@sema-agent/core 7.19.0 → 7.20.0

package/dist/core/runner/denial-limit-arms.d.ts

@@ -105,9 +105,12 @@ export declare function inheritedAskCarry(judged: Pick<Extract<InheritedClassifi
 }>, "origin" | "fallback" | "ask">, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
 /** What {@link judgeInheritedClassifier} hands back to the arm that called it. */
 export type InheritedClassifierJudgment<A extends InheritedAsk> = 
-/** The frozen classifier allowed — the arm returns its own allow shape (with or without the ask's rewrite). */
+/** The frozen classifier allowed. `result` is the allow the arm RETURNS — minted at the judging station so
+ *  the model attribution rides the same one object the deny arm's does (an arm re-minting its own
+ *  `{action:"allow"}` drops it); it already carries the ask's rewrite when the arm declared one. */
 {
     kind: "allow";
+    result: PermissionResult;
 }
 /** A block below the bound — the exact deny the ancestor's own gate would have produced. */
  | {
@@ -145,6 +148,13 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  * `req` is the request as the classifier must see it (the arm's presented / edited args);
  * `subject` is the noun the deny names ("this call" on the wrapper arms, "the approved edit" on the
  * re-check).
+ *
+ * ONE MINT for the classification's model attribution: every decision this station hands back — the allow it
+ * mints from `allowRewrite` as much as either deny — carries it on the identity-keyed seat beside the one
+ * carrying the FORM, and the arms return the station's object instead of re-minting their own. The
+ * descendant's fold reads both seats at its single attestation read. A decider with no candidate ladder
+ * vouches for no name and the seat stays empty (absence = unknown); a block AT the bound reaches no seat at
+ * all, since it becomes an ask and the disposition then names that resolution.
  */
 export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     autoMode: InheritedAutoMode | undefined;
@@ -152,6 +162,9 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     req: ToolCallRequest;
     signal: AbortSignal;
     subject: "this call" | "the approved edit";
+    /** The rewrite the arm's allow would have carried (the ask's own `updatedInput`, the re-check's edited
+     *  args) — handed IN so the allow is minted here, attested, once; absent ⇒ a bare allow. */
+    allowRewrite?: unknown;
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
 export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;

package/dist/core/runner/denial-limit-arms.js

@@ -1,6 +1,6 @@
 import { classifierParseFailureDenyMessage, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
-import { attestClassifierDenyCause } from "../tool-policy.js";
+import { attestClassifierDenyCause, attestClassifierRound } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { askOriginOf, classifierMayAnswer, probeMandatedAsk } from "../ask-origin.js";
@@ -82,14 +82,15 @@ export async function judgeInheritedClassifier(opts) {
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
+    const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
     if (verdict.kind === "allow") {
         autoMode.denialTracking?.recordAllow();
-        return { kind: "allow" };
+        return { kind: "allow", result: attributed({ action: "allow", ...(opts.allowRewrite !== undefined ? { updatedInput: opts.allowRewrite } : {}) }) };
     }
     if (verdict.kind === "unavailable") {
         return {
             kind: "deny",
-            result: attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req),
+            result: attributed(attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req)),
         };
     }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
@@ -101,7 +102,7 @@ export async function judgeInheritedClassifier(opts) {
             message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
             decisionReason: "classifier",
         };
-        return { kind: "deny", result: verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied };
+        return { kind: "deny", result: attributed(verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied) };
     }
     const fallback = tracked.fallback;
     const minted = { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };

package/dist/core/runner/env-capability-census.d.ts

@@ -0,0 +1,30 @@
+import type { ExecutionEnv } from "../../internal/harness.js";
+import type { EngineNotice } from "../engine-notice.js";
+/** One capability key whose declared value is not a boolean, with the type it actually carries. */
+export interface MalformedCapabilityDeclaration {
+    readonly key: string;
+    readonly valueType: string;
+}
+/**
+ * Every boolean capability this env DECLARES with a value that is not a boolean.
+ *
+ * The probe is the VALUE, not membership, because the value is what the readers get: a `capabilities`
+ * that answers `has` and `get` differently (a Proxy) would otherwise hide from the census exactly the
+ * value a reader goes on to act on. `undefined` is where absence lands — an absent key and an explicit
+ * `undefined` are the same word to every reader, and both are the documented silent reading — so one
+ * test covers both and the census needs no membership rule at all.
+ *
+ * TOTAL by construction: a diagnostic may not be the thing that fails a run. Every read of the adapter
+ * can throw on a getter or a Proxy trap — the structural probe, the block acquisition and each key —
+ * and a read that throws is itself a declaration nobody can use, so all three are reported rather than
+ * raised (`unreadable`, under the key when there is one and under `capabilities` when the block itself
+ * could not be had).
+ *
+ * What a snapshot cannot promise: this is taken once, at admission. An adapter whose capability values
+ * CHANGE afterwards can hand a later reader something this census never saw; the declaration is
+ * documented as a constant property of the adapter, and a mutable one is outside what any one-time
+ * reading covers.
+ */
+export declare function malformedCapabilityDeclarations(env: ExecutionEnv): MalformedCapabilityDeclaration[];
+/** Announce each malformed declaration once, to the operator who wired the adapter. */
+export declare function announceMalformedCapabilities(env: ExecutionEnv, onNotice: ((notice: EngineNotice) => void) | undefined): void;

package/dist/core/runner/env-capability-census.js

@@ -0,0 +1,38 @@
+import { isRemoteExecutionEnv } from "../remote-env.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+const BOOLEAN_CAPABILITY_KEYS = ["isolation", "suspendable", "canonicalPathAuthoritative"];
+export function malformedCapabilityDeclarations(env) {
+    let caps;
+    try {
+        if (!isRemoteExecutionEnv(env))
+            return [];
+        caps = env.capabilities;
+    }
+    catch {
+        return [{ key: "capabilities", valueType: "unreadable" }];
+    }
+    const out = [];
+    for (const key of BOOLEAN_CAPABILITY_KEYS) {
+        let value;
+        try {
+            value = caps[key];
+        }
+        catch {
+            out.push({ key, valueType: "unreadable" });
+            continue;
+        }
+        if (value === undefined || typeof value === "boolean")
+            continue;
+        out.push({ key, valueType: value === null ? "null" : typeof value });
+    }
+    return out;
+}
+export function announceMalformedCapabilities(env, onNotice) {
+    for (const { key, valueType } of malformedCapabilityDeclarations(env)) {
+        deliverEngineNotice(onNotice, {
+            code: "config.execution_env_capability_invalid",
+            message: `The execution environment declares capabilities.${key} as a ${valueType}, not a boolean. What a reader makes of that is the reader's own business and differs between them — the containment readers take only the boolean, so this reads as undeclared, while the suspend reader takes any truthy value, so a non-empty string reads as TRUE. That is why a declaration of the wrong shape cannot pass quietly: the engine may act on something other than what the adapter meant. Fix the adapter — this is a wiring fault, not a supported way to leave the capability unset.`,
+            detail: { key, valueType },
+        });
+    }
+}

package/dist/core/runner/forward-sink.d.ts

@@ -0,0 +1,32 @@
+import type { TaskEvent } from "../task-event.js";
+import type { RunnerDeps } from "../runner-deps.js";
+import { type SafeNotifier } from "../safe-notify.js";
+/** One run's forwarding-failure bookkeeping: opaque to everything but this module. */
+export interface ForwardSinkScope {
+    readonly notifier: SafeNotifier;
+}
+/** The two seats this module reads off a run's trusted internals — spelled structurally so a SNAPSHOT
+ *  of them (the delegation revive lane holds one) is as valid a holder as the live object. */
+export interface ForwardSinkHolder {
+    onForwardEvent?: (event: TaskEvent) => void;
+    forwardScope?: ForwardSinkScope;
+}
+/**
+ * Mint the forwarding scope for ONE run, bound to the deployment's notice seat. Called where the run's
+ * internals object is composed (`Runner.runTaskStream`), so every copy of that object made later — the
+ * prepare re-spread, a placement-root rebind, a child's snapshot — carries the same counters.
+ */
+export declare function createForwardSinkScope(onNotice: RunnerDeps["onNotice"]): ForwardSinkScope;
+/**
+ * Forward ONE event to the deployment's display sink, containing both failure shapes.
+ *
+ * @contract runtask.forward_sink_never_faults_the_run — a `RunInternals.onForwardEvent` that throws,
+ * or that returns a promise which rejects, never reaches the run's control flow: the frame is dropped,
+ * the failure is counted on the run's own `forwardScope`, and the FIRST one is announced once per run
+ * as `config.forward_sink_failed` (later ones are counted only). Delivery is never awaited — describing
+ * a run is not part of it, so a sink that never settles cannot hold a turn open. An absent sink is a
+ * no-op, and a healthy sink sees the same call it always did, with the same receiver.
+ */
+export declare function forwardSafely(holder: ForwardSinkHolder | undefined, event: TaskEvent): void;
+/** Contained forwarding failures on this scope (diagnostics; 0 on the healthy path). */
+export declare function forwardSinkFailures(holder: ForwardSinkHolder | undefined): number;

package/dist/core/runner/forward-sink.js

@@ -0,0 +1,41 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+import { createSafeNotifier, observeThenableRejection, safeErrorMessage } from "../safe-notify.js";
+const FORWARD_SINK_SITE = "runtask.onForwardEvent";
+const ORPHAN_SCOPES = new WeakMap();
+function forwardSinkFailedNotice(message) {
+    return {
+        code: "config.forward_sink_failed",
+        message: `The subagent display sink (RunInternals.onForwardEvent) failed and the frame was dropped: ${message}. ` +
+            `The run is unaffected — forwarding is a render channel — and further failures of this run are counted, not repeated.`,
+        detail: { site: FORWARD_SINK_SITE, cause: message },
+    };
+}
+export function createForwardSinkScope(onNotice) {
+    return {
+        notifier: createSafeNotifier({
+            onError: (f) => deliverEngineNotice(onNotice, forwardSinkFailedNotice(safeErrorMessage(f.error))),
+        }),
+    };
+}
+function scopeOf(holder) {
+    if (holder.forwardScope !== undefined)
+        return holder.forwardScope;
+    const existing = ORPHAN_SCOPES.get(holder);
+    if (existing !== undefined)
+        return existing;
+    const scope = createForwardSinkScope(undefined);
+    ORPHAN_SCOPES.set(holder, scope);
+    return scope;
+}
+export function forwardSafely(holder, event) {
+    if (holder?.onForwardEvent === undefined)
+        return;
+    const { notifier } = scopeOf(holder);
+    notifier.notify(() => observeThenableRejection(holder.onForwardEvent?.(event), notifier, FORWARD_SINK_SITE), FORWARD_SINK_SITE);
+}
+export function forwardSinkFailures(holder) {
+    if (holder === undefined)
+        return 0;
+    const scope = holder.forwardScope ?? ORPHAN_SCOPES.get(holder);
+    return scope?.notifier.failuresAt(FORWARD_SINK_SITE) ?? 0;
+}

package/dist/core/runner/gate-exit.d.ts

@@ -92,6 +92,10 @@ export interface SettlementLedger {
      *  `parse_error` round travelling through an ancestor wrapper into this fold); undefined for a ruling
      *  block, a non-classifier deny, an allow or an ask. */
     causeOf(decision: PermissionResult): ClassifierDenyCause | undefined;
+    /** Read a decision's attested CLASSIFICATION for this call — which model an ancestor's frozen classifier
+     *  asked and which answered, on the allow arm as much as the deny arm. Undefined when no inherited
+     *  classifier judged the call, or when the ancestor's decider could vouch for no name. */
+    classifierRoundOf(decision: PermissionResult): AutoModeClassifierRound | undefined;
     /** A surviving ask supersedes whatever an earlier decision settled. */
     supersede(): void;
 }

package/dist/core/runner/gate-exit.js

@@ -1,5 +1,5 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
-import { askUnresolvableCauseOf, classifierDenyCauseOf, decisionText, engineSettlementOf } from "../tool-policy.js";
+import { askUnresolvableCauseOf, classifierDenyCauseOf, classifierRoundOf, decisionText, engineSettlementOf } from "../tool-policy.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
 export function mintGateOutcome(facts) {
@@ -56,6 +56,9 @@ export function createSettlementLedger(call) {
         causeOf(decision) {
             return decision.action === "deny" ? classifierDenyCauseOf(decision, call) : undefined;
         },
+        classifierRoundOf(decision) {
+            return classifierRoundOf(decision, call);
+        },
         supersede() {
             settled = undefined;
         },

package/dist/core/runner/git-status-frame.d.ts

@@ -126,15 +126,6 @@ export interface GitStatusLaneRef {
         hash: string;
         entryId: string;
     };
-    /** The duplicate-tolerant receipt slot: set when a frame delivery is in flight, settled by the
-     *  run loop's `message_end` walk when the CARRYING message commits (matched on the exact
-     *  engine-held message text). Commit-on-receipt, never commit-before-append — the git lane's
-     *  error asymmetry is the REVERSE of the listing lane's (a false "announced" = stale git facts
-     *  forever; a duplicate frame = a few idempotent kilobytes). */
-    pendingReceipt?: {
-        text: string;
-        commit: (entryId: string) => void;
-    };
 }
 /**
  * prepare-side probe half of the lane (H4, extracted from prepareTask): run the CC-shape snapshot

package/dist/core/runner/listing-fold.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The ONE folding engine every listing frame renders through — the `<skills>` block, the skills drift
+ * frame's add arm, the agent-type roster and its drift frame's add arm. A listing is an intact-class
+ * turn attachment (`turn-attachments.ts` `ATTACHMENT_DELIVERY_CLASS`): the delivery lane never clips
+ * it, so this engine is the frame's whole bound, byte-exact over the caller's `frame` (headers, fences,
+ * markers, joiners included).
+ *
+ * Three honesty tiers over ONE set of items, each chosen with the LATER tiers' fixed overhead already
+ * reserved so the final render never blows the budget it was sized against:
+ *   A. everything fits → every item gets its full line;
+ *   B. reserve the cap marker + EVERY item's name-only line first, then spend the remaining slack on
+ *      full lines in PRIORITY order (`rank` ascending; absent ⇒ index), admitting each full line whose
+ *      incremental cost still fits and skipping (not stopping at) the ones that do not — every item stays
+ *      listed, the low-priority ones lose their detail;
+ *   C. even all-name-only overflows → the longest name-only prefix that fits, closed by the caller's
+ *      overflow count line.
+ * Pure: the same items, spec and frame always render the same bytes.
+ */
+export interface ListingFoldSpec<T> {
+    /** The whole frame's byte budget, honoured as given. */
+    blockMaxBytes: number;
+    /** One item's full line (tier A, and tier B's admitted lines). */
+    full: (item: T) => string;
+    /** One item's name-only line (tier B's degraded form, tier C's listed prefix). */
+    nameOnly: (item: T) => string;
+    /** The raw name reported for an item the budget degraded (host-facing data, not prompt text). */
+    nameOf: (item: T) => string;
+    /** Priority for keeping the full line: ascending, 0 = first. Absent ⇒ the item's index. */
+    rank?: (item: T, index: number) => number;
+    /** The marker line that opens a degraded (tier B/C) body. */
+    capMarker: string;
+    /** Tier C's closing line for `n` items that could not be listed at all. */
+    overflowLine: (n: number) => string;
+    /** Renders body lines into the lane's frame; its fixed cost is priced once by rendering it empty. */
+    frame: (lines: readonly string[]) => string;
+}
+/** What one fold produced: the frame, and which items the budget degraded (display order). */
+export interface ListingFoldRender {
+    text: string;
+    /** Items listed WITHOUT their full line. */
+    nameOnly: readonly string[];
+    /** Items the frame could not list at all (tier C's overflow tail). */
+    dropped: readonly string[];
+}
+export declare function foldListingWithin<T>(items: ReadonlyArray<T>, spec: ListingFoldSpec<T>): ListingFoldRender | undefined;
+/** The removal arm's FLOOR — the departure fact with none of the names; constant-size, which is what
+ *  keeps the fact from being starved by a budget the names cannot fit. */
+export declare function removalArmFloor(header: string, count: number): string;
+/**
+ * A listing frame's REMOVAL arm rendered INSIDE a byte budget: every departed name when they fit,
+ * otherwise the longest prefix that does, closed by an honest count line — tier C over a list whose
+ * lines have one form, so there is no name-only tier between them. Names are neutralized on the way
+ * out: the announced map holds raw names from the commit half. Cost of the bound, stated: a name that
+ * does not fit is never announced (the commit half advances past it), so the model can still hold an
+ * entry that is gone — one failed call, against a frame that would otherwise never fit its budget.
+ */
+export declare function foldRemovalArmWithin(removed: readonly string[], header: string, maxBytes: number): string;

package/dist/core/runner/listing-fold.js

@@ -0,0 +1,75 @@
+import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
+export function foldListingWithin(items, spec) {
+    if (items.length === 0)
+        return undefined;
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const render = spec.frame;
+    const lineCost = (l) => bytes(l) + 1;
+    const bodyBudget = spec.blockMaxBytes - bytes(render([]));
+    const fullLines = items.map((it) => spec.full(it));
+    const fullTotal = fullLines.reduce((acc, l) => acc + lineCost(l), 0);
+    if (fullTotal <= bodyBudget)
+        return { text: render(fullLines), nameOnly: [], dropped: [] };
+    const nameLines = items.map((it) => spec.nameOnly(it));
+    const namePrefix = new Array(nameLines.length + 1);
+    namePrefix[0] = 0;
+    for (let i = 0; i < nameLines.length; i++)
+        namePrefix[i + 1] = namePrefix[i] + lineCost(nameLines[i]);
+    const markerCost = lineCost(spec.capMarker);
+    const floorCost = markerCost + namePrefix[nameLines.length];
+    if (floorCost <= bodyBudget) {
+        let slack = bodyBudget - floorCost;
+        const byPriority = items
+            .map((it, i) => ({ i, rank: spec.rank?.(it, i) ?? i }))
+            .toSorted((a, b) => a.rank - b.rank || a.i - b.i);
+        const withFull = new Set();
+        for (const { i } of byPriority) {
+            const delta = lineCost(fullLines[i]) - lineCost(nameLines[i]);
+            if (delta <= slack) {
+                withFull.add(i);
+                slack -= delta;
+            }
+        }
+        return {
+            text: render([spec.capMarker, ...items.map((_it, i) => (withFull.has(i) ? fullLines[i] : nameLines[i]))]),
+            nameOnly: items.filter((_it, i) => !withFull.has(i)).map((it) => spec.nameOf(it)),
+            dropped: [],
+        };
+    }
+    for (let m = items.length - 1; m >= 0; m--) {
+        const overflow = spec.overflowLine(items.length - m);
+        if (markerCost + namePrefix[m] + lineCost(overflow) <= bodyBudget) {
+            return {
+                text: render([spec.capMarker, ...nameLines.slice(0, m), overflow]),
+                nameOnly: items.slice(0, m).map((it) => spec.nameOf(it)),
+                dropped: items.slice(m).map((it) => spec.nameOf(it)),
+            };
+        }
+    }
+    return {
+        text: render([spec.capMarker, spec.overflowLine(items.length)]),
+        nameOnly: [],
+        dropped: items.map((it) => spec.nameOf(it)),
+    };
+}
+export function removalArmFloor(header, count) {
+    return [header, `(… +${count} more are no longer available)`].join("\n");
+}
+export function foldRemovalArmWithin(removed, header, maxBytes) {
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const lines = removed.map((n) => `- ${sanitizeUntrustedText(n, SHELLED_BODY_ENVELOPE_TAGS)}`);
+    const head = bytes(header);
+    const lineCost = (l) => bytes(l) + 1;
+    const prefix = new Array(lines.length + 1);
+    prefix[0] = 0;
+    for (let i = 0; i < lines.length; i++)
+        prefix[i + 1] = prefix[i] + lineCost(lines[i]);
+    if (head + prefix[lines.length] <= maxBytes)
+        return [header, ...lines].join("\n");
+    for (let m = lines.length - 1; m >= 0; m--) {
+        const tail = `(… +${lines.length - m} more are no longer available)`;
+        if (head + prefix[m] + lineCost(tail) <= maxBytes)
+            return [header, ...lines.slice(0, m), tail].join("\n");
+    }
+    return removalArmFloor(header, lines.length);
+}

package/dist/core/runner/prepare-execution-env.d.ts

@@ -14,7 +14,7 @@ export interface OwnedEnvSeat {
 export interface PrepareExecutionEnvInput {
     /** borrowed-readonly — the deployment's env seats: the per-task factory (wins), the static env, the
      *  declared root fence, and the incident sink for the bounded teardown legs. */
-    deps: Pick<RunnerDeps, "executionEnvFactory" | "executionEnv" | "rootPath" | "onError">;
+    deps: Pick<RunnerDeps, "executionEnvFactory" | "executionEnv" | "rootPath" | "onError" | "onNotice">;
     /** borrowed-readonly — the REBOUND spec; only the caller's task id rides into the factory ctx. */
     spec: Pick<TaskSpec, "taskId">;
     /** borrowed-readonly — the trusted spawn-side requests: the explicit cwd (a contract), the isolation

package/dist/core/runner/prepare-execution-env.js

@@ -1,5 +1,6 @@
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasDestroy } from "../remote-env.js";
+import { announceMalformedCapabilities } from "./env-capability-census.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 export async function prepareExecutionEnv(input) {
     const { deps, spec, internals, resume, placementRootResolved, sessionId, forgetOnThrow, rollback } = input;
@@ -39,6 +40,7 @@ export async function prepareExecutionEnv(input) {
         });
     }
     const executionEnv = ownedEnv ?? deps.executionEnv ?? new StubExecutionEnv();
+    announceMalformedCapabilities(executionEnv, deps.onNotice);
     if (internals?.requestedCwd !== undefined) {
         const canon = async (p) => {
             const r = await executionEnv.canonicalPath(p);

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -23,6 +23,7 @@
  * gate outcome; nothing here changes a word, a source or an order — the stations are moved, not re-adjudicated.
  */
 import type { AgentHarness, AgentTool } from "../../internal/harness.js";
+import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { AskClass } from "../ask-class.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type ComplianceCapability } from "../compliance.js";
@@ -147,6 +148,13 @@ export interface PrepareGateStationsInput {
     handsCwdRef: CwdRef | undefined;
     /** borrowed-readonly — the read-only env capability face every hook context carries, or undefined. */
     hookEnvFace: HookEnvCapabilities | undefined;
+    /** borrowed-readonly — the HANDS' execution environment (the one the write tools resolve against), or
+     *  undefined when the run has no hands: the write-protection judge's target view resolves in it, and with
+     *  none the judge answers by the spelling alone. */
+    handsEnv: ExecutionEnv | undefined;
+    /** borrowed-readonly — the resolved task root, the base a `base: "root"` write tool's relative spelling
+     *  resolves against (the same seat the path policies read as `rootPath`). */
+    taskRootFinal: string;
     /** borrowed-readonly — the per-tool irreversibility tier handed to the gate per call. */
     irreversibilityTier: IrreversibilityTier;
     /** borrowed-readonly — the per-tool reversibility probes handed to the gate per call. */

package/dist/core/runner/prepare-gate-stations.js

@@ -42,7 +42,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, handsEnv, taskRootFinal, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
     if (askLane !== undefined && parkAsk !== undefined) {
         const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
         const { resolveContentAsk, suspendAsk } = parkAsk;
@@ -51,7 +51,11 @@ export function prepareGateStations(input) {
             if (eff !== undefined && !toolEffects.has(t.name))
                 toolEffects.set(t.name, eff);
         }
-        const writeProtectionCheck = createWriteProtectionCheck(deps.writeProtectedPaths, deps.memoryEngineDir !== undefined ? { dataRoot: deps.memoryEngineDir } : undefined);
+        const writeProtectionCheck = createWriteProtectionCheck(deps.writeProtectedPaths, {
+            ...(deps.memoryEngineDir !== undefined ? { dataRoot: deps.memoryEngineDir } : {}),
+            ...(handsEnv !== undefined ? { env: handsEnv } : {}),
+            rootPath: taskRootFinal,
+        });
         const writeProtectionArmed = writeProtectionCheck !== undefined && tools.some((t) => PATH_CONFINABLE_WRITE_TOOLS.has(t.name));
         toolCallGateArmedRef.armed =
             effectivePolicy !== undefined ||

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -110,6 +110,10 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-readonly — B-4's settled root (T6 FINAL semantics); the containment root every face
      *  in this phase canonicalizes from. */
     taskRootFinal: string;
+    /** borrowed-readonly — the same root, resolved to the spelling the fence compares with, by the ONE
+     *  resolver at the driver's root receiving point ({@link import("./task-root-canonical.js").resolveTaskRootCanonical}):
+     *  taken as an input, never re-canonicalized here, so the fence and the root notice cannot disagree. */
+    taskRootCanonical: string;
     /** borrowed-readonly — B-4's checkpoint-path rebaser (T7): identity unless a divergent restore
      *  armed it; applied to the readFileState seed keys and the handsCwd seed. */
     rebaseRestoredPath: (p: string) => string;

package/dist/core/runner/prepare-hands-readface.js

@@ -152,7 +152,7 @@ export function resolveHandsLessReadFace(input) {
 }
 export async function prepareHandsMount(input) {
     const envHandToolNames = new Set();
-    const { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
+    const { handsEnabled, executionEnv, taskRootCanonical, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
     assertStringArraySeat(spec.additionalDirectories, "TaskSpec.additionalDirectories", "strings");
     assertStringArraySeat(spec.additionalReadDirectories, "TaskSpec.additionalReadDirectories", "strings");
     assertStringArraySeat(deps.readDenyPatterns, "RunnerDeps.readDenyPatterns", "compiler-owned");
@@ -176,15 +176,13 @@ export async function prepareHandsMount(input) {
     let attachmentRootCanonical;
     let readDenyMatcher;
     if (handsEnabled) {
-        const rootRaw = taskRootFinal;
-        const canon = await executionEnv.canonicalPath(rootRaw);
-        const rootCanonical = canon.ok ? canon.value : rootRaw;
+        const rootCanonical = taskRootCanonical;
         attachmentRootCanonical = rootCanonical;
         const canonicalizeExtraDirs = async (dirs, field, sink) => {
             for (const dir of dirs ?? []) {
                 if (!dir || !dir.trim())
                     continue;
-                const c = await executionEnv.canonicalPath(dir);
+                const c = await (advertisedWritableDirs?.canonicalizeDeclaredRoot(dir) ?? executionEnv.canonicalPath(dir));
                 if (c.ok) {
                     sink.push(c.value);
                 }

package/dist/core/runner/prepare-listings.d.ts

@@ -17,6 +17,7 @@ import type { AgentTool } from "../../internal/harness.js";
 import type { TaskSpec } from "../types.js";
 import type { AnnounceOnceSink, Prepared, PrepareResume, ToolFaceSnapshot } from "./contracts.js";
 import type { AnnouncedListingSnapshot } from "../../internal/harness.js";
+import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 export interface PrepareListingsInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `agents` (the audit's subject), `tools`
      *  (the roster-bearing delegation tool, by its `agentListing` marker), `sessionId` (continuation
@@ -44,6 +45,8 @@ export interface PrepareListingsInput {
     /** borrowed-readonly — the project-context phase's skills-listing projection; read only for the
      *  skills opt-out advisory (entries.length). */
     skillsListing: Prepared["skillsListing"];
+    /** borrowed-readonly — the listing family's resolved budget; the agent roster frames fold into it. */
+    listingBudget: ResolvedSkillListingBudget;
     /** borrowed-mutable — the deferred roster's ToolSearch RIDE seat (declared by the disclosure
      *  mount, read at activation time through `listingRideRef.current?.(newly)`). Written here, once,
      *  on a deferred roster face; no later writer. Identity is the contract (the mount's closures read

package/dist/core/runner/prepare-listings.js

@@ -2,7 +2,7 @@ import { formatLocalDate } from "../../prompts/default.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { renderAgentListingDelta } from "./turn-attachments.js";
 export function prepareListings(input) {
-    const { spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingRideRef, renderWithDate, envFacts, tzValid, userTz } = input;
+    const { spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingBudget, listingRideRef, renderWithDate, envFacts, tzValid, userTz } = input;
     if (spec.agents !== undefined && spec.agents.length > 0) {
         const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
         for (const def of spec.agents) {
@@ -39,6 +39,7 @@ export function prepareListings(input) {
         ? {
             entries: agentListingSpec.agentListing,
             toolName: agentListingSpec.name,
+            budget: listingBudget,
             seedAnnounced: resume !== undefined || spec.sessionId !== undefined,
             ...(agentListingSpec.agentModels !== undefined ? { models: agentListingSpec.agentModels } : {}),
         }
@@ -48,6 +49,7 @@ export function prepareListings(input) {
                     {
                         entries: [],
                         toolName: (spec.tools ?? []).find((t) => t.agentListing !== undefined)?.name ?? "Agent",
+                        budget: listingBudget,
                         seedAnnounced: true,
                     }
                 : undefined;
@@ -66,7 +68,7 @@ export function prepareListings(input) {
                 return undefined;
             if ((announcedListingsRef.agents?.length ?? 0) > 0)
                 return undefined;
-            return renderAgentListingDelta({ announcedAgentTypes: undefined }, rideEntries, rosterBearingSpec.name, rideModels);
+            return renderAgentListingDelta({ announcedAgentTypes: undefined }, rideEntries, rosterBearingSpec.name, rideModels, listingBudget);
         };
     }
     const dateChange = renderWithDate

package/dist/core/runner/prepare-memory.js

@@ -4,7 +4,7 @@ import { admitMemoryScopes } from "../memory-admission.js";
 import { adoptLegacyRepoDirs, canonicalize, deriveRepoControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, isContainedIn, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
 import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir, mergeHarvestReports, mergeInjections, needsDualRoots, parsedProjectPlane } from "../memory-engine/dual-root.js";
 import { normalizeMemorySpec } from "../memory.js";
-import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_INDETERMINATE_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
+import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_INDETERMINATE_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memoryRestoreWithheldNotice, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
 import { adjudicateCaptureOptOut, captureOptOutDeniedError, captureOptOutUnpersistedError } from "./memory-capture-optout.js";
 import { readSessionCaptureOptOut } from "../memory-engine/layout.js";
 import { createMemoryEngineTools } from "../memory-engine/tools.js";
@@ -522,6 +522,9 @@ export async function prepareMemory(input) {
                     }
                     deliverEngineNotice(deps.onNotice, memoryHarvestQuarantinedNotice({ count, moved, escalated, ...(report.reportId !== undefined ? { reportId: report.reportId } : {}), ...(reason !== undefined ? { reason } : {}), sessionId, provenance: input.memoryProvenance, ...(indexOnly ? { indexRolledBack: true } : {}) }));
                 }
+                if (report.restoreWithheld !== undefined && report.restoreWithheld.length > 0) {
+                    deliverEngineNotice(deps.onNotice, memoryRestoreWithheldNotice({ paths: report.restoreWithheld, sessionId }));
+                }
                 for (const notice of memoryHoldNotices(report, sessionId))
                     deliverEngineNotice(deps.onNotice, notice);
                 const consolidationNotice = memoryConsolidationRecommendedNotice(report, sessionId);
@@ -615,6 +618,9 @@ export async function prepareMemory(input) {
                             }
                         }
                         const sweep = await writeEngine.sweepSessionCaptureResidue(writeHandle);
+                        if (sweep.withheld.length > 0) {
+                            deliverEngineNotice(deps.onNotice, memoryRestoreWithheldNotice({ paths: sweep.withheld, sessionId }));
+                        }
                         if (sweep.failures.length > 0) {
                             const named = sweep.failures
                                 .slice(0, 5)