@sema-agent/core 7.17.7 → 7.19.0

package/dist/core/runner/gate-exit.d.ts

@@ -22,6 +22,7 @@
  * contract (`ToolGateInput`, `ToolGateResult`, the observer payload), which stays declared there.
  */
 import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
+import type { AutoModeClassifierRound } from "../auto-mode.js";
 import type { AskOrigin, AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import type { SafeNotifier } from "../safe-notify.js";
@@ -40,6 +41,10 @@ export interface GateExitFacts {
     deniedBy?: DeniedBy;
     cause?: ClassifierDenyCause;
     settled?: SettledAsk;
+    /** The classifier CLASSIFICATION this pass ran, when it ran one on a decider that can name its model.
+     *  Orthogonal to `deniedBy`: one that ALLOWED is attributed too (a fallback model's allow is exactly the case
+     *  an operator needs to see), which is why it rides the disposition's shared member, not the deny arm. */
+    classifier?: AutoModeClassifierRound;
 }
 /**
  * Mint the outcome. A defect here is an ENGINE defect (a refusing site that did not say who refused, a
@@ -220,6 +225,13 @@ export interface GatePass {
      *  re-check when an inherited station's attested deny arrives through the chain; undefined for a ruling
      *  block and every non-classifier deny. The exit mints `GateDisposition.cause` from it. */
     denyCause: ClassifierDenyCause | undefined;
+    /** borrowed-mutable — the classifier CLASSIFICATION this pass ran ({@link AutoModeClassifierRound}).
+     *  Written ONCE by the gate's classifier step from the verdict the decider handed back, on EVERY arm (allow
+     *  included — a fallback model's allow is the fact the record exists for); absent when no classifier was
+     *  consulted or the decider could name no model. Both exits mint `GateDisposition.classifier` from it.
+     *  OPTIONAL rather than `| undefined` (the `probeUnanswered` form): the dispatch that builds the pass is
+     *  not a station of this lane and has nothing to declare here. */
+    classifierRound?: AutoModeClassifierRound;
     /** borrowed-mutable — the standing verdict. The no-policy default until the adjudication station writes the
      *  policy's answer; then rewritten by every station that changes the verdict (fold, tightens, org, rule
      *  lane, stamp, classifier, sandbox, content lane, resolution, edit chain). */

package/dist/core/runner/gate-exit.js

@@ -4,8 +4,11 @@ import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
 export function mintGateOutcome(facts) {
     const settlement = facts.settled !== undefined ? Object.freeze({ ...facts.settled.settlement, who: Object.freeze({ ...facts.settled.settlement.who }) }) : undefined;
+    const attribution = facts.classifier !== undefined ? Object.freeze({ ...facts.classifier, ...(facts.classifier.fallback !== undefined ? { fallback: Object.freeze({ ...facts.classifier.fallback }) } : {}) }) : undefined;
     const outcome = Object.freeze({
-        disposition: Object.freeze(facts.deniedBy !== undefined ? { kind: "denied", deniedBy: facts.deniedBy, ...(facts.cause !== undefined ? { cause: facts.cause } : {}) } : { kind: "allowed" }),
+        disposition: Object.freeze(facts.deniedBy !== undefined
+            ? { kind: "denied", deniedBy: facts.deniedBy, ...(facts.cause !== undefined ? { cause: facts.cause } : {}), ...(attribution !== undefined ? { classifier: attribution } : {}) }
+            : { kind: "allowed", ...(attribution !== undefined ? { classifier: attribution } : {}) }),
         ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
     });
     const defects = screenGateOutcome(outcome);
@@ -114,7 +117,7 @@ export async function exitGate(pass) {
         }
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
-        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
+        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}) });
         const unresolvable = askUnresolvableCauseOf(pass.decision, { toolCallId, toolName }) ?? unresolvableCauseOfSettlement(gate);
         if (unresolvable !== undefined) {
             const cause = unresolvable;
@@ -142,7 +145,7 @@ export async function exitGate(pass) {
     }
     return {
         updatedInput: pass.currentInput === event.input ? undefined : pass.currentInput,
-        gate: mintGateOutcome(ledger.settled !== undefined ? { settled: ledger.settled } : {}),
+        gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}) }),
         preToolContext: pass.preToolContext,
     };
 }

package/dist/core/runner/prepare-artifact.d.ts

@@ -7,13 +7,18 @@
  * face) exactly as `Read` does, then reads the bytes once from the execution env. A local stub's store
  * (`capabilities.storageDir`) must lie OUTSIDE every root the run may write or read — a ledger the model can
  * edit through the fs tools is not a trust boundary — and a store inside one refuses the mount, naming both.
+ * The store is a path on THIS process's filesystem; a root is the execution env's canonical key. The two are
+ * compared as identities under one spelling family only when both spell the same family (`within` reads both
+ * under the root's family); a root of the other family names a filesystem the store cannot be on, and no
+ * containment claim is made against it.
  * Synchronous: the stretch has no await (the file read is a closure the tool calls later).
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
+import type { OnAsk } from "../tool-policy.js";
 import { type ArtifactPlane } from "../artifact-host.js";
 import { RosterBuilder } from "../tool-roster.js";
 import type { AgentTool, RunnerDeps } from "../types.js";
-import type { ReadDenyMatcher, ReadFace } from "../../tools/fs/index.js";
+import type { ReadDenyMatcher, ContainmentFace } from "../../tools/fs/index.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareArtifactInput {
     /** borrowed-readonly — the deployment's hosting seat and the notice sink the refusal arm announces on. */
@@ -26,6 +31,9 @@ export interface PrepareArtifactInput {
     sessionId: string;
     /** borrowed-readonly — the spawned name this run carries, when any (call-context attribution only). */
     agentName: string | undefined;
+    /** borrowed-readonly — the run's effective approver (`spec.onAsk ?? deps.onAsk`, the seat the tool gate resolves at):
+     *  the tool's shared-read consent gate rides it as a mount dep (a core mount's execute ctx is minimal). */
+    onAsk: OnAsk | undefined;
     /** borrowed-readonly — the run's resolved env: the byte source of a published local file. */
     executionEnv: ExecutionEnv;
     /** borrowed-readonly — the canonical task root the fs fence contains reads to; undefined ⇒ no local-file publish. */
@@ -35,7 +43,7 @@ export interface PrepareArtifactInput {
     /** borrowed-readonly — the read-deny matcher in force for the run, when any. */
     readDenyMatcher: ReadDenyMatcher | undefined;
     /** borrowed-readonly — the resolved read face (`"open"` lifts root containment for reads). */
-    resolvedReadFace: ReadFace | undefined;
+    resolvedReadFace: ContainmentFace | undefined;
     /** borrowed-readonly — the tracked-cwd cell; `current` is read per call as the relative-path base. */
     handsCwdRef: Prepared["cwdRef"];
     /** borrowed-mutable — the run's roster builder; writer here: ONE mount when the seat is valid. */

package/dist/core/runner/prepare-artifact.js

@@ -5,10 +5,10 @@ import { RosterBuilder } from "../tool-roster.js";
 import { defineTool } from "../tools.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { physicalPathOfExisting } from "../physical-path.js";
-import { resolveKey, violationDetails, violationText, withinAnyRoot } from "../../tools/fs/safety.js";
+import { pathFamilyOf, resolveKey, violationDetails, violationText, withinAnyRoot } from "../../tools/fs/safety.js";
 import { createArtifactTool } from "../../tools/artifact/artifact-tool.js";
 export function prepareArtifact(input) {
-    const { deps, runId, taskId, sessionId, agentName, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames } = input;
+    const { deps, runId, taskId, sessionId, agentName, onAsk, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames } = input;
     const host = deps.artifactHost;
     if (host === undefined)
         return { artifactPlane: undefined };
@@ -26,7 +26,8 @@ export function prepareArtifact(input) {
     const storageDir = verdict.capabilities.storageDir;
     if (storageDir !== undefined && rootCanonical !== undefined) {
         const real = physicalPathOfExisting(storageDir);
-        const inside = [rootCanonical, ...additionalRootsCanonical].find((root) => withinAnyRoot([root], real));
+        const storeFamily = pathFamilyOf({ root: real });
+        const inside = [rootCanonical, ...additionalRootsCanonical].find((root) => pathFamilyOf({ root }) === storeFamily && withinAnyRoot([root], real));
         if (inside !== undefined)
             return refuse(`the local artifact store ${storageDir} lies inside a root this run may reach through its file tools (${inside}); put the store outside every task root and additional directory`);
     }
@@ -56,7 +57,7 @@ export function prepareArtifact(input) {
             return { ok: false, reason: "too_large", size: r.value.byteLength, limit: maxBytes, judgedOn: "bytes" };
         return { ok: true, key: rk.key, bytes: r.value };
     };
-    const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile });
+    const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile, ...(onAsk !== undefined ? { onAsk } : {}) });
     roster.mount(firstPartyOffload(defineTool(artifactSpec)), { source: "builtin", mountedBy: "optional" });
     envHandToolNames.add(ARTIFACT_TOOL_NAME);
     return { artifactPlane: verdict.capabilities.plane };

package/dist/core/runner/prepare-ask-lane.js

@@ -102,6 +102,7 @@ export function prepareAskLane(input) {
             ...(decision.action === "ask" ? gateAskCarry(decision, isLiveApproverSeat(onAsk), autoModeDenialTracking) : {}),
             ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
             ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
+            ...(decision.action === "ask" && decision.probeReadRootCandidate !== undefined ? { readRootCandidate: decision.probeReadRootCandidate } : {}),
             ...(decision.action === "ask" && decision.ruleEvidence !== undefined ? { ruleEvidence: decision.ruleEvidence } : {}),
         }, onAsk, composedCallSignal(callSignal), lateAskSettlementObserver({ toolName: req.toolName, toolCallId: req.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
         const waitMs = Math.max(0, now() - t0);

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -33,7 +33,7 @@ import type { OnAsk } from "../tool-policy.js";
 import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
 import type { AutoModeArmFact } from "../wiring-manifest.js";
 import type { AssertAllKeysHandled } from "../ask-origin.js";
-import type { ReadFace } from "../../tools/fs/index.js";
+import type { ContainmentFace } from "../../tools/fs/index.js";
 import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
 import { RosterBuilder } from "../tool-roster.js";
@@ -91,7 +91,9 @@ export interface PrepareCapsAndWorkflowInput {
     frozenOnAsk: OnAsk | undefined;
     /** borrowed-readonly — the parent SPEC seat the children inherit (minted once by the inherited-gate phase; the Workflow mount's dep, the same value the delegation ctx carries). */ parentSpecSeat: ParentSpecSeat;
     /** borrowed-readonly — the ONE read-face carrier expression (the Workflow mount's parentReadFace getter calls it). */
-    carrierReadFace: () => ReadFace | undefined;
+    carrierReadFace: () => ContainmentFace | undefined;
+    /** borrowed-readonly — the same carrier expression on the WRITE seat. */
+    carrierWriteFace: () => ContainmentFace | undefined;
     /** borrowed-readonly — the filtered display-forwarding wrapper (the Workflow mount's forwardEvent; absent ⇒ no key). */
     forwardEvent: ((e: TaskEvent) => void) | undefined;
     /** borrowed-readonly — the child-chain assembly (the Workflow mount's inheritedGateForChildren). */

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -5,34 +5,20 @@ import { CROSS_SESSION_CLASSIFIER_RULE } from "../../agents/cross-session-envelo
 import { createRunWorkflowTool } from "../../orchestration/run-workflow-tool.js";
 import { isSelfOrchestrationActive } from "../../orchestration/workflow-script-runner.js";
 import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
-import { thinkingOffExpressible } from "../../brain/reasoning.js";
 import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
-import { AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "../auto-mode-defaults.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
-import { createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
+import { autoModeClassifierFallbackOf, autoModeRoundNotAsked, createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
 import { checkpointStoreOfSeat } from "../checkpoint-seat.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, resolveComplianceDenies } from "../compliance.js";
 import { createPresentPlanTool, createEnterPlanModeTool } from "../present-plan-tool.js";
-import { resolveTaskModel } from "../roles.js";
 import { brainToRuntime } from "../runtime.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { emitTrace } from "../trace.js";
 import { defineTool, isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
 const MOUNT_REMEDY = "author it as a plain-object ToolSpec (own `name` and `execute`), hand the defineTool product itself, or wrap a product through the supported wrapper form (a fresh object re-stamped with `stampDefineToolBrand` whose rebind re-wraps the rebound product)";
 import { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "../runtime-caps.js";
 import { derivedRouteFallsBack } from "./derived-route-fallback.js";
+import { CLASSIFIER_ATTEMPT_SUFFIX, CLASSIFIER_THINK_SEAT, announceClassifierRoleDefaulted, classifierLadderRungs, classifierReplyAsksAgain, classifierReplyFailure, classifierReplyVerdictText, classifierRoundObserver, classifierRungSeat, classifierSeatModel } from "./classifier-ladder.js";
 import { REPORT_FINDINGS_TOOL_NAME, createReportBlockedTool, createReportFindingsTool } from "./synthetic-tools.js";
-function classifierReplyText(reply) {
-    return reply.content
-        .filter((c) => c.type === "text")
-        .map((c) => c.text)
-        .join("");
-}
-function classifierReplyEmptyAtCap(reply) {
-    if (classifierReplyText(reply) !== "")
-        return false;
-    return reply.stopReason === "length" || (reply.stopReason === "error" && reply.errorKind === "length_empty");
-}
 import { RosterBuilder, callerMountSource } from "../tool-roster.js";
 function assembleParentCaptureState(o, i, ctl, ancestors) {
     const build = (optedOut, indeterminate) => ({
@@ -112,7 +98,7 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
@@ -211,53 +197,54 @@ export async function prepareCapsAndWorkflow(input) {
     const autoModeArmReason = autoModeArmReasonOf(autoModeIntent, deps.autoMode !== undefined, runtimeCaps, runtimeCapsFaulted);
     if (autoModeIntent && deps.autoMode !== undefined && runtimeCaps?.autoMode !== false) {
         const am = deps.autoMode;
-        let classifierModel;
-        try {
-            classifierModel = resolveTaskModel({ modelRole: "classifier" }, deps).model;
-        }
-        catch {
-            classifierModel = model;
-        }
-        if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId, runId })) {
+        const classifierSeat = classifierSeatModel({ deps, main: model });
+        let classifierModel = classifierSeat.model;
+        if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId, runId, onBrokenPairing: autoModeClassifierFallbackOf(am.classifierFallback) === "none" ? "refuse" : "fall_back" })) {
             classifierModel = model;
         }
+        announceClassifierRoleDefaulted({ onNotice: deps.onNotice, seat: { ...classifierSeat, model: classifierModel }, ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) });
         const classifierLaneRule = peerLaneActive && peerSendMessageBuiltIn;
         const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
         const classifierRuntime = brainToRuntime(deps.brain);
-        const classifierOffSeat = { reasoning: "off", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS };
-        const classifierLowSeat = { reasoning: "low", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS + AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS };
-        const classifierSeat = thinkingOffExpressible(classifierModel) ? classifierOffSeat : classifierLowSeat;
+        const classifierRungs = classifierLadderRungs(am.classifierFallback, classifierModel, model);
+        const roundPrompt = new WeakMap();
         autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
         autoModeDecider = createAutoModeDecider({
             ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
-            onClassified: (info) => emitTrace(deps.tracer, () => ({
-                kind: "auto_mode.classified",
-                version: 1,
-                taskId: hostTaskId,
-                toolCallId: info.toolCallId,
-                model: classifierModel.id,
-                ms: info.ms,
-                verdict: info.verdict,
-                ...(info.cause !== undefined ? { cause: info.cause } : {}),
-                ts: Date.now(),
-            })),
-            classify: async (input, signal) => {
-                const ctx = await session.buildContext();
-                const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) &&
-                    (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
-                const userPrompt = renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
-                const classifierAuth = await spec.getApiKeyAndHeaders?.(classifierModel);
-                const request = (seat) => classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
-                    signal,
-                    ...seat,
-                    ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
-                    ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
-                });
-                let response = await request(classifierSeat);
-                if (classifierSeat === classifierOffSeat && classifierReplyEmptyAtCap(response)) {
-                    response = await request(classifierLowSeat);
+            candidates: classifierRungs.map((m) => m.id),
+            onClassified: classifierRoundObserver({ tracer: deps.tracer, onNotice: deps.onNotice, taskId: hostTaskId, seatModelId: classifierModel.id, ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) }),
+            classify: async (input, signal, rung) => {
+                const rungModel = rung !== undefined ? classifierRungs[rung.index] : undefined;
+                if (rung === undefined || rungModel === undefined) {
+                    throw new Error(`the auto-mode classifier was asked at ladder position ${JSON.stringify(rung?.index)}, which this arming did not build`);
+                }
+                let build = rung.index > 0 ? roundPrompt.get(input) : undefined;
+                if (build === undefined) {
+                    build = (async () => {
+                        const ctx = await session.buildContext();
+                        const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) && (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
+                        return renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
+                    })();
+                    roundPrompt.set(input, build);
                 }
-                return classifierReplyText(response);
+                const userPrompt = await build.catch((e) => { throw autoModeRoundNotAsked(e); });
+                const classifierAuth = await spec.getApiKeyAndHeaders?.(rungModel);
+                const request = async (seat, suffix) => {
+                    const response = await classifierRuntime.completeSimple(rungModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt + suffix, timestamp: Date.now() }] }, {
+                        signal,
+                        ...seat,
+                        ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
+                        ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
+                    });
+                    const failure = classifierReplyFailure(response);
+                    if (failure !== undefined)
+                        throw failure;
+                    return response;
+                };
+                let response = await request(classifierRungSeat(rungModel), CLASSIFIER_ATTEMPT_SUFFIX.first);
+                if (classifierReplyAsksAgain(response) && signal?.aborted !== true)
+                    response = await request(CLASSIFIER_THINK_SEAT, CLASSIFIER_ATTEMPT_SUFFIX.reask);
+                return classifierReplyVerdictText(response);
             },
         });
         if (am.persistArming === true)
@@ -325,6 +312,7 @@ export async function prepareCapsAndWorkflow(input) {
             parentCwd: taskRootFinal,
             parentThinking: () => childThinkingSeat(undefined, deploymentSubagentThinking(runnerSelf.agentCatalog?.roles), harnessRef.current?.getThinkingLevel() ?? thinking).thinking,
             parentReadFace: () => carrierReadFace(),
+            parentWriteFace: () => carrierWriteFace(),
             parentReadDenyPatterns: () => {
                 const readDenyAdditionsNormalized = input.readDenyAdditionsNormalized();
                 return readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized : undefined;

package/dist/core/runner/prepare-config-doors.d.ts

@@ -25,6 +25,7 @@ import type { ThinkingLevel } from "../../internal/harness.js";
 import { type MicroCompactMachine } from "../context-edit.js";
 import { type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
+import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import type { SessionStore } from "../session.js";
 import type { RunnerDeps, TaskLimits, TaskSpec } from "../types.js";
 import { type UsageWindow } from "../usage-window-store.js";
@@ -115,7 +116,7 @@ export interface PrepareConfigDoorsInput {
     /** borrowed-readonly — the caller's spec. NEVER mutated here: the per-task agents rebind returns a
      *  SHALLOW COPY on {@link PrepareConfigDoorsResult.spec} (only `tools` replaced). */
     spec: TaskSpec;
-    /** borrowed-readonly — deployment seats. Read for: readFace value screen, locked-config preflight,
+    /** borrowed-readonly — deployment seats. Read for: the two containment-face value screens, locked-config preflight,
      *  retention door, interaction-posture door (incl. `deps.onError` disclosure), usage windows,
      *  brain-call guardrail default, model/role maps. */
     deps: RunnerDeps;
@@ -184,6 +185,11 @@ export interface PrepareConfigDoorsResult {
      *  mutated (or getter-backed) after the door must not present an unscreened value to the mark
      *  branch (the read-once posture). */
     memoryDelegationEvidence: "static-face" | "attested-only";
+    /** owned — the lowered skills-listing budget seats (`TaskSpec.skillListingBudgetFraction` /
+     *  `skillListingMaxDescChars`): the renderer's two numbers, resolved once against the resolved main
+     *  model's window. Read at the door so a bad value refuses BEFORE session acquisition, and carried so
+     *  the listing phase and the boundary renderer measure against the same resolution. */
+    skillListingBudget: ResolvedSkillListingBudget;
     /** owned — the NORMALIZED memory-provenance mode: the deps seat read ONCE in
    *  the synchronous pre-await stretch, screened, absent folded to the `"carry"` default.
      *  The memory phase constructs every engine with THIS value — never a live deps re-read. */

package/dist/core/runner/prepare-config-doors.js

@@ -1,5 +1,5 @@
 import { resolveBrainCallGuardrailMs } from "../../brain/timeout.js";
-import { assertReadFaceValue } from "../../tools/fs/index.js";
+import { assertContainmentFaceValue } from "../../tools/fs/index.js";
 import { MICRO_COMPACT_MACHINES } from "../context-edit.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
@@ -7,6 +7,8 @@ import { isModelPriced, malformedPricingField, modelCostToPricing } from "../pri
 import { preflightLockedConfig } from "../locked-config.js";
 import { assertRetentionCapability } from "../retention.js";
 import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
+import { resolveSkillListingBudget } from "../skill-listing-budget.js";
+import { describeRejectedValue } from "../tool-search-setting.js";
 import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeamForm, resolveQuestionSeam } from "../wiring-manifest.js";
@@ -35,16 +37,6 @@ export function limitConfigError(code, message) {
     e.code = code;
     return e;
 }
-function describeRejectedValue(value) {
-    try {
-        const quoted = JSON.stringify(value);
-        if (quoted !== undefined)
-            return quoted;
-    }
-    catch {
-    }
-    return `a ${typeof value} value`;
-}
 export function resolveTaskLimits(limits) {
     if (limits === undefined)
         return undefined;
@@ -196,8 +188,10 @@ export function prepareConfigDoors(input) {
             throw e;
         }
     }
-    assertReadFaceValue(spec.readFace, "TaskSpec.readFace");
-    assertReadFaceValue(deps.readFace, "readFace (deployment seat)");
+    assertContainmentFaceValue(spec.readFace, "read", "spec");
+    assertContainmentFaceValue(deps.readFace, "read", "deps");
+    assertContainmentFaceValue(spec.writeFace, "write", "spec");
+    assertContainmentFaceValue(deps.writeFace, "write", "deps");
     const memoryDelegationEvidenceRaw = deps.memoryDelegationEvidence;
     if (memoryDelegationEvidenceRaw !== undefined && memoryDelegationEvidenceRaw !== "static-face" && memoryDelegationEvidenceRaw !== "attested-only") {
         const evidence = memoryDelegationEvidenceRaw;
@@ -414,6 +408,11 @@ export function prepareConfigDoors(input) {
     if (gateDecision.survivors !== undefined) {
         spec = { ...spec, tools: gateDecision.survivors };
     }
+    const skillListingBudget = resolveSkillListingBudget({
+        fraction: spec.skillListingBudgetFraction,
+        maxDescChars: spec.skillListingMaxDescChars,
+        model,
+    });
     const modelGate = Object.freeze({
         removedByClass: gateDecision.removedByClass,
         unknownClasses: gateDecision.unknownClasses,
@@ -437,6 +436,7 @@ export function prepareConfigDoors(input) {
         fableMitigations,
         modelGate,
         memoryDelegationEvidence,
+        skillListingBudget,
         memoryProvenance,
         memoryCapturePolicy,
         usageWindows,

package/dist/core/runner/prepare-defer-classify.d.ts

@@ -5,11 +5,10 @@ import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { AnnounceOnceSink, ToolFaceSnapshot } from "./contracts.js";
 import { RosterBuilder } from "../tool-roster.js";
 export interface PrepareDeferClassifyInput {
-    /** borrowed-readonly — the REBOUND spec (`spec′`); only `tools` is read (the caller roster the
-     *  classifier judges: names for the full-schema filter, specs for the `defer` declarations). */
+    /** borrowed-readonly — the REBOUND spec (`spec′`); only `tools` is read (names for the full-schema filter, specs for the `defer` declarations). */
     spec: Pick<TaskSpec, "tools" | "excludeAllTools">;
-    /** borrowed-readonly — deployment deps; only `deferMode` is read (the classifier's mode knob). */
-    deps: Pick<RunnerDeps, "deferMode">;
+    /** borrowed-readonly — deps; `deferMode` (candidate widening) and `toolSearch` (rule ②'s gate) are the only seats read. */
+    deps: Pick<RunnerDeps, "deferMode" | "toolSearch">;
     /** borrowed-mutable — the shared mount array (later refs alias it; in-place contract, never
      *  re-created). Mutated here, in order: `splice` of every excluded name; element REPLACEMENT with a
      *  shallow copy for the classic-profile description swap (the caller's ToolSpec object is never
@@ -17,21 +16,17 @@ export interface PrepareDeferClassifyInput {
      *  (element replacement with the wrapped object), the disclosure mount, the MCP refresh re-splice. Since
      *  Every one of those writes is a builder verb (`unmountWhere` / `replaceAt`). */
     roster: RosterBuilder;
-    /** borrowed-readonly — the frozen task-start tool face: `exclude` (the valve), `defer` (operator
-     *  defers, exact wire names), `alwaysLoad` (the inline pins). */
+    /** borrowed-readonly — the frozen task-start tool face: `exclude` (the valve), `defer` (operator defers, exact wire names), `alwaysLoad` (the pins). */
     toolFaceSnapshot: Pick<ToolFaceSnapshot, "exclude" | "defer" | "alwaysLoad">;
-    /** borrowed-readonly — whether a real execution env is mounted (the full-shell invariant runs only
-     *  where a shell could be on the roster). */
+    /** borrowed-readonly — whether a real execution env is mounted (the full-shell invariant runs only where a shell could be on the roster). */
     handsEnabled: boolean;
-    /** borrowed-readonly — the spec-time precomputation the invariant checks the post-exclusion roster
-     *  against: a mismatch is an engine bug, thrown. */
+    /** borrowed-readonly — the spec-time precomputation the invariant checks the post-exclusion roster against: a mismatch is an engine bug, thrown. */
     fullShellReachable: boolean;
     /** borrowed-readonly — the resolved prompt profile (`classic` swaps in `descriptionClassic`). */
     promptProfile: "simple" | "classic";
     /** borrowed-readonly — the resolved model (the deferral gate's threshold reads its context window). */
     model: Model;
-    /** borrowed-readonly — the materialized MCP roster; only `tools` is read (protocol names for the
-     *  remote-roster arm; `mcpAlwaysLoad` self-declarations, losing to an explicit operator defer). */
+    /** borrowed-readonly — the materialized MCP roster; only `tools` is read (protocol names; `mcpAlwaysLoad` self-declarations lose to an operator defer). */
     mcp: Pick<MaterializedMcp, "tools">;
     /** borrowed-readonly — the materialized A2A roster; only `tools` is read (protocol names). */
     a2a: Pick<MaterializedA2a, "tools">;
@@ -39,15 +34,12 @@ export interface PrepareDeferClassifyInput {
     sharedMemoryPairMounted: boolean;
     /** borrowed-readonly — whether the engine-memory pair mounted (project-context phase). */
     memoryEnginePairMounted: boolean;
-    /** borrowed-readonly — the memory block as the project-context phase left it. The engine pair's
-     *  retraction strips the recall paragraph from it and the stripped value returns as
-     *  {@link PrepareDeferClassifyResult.memoryBlock}; the input value itself is never mutated. */
+    /** borrowed-readonly — the memory block as the project-context phase left it; the engine pair's retraction strips the recall paragraph and returns the
+     *  stripped value as {@link PrepareDeferClassifyResult.memoryBlock}. The input is never mutated. */
     memoryBlock: string | undefined;
-    /** borrowed-readonly — the exact recall-discipline segment the memory phase composed (the strip
-     *  removes THIS string, never a re-composition). */
+    /** borrowed-readonly — the exact recall-discipline segment the memory phase composed (the strip removes THIS string, never a re-composition). */
     memoryRecallSegment: string | undefined;
-    /** borrowed-readonly — the once-per-session ledger's deduplicated operator sink (a retraction is a
-     *  session-level fact, announced once). */
+    /** borrowed-readonly — the once-per-session ledger's deduplicated operator sink (a retraction is announced once per session). */
     onceLedger: AnnounceOnceSink;
     /** borrowed-readonly — the acquired session's id (operator-line context). */
     sessionId: string;
@@ -60,6 +52,8 @@ export interface PrepareDeferClassifyResult {
     /** owned — the memory block after the engine pair's retraction strip (unchanged when no retraction
      *  ran). The driver binds it under the name the prompt assembly reads. */
     memoryBlock: string | undefined;
+    /** owned — the gate policy this classification was MEASURED under; the census reports it from here, never a second reading of the seat. */
+    toolSearch: import("../tool-search-setting.js").ResolvedToolSearch;
 }
 /** The M11 phase body — prepareTask's tool-face fold + deferred classification, verbatim (module header). */
 export declare function prepareDeferClassify(input: PrepareDeferClassifyInput): PrepareDeferClassifyResult;

package/dist/core/runner/prepare-defer-classify.js

@@ -4,8 +4,9 @@ import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
 import { protocolOf } from "../protocol-table.js";
-import { classifyDeferred } from "./tool-defer-gate.js";
+import { classifyDeferredWithGate } from "./tool-defer-gate.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
+import { resolveToolSearch, toolSearchSettingOf } from "../tool-search-setting.js";
 import { RosterBuilder } from "../tool-roster.js";
 function explicitlyDeferredMemoryTrio(mounted, roster, callerDeferNames) {
     return mounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => roster.some((t) => t.name === n) && (callerDeferNames ?? []).includes(n)) : [];
@@ -45,13 +46,16 @@ export function prepareDeferClassify(input) {
     const mcpAlwaysLoadNames = mcp.tools
         .filter((t) => t.mcpAlwaysLoad === true && !(toolFaceSnapshot.defer ?? []).includes(t.name))
         .map((t) => t.name);
+    const resolvedToolSearch = resolveToolSearch(deps.toolSearch);
+    const toolSearchSeat = toolSearchSettingOf(resolvedToolSearch);
     const classifyDeferredOverFace = (face, builtinDeferNames) => {
         const mounted = new Set(face.map((t) => t.name));
-        const deferredSet = classifyDeferred({
+        const classified = classifyDeferredWithGate({
             specs: spec.tools ?? [],
             protocolToolNames,
             fullTools: face,
             deferMode: deps.deferMode,
+            toolSearch: toolSearchSeat,
             model,
             callerDeferNames: (toolFaceSnapshot.defer ?? []).filter((n) => mounted.has(n)),
             builtinDeferNames: builtinDeferNames.filter((n) => mounted.has(n)),
@@ -61,6 +65,7 @@ export function prepareDeferClassify(input) {
                 ...mcpAlwaysLoadNames,
             ],
         });
+        const deferredSet = classified.deferred;
         for (const n of [...deferredSet])
             if (!mounted.has(n))
                 deferredSet.delete(n);
@@ -105,5 +110,5 @@ export function prepareDeferClassify(input) {
     else {
         deferred = classifyDeferredOverFace(tools, []);
     }
-    return { deferred, memoryBlock };
+    return { deferred, memoryBlock, toolSearch: resolvedToolSearch };
 }

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -28,12 +28,38 @@ import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type ComplianceCapability } from "../compliance.js";
 import { type HookEnvCapabilities, type HookInvocationIdentity, type Hooks } from "../hooks.js";
 import type { ToolPolicy } from "../tool-policy.js";
+import { type GateOutcome } from "../gate-outcome.js";
 import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, ReversibilityProbes } from "./contracts.js";
 import type { StopForDenialLimit } from "./denial-limit-arms.js";
 import type { PermissionRuleLanes } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
+/**
+ * The parent-thread human-rejection boundary — judged ONCE here, from the pass's own record (CC parity:
+ * the reference CLI's reject path aborts exactly when there is no feedback and the run is not a
+ * subagent; a rejection WITH the decider's note, and every delegated child — forks included — keep the
+ * continue / adapt-or-report posture): the final block IS a person's refusal (`deniedBy: ask_resolution`
+ * and a `human_refused` settlement — not a later fold layer's deny that merely followed a human
+ * interaction), the refusal carried NO note (`settlement.note` absent — a fact composed at the refusal,
+ * never re-derived from message text), and the run is not a delegated child (the raw trusted delegation
+ * facet — the same fact that selects the refusal text's posture, so the boundary and the words the model
+ * was told always agree). Policy/hook/classifier denies and window/abort settlements never satisfy it.
+ *
+ * Returns the loop directive that settles every never-started same-batch sibling: honest
+ * known-not-executed wording plus the machine mark (`error`/`code` twin — the wire errorCode lift
+ * reads `details.code`; `details.error` is the in-band mark result consumers grep) naming the
+ * rejected call. `undefined` = no boundary (the block stands alone, current behavior).
+ */
+export declare function maybeHumanRejectionHalt(input: {
+    gate: GateOutcome | undefined;
+    isDelegatedChild: boolean;
+    toolName: string;
+    toolCallId: string;
+}): {
+    reason: string;
+    details: Record<string, unknown>;
+} | undefined;
 export interface PrepareGateStationsInput {
     /** borrowed-readonly — the in-stream ask lane, or undefined when the gate machinery is inactive (then no `tool_call`
      *  station is built). Read: `adjudicate`, `resolveAskBound`, `notifyPermissionDenied`, `notifyHookError`. */

package/dist/core/runner/prepare-gate-stations.js

@@ -23,7 +23,7 @@ function screenGateResult(result) {
     }
     return defects.length > 0 ? { defects } : { gate, defects };
 }
-function maybeHumanRejectionHalt(input) {
+export function maybeHumanRejectionHalt(input) {
     const d = input.gate?.disposition;
     const s = input.gate?.settlement;
     const bare = d?.kind === "denied" && d.deniedBy === "ask_resolution" && s?.kind === "human_refused" && s.note === undefined;