@sema-agent/core 7.18.0 → 7.19.0

package/dist/core/auto-mode.d.ts

@@ -10,6 +10,18 @@ export declare const AUTO_MODE_UNAVAILABLE_CAUSES: readonly ["error", "timeout"]
 export type AutoModeUnavailableCause = (typeof AUTO_MODE_UNAVAILABLE_CAUSES)[number];
 /** Whether a value is a member of the unavailable-cause set — the screen a row reader applies to a stored word. */
 export declare function isAutoModeUnavailableCause(v: unknown): v is AutoModeUnavailableCause;
+/**
+ * HOW a reply failed to carry a verdict — the closed set behind `parse_error.form`. `missing` = the reader found
+ * NO answer (empty text, prose, an answer only inside a thinking block); `conflict` = it found TWO distinct
+ * `<block>` answers (raw or thinking-stripped). The split exists for the classify leg's re-ask: a missing
+ * answer is asked for again (CC 2.1.259 `Vrr` re-asks an unparseable reply), a conflict is not — it carries a
+ * `yes`, and a second attempt that answered `no` would erase it. Not on any wire face; the trace frame and the
+ * gate record keep the one word `parse_error`.
+ */
+export declare const AUTO_MODE_PARSE_FAILURES: readonly ["missing", "conflict"];
+export type AutoModeParseFailure = (typeof AUTO_MODE_PARSE_FAILURES)[number];
+/** Whether a value is a member of the parse-failure set. */
+export declare function isAutoModeParseFailure(v: unknown): v is AutoModeParseFailure;
 /**
  * WHY a classification moved DOWN the candidate ladder — the closed set behind
  * {@link AutoModeClassifierRound}'s `fallback.cause`, i.e. the ways a candidate produces NO RULING
@@ -52,10 +64,13 @@ export type AutoModeVerdict = ({
     cause: AutoModeUnavailableCause;
 } & AutoModeRoundAttributed)
 /** The model responded but not in the `<block>…` contract shape. Handled as a BLOCK with the CC
- *  parse-failure sentence ({@link CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE}), counted by the denial limit. */
+ *  parse-failure sentence ({@link classifierParseFailureDenyMessage}), counted by the denial limit. `form`
+ *  says WHICH way the reply failed ({@link AutoModeParseFailure}): the classify leg re-asks a `missing`
+ *  reply once and never a `conflict`. */
  | ({
     kind: "parse_error";
     raw: string;
+    form: AutoModeParseFailure;
 } & AutoModeRoundAttributed);
 /** The member every verdict arm shares: WHICH MODEL this classification asked and which one answered. */
 export interface AutoModeRoundAttributed {
@@ -121,23 +136,35 @@ export declare function rungDidNotRule(v: AutoModeVerdict): AutoModeFallbackCaus
  * NOT move keeps the CC text byte for byte.
  */
 export declare function classifierUnavailableDenyMessage(toolName: string, cause: AutoModeUnavailableCause, attribution?: AutoModeClassifierRound): string;
-/** The model-facing deny text for a `parse_error` verdict — CC 2.1.250 `Ure` over the R3t stem: the classifier
- *  answered, but not with a verdict, and auto mode blocks what it could not evaluate. */
-export declare const CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE = "Auto mode could not evaluate this action and is blocking it for safety \u2014 the classifier's reply carried no verdict.";
 /**
- * Parse the classifier's output contract — the CC 2.1.250 verdict reader (`wCe`, its thinking strip
- * `xCe`, its reason reader `yCe`) ported as is:
+ * The model-facing deny text for a `parse_error` verdict — CC 2.1.259 `i7t` stem ("Auto mode could not evaluate
+ * this action and is blocking it for safety"; 2.1.250 `Ure`): the classifier answered, but not with a verdict,
+ * and auto mode blocks what it could not evaluate. With a candidate ladder wired the tail NAMES the model whose
+ * reply carried no verdict (`attribution.modelUsed`) — a declared departure from upstream, whose card names no
+ * model: the person reading this card is the one who can change the catalog, and on a single-model deployment
+ * the name is the whole diagnosis. Without attribution the sentence is unchanged. The stem is a stable prefix
+ * either way; one writer for both deny sites.
+ */
+export declare function classifierParseFailureDenyMessage(attribution?: AutoModeClassifierRound): string;
+/**
+ * Parse the classifier's output contract — the CC 2.1.259 verdict reader (`MTt`, its thinking strip `QTt`, its
+ * reason reader `TTt`; unchanged from 2.1.250 `wCe`/`xCe`/`yCe`), plus ONE arm of sema's own:
  *   blocked: `<block>yes</block><category>Rule Name</category><reason>[Rule Name] …</reason>`
  *   allowed: `<block>no</block>`
  *
  * The verdict is the set of `<block>yes|no` hits, NOT a prefix match:
  *   1. CONFLICT, read on the RAW text (thinking included): `<block>(yes|no)\b` collected over the whole
- *      response — more than one distinct answer ⇒ no verdict (`parse_error`). A scratch-space "yes"
- *      contradicting a final "no" is a contradiction, not an allow.
- *   2. HITS, read on the text with `<thinking>` blocks removed (closed ones anywhere, then an unclosed
- *      trailing one — a reasoning model's scratch space is not part of the verdict): `<block>(yes|no)\b`
- *      with the closing tag OPTIONAL, at ANY position. Zero hits ⇒ `parse_error` (a reply that only
- *      answered inside its thinking has no verdict); the one distinct answer ⇒ `no` = allow, `yes` = block.
+ *      response — more than one distinct answer ⇒ no verdict (`parse_error`, form `conflict`). A scratch-space
+ *      "yes" contradicting a final "no" is a contradiction, not an allow.
+ *   2. HITS, read on the text with thinking blocks removed ({@link stripThinking}): `<block>(yes|no)\b` with
+ *      the closing tag OPTIONAL, at ANY position. Two distinct answers ⇒ `conflict`; the one distinct answer ⇒
+ *      `no` = allow, `yes` = block.
+ *   3. BARE ANSWER (sema, ruled 2026-09-15 — small open models drop the tag; recorded as a divergence; a caller
+ *      that knows the reply is not a complete answer passes `bareAnswer: false` and this arm is closed): zero
+ *      hits AND the whole thinking-stripped text is an answer by {@link bareAnswerOf} ⇒ that word is the
+ *      verdict (a bare `yes` blocks with empty category/reason) — unless a `<block>` answer inside the
+ *      thinking disagrees with it (`conflict`). Zero hits and anything else — prose, a question with its
+ *      answer, a reply that only answered inside its thinking — ⇒ `parse_error`, form `missing`.
  * So a preamble before the tag, prose after `<block>no`, a missing `</block>` and a reply that repeats
  * its answer all read as the answer they carry; the tag must be spelled `<block>yes` / `<block>no` with
  * no whitespace inside (the word-boundary form — `<block>yesterday` is not a hit) and case does not matter.
@@ -149,11 +176,13 @@ export declare const CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE = "Auto mode could no
  * line from the tool name in that case. Downgrading a stated block to `parse_error` would lose the
  * classifier's explicit verdict on the exact calls it flagged.
  *
- * `parse_error` is fail-closed: the gate handles it as a BLOCK (CC 2.1.250's own outcome for a reply with no
+ * `parse_error` is fail-closed: the gate handles it as a BLOCK (CC 2.1.259's own outcome for a reply with no
  * verdict) that the denial limit counts like any other — never a silent allow, and never a question handed
  * to a person on the classifier's behalf.
  */
-export declare function parseAutoModeResponse(text: string): AutoModeVerdict;
+export declare function parseAutoModeResponse(text: string, options?: {
+    bareAnswer?: boolean;
+}): AutoModeVerdict;
 /** What the decider hands the deployment's `classify` hook (the assembled prompt is the hook's job
  *  when it owns assembly; when using {@link buildAutoModePrompt} the decider passes its output). */
 export interface AutoModeClassifyInput {

package/dist/core/auto-mode.js

@@ -5,6 +5,11 @@ const AUTO_MODE_UNAVAILABLE_CAUSE_SET = new Set(AUTO_MODE_UNAVAILABLE_CAUSES);
 export function isAutoModeUnavailableCause(v) {
     return AUTO_MODE_UNAVAILABLE_CAUSE_SET.has(v);
 }
+export const AUTO_MODE_PARSE_FAILURES = ["missing", "conflict"];
+const AUTO_MODE_PARSE_FAILURE_SET = new Set(AUTO_MODE_PARSE_FAILURES);
+export function isAutoModeParseFailure(v) {
+    return AUTO_MODE_PARSE_FAILURE_SET.has(v);
+}
 export const AUTO_MODE_FALLBACK_CAUSES = ["error", "timeout", "parse_error"];
 const AUTO_MODE_FALLBACK_CAUSE_SET = new Set(AUTO_MODE_FALLBACK_CAUSES);
 export function isAutoModeFallbackCause(v) {
@@ -64,19 +69,83 @@ export function classifierUnavailableDenyMessage(toolName, cause, attribution) {
         "If it keeps failing, continue with other tasks that don't require this action and come back to it later. " +
         "Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.");
 }
-export const CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE = "Auto mode could not evaluate this action and is blocking it for safety — the classifier's reply carried no verdict.";
-export function parseAutoModeResponse(text) {
+export function classifierParseFailureDenyMessage(attribution) {
+    const stem = "Auto mode could not evaluate this action and is blocking it for safety";
+    return attribution === undefined ? `${stem} — the classifier's reply carried no verdict.` : `${stem} — the classifier model "${attribution.modelUsed}" replied without a verdict.`;
+}
+function stripThinking(text) {
+    return text.replace(/<(thinking|think)>[\s\S]*?<\/\1>/gi, "").replace(/<(thinking|think)>[\s\S]*$/i, "");
+}
+const BARE_ANSWER_WRAPPERS = [
+    ["**", "**"],
+    ["__", "__"],
+    ["*", "*"],
+    ["_", "_"],
+    ["`", "`"],
+    ['"', '"'],
+    ["'", "'"],
+    ["«", "»"],
+];
+function unwrapBareAnswer(text) {
+    let s = text;
+    for (;;) {
+        const before = s;
+        s = s.trim().replace(/[.!]+$/, "").trim();
+        for (const [open, close] of BARE_ANSWER_WRAPPERS) {
+            if (s.length > open.length + close.length && s.startsWith(open) && s.endsWith(close)) {
+                s = s.slice(open.length, s.length - close.length);
+                break;
+            }
+        }
+        if (s === before)
+            return s;
+    }
+}
+function bareAnswerOf(text) {
+    const visible = text.replace(/[\u200b-\u200d\ufeff]/g, "").trim();
+    if (visible.includes("```") || visible.includes("\n"))
+        return undefined;
+    let s = unwrapBareAnswer(visible);
+    const labelled = labelledAnswer(s);
+    if (labelled !== undefined)
+        s = unwrapBareAnswer(labelled);
+    const word = /^(yes|no)$/i.exec(s)?.[1]?.toLowerCase();
+    return word === "yes" || word === "no" ? word : undefined;
+}
+function labelledAnswer(s) {
+    const label = "(?:final[ \\t]+)?(?:block|answer|verdict|decision)";
+    for (const [open, close] of [["", ""], ...BARE_ANSWER_WRAPPERS]) {
+        const re = new RegExp(`^${escapeRe(open)}${label}${escapeRe(close)}[ \\t]*[:=][ \\t]*(.*)$`, "i");
+        const m = re.exec(s);
+        if (m !== null)
+            return m[1];
+    }
+    return undefined;
+}
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+export function parseAutoModeResponse(text, options) {
     const rawAnswers = new Set([...text.matchAll(/<block>(yes|no)\b/gi)].map((m) => m[1].toLowerCase()));
     if (rawAnswers.size > 1)
-        return { kind: "parse_error", raw: text };
-    const stripped = text.replace(/<thinking>[\s\S]*?<\/thinking>/g, "").replace(/<thinking>[\s\S]*$/, "");
+        return { kind: "parse_error", raw: text, form: "conflict" };
+    const stripped = stripThinking(text);
     const hits = [...stripped.matchAll(/<block>(yes|no)\b(<\/block>)?/gi)];
-    if (hits.length === 0)
-        return { kind: "parse_error", raw: text };
-    const answers = new Set(hits.map((m) => m[1].toLowerCase()));
-    if (answers.size !== 1)
-        return { kind: "parse_error", raw: text };
-    if (!answers.has("yes"))
+    let answer;
+    if (hits.length > 0) {
+        const answers = new Set(hits.map((m) => m[1].toLowerCase()));
+        if (answers.size !== 1)
+            return { kind: "parse_error", raw: text, form: "conflict" };
+        answer = answers.has("yes") ? "yes" : "no";
+    }
+    else {
+        answer = options?.bareAnswer === false ? undefined : bareAnswerOf(stripped);
+        if (answer === undefined)
+            return { kind: "parse_error", raw: text, form: "missing" };
+        if (rawAnswers.size > 0 && !rawAnswers.has(answer))
+            return { kind: "parse_error", raw: text, form: "conflict" };
+    }
+    if (answer === "no")
         return { kind: "allow" };
     const category = /<category>([\s\S]*?)<\/category>/i.exec(stripped)?.[1]?.trim() ?? "";
     const reason = /<reason>([\s\S]*?)<\/reason>/.exec(stripped)?.[1]?.trim() ?? "";

package/dist/core/checkpoint-store.d.ts

@@ -369,6 +369,13 @@ export interface PendingSteerInput {
     inputId?: string;
     priority?: SystemInjectionPriority;
 }
+/** True ONLY for a PLAIN data record (not null / array / class-instance / proxy-with-odd-prototype) — the only
+ *  shape we safely digest. Adversarial args (a proxy, a getter that throws) must never crash the mint, so this +
+ *  {@link safeDataValue}/{@link safeKeys} make {@link buildRiskDescriptor} fully TOTAL. */
+export declare function isPlainRecord(x: unknown): x is Record<string, unknown>;
+/** Read `obj[key]` as a DATA property only — NEVER invokes a getter/accessor (so a throwing getter can't escape
+ *  AND a non-deterministic getter can't vary the digest); a trapped descriptor read ⇒ undefined. */
+export declare function safeDataValue(obj: Record<string, unknown>, key: string): unknown;
 /**
  * design/80 §D-E: build the DETERMINISTIC, REDACTED {@link RiskDescriptor} for an escalation checkpoint at
  * MINT. Pure — a function ONLY of (`toolName`, `args`, the D-2 `safety` axis, the `shellGated` flag); it reads

package/dist/core/checkpoint-store.js

@@ -73,7 +73,7 @@ export const MAX_PENDING_STEER_CHARS = 16_000;
 export const PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES = 48_000;
 export const MAX_PENDING_STEER_ENTRIES = Math.floor(PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES / MAX_PENDING_STEER_CHARS);
 export const PENDING_STEER_FROZEN_FIELDS = ["text", "trusted", "actor", "seq", "inputId", "priority"];
-function isPlainRecord(x) {
+export function isPlainRecord(x) {
     try {
         if (x === null || typeof x !== "object" || Array.isArray(x))
             return false;
@@ -84,7 +84,7 @@ function isPlainRecord(x) {
         return false;
     }
 }
-function safeDataValue(obj, key) {
+export function safeDataValue(obj, key) {
     try {
         const d = Object.getOwnPropertyDescriptor(obj, key);
         return d && "value" in d ? d.value : undefined;

package/dist/core/engine-notice.d.ts

@@ -23,6 +23,22 @@ export interface EngineNotice {
      *  - `"config.tool_face_undeclared"` / `"config.tool_face_invalid"` (design/388 §2.7) — an MCP server's
      *    `toolFaces` overlay names a tool the listing does not carry / does not fit the tool's materialized
      *    schema (the tool mounts bare); once per leg per tool; `detail: { server, tool, problem?, sessionId, runId }`.
+     *  - `"skills.listing_truncated"` — the `<skills>` disclosure block did not fit its byte budget, so
+     *    at least one skill is listed without its description (`nameOnly`) or, in the pathological case,
+     *    not listed at all (`dropped`); the `Skill` tool still serves every one of them. Audience
+     *    `operator` — raising `TaskSpec.skillListingBudgetFraction`, lowering `skillListingMaxDescChars`
+     *    or declaring fewer skills are all deployment acts. `detail: { budgetBytes,
+     *    requestedBudgetBytes, descMaxChars, total, kept, nameOnly: [name], dropped: [name], sessionId }`
+     *    — `requestedBudgetBytes` is what the declared fraction asked for BEFORE the delivery lane's
+     *    structural clamp, and differs from `budgetBytes` only when that clamp bound, so a listing
+     *    shortened by the lane is distinguishable from one shortened by the deployment's own fraction.
+     *    Announced by the lane that DELIVERS a listing frame — the leg's first-frame producer, or the
+     *    turn boundary that a drift (or a resume leg's initial listing) rides — once per delivered frame
+     *    the budget actually degraded, and never for one that fit. Every count is read off that frame, so
+     *    `total` is the whole roster on an initial listing and the newly announced set on a drift frame.
+     *    A run whose deployment turned the listing off (`attachments.skillsListing: false`) emits nothing,
+     *    since nothing is rendered. There is NO dedup key: each notice is one delivered frame`s cost, and
+     *    a frame is delivered (and committed) once.
      *  - `"tool_result.offload_put_failed"` (#167) — a clear-with-offload persist's fire-and-forget put
      *    failed; THIS attempt stored nothing (the failure arm reports, it never re-inserts under the
      *    ref) — an earlier attempt of the same idempotent re-put may already have stored the row, so
@@ -118,6 +134,20 @@ export interface EngineNotice {
      *    `detail: { from, to, cause, sessionId?, runId? }` — `cause` is the `AutoModeFallbackCause` word, the
      *    two ids are the rungs. Dedup key: (code, from, cause) PER RUN; a second CAUSE on the same rung is
      *    its own line.
+     *  - `"classifier.role_defaulted"` (`src/core/runner/classifier-ladder.ts`, the seat resolver) — no
+     *    `classifier` role names a model, so another model STANDS IN for the seat. `detail: { model, reason,
+     *    thinkingOffSpelled, sessionId?, runId? }` — `reason` ∈ `tier_below_main` (the nearest directly-bound
+     *    tier below the run's main model) / `tier_table` (the static `flash` row, a main bound to no tier) /
+     *    `role_fallback` (the `summarize → default` chain, no tiers) / `main_only` (the main model is the only
+     *    model there is) / `role_unresolvable` (the role named a model the catalog cannot resolve; the main
+     *    stands in); `thinkingOffSpelled` = whether that model's wire can carry a disable key. Minted
+     *    AFTER the route pre-flight, so it names the seat actually used. Once per run.
+     *  - `"classifier.contract_broken"` (same file, the round observer) — ONE model answered
+     *    `AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER` CONSECUTIVE classifications without a verdict (each already
+     *    re-asked once by the leg). `detail: { model, rung, consecutive, sessionId?, runId? }` — `rung` is the
+     *    ladder position (0 the seat, 1 the model behind it), since two rungs may share an id. A ruling from
+     *    that rung resets its count; an `unavailable` round neither counts nor resets. Once per run per rung,
+     *    and by construction before the denial limit's third block hands the user its card.
      *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapDeps` moved a
      *    same-name entry's `baseUrl` while its Model-visible credential half (auth-bearing headers)
      *    did not change: legal (a provider changing domains), but worth one loud line — if the

package/dist/core/gate-fold.js

@@ -1,5 +1,6 @@
 import { inlineUntrusted } from "./untrusted-text.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
+import { normalizeReadRootCandidate } from "./read-root-candidate.js";
 import { traceHookCrash } from "./runner/gate-exit.js";
 function withProbeTimeout(p, ms, signal) {
     if (ms === undefined && signal === undefined)
@@ -80,6 +81,7 @@ export async function runGateFold(pass) {
         let probeReason;
         let probeCause;
         let probeMandated;
+        let probeReadRootCandidate;
         if (input.irreversibility === "maybe" && input.reversibilityProbe) {
             let reversible = false;
             const probeArgs = pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput;
@@ -105,6 +107,7 @@ export async function runGateFold(pass) {
                     probeCause = normalizeProbeCause(verdict?.cause);
                     if (verdict?.mandated === true)
                         probeMandated = true;
+                    probeReadRootCandidate = normalizeReadRootCandidate(verdict?.readRootCandidate);
                 }
             }
             catch (err) {
@@ -123,6 +126,7 @@ export async function runGateFold(pass) {
                 ...(probeReason !== undefined ? { probeReason } : {}),
                 ...(probeCause !== undefined ? { probeCause } : {}),
                 ...(probeMandated === true ? { probeMandated: true } : {}),
+                ...(probeReadRootCandidate !== undefined ? { probeReadRootCandidate } : {}),
             };
             pass.tightenedBy = input.shellGated === true ? "shell_gate" : "safety";
         }
@@ -139,7 +143,7 @@ export async function runGateFold(pass) {
         pass.tightenedBy = "safety";
     }
     if (pass.decision.action === "allow" && input.writeProtectionCheck !== undefined) {
-        const writeProtectedHit = input.writeProtectionCheck(toolName, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, pass.req.face);
+        const writeProtectedHit = input.writeProtectionCheck(toolName, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, pass.req.face, input.trackedCwd?.());
         if (writeProtectedHit !== null) {
             pass.decision = {
                 action: "ask",

package/dist/core/gate-lanes.js

@@ -1,6 +1,6 @@
 import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, describeThrown } from "./tool-policy.js";
-import { askOriginOf, classifierMayAnswer, persistedRuleMandateOf, probeBoundaryMandate, safetyAxisOf } from "./ask-origin.js";
-import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
+import { classifierMayAnswer, persistedRuleMandateOf, probeBoundaryMandate, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
+import { classifierParseFailureDenyMessage, classifierUnavailableDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { isRuleBehavior } from "./permission-rule-model.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
@@ -346,7 +346,7 @@ export async function runGateLanes(pass) {
         if (pass.decision.action === "ask") {
             const { ruleStoreUnreadable: _selfDeclared, ...unstamped } = pass.decision;
             const stamped = { ...unstamped, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}), ...(originFacts.ruleStore !== undefined ? { ruleStoreUnreadable: originFacts.ruleStore } : {}) };
-            pass.decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
+            pass.decision = stampAskOrigin(stamped, originFacts);
         }
         if (allowLayerMayClear() && pass.decision.action === "ask" && persistedRuleMandate === undefined && pass.decision.matchedAskRule === undefined && pass.req.toolName === COMMAND_RULE_TOOL) {
             const commandParam = catalogRuleFaceOf(COMMAND_RULE_TOOL)?.primaryParams[0] ?? "command";
@@ -387,7 +387,7 @@ export async function runGateLanes(pass) {
                 }, "unavailable", pass.req);
             }
             else {
-                const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
+                const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
                 const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
                 const tracked = input.autoMode.denialTracking?.recordBlock();
                 if (tracked?.limitReached === true) {
@@ -398,7 +398,7 @@ export async function runGateLanes(pass) {
                         requiresRealApproval: true,
                         denialLimitFallback: tracked.fallback,
                     };
-                    pass.decision = { ...fallbackAsk, origin: askOriginOf(fallbackAsk, originFacts) };
+                    pass.decision = stampAskOrigin(fallbackAsk, originFacts);
                 }
                 else {
                     const denied = {
@@ -658,7 +658,7 @@ export async function runGateLanes(pass) {
                     const { ruleStoreUnreadable: _selfDeclaredOnEdit, ...recheckUnstamped } = recheck;
                     const editAskSnapshot = { ...recheckUnstamped, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
                     markedThisRound = undefined;
-                    const editAskDecision = { ...editAskSnapshot, ...(editRuleStore !== undefined ? { ruleStoreUnreadable: editRuleStore } : {}), origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org, editRuleStore)) };
+                    const editAskDecision = stampAskOrigin({ ...editAskSnapshot, ...(editRuleStore !== undefined ? { ruleStoreUnreadable: editRuleStore } : {}) }, askOriginFacts(editOrg.org, editRuleStore));
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     ledger.fromResolved(rr, editAskDecision, toolName);
@@ -677,7 +677,7 @@ export async function runGateLanes(pass) {
                     editRewrittenSinceHuman = false;
                 }
                 if (editDenied === undefined && editRewrittenSinceHuman && input.writeProtectionCheck !== undefined) {
-                    const editHit = input.writeProtectionCheck(toolName, editArgs, pass.req.face);
+                    const editHit = input.writeProtectionCheck(toolName, editArgs, pass.req.face, input.trackedCwd?.());
                     if (editHit !== null) {
                         editDenied = {
                             action: "deny",

package/dist/core/gate-outcome.d.ts

@@ -93,6 +93,31 @@ export type Settlement = {
     };
     when: number;
 };
+/** The person arm of {@link Settlement} — the shape the two human words inhabit. Named so a site that
+ *  both composes one and quotes its note can read the seat off the record instead of re-deriving it. */
+export type PersonSettlement = Extract<Settlement, {
+    kind: "human_allowed" | "human_refused";
+}>;
+/**
+ * A decider's NOTE, normalised — the one rule for "did the decider say anything": empty text is a
+ * decider who attached nothing and reads as absent wherever the note travels. Whitespace-only text is
+ * not empty by this rule and stays a note: that half is PINNED CURRENT BEHAVIOUR, not a promise —
+ * nothing here requires a note to carry content, and narrowing it is a separate decision with its own
+ * consumers to warn.
+ */
+export declare function decidersNote(text: string | undefined): string | undefined;
+/**
+ * THE mint for a person's settlement: the synchronous resolver's human arms and the durable decide
+ * lane's person arm compose their record here, so one refusal plus one reason text cannot end as two
+ * different records depending on which path carried it.
+ *
+ * @contract settlement.note — the `note` seat is filled exactly when the decider attached a reason, and
+ * its absence is how the record says the refusal was bare (the runner reads that absence, and nothing
+ * else, as the issuing batch's control-flow boundary). Empty text folds to absence HERE, once, for
+ * every path that fills the seat ({@link decidersNote}); a site that hand-builds the record instead is
+ * a second answer to the same question, which is how one path came to halt a batch the other let run.
+ */
+export declare function settledByPerson(kind: PersonSettlement["kind"], approver: string | undefined, note?: string): PersonSettlement;
 /** Which settlement kinds are REFUSALS (the ask ended as a deny). Total over the closed set — the fence
  *  below refuses a member without a row — so invariant I2 is a table lookup, not a list in a condition. */
 export declare const SETTLEMENT_IS_REFUSAL: {

package/dist/core/gate-outcome.js

@@ -18,6 +18,13 @@ const SETTLEMENT_KIND_SET = new Set(SETTLEMENT_KINDS);
 export function isSettlementKind(v) {
     return SETTLEMENT_KIND_SET.has(v);
 }
+export function decidersNote(text) {
+    return text === "" ? undefined : text;
+}
+export function settledByPerson(kind, approver, note) {
+    const given = decidersNote(note);
+    return { kind, who: { party: "person", ...(approver !== undefined ? { approver } : {}) }, when: Date.now(), ...(given !== undefined ? { note: given } : {}) };
+}
 export const SETTLEMENT_IS_REFUSAL = {
     human_allowed: false,
     human_refused: true,

package/dist/core/governance-codes.d.ts

@@ -104,7 +104,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -119,6 +119,8 @@ export const ENGINE_NOTICE_CODES = [
     "peer.idle_subscription",
     "classifier.denial_limit",
     "classifier.fallback",
+    "classifier.role_defaulted",
+    "classifier.contract_broken",
     "checkpoint.execution_outcome_unrecorded",
     "delegation.transcript_integrity",
     "delegation.ask_unresolvable",
@@ -151,6 +153,7 @@ export const ENGINE_NOTICE_CODES = [
     "task.interrupt_unconsumed",
     "memory.capture_opted_out",
     "memory.capture_optout_unpersisted",
+    "skills.listing_truncated",
     "tool_result.offload_put_failed",
 ];
 const NOTICE_AUDIENCE_TABLE = {
@@ -164,6 +167,8 @@ const NOTICE_AUDIENCE_TABLE = {
     "task.user_followup_undrained": "user",
     "classifier.denial_limit": "user",
     "classifier.fallback": "operator",
+    "classifier.role_defaulted": "operator",
+    "classifier.contract_broken": "operator",
     "task.turn_interrupted": "user",
     "steering.parked_input_blocked": "user",
     "task.halt_unconsumed": "user",
@@ -209,6 +214,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "route.fallback_to_primary": "operator",
     "route.classifier_unroutable": "operator",
     "route.base_url_changed_key_unchanged": "operator",
+    "skills.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",
 };
 export const NOTICE_AUDIENCE = NOTICE_AUDIENCE_TABLE;

package/dist/core/hooks.d.ts

@@ -1354,7 +1354,7 @@ export interface ToolGateInput {
      * (the write-protection tighten below). Absent ⇒ the deployment replaced the table with `[]` (or
      * the caller runs the gate without one) and the decision path is byte-identical.
      */
-    writeProtectionCheck?: (toolName: string, args: unknown, face?: import("./tool-registry.js").ToolCallLike["face"]) => import("./write-protect.js").WriteProtectedHit | null;
+    writeProtectionCheck?: (toolName: string, args: unknown, face?: import("./tool-registry.js").ToolCallLike["face"], cwd?: string) => import("./write-protect.js").WriteProtectedHit | null;
     /**
      * design/143 批2 (A, CC 2.1.207 auto mode): when present, a surviving `ask` is routed to the
      * small-model policy CLASSIFIER before any human/durable resolution:

package/dist/core/read-root-candidate.d.ts

@@ -0,0 +1,12 @@
+/** The display bound on a grant candidate's directory: generous next to a real `PATH_MAX`, tight enough
+ *  that the seat cannot become an unbounded prose channel onto an approval card. */
+export declare const READ_ROOT_CANDIDATE_DIR_MAX = 1024;
+/**
+ * The validator for a probe's {@link import("./tool-spec.js").ReversibilityVerdict.readRootCandidate}: the
+ * errand `normalizeProbeCause` does for the cause, fail-closed on the disclosure alone — a malformed value
+ * yields `undefined`, the ask stands, the card carries no offer. It REFUSES where the cause NEUTRALIZES,
+ * per `shell.read_boundary.grant_candidate_is_the_grant`: the cause is prose, so folding a separator out of
+ * it keeps it true, while this string IS the grant, and a card showing one spelling while the deployment
+ * applies another is the failure the seat prevents.
+ */
+export declare function normalizeReadRootCandidate(value: unknown): import("./tool-spec.js").ReadRootGrantCandidate | undefined;

package/dist/core/read-root-candidate.js

@@ -0,0 +1,24 @@
+import { isPlainRecord, safeDataValue } from "./checkpoint-store.js";
+import { hasWin32AliasedComponent, isAbsolutePathForm, normalizeAbsPathLexically, pathFamilyOf, win32NamespaceScreen } from "../tools/fs/safety.js";
+export const READ_ROOT_CANDIDATE_DIR_MAX = 1024;
+export function normalizeReadRootCandidate(value) {
+    if (!isPlainRecord(value))
+        return undefined;
+    if (safeDataValue(value, "clearsThisAsk") !== true)
+        return undefined;
+    const dir = safeDataValue(value, "dir");
+    if (typeof dir !== "string" || dir.length === 0 || dir.length > READ_ROOT_CANDIDATE_DIR_MAX)
+        return undefined;
+    if (/[\u0000-\u001f\u007f\u2028\u2029]/.test(dir))
+        return undefined;
+    if (!isAbsolutePathForm(dir))
+        return undefined;
+    const folded = normalizeAbsPathLexically(dir);
+    if (folded !== dir || normalizeAbsPathLexically(`${dir}/..`) === dir)
+        return undefined;
+    if (hasWin32AliasedComponent(dir))
+        return undefined;
+    if (!win32NamespaceScreen(dir, pathFamilyOf({ root: dir })).ok)
+        return undefined;
+    return { dir, clearsThisAsk: true };
+}

package/dist/core/roles.d.ts

@@ -1,6 +1,6 @@
 import type { ThinkingLevel } from "../internal/harness-types.js";
 import type { Model } from "../internal/llm.js";
-import type { ModelRef, ModelRole, ModelRoles } from "./types.js";
+import type { ModelRef, ModelRole, ModelRoles, RoleSpec } from "./types.js";
 export type { ModelRole, RoleSpec, ModelRoles } from "./types.js";
 /** Resolve a string ModelRef against the catalog (a Model object passes through). */
 export declare function resolveModel(ref: ModelRef, models?: Record<string, Model>): Model;
@@ -87,6 +87,14 @@ export declare function parseModelMention(text: string, allowedNames: Iterable<s
  * (即使 catalog 恰有裸模型名 `pro`/`flash` 也不入档位路由——INERT 靠配置成立,不靠键名运气)。
  */
 export declare const ROLE_TIER_DEFAULTS: Readonly<Partial<Record<ModelRole, string>>>;
+/**
+ * Whether a RoleSpec NAMES a model — a string ref, a Model object, or a config object carrying `model` or
+ * `select` — as opposed to a preset-only object (`{ thinking }`, `{ systemPrompt }`) that shapes the role's
+ * request but leaves its model to the defaults. The classifier seat's own default (the tier below the run's
+ * main model, `classifier-ladder.ts`) applies exactly when this is false: a `{select}` keeps its selection, a
+ * preset-only role does not disable the relative pick. One reader, the same parts {@link specParts} reads.
+ */
+export declare function roleSpecNamesModel(spec: RoleSpec | undefined): boolean;
 export interface ResolvedRole {
     model: Model;
     /** The effective thinking level: explicit `spec.thinking` wins, else the role's default. */

package/dist/core/roles.js

@@ -130,6 +130,10 @@ function specParts(s) {
     const cfg = s;
     return { model: cfg.model, select: cfg.select, thinking: cfg.thinking, systemPrompt: cfg.systemPrompt };
 }
+export function roleSpecNamesModel(spec) {
+    const parts = specParts(spec);
+    return parts.model !== undefined || parts.select !== undefined;
+}
 function toConfig(s) {
     if (s == null) {
         return undefined;