@sema-agent/core 7.15.0 → 7.17.0

package/dist/core/runner/prepare-inherited-gate.js

@@ -1,8 +1,9 @@
 import { forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/subagent.js";
 import { isLiveQuestionFace } from "../ask-question.js";
+import { parentSpecSeatOf } from "../parent-spec-seat.js";
 import { createPreToolUseConstraintPolicy } from "../hooks.js";
 import { StubExecutionEnv } from "../stub-env.js";
-import { askApproverIdentity, isLiveApproverSeat } from "../tool-policy.js";
+import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 export function prepareInheritedGate(input) {
     const { spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
@@ -93,6 +94,7 @@ export function prepareInheritedGate(input) {
         }
     };
     const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
+    const parentSpecSeat = parentSpecSeatOf(spec, frozenOnQuestion);
     const provenanceForChildrenRef = {};
     const delegationProvenanceForChildren = () => provenanceForChildrenRef.current;
     const delegationSettlementRef = {};
@@ -106,8 +108,7 @@ export function prepareInheritedGate(input) {
             ...(ownSessionRulesRef.current !== undefined ? [ownSessionRulesRef.current] : []),
         ];
         const ownCallerPolicy = lockedPreflight.toolPolicy;
-        const durableMandate = input.runtimeCaps()?.forceDurableGate === true ||
-            (spec.durableApproval !== undefined && !isLiveApproverSeat(frozenOnAsk));
+        const durableMandate = durableMandateSourceOf({ forceDurableGate: input.runtimeCaps()?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined, onAsk: frozenOnAsk }) !== undefined;
         const contentMandate = input.runtimeCaps()?.forceDurableGate === true ||
             (spec.durableApproval !== undefined && !isLiveQuestionFace(frozenOnQuestion));
         const ownPreToolUse = input.preToolUseObservational() ? undefined : input.hooks()?.preToolUse;
@@ -186,15 +187,13 @@ export function prepareInheritedGate(input) {
             ...(readDenyAdditionsNormalized.length > 0 ? { readDenyPatterns: Object.freeze(readDenyAdditionsNormalized.map((e) => ({ ...e }))) } : {}),
             ...(spec.interactiveTools === false ? { interactiveTools: false } : {}),
             oneShot: spec.oneShot,
-            clientContext: spec.clientContext,
+            parentSpecSeat,
+            ...(internals?.questionFaceStripped === true ? { questionFaceStripped: true } : {}),
             excludeTools: toolFaceSnapshot.exclude,
             deferTools: toolFaceSnapshot.defer,
             alwaysLoadTools: toolFaceSnapshot.alwaysLoad,
             ...(toolFaceSnapshot.restoreGated !== undefined ? { restoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
             promptProfile,
-            ...(spec.additionalDirectories !== undefined ? { additionalDirectories: Object.freeze([...spec.additionalDirectories]) } : {}),
-            ...(spec.additionalReadDirectories !== undefined ? { additionalReadDirectories: Object.freeze([...spec.additionalReadDirectories]) } : {}),
-            ...(spec.envFacts !== undefined ? { envFacts: { ...spec.envFacts } } : {}),
             ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
             get memoryCaptureOptedOut() {
                 return input.memoryEngineSession()?.captureOptOut?.optedOut() ?? false;
@@ -263,5 +262,5 @@ export function prepareInheritedGate(input) {
             ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
         };
     };
-    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
+    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
 }

package/dist/core/runner/prepare-listings.d.ts

@@ -1,13 +1,13 @@
 /**
- * design/390 M15 — prepareTask's LISTINGS phase: the per-task agent definitions' tool-name audit
+ * PrepareTask's LISTINGS phase: the per-task agent definitions' tool-name audit
  * (deny entries fail loud, allow entries advise), the agent-listing announce face read off the
  * delegation tool's roster (with its deferred / excluded / removal-to-zero arms), the two listing
  * opt-out advisories, the announced-listings mirror seeded from the once-per-session ledger, the
  * deferred roster's ToolSearch ride, and the date_change seam. The body is the driver's stretch moved
- * verbatim; the interface is the dependency list it had implicitly (design/238 R-1).
+ * verbatim; the interface is the dependency list it had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between
- * the disclosure mount before it and the context-lane seats after it (design/390 §1.5 S1: a stretch
+ * the disclosure mount before it and the context-lane seats after it (a stretch
  * with no await is extracted as a sync function — an `async` wrapper would open a microtask window).
  *
  * Throws pass through unchanged: `config.agent.unknown_tool` (a deny entry naming a tool this

package/dist/core/runner/prepare-lsp.d.ts

@@ -1,13 +1,13 @@
 /**
- * design/390 §1.2 M8 — prepareTask's LSP phase, verbatim from the driver: the manager fold (spec > deps), the
+ * PrepareTask's LSP phase, verbatim from the driver: the manager fold (spec > deps), the
  * LSP tool mount over the per-task env with its git-ignore filter, the diagnostics lane behind its four
  * preconditions (a manager whose sessions feed a registry, write-capable hands, not opted out), the run-scoped
  * registry key, and the edit nudge (raw path → the SAME resolution the tool leg uses → registry reset +
  * session didChange). No manager ⇒ nothing mounts and both lane seats are undefined. The interface is the
- * dependency list the segment had implicitly (design/238 R-1).
+ * dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the
- * fork-governance note before it and the memory trio's occupancy read after it (design/390 §1.5 S1: a stretch
+ * fork-governance note before it and the memory trio's occupancy read after it (a stretch
  * with no await is extracted as a sync function — an `async` wrapper would open a microtask window).
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  */

package/dist/core/runner/prepare-memory-engine-session.d.ts

@@ -1,16 +1,16 @@
 /**
- * design/390 §1.2 M12 — prepareTask's MEMORY-ENGINE-SESSION phase, verbatim from the driver: the content-origin
- * classification + one-way session pollution wrap section (design/178 §3 / design/180 half A / design/324 /
- * design/336 §3.3 + §5.5 / design/378 D-4 / design/380 O9a). Its arming predicate (a mounted memory session OR an
+ * PrepareTask's MEMORY-ENGINE-SESSION phase, verbatim from the driver: the content-origin
+ * classification + one-way session pollution wrap section (consolidating several design threads).
+ * Its arming predicate (a mounted memory session OR an
  * upstream recorder channel), the chain-narrowed classification config, the children's provenance seat, the
  * declared-MCP-class announcement, the settlement seat, the per-tool wrap with its three record verbs (mark /
  * recordExternal / recordIncomplete), the Read tool's recall-taint arm and the delegation arm's three-valued
  * attestation judgment all live here; the announcement helper only this section called moved with it. The
- * interface is the dependency list the segment had implicitly (design/238 R-1).
+ * interface is the dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the awaits sit inside the wrappers it
  * installs, which run at tool-call time), so the phase adds no yield between the deferred classification before it
- * and the prompt assembly after it (design/390 §1.5: a stretch with no await is extracted as a sync function).
+ * and the prompt assembly after it (a stretch with no await is extracted as a sync function).
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * One read changed spelling and nothing else: the declared-class announcement read `mcp?.statuses` while `mcp` had

package/dist/core/runner/prepare-memory.d.ts

@@ -18,12 +18,6 @@ export interface PrepareMemoryInput {
     /** borrowed-readonly — the resolved task root: the containment boundary every derived memory dir
      *  is checked against, and the repo-root fallback when `deps.rootPath` is unset. */
     taskRootPath: string;
-    /** borrowed-mutable — the caller's write-gate cell, and THIS phase is its writer: it installs the
-     *  memory write gate into `.current` (the module header's one out-param effect). Identity is the
-     *  contract — the caller's hands/read-face seat reads this exact cell. */
-    memoryWriteGateRef: {
-        current?: BeforeWriteHook;
-    };
     /**
      * borrowed-readonly — #181-F5: whether a tool NAMED `Write` (the tool the CC `# Memory` instruction names) is on the
      * ASSEMBLED roster this run, not excluded, AND can actually REACH the host-side memory root:
@@ -199,6 +193,10 @@ export interface MemoryInjectionComposition {
 export interface PrepareMemoryResult {
     memoryEngineSession: Prepared["memoryEngineSession"];
     memoryTools?: ToolSpec[];
+    /** owned — the memory WRITE gate (Write/Edit/NotebookEdit run their FINAL text through MemoryEngine.gateWrite when
+     *  the target lands inside the memory writable root; the read-only plane refuses its own domain). Present iff a memory
+     *  engine mounted; the hands phase composes it into the band's beforeWrite (a memory-less run: every write passes). */
+    memoryWriteGate?: BeforeWriteHook;
     /**
      * owned — #691: the injection's COMPOSITION step, run by the driver AFTER the hands phase (the mount above runs
      * BEFORE it). It performs the one destructive read this phase has — `inject()` drains the announcement queue —

package/dist/core/runner/prepare-memory.js

@@ -10,9 +10,11 @@ import { readSessionCaptureOptOut } from "../memory-engine/layout.js";
 import { createMemoryEngineTools } from "../memory-engine/tools.js";
 import { assertScopeContractPlacement, parseScopeKey, resolveProjectId } from "../memory-engine/scope-contract.js";
 import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
+import { writableRootOf } from "../memory-engine/types.js";
 let undeclaredCapturePostureAnnounced = false;
 export async function prepareMemory(input) {
-    const { spec, deps, sessionId, taskRootPath, memoryWriteGateRef, admissionCtx } = input;
+    const { spec, deps, sessionId, taskRootPath, admissionCtx } = input;
+    let memoryWriteGate;
     const memorySpec = normalizeMemorySpec(spec.memory);
     let admittedOrgScopes = [];
     let ownOrgVerdict;
@@ -460,21 +462,19 @@ export async function prepareMemory(input) {
             }
             const foreignUnderRoot = [];
             if (input.writeToolsMounted && writeHandle.writeScope !== null && input.advertisedWritableDirs !== undefined) {
-                for (const d of [...writeEngine.readonlyDirNamesUnderRoot(writeHandle)].sort())
-                    foreignUnderRoot.push(`another scope's directory ${d}`);
                 const controlPlane = canonicalize(writeEngine.controlPlaneDir);
-                if (isContainedIn(writeHandle.writableRoot, controlPlane))
+                if (isContainedIn(writableRootOf(writeHandle), controlPlane))
                     foreignUnderRoot.push(`the engine's control plane ${controlPlane}`);
             }
             if (foreignUnderRoot.length > 0) {
-                deps.onError?.(new Error(`memory advertised writable directory refused: the write scope's root ${writeHandle.writableRoot} contains what is not the model's to touch (${foreignUnderRoot.join("; ")}) — the file tools' root fence is directory-granular, so admitting it would expose those files; memory writes through the file tools stay closed this session and the write instruction is not taught.`), { phase: "config", sessionId });
+                deps.onError?.(new Error(`memory advertised writable directory refused: the write scope's root ${writableRootOf(writeHandle)} contains what is not the model's to touch (${foreignUnderRoot.join("; ")}) — the file tools' root fence is directory-granular, so admitting it would expose those files; memory writes through the file tools stay closed this session and the write instruction is not taught.`), { phase: "config", sessionId });
             }
             writeChannelOpen =
                 input.writeToolsMounted &&
                     writeHandle.writeScope !== null &&
                     foreignUnderRoot.length === 0 &&
-                    (input.advertisedWritableDirs === undefined || (await input.advertisedWritableDirs.admit({ path: writeHandle.writableRoot, advertiser: "memory", expectCanonical: writeHandle.writableRoot })));
-            memoryWriteGateRef.current = async (w) => {
+                    (input.advertisedWritableDirs === undefined || (await input.advertisedWritableDirs.admit({ path: writableRootOf(writeHandle), advertiser: "memory", expectCanonical: writableRootOf(writeHandle) })));
+            memoryWriteGate = async (w) => {
                 if (readOnlyEngine !== undefined && readOnlyHandle !== undefined) {
                     const ro = readOnlyEngine.gateWrite(readOnlyHandle, w.key, w.content);
                     if (!ro.ok)
@@ -482,7 +482,7 @@ export async function prepareMemory(input) {
                 }
                 if (input.memoryPersistenceDeclared === false) {
                     const root = writeHandle.writableRoot;
-                    if (w.key === root || w.key.startsWith(`${root}${sep}`)) {
+                    if (root !== null && (w.key === root || w.key.startsWith(`${root}${sep}`))) {
                         return {
                             ok: false,
                             code: "read_only_layering",
@@ -493,7 +493,7 @@ export async function prepareMemory(input) {
                 }
                 {
                     const root = writeHandle.writableRoot;
-                    if (w.key === root || w.key.startsWith(`${root}${sep}`)) {
+                    if (root !== null && (w.key === root || w.key.startsWith(`${root}${sep}`))) {
                         const state = captureOptedOut ? { record: { at: 0, reason: "in-run state" }, fault: false } : await writeEngine.sessionCaptureOptOutOrFault(sessionId);
                         if (state.record !== undefined || state.fault) {
                             return {
@@ -777,6 +777,7 @@ export async function prepareMemory(input) {
         ownOrgVerdict,
         effectiveMemoryScopes,
         ...(memoryTools !== undefined ? { memoryTools } : {}),
+        ...(memoryWriteGate !== undefined ? { memoryWriteGate } : {}),
         composeInjection,
     };
 }

package/dist/core/runner/prepare-offload-wrappers.d.ts

@@ -1,11 +1,11 @@
 /**
- * design/390 §1.2 M0 (the offload half of the prelude) — prepareTask's nested-usage accumulator, the
+ * (The offload half of the prelude) — prepareTask's nested-usage accumulator, the
  * large-tool-result offload store resolution and the THREE offload wrappers every later mount site
  * applies (caller tools, first-party hand tools, remote MCP/A2A peers), verbatim from the driver.
  *
  * SYNCHRONOUS by construction: the segment held no await in the driver, and a phase that yields where
  * the driver did not would open a microtask window between two steps that used to be adjacent (the
- * design/238 T1 posture). Nothing here touches the store — the wrappers close over it and only the
+ * posture). Nothing here touches the store — the wrappers close over it and only the
  * wrapped tools' `execute` reach it, at run time.
  *
  * What stays in the driver: the trust-axis choice of `offloadScope` (`spec.principal ?? "default"`)

package/dist/core/runner/prepare-park-ask.d.ts

@@ -1,11 +1,11 @@
 /**
- * design/390 §1.2 M19 (park ask) — prepareTask's PARK CLOSURE and CONTENT-ASK ROUTING closure, verbatim from the driver's
+ * PrepareTask's PARK CLOSURE and CONTENT-ASK ROUTING closure, verbatim from the driver's
  * gate-machinery block: `resolveContentAsk` (the question face's delivery race, the binding table's cap and redemption
  * identity, the stranded-answer disclosure) and `suspendAsk` (the sync-first decline and the park-priority mandates, the
  * args capture / fidelity projection / re-adjudication steps, the pause-then-cut fence, the gate-kind choice, the row
  * mint, the commit through the saga and the post-commit publication). The one module-scope helper only this segment
- * threw (`ParkRefusal`) moved with it. The interface is the dependency list the segment had implicitly (design/238
- * R-1) — the two closures used to capture every seat here off the driver's scope, which is the capture surface this
+ * threw (`ParkRefusal`) moved with it. The interface is the dependency list the segment had implicitly
+ * — the two closures used to capture every seat here off the driver's scope, which is the capture surface this
  * decomposition exists to make explicit.
  *
  * The thirteen-argument park closure is unchanged: twelve positional seats then the structural {@link AskCarry}, the
@@ -13,7 +13,7 @@
  * carry onto the row exactly as before — this phase mints no origin, changes no word, adds no arm to the closed set.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (both closures run per tool call), so the
- * phase adds no yield between the boundary parks before it and the gate station after it (design/390 §1.5).
+ * phase adds no yield between the boundary parks before it and the gate station after it.
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * Both closures exist exactly when the ask lane and the saga do (the same predicate) — an absent lane answers two absent
@@ -50,7 +50,7 @@ export interface PrepareParkAskInput {
     /** borrowed-readonly — the leg's checkpoint store, or undefined (then `suspendAsk` is absent — the park predicate's store
      *  term). Read: the declared fidelity; the saga writes to it. */
     checkpointStore: CheckpointStore | undefined;
-    /** borrowed-readonly — the leg's delta seat (design/388 B18): the park reads the gated tool's identity off its
+    /** borrowed-readonly — the leg's delta seat (B18): the park reads the gated tool's identity off its
      *  CURRENT roster snapshot so the row carries who the action was minted against. */
     toolRosterDeltas: ToolRosterDeltaSeat;
     /** borrowed-readonly — the wiring-manifest phase's park predicate (`parkLane.effective`): arms `suspendAsk`. */
@@ -155,7 +155,7 @@ export interface PrepareParkAskResult {
 /** The M19 park-ask phase body — prepareTask's park closure and content-ask routing stretch, verbatim (see the module header). */
 export declare function prepareParkAsk(input: PrepareParkAskInput): PrepareParkAskResult;
 /**
- * From the resumed/active transcript, the batch position of `currentId` (design/45 §4.ter): the tool-call
+ * From the resumed/active transcript, the batch position of `currentId`: the tool-call
  * ids of the assistant message that issued it (the batch), and the subset already resolved (executed
  * before the suspend — #1..k-1). ID-based, not positional (council Question #1): immune to reordering.
  */

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -1,14 +1,14 @@
 /**
- * design/390 §1.2 M17 (design/238 P21) — prepareTask's POLICY-CHAIN phase, verbatim from the driver: the caller policy
+ * PrepareTask's POLICY-CHAIN phase, verbatim from the driver: the caller policy
  * and its name audit (advisory once per deployment; the two hard refusals), the session / ancestor / frozen-projection /
  * skill-scope deny-narrowing layers and their fold, the resume-edit base policy, the hook record with its timeout seat
  * and observational half, the same-instance arbitration machinery (the caller slot's first-decision record), the
- * inherited-unavailable marker channel, the RB-40 grant record, the sandbox-admission mode's arming and its three
+ * inherited-unavailable marker channel, the grant record, the sandbox-admission mode's arming and its three
  * sideband maps, the source-identity and risk-axes factories, the two permission-rule lanes and the rule-offer
  * factory, the approved-edit re-check, the inherited-constraint wrappers (the same-instance adapter and the true
  * wrapper), the rewrite-emitter index and the instrumented chain, the integrity guards, the fold, and the final-form
  * re-check that is the effective policy. The advised-names dedupe pair only this section reads moved with it.
- * The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * The interface is the dependency list the segment had implicitly.
  *
  * ASYNC PHASE: the stretch awaits the session-policy store (the task's own rules and each ancestor's live re-read)
  * exactly where the segment did; the closures it builds await at tool-call time. The phase boundary adds one
@@ -75,9 +75,9 @@ export interface PreparePolicyChainInput {
         irreversible?: false;
         egress?: false;
     }>;
-    /** borrowed-readonly — the caller tools' names, the first-await snapshot (the sandbox boundary predicate: a caller tool
-     *  is never contained by the hand tools' env). */
-    ownToolNames: ReadonlySet<string>;
+    /** borrowed-readonly — the ENGINE HAND roster: every tool whose effect dispatches through the task's execution env,
+     *  membership minted at the mount sites (the sandbox boundary predicate's one containment fact). */
+    envHandToolNames: ReadonlySet<string>;
     /** borrowed-readonly — the shell-seat provenance set (the offer factory's `shellGated` mandate term, read per call). */
     shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the tracked-cwd seat, read per call by the lanes and the offer factory (never written here). */
@@ -148,7 +148,7 @@ export interface PreparePolicyChainResult {
     /** borrowed-mutable — the inherited-unavailable marker channel. Writers: the inherited arms here (mark); the gate station
      *  (the lifecycle-end sweep) and the park lane's consumers (delete on consumption). */
     inheritedUnavailableAsks: Set<string>;
-    /** borrowed-mutable — the RB-40 grant record. Writers: the inherited arms here (record a clean allow at a live approver);
+    /** borrowed-mutable — the grant record. Writers: the inherited arms here (record a clean allow at a live approver);
      *  the gate station (consume on reuse, sweep at settlement). */
     inheritedAskGrants: Map<string, {
         approver: unknown;

package/dist/core/runner/prepare-policy-chain.js

@@ -1,11 +1,10 @@
-import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, isLiveApproverSeat, resolveAsk, toolPolicyNameSets } from "../tool-policy.js";
+import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, attestAskUnresolvableCause } from "../tool-policy.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
@@ -16,7 +15,7 @@ import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedTools, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const policy = lockedPreflight.toolPolicy;
     const auditPolicyNames = (auditee) => {
         const nameGroups = toolPolicyNameSets(auditee);
@@ -144,6 +143,12 @@ export async function preparePolicyChain(input) {
         inheritedUnavailableAsks.add(toolCallId);
         return true;
     };
+    const mandatedCallFloats = (toolCallId) => resolveCheckpointStore(spec, deps) !== undefined && (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) && markInheritedUnavailable(toolCallId);
+    const mandateUnreconstructibleDeny = (creq) => attestAskUnresolvableCause({
+        action: "deny",
+        message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+    }, "mandate_unreconstructible", creq);
+    const markerChannelFullDeny = (creq) => attestAskUnresolvableCause({ action: "deny", message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed` }, "approver_unavailable", creq);
     const inheritedAskGrants = new Map();
     const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs) => {
         if (typeof approver !== "function")
@@ -190,7 +195,7 @@ export async function preparePolicyChain(input) {
         list.push({ cls, layer });
         foldAskClasses.set(toolCallId, list);
     };
-    const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName) || toolName === SEND_MESSAGE_TOOL_NAME;
+    const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || !envHandToolNames.has(toolName);
     const emitSandboxAdmitted = (info) => {
         emitTrace(deps.tracer, () => ({
             kind: "permission.sandbox_admitted",
@@ -358,16 +363,9 @@ export async function preparePolicyChain(input) {
                         };
                     }
                     if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
+                        if (mandatedCallFloats(creq.toolCallId))
                             return first;
-                        }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
+                        return mandateUnreconstructibleDeny(creq);
                     }
                     const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call" });
                     if (judged.kind === "allow")
@@ -398,10 +396,7 @@ export async function preparePolicyChain(input) {
                     if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                         if (markInheritedUnavailable(creq.toolCallId))
                             return inheritedAsk;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
+                        return markerChannelFullDeny(creq);
                     }
                     settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                     if (resolved.action !== "allow")
@@ -437,16 +432,9 @@ export async function preparePolicyChain(input) {
                         };
                     }
                     if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
+                        if (mandatedCallFloats(creq.toolCallId))
                             return decision;
-                        }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
+                        return mandateUnreconstructibleDeny(creq);
                     }
                     const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
                     const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call" });
@@ -477,10 +465,7 @@ export async function preparePolicyChain(input) {
                     if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                         if (markInheritedUnavailable(creq.toolCallId))
                             return inheritedAsk;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
+                        return markerChannelFullDeny(creq);
                     }
                     settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                     if (resolved.action !== "allow")

package/dist/core/runner/prepare-prompt-assembly.js

@@ -95,7 +95,7 @@ export async function preparePromptAssembly(input) {
         }
         : undefined;
     const promptConstitution = assembled.constitution;
-    const promptBlocks = assembled.legacyBlocks;
+    const promptBlocks = assembled.blocks;
     const collisionAudit = auditToolCollisions(tools);
     for (const y of collisionAudit.yields) {
         onceLedger.onError(new Error(`tool mount: caller tool "${y.name}" shadows another tool with the same canonical name (deliberate last-write-wins yield — the later mount serves)`), { phase: "config", sessionId });

package/dist/core/runner/prepare-prompt-inputs.d.ts

@@ -1,11 +1,11 @@
 /**
- * design/390 M10 — prepareTask's PROMPT-INPUTS phase: the prompt provider selection, the runtime
+ * PrepareTask's PROMPT-INPUTS phase: the prompt provider selection, the runtime
  * feature flags the harness-context block gates on (so it never claims a mechanism the task lacks),
  * the three-source user system prompt + the caller's append block, the fenced MCP server-instructions
  * block, the environment facts (client zone + date basis, knowledge cutoff, the deployment's sandbox
  * axes, resume-continuity facts on a durable-resume leg only, the hands facts + the one batched env
- * probe with its cwd/pwd alignment guard) and the git-status lane probe. The body is the driver's
- * stretch moved verbatim; the interface is the dependency list it had implicitly (design/238 R-1).
+ * probe with its cwd/pwd alignment guard) and the git-status lane probe. The body is moved verbatim
+ * from the driver's own stretch; its interface is the dependency list that stretch had implicitly.
  *
  * ASYNC BY CONTENT: the stretch awaits the env probe (hands) and the git-status lane probe (always).
  * It sits past prepareTask's first await, so the driver's `await` adds no window a caller could reach.
@@ -13,7 +13,7 @@
  * The one input computed by the DRIVER rather than read here: `failClosedReason` — the
  * self-orchestration fail-closed advisory's text. Its helper takes the whole `TaskSpec`/`RunnerDeps`
  * (it audits several deployment seats), which this phase's narrow `spec`/`deps` seats cannot satisfy
- * (design/238 R-4); the driver evaluates the helper in the Input literal and this phase only announces
+ * The driver evaluates the helper in the Input literal and this phase only announces
  * the result on the operator lane, exactly where the stretch always did.
  *
  * Nothing here throws on its own: the env probe and the alignment guard are best-effort (a stub/odd env
@@ -91,7 +91,7 @@ export interface PreparePromptInputsInput {
     additionalRootsCanonical: readonly string[];
     /** borrowed-readonly — the canonical extra read-only roots (copied into the env facts). */
     additionalReadRootsCanonical: readonly string[];
-    /** borrowed-readonly — #691: the advertised-writable-directory seat (hands only). The scratchpad section is
+    /** borrowed-readonly — the advertised-writable-directory seat (hands only). The scratchpad section is
      *  rendered only when the seat did not SKIP the scratchpad — a directory the fence refused is not advertised. */
     advertisedWritableDirs?: AdvertisedWritableDirs;
     /** borrowed-readonly — the acquired session's id (operator-line context). */

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -36,7 +36,7 @@ export interface PrepareProtocolToolsInput {
      *  wrapper) and, at RUN time, the refresh closure's splice within a server's name-prefix domain. Later
      *  phases push their own mounts; the roster's full writer table is the delegation-surface phase's. */
     roster: RosterBuilder;
-    /** borrowed-mutable — the run-time delta seat (design/388 §2.5): the refresh closure re-mints the roster through it after
+    /** borrowed-mutable — the run-time delta seat: the refresh closure re-mints the roster through it after
      *  every re-splice so the stream learns of the change. Armed by the driver after the roster is minted. */
     rosterSeat: ToolRosterDeltaSeat;
     /** borrowed-readonly — the large-result wrapper for protocol tools (per-tool `_meta` bar, 50K default). */

package/dist/core/runner/prepare-question-face.d.ts

@@ -1,17 +1,17 @@
 /**
- * design/390 §1.2 M7 — prepareTask's QUESTION-FACE phase, verbatim from the driver: the leg's ONE checkpoint-store
+ * PrepareTask's QUESTION-FACE phase, verbatim from the driver: the leg's ONE checkpoint-store
  * read, the durable mandate as it binds at the question seat, the content-ask binding table (with the leak
  * bound the routing lane checks against — the constant below), the stranded-answer disclosure and the leg-end
  * settle, the three-way mount decision (live face / durable face / override), and the AskUserQuestion mount
  * with its redeemed-approval, posture, fallback and synthetic-continuation arms. The interface is the
- * dependency list the segment had implicitly (design/238 R-1).
+ * dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the
- * offload-reader mount before it and the scheduler mount after it (design/390 §1.5 S1: a stretch with no await
+ * offload-reader mount before it and the scheduler mount after it (a stretch with no await
  * is extracted as a sync function — an `async` wrapper would open a microtask window). Read-stability of the
  * host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
- * One seat is a LIVE GETTER (design/238 D-3): the inherited-unavailable marker set is declared by the driver's
+ * One seat is a LIVE GETTER: the inherited-unavailable marker set is declared by the driver's
  * gate-fold section AFTER this phase and read per call at RUN time, so it enters as `() => ReadonlySet` — a
  * read before the driver declares it throws (temporal dead zone), which is the fail-loud an uninitialized
  * live read owes.

package/dist/core/runner/prepare-run-refs.d.ts

@@ -1,17 +1,17 @@
 /**
- * design/390 §1.2 M3a — prepareTask's RUN-REFS phase, verbatim from the driver: the run's own edited-files
+ * PrepareTask's RUN-REFS phase, verbatim from the driver: the run's own edited-files
  * ledger, the harness ref, the per-task skill scope, the display-forwarding wrapper, the three run-local refs
  * (review request / stop-after-turn / plan mode) with the ctx primitives that write them, the subagent-retain
  * ledger and the worktree-isolation helper. Nothing here has behavior of its own: the phase MINTS SEATS —
  * mutable cells and the closures bound to them — that later phases, the tool ctx and the run loop read and
- * write. The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * write. The interface is the dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the
- * file-history phase before it and the inherited-gate fold after it (design/390 §1.5 S1: a stretch with no
+ * file-history phase before it and the inherited-gate fold after it (a stretch with no
  * await is extracted as a sync function — an `async` wrapper would open a microtask window).
  *
- * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member (design/238
- * R-3): the closures minted here, the driver's harness build, the project-context phase's inherited-skill
+ * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member:
+ * the closures minted here, the driver's harness build, the project-context phase's inherited-skill
  * seed, the skill tool, and the run loop's two writes — nothing else writes them. Read-stability of the host
  * handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  */
@@ -43,8 +43,8 @@ export interface PrepareRunRefsResult {
     /** owned — the ledger's LIVE read face (`Prepared.editedFilesSnapshot`, read at result assembly). */
     editedFilesSnapshot: EditedFilesLedger["snapshot"];
     /** borrowed-mutable — the harness seat: holds the harness once built, so a tool's execute can read the model
-     *  the parent is CURRENTLY on (design/38 1B: the `ToolExecuteContext.model` snapshot a delegation tool uses
-     *  for `inherit`), and breaks the harness↔tool_search build cycle (design/36 rematerialize). Writers (R-3):
+     *  the parent is CURRENTLY on (the `ToolExecuteContext.model` snapshot a delegation tool uses
+     *  for `inherit`), and breaks the harness↔tool_search build cycle (rematerialize). Writers (R-3):
      *  the driver, ONCE, when the harness is built (`harnessRef.current = harness`) — before any run. Readers:
      *  `requestStopAfterTurn` here (mirrors the stop onto the harness's one-way flag), the tool ctx's model
      *  snapshot, the rebuild seam and the delegation mounts. Identity is the contract: every closure minted
@@ -63,7 +63,7 @@ export interface PrepareRunRefsResult {
      *  (the first request wins) and the run loop's turn-boundary consumer, which clears `pending` once the
      *  `plan_review` checkpoint is minted. */
     reviewRequestRef: Prepared["reviewRequestRef"];
-    /** owned — the ctx primitive that arms `reviewRequestRef` (design/80 D-B). */
+    /** owned — the ctx primitive that arms `reviewRequestRef`. */
     requestReview: (opts?: {
         reason?: string;
     }) => void;
@@ -79,7 +79,7 @@ export interface PrepareRunRefsResult {
     /** owned — the ctx primitive (mounted on the ctx only under `enablePlanMode`). */
     enterPlanMode: () => void;
     /** ownership-ref — the parent-run subagent-retain ledger, or undefined when the spec did not opt in. Its
-     *  lifecycle protocol belongs to the Runner (disposed in the task's terminal finally, design/122 D4); a
+     *  lifecycle protocol belongs to the Runner (disposed in the task's terminal finally); a
      *  prepare that throws has nothing to release here — the ledger is empty until a delegation retains. */
     subagentRetain: SubagentRetainLedger | undefined;
     /** owned — the Agent tool's worktree-isolation helper (lazy; write-capable runs only), or undefined. */
@@ -90,8 +90,8 @@ export interface PrepareRunRefsResult {
  * A run that opted into `forwardSubagentEvents` may have BACKGROUND children whose frames are forwarded to the
  * deployment's sink from the child's own run. Those forwards are scheduled on later microtasks than the parent's
  * turn, so "the parent stream ended" and "the child's already-emitted frames reached the sink" are two different
- * moments — the gap is one microtask ladder deep and moves whenever the gate's station structure changes (design/393
- * / #594: the three-layer gate added three async frames to a child's gated call, and a consumer that read the parent
+ * moments — the gap is one microtask ladder deep and moves whenever the gate's station structure changes
+ * (the three-layer gate added three async frames to a child's gated call, and a consumer that read the parent
  * to `done` then inspected the sink lost the child's `tool_end`). The rule is not a tick count: **before the parent
  * says `done`, every frame a child had already handed to the forward channel is delivered.** One macrotask turn is
  * the smallest boundary that strictly orders after all pending microtasks; it is taken only on the opted-in run,

package/dist/core/runner/prepare-safety-scan.d.ts

@@ -9,10 +9,10 @@ export interface PrepareSafetyScanInput {
     deps: RunnerDeps;
 }
 /**
- * The scan's outputs. Ownership annotations (design/238 §4.2 four-class form):
+ * The scan's outputs. Ownership annotations (four-class form):
  *
  * `ownToolNames` is **borrowed-readonly** — a first-await snapshot with no mutation anywhere after
- * the scan; its one later read is the sandbox-boundary predicate's `.has()`.
+ * the scan (sandbox containment reads the env-hand roster, not this set).
  *
  * The six collections are **borrowed-mutable**: the driver and later phases fold into them IN
  * PLACE (identity is part of the contract — closures alias these exact objects). Mutation owners

package/dist/core/runner/prepare-suspend-saga.d.ts

@@ -1,16 +1,16 @@
 /**
- * design/390 §1.2 M19 (suspend saga) — prepareTask's DURABLE SETTLEMENT machinery, verbatim from the driver's
+ * PrepareTask's DURABLE SETTLEMENT machinery, verbatim from the driver's
  * gate-machinery block: the in-flight spend and repair-bundle folds, the §4.bis correctness-state serializer, the shared
  * paused-VM compensation bound to this task's failure ledger, the put-commit + put-failure saga (the pre-put cut
  * checkpoint, the screening-park disclosure, the rejection read-back with its three answers), the suspend-loop cap, the
  * env capability split (suspendable / park-only / neither) and the park-only handle. The module-scope helpers only this
  * segment called moved with it (the compensation's bound and body, the auto-mode latch reading, the placement stamp).
- * The interface is the dependency list the segment had implicitly (design/238 R-1) — every seat below used to be
+ * The interface is the dependency list the segment had implicitly — every seat below used to be
  * captured off the driver's scope.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (every await lives inside the closures it
  * builds, which run at park time), so the phase adds no yield between the ask lane before it and the boundary parks
- * after it (design/390 §1.5). Read-stability of the host handles for the call: {@link RunInternals}
+ * after it. Read-stability of the host handles for the call: {@link RunInternals}
  * (`@contract prepare.deps-read-stable`).
  *
  * The saga exists exactly when the wiring-manifest phase's `gateMachineryActive` holds (the ask lane's presence law) —
@@ -27,7 +27,7 @@ import type { OutputRef } from "./synthetic-tools.js";
 import type { HookInvocationIdentity } from "../hooks.js";
 import type { InheritedGate, Prepared, PrepareResume, RunInternals, SuspendSaga } from "./contracts.js";
 /**
- * design/384 slice 2 — the ONE compensation for a paused-but-unparked VM, shared by the fence's
+ * The ONE compensation for a paused-but-unparked VM, shared by the fence's
  * post-pause checkpoints (③ in the park closure, ④ in the saga) and the saga's put-failure absent
  * arm (previously inline there: same two hops, one implementation now, so the three sites cannot
  * drift). Restores the workspace (bounded transient retry) then re-establishes consistency