@sema-agent/core 7.15.0 → 7.17.0

package/dist/core/memory-engine/types.d.ts

@@ -394,6 +394,10 @@ export interface MaterializedFile {
     /** True when the file belongs to a read-only inherited layer (chmod-protected, never harvested as a write). */
     readonly: boolean;
 }
+/** The write face's home, for a call site that has established a write face exists (`writeScope !==
+ *  null`). Throws on a read-only handle: a consumer that reaches here without a write face is a
+ *  defect, and a template-literal or `join` over `null` would otherwise mint a `null/…` path. */
+export declare function writableRootOf(handle: Pick<MemorySessionHandle, "writableRoot" | "writeScope">): string;
 /**
  * design/138 §2.2 — the session handle `materialize` returns and `harvest`/`rebaseline` consume.
  * `materialized` IS the harvest diff domain (plus session-new files under `writableRoot`): an entry
@@ -405,9 +409,10 @@ export interface MemorySessionHandle {
      *  TODO(S1b): per-scope PHYSICAL roots (project scope in-repo + user scope in the home mount in ONE
      *  session) — `fileToScope` already keys absolute paths, so only the layout mapping needs the split. */
     memoryDir: string;
-    /** The single directory the model may write memory into (the writeScope's home). Equals `memoryDir`
-     *  when the writeScope owns the root (the standard TOC layout). */
-    writableRoot: string;
+    /** The single directory the model may write memory into: the writeScope's home
+     *  `<memoryDir>/<label>` (canonical). `null` iff there is no write face (`writeScope === null`) —
+     *  a read-only layering has no directory the model may write, and no index is read from disk. */
+    writableRoot: string | null;
     writeScope: string | null;
     scopes: string[];
     /** The materialized manifest = the harvest diff domain. */

package/dist/core/memory-engine/types.js

@@ -1 +1,6 @@
 export const MEMORY_ORIGIN_CAUSES = ["observed", "derived", "static", "unattributed"];
+export function writableRootOf(handle) {
+    if (handle.writableRoot === null)
+        throw new Error("memory session handle has no write face (writeScope is null) — writableRoot is not available");
+    return handle.writableRoot;
+}

package/dist/core/memory-recall.d.ts

@@ -177,14 +177,6 @@ export declare function composeSelectiveBody(manifestText: string, selected: Mem
  *  widen the public surface (and invite callers to parse the opaque format) for zero consumer. Treat the key
  *  as an opaque token: persist it, feed it back, compare for equality — never split it. */
 export declare function encodeSurfacedKey(scope: string, id: string): string;
-/** A manifest header tagged with the scope it came from (design/84 Seam A decision 5). */
-export interface ScopedNoteHeader extends MemoryNoteHeader {
-    scope: string;
-}
-/** A full record tagged with its scope (for cross-scope getByIds). */
-export interface ScopedNoteRecord extends MemoryNoteRecord {
-    scope: string;
-}
 export interface LayeredRecallOptions {
     store: MemoryStore;
     /** Ordered scopes (design/84 Seam A): list order = priority; the last is highest. */

package/dist/core/memory.d.ts

@@ -233,7 +233,7 @@ export type ConsolidationCapableStore = MemoryStore & Required<Pick<MemoryStore,
  * (design/41): {@link MemoryStore.searchScored}/{@link MemoryStore.update}/{@link MemoryStore.delete}.
  * When false, the Runner skips consolidation entirely (graceful no-op).
  *
- * RB-436-g: a TYPE PREDICATE, so the guard's conclusion travels to the call sites. A bare boolean left
+ * A TYPE PREDICATE, so the guard's conclusion travels to the call sites. A bare boolean left
  * every post-guard call site writing `store.update!(…)`, and a guard that later forgot one of the three
  * would have been invisible — the `!`s keep compiling. Now dropping a method from the check turns the
  * call sites red.

package/dist/core/oracle-isolation.js

@@ -1,5 +1,5 @@
 import { isRemoteExecutionEnv, isIsolated } from "./remote-env.js";
-import { canonicalizeTarget } from "../tools/fs/safety.js";
+import { canonicalizeTarget, pathFamilyOf } from "../tools/fs/safety.js";
 function probeCommand(canonOraclePath) {
     const q = `'${canonOraclePath.replace(/'/g, `'\\''`)}'`;
     return `touch -- ${q}/.oracle-isolation-probe 2>/dev/null`;
@@ -31,7 +31,7 @@ export async function assertOracleIsolation(workerEnv, grader, opts) {
         }
         let writable;
         try {
-            const canon = await canonicalizeTarget(workerEnv, oraclePath, opts?.signal);
+            const canon = await canonicalizeTarget(workerEnv, oraclePath, opts?.signal, pathFamilyOf({ root: oraclePath }));
             if (!canon.ok) {
                 return { protected: false, isolationClass, reason: `cannot canonicalize oracle path "${oraclePath}": ${canon.message}` };
             }

package/dist/core/parent-spec-seat.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The parent SPEC seat a run hands its children — the projection of the fields of the parent's own REBOUND spec
+ * that inherit copy-at-spawn (identity, process facts, deployment facts, the frozen question face) onto ONE value
+ * both delegation lanes copy onto a child spec: `ToolExecuteContext.parentSpecSeat` on the Task lane,
+ * `RunWorkflowToolDeps.parentSpecSeat` → `RunWorkflowOptions.parentSpecSeat` on the workflow lane. Minted once per
+ * prepare (the inherited-gate phase); applied by ONE function ({@link applyParentSpecSeat}) so the two lanes
+ * cannot drift on which fields travel or on the priority between a child's own value and the parent's.
+ *
+ * The checkpoint seat (`./checkpoint-seat.ts`) is the same shape for one field; this seat carries the rest.
+ */
+import type { OnQuestion } from "./ask-question.js";
+import type { ToolExecuteContext } from "./tool-spec.js";
+import type { TaskSpec } from "./types.js";
+/** The fields of a spec the seat carries — one `Pick`, shared by the mint's input and the apply's target. */
+export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable">;
+/**
+ * The seat a run hands its children. Every member is the parent's own value, frozen at mint (arrays copied and
+ * frozen; the facts object copied). Members present iff the parent carries them — an absent member is "nothing to
+ * inherit", never a value.
+ *  · `principal` — the end-user identity (design/62: inherits verbatim, a worker cannot delegate under another).
+ *  · `oneShot` — the process fact ("no later turn"): only `true` travels; it is a REMOVAL (see the apply law).
+ *  · `clientContext` — the user's TZ/email facts (the child's environment block localizes the same way).
+ *  · `onQuestion` — the parent's FROZEN question face (`spec.onQuestion ?? deps.onQuestion`, the value the parent's
+ *    own AskUserQuestion resolves at): the child's question tool MOUNTS on it, so without it the child has no tool.
+ *  · `additionalDirectories` / `additionalReadDirectories` — the fs-fence widening (deployment property).
+ *  · `envFacts` — the sandbox facts (profile / egress / scratchpad).
+ *  · `memoryPersistenceCapable` — the deployment's DECLARED persistence statement: `false` is a REMOVAL (floor),
+ *    `true` a default a child's own declaration may narrow.
+ */
+export interface ParentSpecSeat {
+    readonly principal?: string;
+    readonly oneShot?: true;
+    readonly clientContext?: TaskSpec["clientContext"];
+    readonly onQuestion?: OnQuestion;
+    readonly additionalDirectories?: readonly string[];
+    readonly additionalReadDirectories?: readonly string[];
+    readonly envFacts?: TaskSpec["envFacts"];
+    readonly memoryPersistenceCapable?: boolean;
+}
+/** Mint the seat off the parent's REBOUND spec and its frozen question face (spec over deps — the caller resolves it once,
+ *  the same value the parent's own question routing reads). Absent fields stay absent; `oneShot` only when `true`. */
+export declare function parentSpecSeatOf(spec: Omit<ParentSpecSeatFields, "onQuestion">, frozenOnQuestion: OnQuestion | undefined): ParentSpecSeat;
+/**
+ * Apply the seat to a child spec — ONE law for every member, both lanes:
+ *   a value the child spec already carries WINS; the seat FILLS an unset one; the two REMOVAL values
+ *   (`oneShot: true`, `memoryPersistenceCapable: false`) land UNCONDITIONALLY.
+ * "Already carries" is the child's own authorship — a deployment baseline, a trusted script, an agent definition's
+ * fold (the Task lane folds the definition's `memoryPersistenceCapable` before applying; the workflow lane applies at
+ * the launch site AFTER the agentType fold) — so a definition may narrow a parent `true` to `false`, a baseline-pinned
+ * principal stands, and nothing a child can author lifts a removal. Arrays and the facts object are copied per child
+ * (a retained child's frozen snapshot must not alias the parent's seat). Returns a NEW object; `child` is not mutated.
+ * No seat (a tool running outside a Runner task) ⇒ the child spec is returned as is.
+ */
+export declare function applyParentSpecSeat<S extends ParentSpecSeatFields>(child: S, seat: ParentSpecSeat | undefined): S;
+/** The ctx keys that restate a seat member as THIS run's own fact (tools read them for scope / receipts / clamps). */
+declare const SEAT_FACTS_ON_CTX: readonly ["principal", "oneShot", "onQuestion", "memoryPersistenceCapable"];
+/**
+ * The seat a delegation boundary reads off a trusted ctx — ONE reader for both delegation tools. A Runner-filled ctx
+ * always carries the seat beside the run's own facts, and the two agree by construction (one mint). A HAND-BUILT ctx
+ * (a caller invoking a delegation tool's `execute` directly) that carries any of those facts WITHOUT the seat, or with
+ * a seat that disagrees with them, is REFUSED (`config.parent_spec_seat_missing`): spawning a principal-less child from a
+ * principal-bearing caller would offload into the shared namespace and re-key its journal — a silent tenant narrowing,
+ * never a fallback. A ctx with neither (a tool running outside a Runner task) hands down no seat.
+ */
+export declare function parentSpecSeatOfCtx(ctx: Pick<ToolExecuteContext, "parentSpecSeat" | (typeof SEAT_FACTS_ON_CTX)[number]>): ParentSpecSeat | undefined;
+export {};

package/dist/core/parent-spec-seat.js

@@ -0,0 +1,47 @@
+export function parentSpecSeatOf(spec, frozenOnQuestion) {
+    return Object.freeze({
+        ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+        ...(spec.oneShot === true ? { oneShot: true } : {}),
+        ...(spec.clientContext !== undefined ? { clientContext: spec.clientContext } : {}),
+        ...(frozenOnQuestion !== undefined ? { onQuestion: frozenOnQuestion } : {}),
+        ...(spec.additionalDirectories !== undefined ? { additionalDirectories: Object.freeze([...spec.additionalDirectories]) } : {}),
+        ...(spec.additionalReadDirectories !== undefined ? { additionalReadDirectories: Object.freeze([...spec.additionalReadDirectories]) } : {}),
+        ...(spec.envFacts !== undefined ? { envFacts: Object.freeze({ ...spec.envFacts }) } : {}),
+        ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
+    });
+}
+export function applyParentSpecSeat(child, seat) {
+    if (seat === undefined)
+        return child;
+    const fill = (key, value) => child[key] === undefined && value !== undefined ? { [key]: value } : {};
+    return {
+        ...child,
+        ...fill("principal", seat.principal),
+        ...fill("clientContext", seat.clientContext),
+        ...fill("onQuestion", seat.onQuestion),
+        ...fill("additionalDirectories", (seat.additionalDirectories !== undefined ? [...seat.additionalDirectories] : undefined)),
+        ...fill("additionalReadDirectories", (seat.additionalReadDirectories !== undefined ? [...seat.additionalReadDirectories] : undefined)),
+        ...fill("envFacts", (seat.envFacts !== undefined ? { ...seat.envFacts } : undefined)),
+        ...(seat.oneShot === true ? { oneShot: true } : {}),
+        ...(seat.memoryPersistenceCapable === false ? { memoryPersistenceCapable: false } : fill("memoryPersistenceCapable", seat.memoryPersistenceCapable)),
+    };
+}
+const SEAT_FACTS_ON_CTX = ["principal", "oneShot", "onQuestion", "memoryPersistenceCapable"];
+export function parentSpecSeatOfCtx(ctx) {
+    const seat = ctx.parentSpecSeat;
+    const facts = SEAT_FACTS_ON_CTX.filter((k) => ctx[k] !== undefined);
+    if (seat === undefined) {
+        if (facts.length === 0)
+            return undefined;
+        throw seatRefusal(`the tool context carries ${facts.join(" / ")} but no \`parentSpecSeat\` — a delegating caller hands its children the seat it was minted (a Runner-filled ctx always carries it); spawning without it would silently drop the identity`);
+    }
+    const disagree = facts.filter((k) => (k === "oneShot" ? (ctx.oneShot === true) !== (seat.oneShot === true) : ctx[k] !== seat[k]));
+    if (disagree.length > 0)
+        throw seatRefusal(`the tool context's ${disagree.join(" / ")} disagree with its \`parentSpecSeat\` — one mint, one value`);
+    return seat;
+}
+function seatRefusal(message) {
+    const e = new Error(`parentSpecSeat: ${message}`);
+    e.code = "config.parent_spec_seat_missing";
+    return e;
+}

package/dist/core/permission-rule-model.d.ts

@@ -73,6 +73,8 @@
  * `Bash(git status:*)`) — the last two are strict-side divergences from upstream, registered as such.
  */
 import type { AssertAllKeysHandled } from "./ask-origin.js";
+import { type PathFamily, type PathIdentity } from "../tools/fs/safety.js";
+import type { PathTargetReading } from "./effective-path-target.js";
 /**
  * The closed set of rule BEHAVIORS — what a matching rule says about the call. The upstream vocabulary
  * verbatim (`allow` / `deny` / `ask`, the three settings lists), in PRECEDENCE order: when rules of more
@@ -538,7 +540,7 @@ export type PathRuleBaseLabelCoversEveryBase = AssertAllKeysHandled<Exclude<Path
 export declare function ruleBasesNeeded(rule: Pick<PersistedRule, "match" | "command">): readonly PathRuleBase[];
 /** Is this base usable by {@link resolvePathPattern} — an absolute path with a lexical normal form? A rule
  *  compiler asks this at compile time so a pattern is refused rather than compiled inert. */
-export declare function isUsablePathBase(base: string | undefined): boolean;
+export declare function isUsablePathBase(base: string | undefined, family: PathFamily | undefined): boolean;
 /**
  * The PATH family's tightening reach — three-valued like the command family's ({@link programRunReachOf}):
  * does this deny/ask rule reach the call's target path? The target is the caller's ALREADY-RESOLVED
@@ -555,7 +557,7 @@ export declare function isUsablePathBase(base: string | undefined): boolean;
  * defect (a `~/` deny falling back to the engine host's home guarded the wrong directory; a `/…` deny with
  * no root reached nothing at all).
  */
-export declare function pathRuleReachOf(rule: Pick<PersistedRule, "match" | "command" | "behavior">, target: string, bases: PathRuleBases): ProgramRunReachOutcome;
+export declare function pathRuleReachOf(rule: Pick<PersistedRule, "match" | "command" | "behavior">, target: PathIdentity, bases: PathRuleBases): ProgramRunReachOutcome;
 /**
  * Does this rule's command pattern admit `command`?
  *
@@ -692,7 +694,7 @@ export declare function pathWithinRoot(path: string, root: string): boolean;
  * bodies never come through here (their canonical spelling is unique and non-normal spellings are
  * refused at the validator); this is for the comparison INPUT a caller derives from a live call.
  */
-export declare function lexicalNormalAbsolutePathOf(path: string): string | undefined;
+export declare function lexicalNormalAbsolutePathOf(path: string, family: PathFamily | undefined, anchor?: string): PathIdentity | undefined;
 /**
  * design/382 §2.5 — the ONE admission predicate of the Read directory rule family, beside
  * {@link ruleAdmitsCommand} as its path-lane sibling. Four consumers share it (the minting round
@@ -715,7 +717,10 @@ export declare function lexicalNormalAbsolutePathOf(path: string): string | unde
  * there is nothing here for it to clear). As a DENY/ASK the same containment refuses or questions every
  * path under the directory, on whichever path tool the rule names.
  */
-export declare function directoryRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, path: string): boolean;
+export declare function directoryRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, path: PathIdentity, bases: PathRuleBases): boolean;
+/** The identity of a directory SPELLING (the cd resolver's `/`-rooted output) under the call's tree, for the
+ *  consumers that hand {@link directoryRuleAdmits} a spelling; a rule minted from it stores this form. */
+export declare function directoryIdentityOf(spelling: string, bases: PathRuleBases): PathIdentity | undefined;
 /** Does a rule's scope cover a task running in `cwd` (and, for the session dimension, in the session
  *  named by `sessionId`)? A project rule needs a cwd to compare against; without one it covers nothing
  *  (fail-closed). A session rule (design/382 §4.3) covers a call iff the call's `sessionId` equals the
@@ -872,8 +877,8 @@ export declare function adjudicatePersistedPathRules(rules: readonly PersistedRu
     cwd: string | undefined;
     sessionId?: string;
 }, targets: {
-    readonly tighten?: string;
-    readonly allow?: string;
+    readonly tighten?: PathTargetReading;
+    readonly allow?: PathTargetReading;
 }, bases: PathRuleBases): PersistedRuleVerdict | undefined;
 /**
  * design/375 §5.2 — the per-segment coverage table for `command`: which segments an eligible rule

package/dist/core/permission-rule-model.js

@@ -4,6 +4,7 @@ import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { pathTargetOf } from "./tool-registry.js";
+import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { readShellCommand } from "./shell-lexer.js";
 export const RULE_BEHAVIORS = ["deny", "ask", "allow"];
 const RULE_BEHAVIOR_SET = new Set(RULE_BEHAVIORS);
@@ -364,12 +365,18 @@ function baseValueOf(base, bases) {
     }
 }
 function resolvePathPattern(pattern, bases, behavior) {
-    if (pattern.startsWith("//"))
-        return { resolved: "/" + pattern.slice(2) };
+    const family = pathFamilyOf(bases);
+    const tree = bases.root ?? bases.cwd;
+    if (pattern.startsWith("//")) {
+        const abs = pathIdentityOf("/" + pattern.slice(2), family, tree);
+        return abs.ok ? { resolved: abs.identity } : { missingBase: "root" };
+    }
     const needed = ruleBasesNeeded({ match: "path", command: pattern })[0];
-    const normal = lexicalNormalAbsolutePathOf(baseValueOf(needed, bases) ?? "");
-    if (normal === undefined)
+    const baseValue = baseValueOf(needed, bases);
+    const base = baseValue !== undefined && isAbsoluteForFamily(family, baseValue) ? pathIdentityOf(baseValue, family, tree) : undefined;
+    if (base === undefined || !base.ok)
         return { missingBase: needed };
+    const normal = base.identity;
     const rest = pattern.startsWith("~/") ? pattern.slice(2) : pattern.startsWith("/") ? pattern.slice(1) : pattern.startsWith("./") ? pattern.slice(2) : pattern;
     const peeled = rest.endsWith("/**") ? rest.slice(0, -3) : rest;
     const bare = needed === "cwd" && peeled !== "" && !peeled.includes("/");
@@ -377,8 +384,8 @@ function resolvePathPattern(pattern, bases, behavior) {
     const body = anyDepth ? "**/" + peeled : rest;
     return { resolved: (normal === "/" ? "" : normal) + "/" + body };
 }
-export function isUsablePathBase(base) {
-    return base !== undefined && lexicalNormalAbsolutePathOf(base) !== undefined;
+export function isUsablePathBase(base, family) {
+    return base !== undefined && isAbsoluteForFamily(family, base) && pathIdentityOf(base, family, base).ok;
 }
 function segmentGlobMatches(glob, segment) {
     if (!glob.includes("*"))
@@ -422,15 +429,18 @@ function globSegmentsReach(globs, target) {
 }
 export function pathRuleReachOf(rule, target, bases) {
     if (rule.match === "subpath")
-        return directoryRuleAdmits(rule, target) ? REACHED : NOT_REACHED;
+        return directoryRuleAdmits(rule, target, bases) ? REACHED : NOT_REACHED;
     if (rule.match !== "path")
         return NOT_REACHED;
-    if (!isLexicalNormalAbsoluteDir(target) && target !== "/")
+    const family = pathFamilyOf(bases);
+    if (!isPathIdentity(target, family))
         return NOT_REACHED;
     const r = resolvePathPattern(rule.command, bases, rule.behavior);
     if ("missingBase" in r) {
-        return { reach: "unreadable", reason: `the rule is relative to ${PATH_RULE_BASE_LABEL[r.missingBase]} and this call supplies no absolute \`${r.missingBase}\` base to resolve it against` };
+        return { reach: "unreadable", reason: `the rule is relative to ${PATH_RULE_BASE_LABEL[r.missingBase]} and this call supplies no absolute \`${r.missingBase}\` base of this tree's family to resolve it against` };
     }
+    if (isUncIdentity(r.resolved) !== isUncIdentity(target))
+        return NOT_REACHED;
     const globs = r.resolved.split("/").filter((sg) => sg !== "");
     const segments = target.split("/").filter((sg) => sg !== "");
     return globSegmentsReach(globs, segments) ? REACHED : NOT_REACHED;
@@ -587,21 +597,9 @@ export function pathWithinRoot(path, root) {
     const base = root.endsWith("/") ? root : root + "/";
     return path.startsWith(base);
 }
-export function lexicalNormalAbsolutePathOf(path) {
-    if (typeof path !== "string" || !path.startsWith("/"))
-        return undefined;
-    const out = [];
-    for (const seg of path.split("/")) {
-        if (seg === "" || seg === ".")
-            continue;
-        if (seg === "..") {
-            if (out.length > 0)
-                out.pop();
-            continue;
-        }
-        out.push(seg);
-    }
-    return out.length === 0 ? "/" : "/" + out.join("/");
+export function lexicalNormalAbsolutePathOf(path, family, anchor) {
+    const r = pathIdentityOf(path, family, anchor);
+    return r.ok ? r.identity : undefined;
 }
 function isLexicalNormalAbsoluteDir(path) {
     if (typeof path !== "string" || !path.startsWith("/") || path.startsWith("//"))
@@ -609,14 +607,22 @@ function isLexicalNormalAbsoluteDir(path) {
     const segments = path.split("/").slice(1);
     return segments.length > 0 && segments.every((s) => s !== "" && s !== "." && s !== "..");
 }
-export function directoryRuleAdmits(rule, path) {
+export function directoryRuleAdmits(rule, path, bases) {
     if (rule.match !== "subpath")
         return false;
-    if (!isLexicalNormalAbsoluteDir(rule.command))
+    const family = pathFamilyOf(bases);
+    if (carriesDotSegment(rule.command, family))
+        return false;
+    const dir = pathIdentityOf(rule.command, family, bases.root ?? bases.cwd);
+    if (!dir.ok || !isIdentityDir(dir.identity, family))
         return false;
-    if (!isLexicalNormalAbsoluteDir(path))
+    if (!isPathIdentity(path, family) || !isIdentityDir(path, family))
         return false;
-    return pathWithinRoot(path, rule.command);
+    return pathWithinRoot(path, dir.identity);
+}
+export function directoryIdentityOf(spelling, bases) {
+    const r = pathIdentityOf(spelling, pathFamilyOf(bases), bases.root ?? bases.cwd);
+    return r.ok ? r.identity : undefined;
 }
 const CD_TARGET_REJECT_CHARS = /[*?[\]{}$`\\'"<>\n\r]/;
 function cdSegmentDirectoryOf(segment, opts) {
@@ -711,7 +717,8 @@ function resolveCdSegmentDirectories(segments, cwd) {
         const dir = cdSegmentDirectoryOf(segment, { cwd, priorCd });
         if (!priorCd && movesShellCursor(segment))
             priorCd = true;
-        return dir;
+        const bases = basesOfCwd(cwd);
+        return dir === undefined || isShellRootedSpellingUnmapped(pathFamilyOf(bases), dir) ? undefined : directoryIdentityOf(dir, bases);
     });
 }
 export function scopeCoversCwd(scope, cwd, sessionId) {
@@ -767,11 +774,14 @@ function firstEligibleDirectoryRule(rules, directory, call) {
     for (const rule of rules) {
         if (!eligiblePersisted(rule, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }, "allow"))
             continue;
-        if (directoryRuleAdmits(rule, directory))
+        if (directoryRuleAdmits(rule, directory, basesOfCwd(call.execCwd ?? call.cwd)))
             return rule;
     }
     return undefined;
 }
+function basesOfCwd(cwd) {
+    return cwd === undefined ? {} : { root: cwd };
+}
 export function adjudicatePersistedRules(rules, call) {
     for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
         if (behavior === "allow") {
@@ -798,23 +808,29 @@ export function adjudicatePersistedRules(rules, call) {
 export function adjudicatePersistedPathRules(rules, call, targets, bases) {
     for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
         if (behavior === "allow") {
-            if (targets.allow === undefined || call.tool !== READ_RULE_TOOL)
+            if (targets.allow?.kind !== "path" || call.tool !== READ_RULE_TOOL)
                 continue;
             for (const rule of rules) {
                 if (!eligiblePersisted(rule, call, behavior))
                     continue;
-                if (directoryRuleAdmits(rule, targets.allow))
+                if (directoryRuleAdmits(rule, targets.allow.identity, bases))
                     return { behavior, rules: [rule] };
             }
             continue;
         }
-        if (targets.tighten === undefined)
+        const tighten = targets.tighten;
+        if (tighten === undefined || tighten.kind === "refused")
             continue;
         let unreadable;
         for (const rule of rules) {
             if (!eligiblePersisted(rule, call, behavior))
                 continue;
-            const outcome = pathRuleReachOf(rule, targets.tighten, bases);
+            if (tighten.kind === "unreadable") {
+                if (rule.match === "path" || rule.match === "subpath")
+                    unreadable ??= { behavior: "ask", rules: [rule], unreadable: tighten.reason };
+                continue;
+            }
+            const outcome = pathRuleReachOf(rule, tighten.identity, bases);
             if (outcome.reach === "reached")
                 return { behavior, rules: [rule] };
             if (outcome.reach === "unreadable")
@@ -843,7 +859,7 @@ export function segmentCoverageOf(command, rules, call) {
                 proposed.some((p) => p.rule.tool === "Read"
                     ? dir !== undefined &&
                         eligibleContext({ tool: p.rule.tool, scope: p.scope }, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }) &&
-                        directoryRuleAdmits(p.rule, dir)
+                        directoryRuleAdmits(p.rule, dir, basesOfCwd(call.execCwd ?? call.cwd))
                     : eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
         };
     });
@@ -889,7 +905,7 @@ export function suggestRulesForCommand(command, ctx) {
         const parsed = parseRuleText(formatRuleText(directory, "subpath", READ_RULE_TOOL), "allow");
         if (!("rule" in parsed) || parsed.rule.match !== "subpath")
             return undefined;
-        if (!directoryRuleAdmits(parsed.rule, directory))
+        if (!directoryRuleAdmits(parsed.rule, directory, basesOfCwd(ctx?.execCwd ?? ctx?.cwd)))
             return undefined;
         return { kind: "directoryRead", rule: parsed.rule.rule, directory: parsed.rule.command, segment };
     };
@@ -963,7 +979,7 @@ export function suggestRulesForCommand(command, ctx) {
             if (parsedBatch.some((p) => p.tool !== "Read" && ruleAdmitsCommand(p, segment)))
                 continue;
             const dir = cdDirs[i];
-            if (dir !== undefined && parsedBatch.some((p) => directoryRuleAdmits(p, dir)))
+            if (dir !== undefined && parsedBatch.some((p) => directoryRuleAdmits(p, dir, basesOfCwd(ctx?.execCwd ?? ctx?.cwd))))
                 continue;
             const reason = carriesShellRedirection(segment) ? "redirection" : mintSegmentRule(segment) === undefined ? "no_rule_form" : "cap_overflow";
             uncoveredDetail.push({ segment, reason });

package/dist/core/permission-rules.js

@@ -2,6 +2,7 @@ import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
 import { catalogRuleFaceOf, pathTargetOf } from "./tool-registry.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule } from "./permission-rule-syntax.js";
 import { PATH_RULE_BASE_LABEL, isUsablePathBase, parseRuleText, pathRuleReachOf, programRunReachOf, ruleBasesNeeded } from "./permission-rule-model.js";
+import { pathFamilyOf } from "../tools/fs/safety.js";
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
 export { parsePermissionRule };
@@ -188,7 +189,7 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
                 }
                 for (const base of ruleBasesNeeded(parsedPath.rule)) {
                     const value = base === "cwd" ? (pathBases.cwd ?? pathBases.root) : pathBases[base];
-                    if (!isUsablePathBase(value)) {
+                    if (!isUsablePathBase(value, pathFamilyOf(pathBases))) {
                         bad(text, "unsupported.path_base", `"${text}" is relative to ${PATH_RULE_BASE_LABEL[base]}, and this policy was given no absolute \`pathBases.${base}\`${base === "cwd" ? " (or `root`)" : ""} to resolve it against — the rule could not be judged on any call`);
                     }
                 }
@@ -321,9 +322,13 @@ export function createPermissionRulePolicy(rules, opts) {
         let unreadable;
         for (const r of lane) {
             if (r.parsed.match === "subpath" || r.parsed.match === "path") {
-                if (target === undefined)
+                if (target === undefined || target.kind === "refused")
                     continue;
-                const outcome = pathRuleReachOf(r.parsed, target, pathBases);
+                if (target.kind === "unreadable") {
+                    unreadable ??= { rule: r, unreadable: target.reason };
+                    continue;
+                }
+                const outcome = pathRuleReachOf(r.parsed, target.identity, pathBases);
                 if (outcome.reach === "reached")
                     return { rule: r };
                 if (outcome.reach === "unreadable")

package/dist/core/protocol-naming.d.ts

@@ -18,13 +18,13 @@ export declare const MINTED_TOOL_SEGMENT_MIN_CHARS = 16;
  * live domain key here (the refresh splice). That case is decided by
  * {@link findNamespacePrefixCollision} and refused at the mount, loudly; the mint stays total.
  *
- * RB-83 (2026-07-25, red probe): the pattern this enforces is `{1,64}`, and only the charset half was
+ * The pattern this enforces is `{1,64}`, and only the charset half was
  * enforced. Both other halves matter for the same reason the charset does — an over-long or empty segment
  * produces a name the provider rejects, which 400s the WHOLE model request, the exact failure the intake
  * gate exists to contain ("a single misconfigured server never bricks the whole task").
  */
 export declare function normalizeNameSegment(name: string): string;
-/** RB-83: force a normalized segment into `{1,max}`, keeping long names distinct via a stable digest. */
+/** Force a normalized segment into `{1,max}`, keeping long names distinct via a stable digest. */
 export declare function clampNameSegment(seg: string, max?: number): string;
 /**
  * The registered-name prefix for `peer` in `ns` — i.e. the set `name.startsWith(prefix)` that a consumer

package/dist/core/remote-env.d.ts

@@ -508,7 +508,7 @@ export declare function missingRestoreSurface(env: ExecutionEnv): readonly ("res
  * A composite type guard (structural AND capability) so a `suspendVM` call site narrowed by THIS predicate
  * gets the {@link RemoteExecutionEnv} type without a cast — `true` always implies the structural check too.
  *
- * RB-439-b: it also requires the RESTORE surface ({@link missingRestoreSurface}). A suspend is only durable
+ * It also requires the RESTORE surface ({@link missingRestoreSurface}). A suspend is only durable
  * if something can undo it; an adapter that offers `suspendVM` but no `resumeVM` used to pass this guard,
  * take a real snapshot, commit a real checkpoint — and then blow up on the resume leg with an untyped
  * TypeError. "Suspendable" now means the whole round trip, so a half-adapter is rejected at the suspend site

package/dist/core/retired-keys.d.ts

@@ -0,0 +1,19 @@
+/**
+ * ONE presence rule for a RETIRED key on a caller-supplied bag (a deps object, an options object): the key is
+ * PRESENT iff ordinary property lookup answers a defined value — prototype and non-enumerable members included,
+ * exactly what the former direct read of the seat honored; an explicit `undefined` reads as absence, as every
+ * optional seat reads. Every retired-key door reads through here so no door grows its own idea of "present";
+ * each composes its own refusal from the answer. A table row is `{ key: replacement }` — the sentence that says
+ * what replaced the seat, quoted in the refusal.
+ */
+/** The first retired key present on `bag`, in table order, or undefined when none is. */
+export declare function retiredKeyOf(bag: object, table: Readonly<Record<string, string>>): {
+    key: string;
+    replacement: string;
+} | undefined;
+/**
+ * The deps-bag door: a retired seat still wired by a deployment is refused BY NAME (`config.deps_retired_key`)
+ * instead of vanishing silently — a seat that is silently dropped reads to the deployment as wired. `owner` is
+ * the bag's type name for the sentence (`RunnerDeps`, `RunWorkflowToolDeps`).
+ */
+export declare function assertNoRetiredKeys(bag: object, table: Readonly<Record<string, string>>, owner: string): void;

package/dist/core/retired-keys.js

@@ -0,0 +1,15 @@
+export function retiredKeyOf(bag, table) {
+    for (const [key, replacement] of Object.entries(table)) {
+        if (Reflect.get(bag, key) !== undefined)
+            return { key, replacement };
+    }
+    return undefined;
+}
+export function assertNoRetiredKeys(bag, table, owner) {
+    const hit = retiredKeyOf(bag, table);
+    if (hit === undefined)
+        return;
+    const e = new Error(`${owner}.${hit.key} is retired and is not read by this engine — ${hit.replacement}. Refused rather than ignored: a seat that is silently dropped reads to the deployment as wired.`);
+    e.code = "config.deps_retired_key";
+    throw e;
+}

package/dist/core/runner/abort-race.d.ts

@@ -6,7 +6,7 @@
  * same three helpers instead of each carrying a copy. Pure: no engine state, no clock.
  */
 /**
- * design/384 slice 1 — the per-call signal composition all three synchronous-wait seats share
+ * The per-call signal composition all three synchronous-wait seats share
  * (adjudicate / resolveAsk / resolveContentAsk): `AbortSignal.any([run, call])` when the gate
  * threaded a per-call signal, the bare run signal otherwise (host-driven gates and unthreaded emits
  * keep the historical binding byte for byte). The run signal is ALSO composed into the loop's turn
@@ -15,7 +15,7 @@
  * (both sources outlive it), so nothing here retains across calls.
  */
 export declare function composeCallSignal(runSignal: AbortSignal, callSignal: AbortSignal | undefined): AbortSignal;
-/** design/384 slice 2 — how a raced await ended. The generalized sibling of the ask-side
+/** How a raced await ended. The generalized sibling of the ask-side
  *  `raceAskWaitAgainstSignal` (tool-policy.ts): same three-state form over any value domain.
  *  `aborted` means the SIGNAL settled the race — the promise may still be pending and stays the
  *  caller's to detach. `threw` reports the rejection AS a rejection, never folded into the abort
@@ -31,7 +31,7 @@ export type RacedSettlement<T> = {
 } | {
     tag: "aborted";
 };
-/** design/384 slice 2 — settle a raced await the moment `signal` aborts, WITHOUT waiting for the
+/** Settle a raced await the moment `signal` aborts, WITHOUT waiting for the
  *  promise to notice. Pre-aborted entry answers at once; the listener is removed on settle
  *  whichever side wins (the `raceAbort` hygiene: `{once}` alone leaks a closure on the signal when
  *  the promise settles first). The mapped promise attaches BOTH handlers up front, so an abort-arm

package/dist/core/runner/active-skill-scope.d.ts

@@ -12,7 +12,7 @@ export type ActiveSkillFrame = {
     reason: string;
 };
 /**
- * The per-task LIFO stack of active skill frames (design/77 §3). Owned by `prepare-task`'s closure;
+ * The per-task LIFO stack of active skill frames. Owned by `prepare-task`'s closure;
  * the injected `skill` tool pushes onto it on a successful load, and a deny-narrowing policy reads it
  * on every tool call. A simple array is the stack — `push` on load, and the policy reads ALL frames
  * currently on it (the intersection). v1 keeps lifetime heuristic (see module header).
@@ -29,7 +29,7 @@ export declare class ActiveSkillScope {
     get size(): number;
 }
 /**
- * Build the Gate-3 deny-narrowing policy over a live {@link ActiveSkillScope} (design/77 §3). For each
+ * Build the Gate-3 deny-narrowing policy over a live {@link ActiveSkillScope}. For each
  * tool call, WHILE any skill frame is active:
  *  - DENY any tool not in the INTERSECTION of every active frame's `allowTools`.
  *  - For a WRITE tool with an `allowPaths` constraint on ANY active frame, DENY a write whose

package/dist/core/runner/active-skill-scope.js

@@ -1,4 +1,4 @@
-import { canonicalizeTarget } from "../../tools/fs/safety.js";
+import { canonicalizeTarget, pathFamilyOf } from "../../tools/fs/safety.js";
 import { pathTargetValue } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
 import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
@@ -100,7 +100,7 @@ export function createActiveSkillScopePolicy(opts) {
                             decisionReason: "safety",
                         };
                     }
-                    const canon = await canonicalizeTarget(env, path, signal, pathTargetBaseOf(declaredTarget, { root: rootPath, cwd: req.cwd }));
+                    const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootPath, cwd: req.cwd ?? env.cwd }), pathTargetBaseOf(declaredTarget, { root: rootPath, cwd: req.cwd }));
                     if (!canon.ok) {
                         return {
                             action: "deny",
@@ -111,7 +111,7 @@ export function createActiveSkillScopePolicy(opts) {
                     for (const m of constraining) {
                         const roots = [];
                         for (const raw of m.allowPaths ?? []) {
-                            const r = await canonicalizeTarget(env, raw, signal, rootPath);
+                            const r = await canonicalizeTarget(env, raw, signal, pathFamilyOf({ root: rootPath ?? env.cwd }), rootPath);
                             if (r.ok)
                                 roots.push(r.key);
                         }