@sema-agent/core 7.17.7 → 7.18.0

package/dist/core/runner/contracts.d.ts

@@ -20,7 +20,7 @@ import type { ActiveWorktreeSession, AgentHarness, AgentMessage, AgentTool, Anno
 import type { Model } from "../../internal/llm.js";
 import type { WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import type { ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
-import type { CwdRef, ReadFace } from "../../tools/fs/index.js";
+import type { CwdRef, ContainmentFace } from "../../tools/fs/index.js";
 import type { MaterializedA2a } from "../a2a.js";
 import type { CompactionForkContext, CompactionPhaseDurations, MaybeCompactOptions, RapidRefillState } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
@@ -43,7 +43,7 @@ import type { SystemInjectionPriority, TaskNotificationPayload } from "../task-n
 import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
-import type { AgentDefinition, Brain, CompactOutcome, ModelRoles, NestedUsageAccum, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
+import type { AgentDefinition, Brain, CompactOutcome, ModelRoles, NestedUsageAccum, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskEventIdentity, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
 import type { WiringManifest } from "../wiring-manifest.js";
 import type { ActiveSkillFrame } from "./active-skill-scope.js";
 import type { BudgetAxis } from "./assemble-result.js";
@@ -157,6 +157,16 @@ export interface FileHistoryBoundarySeat {
  * may no longer match), and the id of the tool call the park is holding (only a `tool_approval` pending
  * action parks ON a call; absent, never guessed, for the kinds that hold none).
  */
+/** See {@link Prepared.undeliveredContinuationRef} — `parkedSteers` is in ISSUE order, and the wake message rides it with no `seq` (no store minted one). */
+export interface UndeliveredContinuation {
+    parkedSteers: Array<Omit<PendingSteerEntry, "seq"> & {
+        seq?: number;
+    }>;
+    orphanTasks: Array<{
+        id: string;
+        description?: string;
+    }>;
+}
 export interface CommittedPause {
     cause: import("../types.js").PausedCause;
     scope: string;
@@ -278,7 +288,9 @@ export interface Prepared {
      *  block's single resolution, or the hands-less legs' resolver run (live spec-time facts, with the
      *  checkpoint seed folded stricter-wins where one exists). Every leg that completes prepare has a
      *  read posture now — this is what its delegation subtree is clamped by even where no faces mount. */
-    effectiveReadFace?: ReadFace;
+    effectiveReadFace?: ContainmentFace;
+    /** owned — the same observation on the WRITE seat (`TaskResult.effectiveWriteFace`). */
+    effectiveWriteFace?: ContainmentFace;
     /** The normalized deny ADDITIONS in force (deployment ∪ task ∪ checkpoint seed; built-ins
      *  excluded), echoed on `TaskResult.effectiveReadDenyPatterns`. Present iff non-empty; a defensive
      *  copy (the wide-scope working array stays the engine's own). */
@@ -291,6 +303,13 @@ export interface Prepared {
     /** The per-task logical cwd ref when a real shell is mounted (else undefined). The Runner
      *  reads `cwdRef.current` after each tool to detect a `cd` move and emit `workspace_changed`. */
     cwdRef?: CwdRef;
+    /** The run's TOOL-PROGRESS lane seat, late-bound for the same reason `harnessRef` is (the tool band is
+     *  built during prepare; the lane needs `pushContent` and `ident`, which exist only after it returns).
+     *  The driver binds `current` right after `pushContent` exists. Always present on a completed prepare —
+     *  the CELL, not the lane: unbound means "no run body has claimed this band", and emissions no-op. */
+    toolProgressRef: {
+        current?: ToolProgressLane;
+    };
     /** The run's advertised-writable-directory seat (present with hands): `roots` is what the prompt advertised as writable and the fence admitted. Read live wherever a policy is adjudicated off a resumed leg, so the write gate's exemption domain is that same list. */
     advertisedWritableDirs?: Pick<import("./advertised-writable-dirs.js").AdvertisedWritableDirs, "roots">;
     /** The ACTIVE EnterWorktree session ref (mounted with the worktree tools; undefined without
@@ -462,6 +481,7 @@ export interface Prepared {
      *  "undiscovered" census the tool_search_usage_reminder lane enumerates. Frozen at prepare time: a
      *  name never leaves the deferred set, it only moves into `activeTools`. */
     deferredToolNames?: ReadonlySet<string>;
+    /** The deferral census seat, present iff {@link deferredToolNames} is. */ toolDisclosure?: import("./deferral-census.js").ToolDisclosureSeat;
     /** The RESOLVED materialization strategy this run runs under (`true` = "static":
      *  activation never swaps the placeholder; the real schema's only in-context carrier is the
      *  ToolSearch result text). Consumed by the tools_delta boundary renderer, whose "full schemas are
@@ -587,6 +607,13 @@ export interface Prepared {
     pausedRef: {
         current?: CommittedPause;
     };
+    /** A resumed leg's continuation content that has NOT reached the transcript yet: EVERY input frame the
+     *  prompt carries (parked steers, the caller's wake message) and the orphaned background tasks whose obituary
+     *  rides it. Set before the prompt, emptied at delivery; a re-park carries it forward (the saga folds the
+     *  orphans in, the adoption re-parks the frames), and what no re-park carries the undrained account announces. */
+    undeliveredContinuationRef: {
+        current: UndeliveredContinuation;
+    };
     /** Ruled 2026-08-05 (matrix ruling arm A): set true by the resume engine when this leg EXECUTES the
      *  approved pending call — the restart-loop cap then counts from a fresh base (consecutive
      *  no-progress suspends only). See `suspendChainBase`. */
@@ -1345,6 +1372,7 @@ export interface PromptFeatureFlags {
     isolationEnabled: boolean;
     reminderMark: string;
     readFaceOpen: boolean;
+    writeFaceOpen: boolean;
     orchestrationEnabled: boolean;
     orchestrationDeferred: boolean;
     promptProfile: "simple" | "classic";
@@ -1782,10 +1810,6 @@ export interface RunInternals {
     onStatusEvent?: (event: Extract<TaskEvent, {
         type: "status";
     }>) => void;
-    /**
-     * Trusted run-local system-injection sink. `Runner.runLocked` wires this to the
-     * live TaskStream queue plus the current harness follow-up lane; it is not a public TaskSpec field.
-     */
     /** The run-local per-tool-call detach hub. runtask creates it and exposes
      *  `TaskStream.detach(toolCallId)`; the hands Bash tool threads `signalFor(toolCallId)` into env.exec. */
     detachHub?: import("../tool-detach.js").ToolDetachHub;
@@ -1797,6 +1821,11 @@ export interface RunInternals {
      * channel, same posture as every other field here.
      */
     sessionReadStates?: SessionReadFileStates;
+    /** Trusted system-injection sink (`Runner.runLocked` wires it to the live TaskStream queue plus the
+     *  current harness lanes; never a public TaskSpec field), ADDRESSED TO THE SESSION rather than to this
+     *  run: a producer wired here (a background shell, a watch, a delegation settle) keeps the closure long
+     *  after the run that mounted it ended, and its frame is then routed to whatever run the SESSION has
+     *  live — at that run's next turn boundary, the seat a steer lands on; only a session with NO live run parks it. */
     onTaskNotification?: (notification: TaskNotificationPayload, 
     /** Injection tier (the ladder is LIVE): "next" = the running turn's next boundary
      *  (arrival order, consecutive frames batch); "later" = the run's would-otherwise-stop seat
@@ -1812,9 +1841,9 @@ export interface RunInternals {
      * `injectTaskNotification`), threaded into a CHILD's internals at spawn time so the child's
      * SendMessage("main") uplink lands in the parent's queue at a turn boundary (the CC
      * "delivered automatically" parent half). DELIBERATELY a separate field from
-     * {@link RunInternals.onTaskNotification}: that one is "inject into THIS run" (runtask wraps it
-     * as upstream-observer + own-queue), and reusing it for the child would tee every internal child
-     * notification (grandchild completions, monitor events) into the parent — double delivery.
+     * {@link RunInternals.onTaskNotification}: that one is "inject into the run's own SESSION" (runtask
+     * wraps it as upstream-observer + session route), and reusing it for the child would tee every
+     * internal child notification (grandchild completions, monitor events) into the parent — double delivery.
      */
     parentNotify?: (notification: TaskNotificationPayload, opts?: {
         priority?: import("../task-notification.js").SystemInjectionPriority;
@@ -1831,9 +1860,9 @@ export interface RunInternals {
      * live (runtask calls it with its wrapped `injectTaskNotification`). The spawner stores it on the
      * child's registry handle so a parent/sibling SendMessage can deliver TO the RUNNING child at its
      * next turn boundary (CC's in-memory `pendingMessages` pedestal, anchors/2.1.212
-     * messaging-runtime.md §2.5). The injector is RUN-SCOPED but fail-safe after the run: the lane's
-     * teardown branch parks late payloads per session (PendingSessionNotifications), which is exactly
-     * CC's durable-mailbox posture for an idle teammate (§2.4) — no separate file mailbox needed.
+     * messaging-runtime.md §2.5). The injector outlives its run safely: once this lane is over the frame
+     * is routed to whatever run the SESSION has live, and only a session with no live run parks it
+     * (PendingSessionNotifications) — exactly CC's durable-mailbox posture for an idle teammate (§2.4).
      * TRUSTED chain (core spawner only); never reachable from TaskSpec.
      */
     onNotifyInjectorReady?: (inject: (notification: TaskNotificationPayload, opts?: {
@@ -2360,6 +2389,30 @@ export interface TurnBoundaryDeps {
 /** R5(harness 事件处理器族)的依赖包。全部为 runLocked 内声明顺序早于
  *  工厂调用点的 const 稳定引用 + 三个 runLocked 形参;this 面(deps.onError)经 runnerHooks 打包
  *  (B13 #coreView / R9 TurnBoundaryDeps 同款)。*/
+/** What a PRODUCER of a `tool_progress` frame knows: the FACTS it observed. The frame minus everything only
+ *  the run supplies — its discriminator, its {@link TaskEventIdentity} stamp, and the elapsed time, which the
+ *  lane computes from its own per-call origin. Derived from the union member, so seat and frame cannot drift. */
+export type ToolProgressBody = Omit<Extract<TaskEvent, {
+    type: "tool_progress";
+}>, "type" | "elapsedTimeSeconds" | keyof TaskEventIdentity>;
+/** The run's TOOL-PROGRESS lane: the ONE mint of `tool_progress` plus the heartbeat clock over the calls
+ *  in flight. Declared on the FLOOR because both registry-side readers sit above its implementation (the
+ *  driver builds it, the harness-handler lane drives it) and the Prepared seat that carries it to the tool
+ *  band is here too. `createToolProgressLane` (tool-progress-lane.ts, layer 1) is its one implementation. */
+export interface ToolProgressLane {
+    /** Offer ONE frame — from a tool that observes its own progress (the shell's per-second tick) or from
+     *  the lane's own heartbeat. The lane stamps the elapsed time, DROPS the offer when it would land inside
+     *  the cadence floor, and resets that call's beat clock when it does not. NEVER THROWS: a tool calls this
+     *  from inside an environment output callback, where a throw kills the command it is describing. */
+    emit(body: ToolProgressBody): void;
+    /** A tool call entered execution: it joins the heartbeat's in-flight set and its clock starts, stamped
+     *  by the LANE (one clock owns one number — see its module header on why that clock is monotonic). */
+    noteStart(toolCallId: string, toolName: string): void;
+    /** A tool call settled: it leaves the in-flight set. */
+    noteEnd(toolCallId: string): void;
+    /** Drop every in-flight call and disarm the timer (turn end / teardown): no beating into the next turn. */
+    clear(): void;
+}
 export interface HarnessHandlersDeps {
     spec: TaskSpec;
     queue: PushQueue<TaskEvent>;
@@ -2375,6 +2428,9 @@ export interface HarnessHandlersDeps {
     emitCommitted: (entryId: string, role: "user" | "assistant" | "toolResult", toolCallId?: string) => void;
     startedToolCallIds: Set<string>;
     toolStartAt: Map<string, number>;
+    /** The run's tool-progress lane: the handlers tell it when a call enters and leaves execution, and
+     *  clear it with the rest of the per-call bookkeeping at turn end. */
+    toolProgress: ToolProgressLane;
     writeFamilyOf: (name: string) => WriteFamily | undefined;
     toolLabels: Map<string, string>;
     postToolBatchHook: ((batch: PostToolBatchCall[], meta?: {

package/dist/core/runner/decide-continuation.d.ts

@@ -7,7 +7,7 @@
  *  · which call a CONTENT-ASK checkpoint parks on, and the one-shot answering face a decide's answer is
  *    bound to for the redeemed call;
  *  · the capture-time domain checks on a decide's TEXT payloads, and the label a rejected value gets;
- *  · the model-facing text for a deferred batch sibling, and the continuation prompt itself.
+ *  · the continuation prompt itself.
  *
  * Pure over its arguments (the answering face is the one closure, and it closes over its own arguments
  * only). Run-loop machinery (layer 1), named without the `resume-` family prefix: that prefix marks a
@@ -25,8 +25,6 @@ import type { ResumeRun } from "./contracts.js";
  * reported the same decidePath locked no matter how many times the human decided).
  */
 export declare function resumeDecisionWasNegative(resume: ResumeRun): boolean;
-/** Model-facing result for a batch sibling of a suspended call that v1 does not blind-run (§4.ter). */
-export declare const DEFERRED_REISSUE: string;
 /**
  * Structural deep equality of two JSON-serializable values (order-independent over object keys). Used ONLY
  * by the Runner's `resumeStream` reopen-by-reason guard to confirm an `env_failed` re-resume

package/dist/core/runner/decide-continuation.js

@@ -7,8 +7,6 @@ export function resumeDecisionWasNegative(resume) {
     const o = resume.outcome;
     return o.decision === "reject" || o.decision === "deny";
 }
-export const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
-    "NOT executed on resume. If you still need it, issue it again now.";
 export function deepJsonEqual(a, b) {
     if (a === b)
         return true;
@@ -122,11 +120,7 @@ export function resumeContinuation(resume, mark) {
     const decided = resume.outcome.decision === "allow"
         ? "was APPROVED and has now been executed — its result is in the tool results above"
         : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}`;
-    const remaining = pendingAction.batchToolCallIds.filter((id) => id !== pendingAction.toolCallId && !pendingAction.completedCallIds.includes(id)).length;
-    const batchNote = remaining > 0
-        ? ` ${remaining} other tool call(s) from that batch were returned as deferred and not run — re-issue any you still need.`
-        : "";
-    return formatHookFeedback(`The pending tool call "${pendingAction.toolName}" ${decided}.${batchNote} ` +
+    return formatHookFeedback(`The pending tool call "${pendingAction.toolName}" ${decided}. ` +
         `This is a RESUMED task — every step before this point is already done and its results are in the ` +
         `conversation above. Do NOT restart the task or re-run any tool you already ran; continue from this ` +
         `exact point, building on the existing results, and finish the remaining work.`, mark);

package/dist/core/runner/deferral-census.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The deferral CENSUS: what a leg discloses about which of its tools ship as name-only placeholders, and the
+ * seat that carries it to the stream. Split out of the disclosure mount because it is a different concern —
+ * the mount decides the request FACE, this decides what is SAID about it.
+ */
+import type { ToolSearchPolicy, ResolvedToolSearch } from "../tool-search-setting.js";
+/**
+ * The HOST-facing census of this leg's deferral: which tool names ship as name-only placeholders, which the model has activated, and the policy that decided it.
+ * @contract tool_disclosure.snapshot — the `tool_disclosure` frame is minted ONLY here ({@link ToolDisclosureSeat.publish}), exists ONLY on a leg that defers
+ * at least one tool, and carries the WHOLE census each time (a consumer replaces its copy; the "what just happened" delta is this snapshot's `activated` minus
+ * the previous one's). `deferred` is frozen at prepare (a name never leaves it, it only appears in `activated`); both lists are sorted, so two snapshots
+ * compare by value. A leg that defers nothing emits no frame at all — absence is "nothing was deferred", never "the disclosure is off".
+ */
+export interface ToolDisclosureSnapshot {
+    /** Which arm of `RunnerDeps.toolSearch` decided rule ② on this leg. */
+    policy: ToolSearchPolicy;
+    /** Present iff `policy === "auto"`: the percent of the window the candidate set had to reach. */
+    thresholdPercent?: number;
+    /** Every deferred name on this leg, sorted. Non-empty (the frame does not exist otherwise). */
+    deferred: readonly string[];
+    /** The deferred names ACTIVE on this leg right now, sorted — the engine's state, not a record of commits. Empty on the leg-start census only when nothing
+     *  seeded it; a RESUMED leg carries whatever the engine reseeded (transcript replay, compaction snapshot, checkpoint) before anything executed. */
+    activated: readonly string[];
+}
+/**
+ * The run-time seat the frame rides: prepare publishes the leg-start census, every activation that changes it publishes the next, and the run's event wiring
+ * subscribes once. Snapshots published before the sink is installed are buffered (bounded) and flushed in order, so the leg-start census can be minted at
+ * prepare and still arrive after the manifest frame it belongs beside. Deliberately the same shape as `ToolRosterDeltaSeat` — the two are one problem.
+ */
+export declare class ToolDisclosureSeat {
+    #private;
+    /** Publish a census. A snapshot equal to the last published one is DROPPED: `rematerialize` also runs on an MCP refresh, and a frame that says nothing
+     *  changed reads as an activation that did not happen. */
+    publish(snapshot: ToolDisclosureSnapshot): void;
+    /** Install the stream sink; anything published before is flushed in order. */
+    subscribe(sink: (snapshot: ToolDisclosureSnapshot) => void): void;
+    /** The leg ended: drop the sink so a late publish never reaches a closed stream (it buffers, unread). */
+    unsubscribe(): void;
+}
+/**
+ * Mint a leg's census producer: the frozen deferred list, the policy it was classified under, and a seat.
+ * One place holds both halves, so a census can never name a policy the classification did not run under.
+ *
+ * `deferred` is frozen because every census shares the one array — a host that mutated the list it was handed
+ * would be editing every later frame of the leg. `activated` is filtered to the DEFERRED names: the live
+ * activation set is seeded from the transcript and a resume checkpoint, both of which can name an undeferred
+ * tool.
+ */
+export declare function createDeferralCensus(deferred: ReadonlySet<string>, policy: ResolvedToolSearch): {
+    seat: ToolDisclosureSeat;
+    publish: (active: ReadonlySet<string>) => void;
+};

package/dist/core/runner/deferral-census.js

@@ -0,0 +1,44 @@
+export class ToolDisclosureSeat {
+    #pending = [];
+    #sink;
+    #last;
+    publish(snapshot) {
+        if (this.#last !== undefined && sameDisclosure(this.#last, snapshot))
+            return;
+        this.#last = snapshot;
+        if (this.#sink !== undefined)
+            this.#sink(snapshot);
+        else {
+            this.#pending.push(snapshot);
+            if (this.#pending.length > 64)
+                this.#pending.shift();
+        }
+    }
+    subscribe(sink) {
+        this.#sink = sink;
+        const pending = this.#pending;
+        this.#pending = [];
+        for (const s of pending)
+            sink(s);
+    }
+    unsubscribe() {
+        this.#sink = undefined;
+    }
+}
+function sameDisclosure(a, b) {
+    const sameList = (x, y) => x.length === y.length && x.every((n, i) => n === y[i]);
+    return a.policy === b.policy && a.thresholdPercent === b.thresholdPercent && sameList(a.deferred, b.deferred) && sameList(a.activated, b.activated);
+}
+export function createDeferralCensus(deferred, policy) {
+    const seat = new ToolDisclosureSeat();
+    const names = Object.freeze([...deferred].sort());
+    return {
+        seat,
+        publish: (active) => seat.publish({
+            policy: policy.policy,
+            ...(policy.thresholdPercent !== undefined ? { thresholdPercent: policy.thresholdPercent } : {}),
+            deferred: names,
+            activated: [...active].filter((n) => deferred.has(n)).sort(),
+        }),
+    };
+}

package/dist/core/runner/derived-route-fallback.d.ts

@@ -2,15 +2,15 @@
  * The derived-leg route pre-flight shared by prepareTask's two derived seats: the compaction-summary model (the
  * driver's own seat, resolved before the offload prelude) and the auto-mode classifier model (the caps-and-workflow
  * phase's arming). Moved whole out of the orchestrator so the phase reaches DOWN for it instead of the two callers
- * spelling it twice. The judgment law itself lives in the brain's route adjudicator; this is the one guarded seat
- * around it.
+ * spelling it twice. The judgment law and both announcements live in the brain's route adjudicator; this is the one
+ * guarded seat around them.
  */
 import type { Model } from "../../internal/llm.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 /**
  * The derived-leg pairing pre-flight as ONE guarded seat: judge the derived model where its route
- * differs from the primary's, announce the fallback on a broken pairing, and ABSTAIN (keep the
- * derived model) on ANY throw. The pre-flight is advisory — the brain's request gate re-runs the
+ * differs from the primary's, announce what a broken pairing means for THIS seat (`onBrokenPairing` —
+ * one judgment, and the POSTURE is the deployment's), and ABSTAIN (keep the derived model) on ANY throw. The pre-flight is advisory — the brain's request gate re-runs the
  * same law — so neither a throwing judge face nor a garbage catalog value (the route-identity
  * normalization throws a TypeError on a non-string baseUrl) may widen into "task preparation
  * failed": at the compaction seat the session is already acquired and the throw-cleanup contract
@@ -31,4 +31,8 @@ export declare function derivedRouteFallsBack(args: {
     /** The INVOCATION this seat resolution belongs to. The session cannot stand in for it: two
      *  runs of one session that both fall back on the same seat mint otherwise byte-identical lines. */
     runId?: string;
+    /** What this seat's DEPLOYMENT asked for on a broken pairing. Absent / `"fall_back"`: swap and announce `route.fallback_to_primary`
+     *  (the only posture a seat with no knob of its own has). `"refuse"`: keep the seat and announce `route.classifier_unroutable` — never
+     *  quietly granting a fallback the deployment declined (`autoMode.classifierFallback: "none"`); announcing is why no swap is not no word. */
+    onBrokenPairing?: "fall_back" | "refuse";
 }): Promise<boolean>;

package/dist/core/runner/derived-route-fallback.js

@@ -1,4 +1,4 @@
-import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity } from "../../brain/route-adjudicator.js";
+import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity, unroutableSeatNotice } from "../../brain/route-adjudicator.js";
 import { deliverEngineNotice } from "../types.js";
 export async function derivedRouteFallsBack(args) {
     try {
@@ -7,8 +7,13 @@ export async function derivedRouteFallsBack(args) {
         const verdict = await adjudicateDerivedRoute({ brain: args.brain, model: args.derived, getApiKeyAndHeaders: args.getApiKeyAndHeaders });
         if (verdict === undefined || verdict.ok)
             return false;
-        deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ seat: args.seat, from: args.derived.id, to: args.primary.id, verdict, ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}), ...(args.runId !== undefined ? { runId: args.runId } : {}) }));
-        return true;
+        const shared = { seat: args.seat, from: args.derived.id, verdict, ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}), ...(args.runId !== undefined ? { runId: args.runId } : {}) };
+        const refuse = args.onBrokenPairing === "refuse";
+        if (refuse)
+            deliverEngineNotice(args.onNotice, unroutableSeatNotice({ ...shared, primary: args.primary.id }));
+        else
+            deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ ...shared, to: args.primary.id }));
+        return !refuse;
     }
     catch {
         return false;

package/dist/core/runner/gate-exit.d.ts

@@ -22,6 +22,7 @@
  * contract (`ToolGateInput`, `ToolGateResult`, the observer payload), which stays declared there.
  */
 import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
+import type { AutoModeClassifierRound } from "../auto-mode.js";
 import type { AskOrigin, AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import type { SafeNotifier } from "../safe-notify.js";
@@ -40,6 +41,10 @@ export interface GateExitFacts {
     deniedBy?: DeniedBy;
     cause?: ClassifierDenyCause;
     settled?: SettledAsk;
+    /** The classifier CLASSIFICATION this pass ran, when it ran one on a decider that can name its model.
+     *  Orthogonal to `deniedBy`: one that ALLOWED is attributed too (a fallback model's allow is exactly the case
+     *  an operator needs to see), which is why it rides the disposition's shared member, not the deny arm. */
+    classifier?: AutoModeClassifierRound;
 }
 /**
  * Mint the outcome. A defect here is an ENGINE defect (a refusing site that did not say who refused, a
@@ -220,6 +225,13 @@ export interface GatePass {
      *  re-check when an inherited station's attested deny arrives through the chain; undefined for a ruling
      *  block and every non-classifier deny. The exit mints `GateDisposition.cause` from it. */
     denyCause: ClassifierDenyCause | undefined;
+    /** borrowed-mutable — the classifier CLASSIFICATION this pass ran ({@link AutoModeClassifierRound}).
+     *  Written ONCE by the gate's classifier step from the verdict the decider handed back, on EVERY arm (allow
+     *  included — a fallback model's allow is the fact the record exists for); absent when no classifier was
+     *  consulted or the decider could name no model. Both exits mint `GateDisposition.classifier` from it.
+     *  OPTIONAL rather than `| undefined` (the `probeUnanswered` form): the dispatch that builds the pass is
+     *  not a station of this lane and has nothing to declare here. */
+    classifierRound?: AutoModeClassifierRound;
     /** borrowed-mutable — the standing verdict. The no-policy default until the adjudication station writes the
      *  policy's answer; then rewritten by every station that changes the verdict (fold, tightens, org, rule
      *  lane, stamp, classifier, sandbox, content lane, resolution, edit chain). */

package/dist/core/runner/gate-exit.js

@@ -4,8 +4,11 @@ import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
 export function mintGateOutcome(facts) {
     const settlement = facts.settled !== undefined ? Object.freeze({ ...facts.settled.settlement, who: Object.freeze({ ...facts.settled.settlement.who }) }) : undefined;
+    const attribution = facts.classifier !== undefined ? Object.freeze({ ...facts.classifier, ...(facts.classifier.fallback !== undefined ? { fallback: Object.freeze({ ...facts.classifier.fallback }) } : {}) }) : undefined;
     const outcome = Object.freeze({
-        disposition: Object.freeze(facts.deniedBy !== undefined ? { kind: "denied", deniedBy: facts.deniedBy, ...(facts.cause !== undefined ? { cause: facts.cause } : {}) } : { kind: "allowed" }),
+        disposition: Object.freeze(facts.deniedBy !== undefined
+            ? { kind: "denied", deniedBy: facts.deniedBy, ...(facts.cause !== undefined ? { cause: facts.cause } : {}), ...(attribution !== undefined ? { classifier: attribution } : {}) }
+            : { kind: "allowed", ...(attribution !== undefined ? { classifier: attribution } : {}) }),
         ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
     });
     const defects = screenGateOutcome(outcome);
@@ -114,7 +117,7 @@ export async function exitGate(pass) {
         }
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
-        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
+        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}) });
         const unresolvable = askUnresolvableCauseOf(pass.decision, { toolCallId, toolName }) ?? unresolvableCauseOfSettlement(gate);
         if (unresolvable !== undefined) {
             const cause = unresolvable;
@@ -142,7 +145,7 @@ export async function exitGate(pass) {
     }
     return {
         updatedInput: pass.currentInput === event.input ? undefined : pass.currentInput,
-        gate: mintGateOutcome(ledger.settled !== undefined ? { settled: ledger.settled } : {}),
+        gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}) }),
         preToolContext: pass.preToolContext,
     };
 }

package/dist/core/runner/prepare-artifact.d.ts

@@ -7,13 +7,18 @@
  * face) exactly as `Read` does, then reads the bytes once from the execution env. A local stub's store
  * (`capabilities.storageDir`) must lie OUTSIDE every root the run may write or read — a ledger the model can
  * edit through the fs tools is not a trust boundary — and a store inside one refuses the mount, naming both.
+ * The store is a path on THIS process's filesystem; a root is the execution env's canonical key. The two are
+ * compared as identities under one spelling family only when both spell the same family (`within` reads both
+ * under the root's family); a root of the other family names a filesystem the store cannot be on, and no
+ * containment claim is made against it.
  * Synchronous: the stretch has no await (the file read is a closure the tool calls later).
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
+import type { OnAsk } from "../tool-policy.js";
 import { type ArtifactPlane } from "../artifact-host.js";
 import { RosterBuilder } from "../tool-roster.js";
 import type { AgentTool, RunnerDeps } from "../types.js";
-import type { ReadDenyMatcher, ReadFace } from "../../tools/fs/index.js";
+import type { ReadDenyMatcher, ContainmentFace } from "../../tools/fs/index.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareArtifactInput {
     /** borrowed-readonly — the deployment's hosting seat and the notice sink the refusal arm announces on. */
@@ -26,6 +31,9 @@ export interface PrepareArtifactInput {
     sessionId: string;
     /** borrowed-readonly — the spawned name this run carries, when any (call-context attribution only). */
     agentName: string | undefined;
+    /** borrowed-readonly — the run's effective approver (`spec.onAsk ?? deps.onAsk`, the seat the tool gate resolves at):
+     *  the tool's shared-read consent gate rides it as a mount dep (a core mount's execute ctx is minimal). */
+    onAsk: OnAsk | undefined;
     /** borrowed-readonly — the run's resolved env: the byte source of a published local file. */
     executionEnv: ExecutionEnv;
     /** borrowed-readonly — the canonical task root the fs fence contains reads to; undefined ⇒ no local-file publish. */
@@ -35,7 +43,7 @@ export interface PrepareArtifactInput {
     /** borrowed-readonly — the read-deny matcher in force for the run, when any. */
     readDenyMatcher: ReadDenyMatcher | undefined;
     /** borrowed-readonly — the resolved read face (`"open"` lifts root containment for reads). */
-    resolvedReadFace: ReadFace | undefined;
+    resolvedReadFace: ContainmentFace | undefined;
     /** borrowed-readonly — the tracked-cwd cell; `current` is read per call as the relative-path base. */
     handsCwdRef: Prepared["cwdRef"];
     /** borrowed-mutable — the run's roster builder; writer here: ONE mount when the seat is valid. */

package/dist/core/runner/prepare-artifact.js

@@ -5,10 +5,10 @@ import { RosterBuilder } from "../tool-roster.js";
 import { defineTool } from "../tools.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { physicalPathOfExisting } from "../physical-path.js";
-import { resolveKey, violationDetails, violationText, withinAnyRoot } from "../../tools/fs/safety.js";
+import { pathFamilyOf, resolveKey, violationDetails, violationText, withinAnyRoot } from "../../tools/fs/safety.js";
 import { createArtifactTool } from "../../tools/artifact/artifact-tool.js";
 export function prepareArtifact(input) {
-    const { deps, runId, taskId, sessionId, agentName, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames } = input;
+    const { deps, runId, taskId, sessionId, agentName, onAsk, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames } = input;
     const host = deps.artifactHost;
     if (host === undefined)
         return { artifactPlane: undefined };
@@ -26,7 +26,8 @@ export function prepareArtifact(input) {
     const storageDir = verdict.capabilities.storageDir;
     if (storageDir !== undefined && rootCanonical !== undefined) {
         const real = physicalPathOfExisting(storageDir);
-        const inside = [rootCanonical, ...additionalRootsCanonical].find((root) => withinAnyRoot([root], real));
+        const storeFamily = pathFamilyOf({ root: real });
+        const inside = [rootCanonical, ...additionalRootsCanonical].find((root) => pathFamilyOf({ root }) === storeFamily && withinAnyRoot([root], real));
         if (inside !== undefined)
             return refuse(`the local artifact store ${storageDir} lies inside a root this run may reach through its file tools (${inside}); put the store outside every task root and additional directory`);
     }
@@ -56,7 +57,7 @@ export function prepareArtifact(input) {
             return { ok: false, reason: "too_large", size: r.value.byteLength, limit: maxBytes, judgedOn: "bytes" };
         return { ok: true, key: rk.key, bytes: r.value };
     };
-    const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile });
+    const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile, ...(onAsk !== undefined ? { onAsk } : {}) });
     roster.mount(firstPartyOffload(defineTool(artifactSpec)), { source: "builtin", mountedBy: "optional" });
     envHandToolNames.add(ARTIFACT_TOOL_NAME);
     return { artifactPlane: verdict.capabilities.plane };

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -33,7 +33,7 @@ import type { OnAsk } from "../tool-policy.js";
 import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
 import type { AutoModeArmFact } from "../wiring-manifest.js";
 import type { AssertAllKeysHandled } from "../ask-origin.js";
-import type { ReadFace } from "../../tools/fs/index.js";
+import type { ContainmentFace } from "../../tools/fs/index.js";
 import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
 import { RosterBuilder } from "../tool-roster.js";
@@ -91,7 +91,9 @@ export interface PrepareCapsAndWorkflowInput {
     frozenOnAsk: OnAsk | undefined;
     /** borrowed-readonly — the parent SPEC seat the children inherit (minted once by the inherited-gate phase; the Workflow mount's dep, the same value the delegation ctx carries). */ parentSpecSeat: ParentSpecSeat;
     /** borrowed-readonly — the ONE read-face carrier expression (the Workflow mount's parentReadFace getter calls it). */
-    carrierReadFace: () => ReadFace | undefined;
+    carrierReadFace: () => ContainmentFace | undefined;
+    /** borrowed-readonly — the same carrier expression on the WRITE seat. */
+    carrierWriteFace: () => ContainmentFace | undefined;
     /** borrowed-readonly — the filtered display-forwarding wrapper (the Workflow mount's forwardEvent; absent ⇒ no key). */
     forwardEvent: ((e: TaskEvent) => void) | undefined;
     /** borrowed-readonly — the child-chain assembly (the Workflow mount's inheritedGateForChildren). */