`
  * replaced) — the caller's object is never mutated; the safety scan must receive the rebound one.
@@ -33,7 +33,7 @@ export declare function limitConfigError(code: string, message: string): Error &
     code?: string;
 };
 /**
- * design/164 — validate `TaskSpec.limits` at the door and return it unchanged.
+ * Validate `TaskSpec.limits` at the door and return it unchanged.
  *
  * Two refusals, both fail-loud (the {@link resolveStallTimeoutMs} posture: a bound nobody can evaluate is
  * not a bound, and folding it to a default would silently run the task under limits nobody chose):
@@ -47,7 +47,7 @@ export declare function limitConfigError(code: string, message: string): Error &
  */
 export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskLimits | undefined;
 /**
- * RB-318 — validate the MODE-VALUED members of `TaskSpec.attachments` at the same door, and return the
+ * Validate the MODE-VALUED members of `TaskSpec.attachments` at the same door, and return the
  * config unchanged. Today that is exactly one member, `totalTokensReminderMode`.
  *
  * WHY A DOOR AT ALL (坏值响亮度律): a knob whose bad value silently folds to the default is a knob the
@@ -66,14 +66,14 @@ export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskL
  *    folded into this lane's change.
  *
  * A NON-OBJECT CONTAINER (`attachments: null` off a wire, above all) is neither refused nor crashed on
- * (review finding, verified by reading): every consumer reads this config through `attachmentsCfg?.…`,
+ * (verified by reading): every consumer reads this config through `attachmentsCfg?.…`,
  * so a null container already means "no lanes are wired" and the spec RUNS today. An unguarded property
  * read here — the first cut — turned that running spec into an untyped `TypeError` from inside a door
  * that promises a typed `config.attachment_invalid`, and refusing it instead would newly reject a spec
  * that works. There is no container-shape door in this family yet; that is a separate widening, not
  * something this lane gets to invent on the way past.
  *
- * The bypass is narrowed to values that CANNOT supply attachment fields (round-2 review finding): a
+ * The bypass is narrowed to values that CANNOT supply attachment fields: a
  * plain-JS caller can hand this a FUNCTION carrying `totalTokensReminderMode` as a property, and every
  * downstream `attachmentsCfg?.…` read would happily find it — so skipping a function here would fold a
  * typo'd mode to the default through exactly the hole this door exists to close. Functions are
@@ -85,13 +85,13 @@ export declare function resolveAttachmentsConfig(attachments: TaskSpec["attachme
  * `fable_5_mitigations` capability / claude-mythos-5), ORTHOGONAL to the simple/classic profile.
  * sema is BYOM, so the id may carry provider prefixes ("anthropic/claude-fable-5",
  * "openrouter/anthropic/claude-fable-5"): BOUNDARY-AWARE family match on the last path segment
- * (统一复审 F3 — raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
+ * (raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
  * as fable), case-normalized. Recognition set = CC's _Nr (startsWith "claude-fable-") + b9e
  * (mythos-5). R3 system sections fork on the resulting fact.
  */
 export declare function isFableFamilyModelId(id: string): boolean;
 /**
- * RB-50 (CC 2.1.220 启示①, 2026-07-25): the SINGLE decision point for the two prompt-shape axes.
+ * The SINGLE decision point for the two prompt-shape axes.
  * Both were resolved in separate places with different mechanisms — `promptProfile` off a TaskSpec field,
  * `fableMitigations` off a raw model-id prefix test — so "which shape does this task speak" had no one
  * place to read. CC 2.1.220's counterpart is a model-registry `capabilities` array (one table drives
@@ -139,14 +139,14 @@ export interface PrepareConfigDoorsResult {
      *  later face reads consult (own-task filter, defer classify, delegation ctx). Frozen-immutable ⇒
      *  shared by reference into tool execution ctxs. */
     toolFaceSnapshot: ToolFaceSnapshot;
-    /** owned — the profile half of the RB-50 single decision point (model-independent by contract). */
+    /** owned — the profile half of the single decision point (model-independent by contract). */
     promptProfile: "simple" | "classic";
     /** owned — the administrator lock snapshot; the rest of prepare reads guarded slots through it. */
     lockedPreflight: LockedPreflight;
     /** owned — the resolved interaction posture (spec > spawning run > deployment); the
      *  AskUserQuestion mount and the child-ctx injection read this same value. */
     resolvedInteractionPosture: "interactive" | "headless" | undefined;
-    /** owned — the validated/resolved microCompact knob (design/374; {@link resolveMicroCompactKnob}
+    /** owned — the validated/resolved microCompact knob ({@link resolveMicroCompactKnob}
      *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
      *  the deps bag is never re-read after this door. */
     microCompactKnob: {
@@ -163,9 +163,9 @@ export interface PrepareConfigDoorsResult {
     /** owned — the compaction model: explicit wins, else the `summarize` role, else undefined (main
      *  model fallback inside maybeCompact). NOT derivable from {@link resolvedRole}. */
     compModel: Model | undefined;
-    /** owned — the mitigations half of the RB-50 decision point (model-family fact). */
+    /** owned — the mitigations half of the decision point (model-family fact). */
     fableMitigations: boolean;
-    /** owned, frozen — design/277 model-gate DISCLOSURE data (the application itself already
+    /** owned, frozen — model-gate DISCLOSURE data (the application itself already
      *  happened on {@link spec}: its `tools` is the survivor rebind when anything was removed).
      *  prepareTask emits the notices from this after the doors return (the onNotice station);
      *  the doors stay side-effect-free on the announcement axis. */
@@ -178,18 +178,18 @@ export interface PrepareConfigDoorsResult {
          *  material; the in-force arm never lands here — it throws at the door). */
         discardedEnvRaw: string | undefined;
     };
-    /** owned — the NORMALIZED per-leg delegation-evidence standard (design/324): the deps seat read
+    /** owned — the NORMALIZED per-leg delegation-evidence standard: the deps seat read
      *  ONCE, in this synchronous pre-await stretch, screened, and absent folded to the "static-face"
      *  default. The delegation wrap consumes THIS value, never the live deps object — a deps seat
      *  mutated (or getter-backed) after the door must not present an unscreened value to the mark
-     *  branch (the #245 5.33 read-once posture). */
+     *  branch (the read-once posture). */
     memoryDelegationEvidence: "static-face" | "attested-only";
-    /** owned — the NORMALIZED memory-provenance mode (design/336 §13-3): the deps seat read ONCE in
-     *  the synchronous pre-await stretch, screened (#123), absent folded to the `"carry"` default.
+    /** owned — the NORMALIZED memory-provenance mode: the deps seat read ONCE in
+   *  the synchronous pre-await stretch, screened, absent folded to the `"carry"` default.
      *  The memory phase constructs every engine with THIS value — never a live deps re-read. */
     memoryProvenance: "off" | "carry";
-    /** owned — the NORMALIZED memory-capture posture (design/383 §3.1): the deps seat read ONCE,
-     *  screened (#123 — a bad value refuses, never folds), absent folded to `"open"`. The capture
+    /** owned — the NORMALIZED memory-capture posture: the deps seat read ONCE,
+     *  screened (a bad value refuses, never folds), absent folded to `"open"`. The capture
      *  opt-out adjudicator consumes THIS value on every leg (declaration, resume record re-check,
      *  and the flip verb's frozen closure) — never a live deps re-read. */
     memoryCapturePolicy: "open" | "governed" | "capture-required";
@@ -202,9 +202,9 @@ export interface PrepareConfigDoorsResult {
      *  the resolver's off states). */
     brainCallGuardrailMs: number | undefined;
 }
-/** design/374 — the microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
- *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing (review
- *  r3): it runs in THIS pre-first-await config-doors phase so a malformed declaration refuses
+/** The microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
+ *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing:
+ *  it runs in THIS pre-first-await config-doors phase so a malformed declaration refuses
  *  BEFORE any resource-bearing preparation — session acquisition, execution-env creation, the MCP
  *  dial — whose external effects a late refusal's teardown cannot undo. SINGLE READ per seat, and
  *  the CONTAINER is judged first (reviews r1/r2): an accessor-backed bag answering a legal value at

package/dist/core/runner/prepare-context-lane.d.ts

@@ -1,15 +1,15 @@
 /**
- * design/390 §1.2 M21 — prepareTask's CONTEXT-LANE phase, verbatim from the driver: the edit/guard budgets, the
+ * PrepareTask's CONTEXT-LANE phase, verbatim from the driver: the edit/guard budgets, the
  * microCompact machine state with the trigger-window clamp's one loud outlet, the model's chars-per-token coordinate,
  * and the `context` handler registered on the harness — heal → ledger replay → aggregate tool-result and media caps →
  * frontier clear → the guard chain (arms A/B/C) → the git-frame guard → the orphan belt → the lossy-projection flag →
  * the projection seat. The four module-level helpers only this lane called moved with it (the machine-state builder,
  * the frontier-clear recorder, the observation-buffer flush, the guard chain with its two types). The interface is the
- * dependency list the segment had implicitly (design/238 R-1).
+ * dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the handler it registers is async and
  * runs per provider request), so the phase adds no yield between the gate stations before it and the turn wiring after
- * it (design/390 §1.5). Read-stability of the host handles: {@link RunInternals} (`@contract prepare.deps-read-stable`).
+ * it. Read-stability of the host handles: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * REGISTRATION SIDE EFFECT, OWNED: this phase registers the ONE `context` handler on the harness; the harness owns the
  * listener for the run's life (it is never unregistered — the harness is per prepare). No other station registers on
@@ -76,7 +76,7 @@ export declare function prepareContextLane(input: PrepareContextLaneInput): Prep
 export interface GuardChainArgs {
     /** The post-frontier view the chain starts from. */
     edited: AgentMessage[];
-    /** The pre-cap counterpart view (arm A's clearSource — RB-212 durable composition seat). */
+    /** The pre-cap counterpart view (arm A's clearSource — durable composition seat). */
     replayed: AgentMessage[];
     index: OccurrenceIndex;
     microCompact: PreparedMicroCompact;
@@ -106,8 +106,8 @@ export type GuardChainOutcome = {
     trimDroppedMessages: boolean;
 };
 /**
- * design/374 slice 3 — the GUARD CHAIN over one request build (D-7 case-ii transfer table),
- * module-level per the design/238 body-span bank. design/123 D3: the chain reads the anchored
+ * The GUARD CHAIN over one request build (D-7 case-ii transfer table),
+ * the chain reads the anchored
  * coordinate re-estimated on the EDITED array (pre-anchor clears don't lower it — deliberately;
  * trimToBudget doc). The opt-out machine = the pre-374 backstop order byte-identical
  * (trim as the ordinary second line); otherwise arm A (blocking machine run, only when the

package/dist/core/runner/prepare-defer-classify.d.ts

@@ -15,7 +15,7 @@ export interface PrepareDeferClassifyInput {
      *  shallow copy for the classic-profile description swap (the caller's ToolSpec object is never
      *  mutated); `splice` of a retracted memory group. After this phase: the content-origin wrap
      *  (element replacement with the wrapped object), the disclosure mount, the MCP refresh re-splice. Since
-     *  design/388 every one of those writes is a builder verb (`unmountWhere` / `replaceAt`). */
+     *  Every one of those writes is a builder verb (`unmountWhere` / `replaceAt`). */
     roster: RosterBuilder;
     /** borrowed-readonly — the frozen task-start tool face: `exclude` (the valve), `defer` (operator
      *  defers, exact wire names), `alwaysLoad` (the inline pins). */
@@ -24,11 +24,11 @@ export interface PrepareDeferClassifyInput {
      *  where a shell could be on the roster). */
     handsEnabled: boolean;
     /** borrowed-readonly — the spec-time precomputation the invariant checks the post-exclusion roster
-     *  against (design/199 D-6): a mismatch is an engine bug, thrown. */
+     *  against: a mismatch is an engine bug, thrown. */
     fullShellReachable: boolean;
     /** borrowed-readonly — the resolved prompt profile (`classic` swaps in `descriptionClassic`). */
     promptProfile: "simple" | "classic";
-    /** borrowed-readonly — the resolved model (the classifier's constant-defer arm reads its shape). */
+    /** borrowed-readonly — the resolved model (the deferral gate's threshold reads its context window). */
     model: Model;
     /** borrowed-readonly — the materialized MCP roster; only `tools` is read (protocol names for the
      *  remote-roster arm; `mcpAlwaysLoad` self-declarations, losing to an explicit operator defer). */

package/dist/core/runner/prepare-defer-classify.js

@@ -3,10 +3,12 @@ import { FULL_SHELL_CONTRACT_ID } from "../../tools/fs/index.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
-import { TOOL_SEARCH_NAME, classifyDeferred } from "./tool-disclosure.js";
+import { protocolOf } from "../protocol-table.js";
+import { classifyDeferred } from "./tool-defer-gate.js";
+import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
 import { RosterBuilder } from "../tool-roster.js";
-function explicitlyDeferredMemoryTrio(mounted, roster, deferNames) {
-    return mounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => roster.some((t) => t.name === n) && (deferNames ?? []).includes(n)) : [];
+function explicitlyDeferredMemoryTrio(mounted, roster, callerDeferNames) {
+    return mounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => roster.some((t) => t.name === n) && (callerDeferNames ?? []).includes(n)) : [];
 }
 function memoryGroupRetractionSet(builtinDeferPairNames, engineTrioInPlay) {
     return new Set([...builtinDeferPairNames, ...(engineTrioInPlay ? MEMORY_ENGINE_TOOL_NAMES : [])]);
@@ -39,29 +41,29 @@ export function prepareDeferClassify(input) {
                 roster.replaceAt(i, { ...t, description: t.descriptionClassic });
         }
     }
-    const userToolNames = (spec.tools ?? []).map((t) => t.name);
-    const protocolToolNames = [...mcp.tools.map((t) => t.name), ...a2a.tools.map((t) => t.name)];
+    const protocolToolNames = [...mcp.tools, ...a2a.tools].filter((t) => protocolOf(t.name) !== undefined).map((t) => t.name);
     const mcpAlwaysLoadNames = mcp.tools
         .filter((t) => t.mcpAlwaysLoad === true && !(toolFaceSnapshot.defer ?? []).includes(t.name))
         .map((t) => t.name);
     const classifyDeferredOverFace = (face, builtinDeferNames) => {
+        const mounted = new Set(face.map((t) => t.name));
         const deferredSet = classifyDeferred({
             specs: spec.tools ?? [],
             protocolToolNames,
-            fullTools: face.filter((t) => userToolNames.includes(t.name) || protocolToolNames.includes(t.name)),
+            fullTools: face,
             deferMode: deps.deferMode,
             model,
-            deferNames: [...(toolFaceSnapshot.defer ?? []), ...builtinDeferNames].filter((n) => face.some((t) => t.name === n)),
+            callerDeferNames: (toolFaceSnapshot.defer ?? []).filter((n) => mounted.has(n)),
+            builtinDeferNames: builtinDeferNames.filter((n) => mounted.has(n)),
             alwaysLoadNames: [
                 ASK_USER_QUESTION_TOOL_NAME,
                 ...(toolFaceSnapshot.alwaysLoad ?? []),
                 ...mcpAlwaysLoadNames,
             ],
         });
-        for (const n of [...deferredSet]) {
-            if (!face.some((t) => t.name === n))
+        for (const n of [...deferredSet])
+            if (!mounted.has(n))
                 deferredSet.delete(n);
-        }
         return deferredSet;
     };
     const sharedMemoryPair = sharedMemoryPairMounted ? SHARED_MEMORY_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n)) : [];

package/dist/core/runner/prepare-delegation-surface.d.ts

@@ -74,7 +74,7 @@ export interface PrepareDelegationSurfaceInput {
      *  the SendMessage / AgentTranscript mounts activate their ctx-first arms with it. */
     enrichSpecToolCtx: (ctx: ToolExecuteContext) => ToolExecuteContext;
     /** borrowed-mutable — the hands mount's tracked-cwd seat: present ⇔ real shell + write hands; the worktree pair's mount
-     *  predicate. Not written by this phase, but the tools it mounts over it ARE its writers (design/238 R-3): EnterWorktree and
+     *  predicate. Not written by this phase, but the tools it mounts over it ARE its writers: EnterWorktree and
      *  ExitWorktree assign `current` at run time (the hands band's shared cwd then points at the worktree, and back); the
      *  Monitor only reads it. The cell must stay the hands mount's own object — a copy would strand those writes. */
     handsCwdRef: CwdRef | undefined;

package/dist/core/runner/prepare-file-history.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/390 §1.2 M2 — prepareTask's file-history phase, verbatim from the driver: the DV-14 first-touch
+ * PrepareTask's file-history phase, verbatim from the driver: the DV-14 first-touch
  * policy door, the `RunnerDeps.fileHistoryStore` bad-value door, the retired `rewindFiles` two-sense
  * split, the restoreFiles / resumeAt / rewindFilesTo combination gates, the run's history coordinates
  * (canonical root, recording scope, filesystem identity), the fork carry, the child-scope refusal, the
@@ -84,7 +84,7 @@ export declare function resolveFileHistoryScope(lineage: RunInternals["fileHisto
  *  · a remote workspace names itself through its {@link WorkspaceHandle} (provider + sandbox, and the
  *    device lane's id when stamped) — two runs on one sandbox share a tree, two sandboxes never do;
  *  · an env that DECLARES its paths host-local (`hostLocalPaths: true`), or is the host adapter itself
- *    (a {@link NodeExecutionEnv}, which the #211 seam names as the host-local default), is the
+ *    (a {@link NodeExecutionEnv}, which the seam names as the host-local default), is the
  *    control-plane host's filesystem — every such env is one tree;
  *  · anything else — an env declaring `hostLocalPaths: false`, or an undeclared custom adapter — is
  *    attested to nothing, so it is its OWN tree: a per-instance token, which still matches when the

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -1,18 +1,18 @@
 /**
- * design/390 §1.2 M20 — prepareTask's two GATE STATIONS, verbatim from the driver: the `tool_call` station (the final-roster
+ * PrepareTask's two GATE STATIONS, verbatim from the driver: the `tool_call` station (the final-roster
  * effect sync, the write-protection judge compiled once per task, the arming predicate, the compliance and plan-mode
  * short-circuits, the `runToolGate` call with every seat it is handed, the lifecycle sweep, the deferred sandbox-admission
  * disclosure, the PreToolUse context stash, the settlement sideband write and the bare-human-rejection boundary) and the
  * `tool_result` station (the PostToolUse / PostToolUseFailure seats and the PreToolUse context drain). The two module-scope
  * helpers only these stations called moved with them (the settlement screen, the rejection-boundary judgment). The
- * interface is the dependency list the stations had implicitly (design/238 R-1).
+ * interface is the dependency list the stations had implicitly.
  *
  * The stations REGISTER handlers on the harness (the side effect this phase exists for) and report only two observation
  * seats back; the order they register in — after the file-history boundary lease the driver registers, and in this order
  * (call before result) — is the order handlers run in.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the handlers run per tool call / per tool
- * result), so the phase adds no yield between the park closure before it and the context lane after it (design/390 §1.5).
+ * result), so the phase adds no yield between the park closure before it and the context lane after it.
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * The `tool_call` station is built exactly when the ask lane and the park closure are (the same predicate as the whole
@@ -43,14 +43,14 @@ export interface PrepareGateStationsInput {
     /** borrowed-readonly — the FINAL mount roster: iterated once for the effect sync and the write-protection arming. Never
      *  mutated here. */
     tools: readonly AgentTool[];
-    /** borrowed-readonly — the leg's delta seat (design/388): its current roster is the face source for every gated call. */
+    /** borrowed-readonly — the leg's delta seat: its current roster is the face source for every gated call. */
     toolRosterDeltas: ToolRosterDeltaSeat;
     /** borrowed-mutable — the effect collection. Writer here: the final-roster sync fills MISSING entries from each
      *  first-party tool's declared effect (never overrides a scanned one); the plan-mode deny reads it per call. */
     toolEffects: Map<string, ToolEffect>;
     /** borrowed-readonly — the deployment seats these stations read, as a Pick over the SAME `deps` object (receiver
      *  preserved for `deps.onError?.()`): the write-protection table and its data root, the tracer, the error face, and
-     *  the notice sink (#648: the gate's unresolvable-ask exit delivers `delegation.ask_unresolvable` through it). */
+     *  the notice sink (the gate's unresolvable-ask exit delivers `delegation.ask_unresolvable` through it). */
     deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "tracer" | "onError" | "onNotice">;
     /** borrowed-mutable — the protocol-tools phase's arming belt. Writer here: `armed` ← the registration predicate, the
      *  one write; the refresh seam reads it. */
@@ -130,10 +130,9 @@ export interface PrepareGateStationsInput {
     abortController: {
         readonly signal: AbortSignal;
     };
-    /** borrowed-readonly — whether Bash is coarsely shell-gated (the gate's `shellGated` attribution). */
-    shellGatedBash: boolean;
-    /** borrowed-readonly — whether Monitor is coarsely shell-gated (same). */
-    shellGatedMonitor: boolean;
+    /** borrowed-readonly — the shell-seat provenance set: the shell-running tools whose tier is the engine's shell seat's, not a
+     *  deployment mark (the gate's `shellGated` attribution is the gated tool's membership). */
+    shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the auto-mode decider, or undefined (the classifier lane the gate routes a surviving ask through). */
     autoModeDecider: AutoModeDecider | undefined;
     /** borrowed-readonly — the auto-mode denial tracker, or undefined (handed to the gate beside the decider). */

package/dist/core/runner/prepare-gate-stations.js

@@ -42,7 +42,7 @@ function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
     if (askLane !== undefined && parkAsk !== undefined) {
         const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
         const { resolveContentAsk, suspendAsk } = parkAsk;
@@ -119,7 +119,7 @@ export function prepareGateStations(input) {
                         abortSignal: abortController.signal,
                         ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
                         onHookError: notifyHookError,
-                        shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
+                        shellGated: shellGatedTools.has(e.toolName),
                         ...(autoModeDecider ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}) } } : {}),
                         onHeadlessDenialLimit: stopForDenialLimit,
                         onAskUnresolvable: (info) => deliverEngineNotice(deps.onNotice, askUnresolvableNotice({ sessionId, ...info })),