@sema-agent/core 7.20.0 → 7.21.0

package/dist/core/runner/prepare-policy-chain.js

@@ -152,7 +152,7 @@ export async function preparePolicyChain(input) {
     }, "mandate_unreconstructible", creq);
     const markerChannelFullDeny = (creq) => attestAskUnresolvableCause({ action: "deny", message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed` }, "approver_unavailable", creq);
     const inheritedAskGrants = new Map();
-    const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs) => {
+    const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs, settled) => {
         if (typeof approver !== "function")
             return;
         if (presented === undefined)
@@ -162,7 +162,7 @@ export async function preparePolicyChain(input) {
         const argsJson = askGrantShapeOf(presented);
         if (argsJson === undefined)
             return;
-        inheritedAskGrants.set(toolCallId, { approver, argsJson, presented, waitMs });
+        inheritedAskGrants.set(toolCallId, { approver, argsJson, presented, waitMs, settled });
     };
     const sandboxDeclared = isIsolated(executionEnv);
     const sandboxAdmissionArmed = (() => {
@@ -277,37 +277,51 @@ export async function preparePolicyChain(input) {
         cwdRef: handsCwdRef,
         deniesDirectoryRead: readDenyMatcher !== undefined ? (d) => readDenyMatcher.matchPath(d) !== null : undefined,
     });
-    const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal, ancestorDecider, ancestorTracker) => {
+    const recheckApprovedEdit = async (pol, onAskOf, creq, edit, approved, csignal, ancestorDecider, ancestorTracker) => {
         let editArgs = edit;
+        let settledBy = approved;
+        const vetoed = (d) => {
+            const out = { ...d };
+            carryEngineAttestations(d, out);
+            carryPrecedingSettlement(settledBy, out);
+            return out;
+        };
         for (let round = 0;; round++) {
             if (round >= 3) {
-                return {
+                return vetoed({
                     action: "deny",
                     message: `the approval-edit chain for "${creq.toolName}" exceeded the re-approval cap (inherited parent policy) — denied fail-closed; re-submit the edited action directly`,
-                };
+                });
             }
             let re;
             try {
                 re = await pol.check({ ...creq, args: editArgs }, csignal ?? abortController.signal);
             }
             catch (err) {
-                return {
+                return vetoed({
                     action: "deny",
                     message: `inherited parent policy re-check of the approved edit errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
-                };
+                });
             }
             if (re.action === "deny")
-                return re;
+                return vetoed(re);
             if (re.action === "allow") {
-                return { action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs };
+                const out = { action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs };
+                carryEngineAttestations(re, out);
+                carryPrecedingSettlement(settledBy, out);
+                return out;
             }
             if (re.updatedInput !== undefined)
                 editArgs = re.updatedInput;
             const judged = await judgeInheritedClassifier({ autoMode: ancestorDecider !== undefined ? { decider: ancestorDecider, denialTracking: ancestorTracker } : undefined, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs });
-            if (judged.kind === "allow")
-                return judged.result;
+            if (judged.kind === "allow") {
+                const cleared = { ...judged.result };
+                carryEngineAttestations(judged.result, cleared);
+                carryPrecedingSettlement(settledBy, cleared);
+                return cleared;
+            }
             if (judged.kind === "deny")
-                return judged.result;
+                return vetoed(judged.result);
             const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
             re = editAsk;
             const rr = await resolveAsk({
@@ -326,8 +340,12 @@ export async function preparePolicyChain(input) {
             settleDenialLimitFallback({ fallback: editFallback, mintedHere: editMintedHere, tracker: ancestorTracker, resolved: rr, headless: headlessDenyAtRecheck, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
             if (rr.action !== "allow")
                 return rr;
-            if (rr.updatedInput === undefined)
-                return { action: "allow", updatedInput: editArgs };
+            settledBy = rr;
+            if (rr.updatedInput === undefined) {
+                const out = { action: "allow", updatedInput: editArgs };
+                carryPrecedingSettlement(rr, out);
+                return out;
+            }
             editArgs = rr.updatedInput;
         }
     };
@@ -404,9 +422,9 @@ export async function preparePolicyChain(input) {
                     if (resolved.action !== "allow")
                         return resolved;
                     if (resolved.updatedInput !== undefined) {
-                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider, pc.autoMode?.denialTracking);
+                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode?.decider, pc.autoMode?.denialTracking);
                     }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved);
                     return { action: "allow" };
                 },
             }
@@ -473,12 +491,16 @@ export async function preparePolicyChain(input) {
                     if (resolved.action !== "allow")
                         return resolved;
                     if (resolved.updatedInput !== undefined) {
-                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider, pc.autoMode?.denialTracking);
+                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode?.decider, pc.autoMode?.denialTracking);
                     }
                     if (pc.preToolUse === undefined) {
-                        recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
+                        recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved);
                     }
-                    return decision.updatedInput !== undefined ? { ...resolved, updatedInput: decision.updatedInput } : resolved;
+                    if (decision.updatedInput === undefined)
+                        return resolved;
+                    const approvedWithRewrite = { ...resolved, updatedInput: decision.updatedInput };
+                    carryEngineAttestations(resolved, approvedWithRewrite);
+                    return approvedWithRewrite;
                 },
             });
     const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
@@ -540,6 +562,7 @@ export async function preparePolicyChain(input) {
                 const recheckLayers = [...recheckPrefix, ...postEmitterSameInstanceAdapters];
                 const finalReq = { ...req, args: decision.updatedInput };
                 let asked;
+                const revalidated = {};
                 try {
                     for (const layer of recheckLayers) {
                         const d = await layer.check(finalReq, signal);
@@ -558,13 +581,22 @@ export async function preparePolicyChain(input) {
                         }
                         if (d.action === "ask" && asked === undefined)
                             asked = d;
+                        carryEngineAttestations(d, revalidated);
                     }
                 }
                 finally {
                     rewriteEmitterIndex.delete(req.toolCallId);
                 }
                 if (asked !== undefined && decision.action === "allow") {
-                    return { ...asked, updatedInput: decision.updatedInput };
+                    const surfaced = { ...asked, updatedInput: decision.updatedInput };
+                    carryEngineAttestations(asked, surfaced);
+                    return surfaced;
+                }
+                if (decision.action === "allow") {
+                    const owned = { ...decision };
+                    carryEngineAttestations(decision, owned);
+                    carryEngineAttestations(revalidated, owned);
+                    return owned;
                 }
                 return decision;
             },

package/dist/core/runner/prepare-task.js

@@ -690,7 +690,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
         }
         const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
-        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined });
+        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtectionCheck, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined });
         if (fileHistoryBoundary !== undefined) {
             harness.on("tool_call", async () => {
                 await fileHistoryBoundary.settle();
@@ -701,7 +701,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, autoModeIntent, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
         const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
-        prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, handsEnv: handsEnabled ? executionEnv : undefined, taskRootFinal, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
+        prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -28,6 +28,7 @@ import { type ToolResultStore } from "../tool-result-store.js";
 import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
 import type { GateOutcome } from "../gate-outcome.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec, ToolEffect, ToolExecuteContext } from "../types.js";
+import type { WriteProtectionCheck } from "../write-protect.js";
 import { type UsageWindow } from "../usage-window-store.js";
 import type { ToolRoster } from "../tool-roster.js";
 import { type AutoModeArmFact, type WiringManifest, type WiringManifestMcpEntry } from "../wiring-manifest.js";
@@ -41,7 +42,8 @@ export interface PrepareWiringManifestInput {
     /** borrowed-readonly — the deployment seats, whole: `onAsk` (the seat's deps half), `onError` (the warning), `executionEnv`
      *  (the hook-env predicate), `checkpointStore` (durable infra), the manifest's dozen wiring facts (`backgroundAgentStore`,
      *  `permissionRuleStore`, `permissionRuleSyncWired`, `onBackgroundChildEvent`, `lockedConfig`, `compliancePostureResolver`,
-     *  `memoryScopeAdmission`, `retentionPolicy`, `onElicit`), `onNotice`, and the usage-governance seats (`usageWindowStore`,
+     *  `memoryScopeAdmission`, `retentionPolicy`, `onElicit`), `onNotice`, the write-protection judge's compile seats
+     *  (`writeProtectedPaths`, `memoryEngineDir`), and the usage-governance seats (`usageWindowStore`,
      *  `now`, `onUsageGovernance`…) the helper reads through the whole record. */
     deps: RunnerDeps;
     /** borrowed-readonly — the trusted spawn-side channel: `questionFaceStripped`, `isDelegatedChild`, `onTaskNotification`,
@@ -67,6 +69,8 @@ export interface PrepareWiringManifestInput {
     effectivePolicy: ToolPolicy | undefined;
     /** borrowed-readonly — whether an execution env is wired (the hand band exists at all). */
     handsEnabled: boolean;
+    /** borrowed-readonly — the resolved task root: the base a `base: "root"` write tool's relative spelling resolves against. */
+    taskRootFinal: string;
     /** borrowed-readonly — the materialized MCP handle: `tools` (the destructive-ungated scan) and `statuses` (the manifest face). */
     mcp: Pick<MaterializedMcp, "tools" | "statuses">;
     /** borrowed-readonly — the assembled safety vocabulary (the ungated scans and the manifest's armed cell). Read only. */
@@ -158,6 +162,9 @@ export interface PrepareWiringManifestResult {
     durableApproval: TaskSpec["durableApproval"];
     /** owned — this leg's EFFECTIVE wiring manifest (`Prepared.wiringManifest`). */
     wiringManifest: WiringManifest;
+    /** owned — the leg's write-protection gate input, or undefined when the table was emptied (no judge, no
+     *  tighten mounted); handed to the gate station rather than compiled a second time there. */
+    writeProtectionCheck: WriteProtectionCheck | undefined;
     /** owned — THE park predicate as one named const (`parkLane.effective === true`). */
     parkLaneArmed: boolean;
     /** owned — THE gate-machinery activation predicate as one named const: a policy, a screening hook, an egress or

package/dist/core/runner/prepare-wiring-manifest.js

@@ -7,6 +7,8 @@ import { isVolatileOffloadStore } from "../tool-result-store.js";
 import { durableMandateSourceOf, isLiveApproverSeat } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
+import { mountWriteProtection } from "./write-protection-station.js";
+import { autoRunOnRecommendationEffective } from "./memory-consolidation-driver.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
 import { LSP_CONTRACT_ID, countElicitOptIns, deriveLspSeam, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
 import { DEFAULT_IRREVERSIBLE_SCOPE } from "./checkpoint-scope.js";
@@ -111,7 +113,7 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, lspManagerWired, lspDiagnosticsLive } = input;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, lspManagerWired, lspDiagnosticsLive } = input;
     const onAsk = spec.onAsk ?? deps.onAsk;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
     const hasEffectAwareGate = Boolean(policyLayers.length > 0 || (hooks?.preToolUse !== undefined && !preToolUseObservational));
@@ -168,6 +170,7 @@ export function prepareWiringManifest(input) {
     const platformSuspendArmed = durableSuspendInfraReady && (envLifetimeSuspendAt !== undefined || usageGovernance !== undefined);
     const durableApproval = spec.durableApproval ??
         (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
+    const writeProtection = mountWriteProtection({ deps, env: handsEnabled ? executionEnv : undefined, rootPath: taskRootFinal, roster: toolRoster, sessionId, runId });
     const wiringQuestionSeam = resolveQuestionSeam(spec, deps);
     const wiringQuestionStripped = internals?.questionFaceStripped === true;
     const wiringAskSeam = resolveAskSeamForm(spec, deps);
@@ -204,6 +207,8 @@ export function prepareWiringManifest(input) {
         ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
         autoMode: { ...autoModeArmReason },
         mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses),
+        ...(writeProtection !== undefined ? { writeProtectionTargetView: writeProtection.targetView } : {}),
+        autoConsolidationOnRecommendation: autoRunOnRecommendationEffective(deps),
         tools: toolRoster,
         hooks: wiredHookEntries(hooks, spec.hooks !== undefined ? "spec" : "deps", preToolUseObservational),
         ...(lspManagerWired ? { lsp: deriveLspSeam(toolRoster.entries.some((e) => e.contract.contractId === LSP_CONTRACT_ID), lspDiagnosticsLive) } : {}),
@@ -242,5 +247,5 @@ export function prepareWiringManifest(input) {
     });
     const hookContextConsumerWired = hooks?.preToolUse !== undefined || hooks?.postToolUse !== undefined || hooks?.postToolUseFailure !== undefined;
     const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
-    return { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, platformSuspendArmed, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace };
+    return { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, platformSuspendArmed, durableApproval, wiringManifest, writeProtectionCheck: writeProtection?.check, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace };
 }

package/dist/core/runner/run-settle-and-teardown.js

@@ -18,6 +18,7 @@ import { resumeDecisionWasNegative } from "./decide-continuation.js";
 import { drainForwardedFramesBeforeDone, forwardsSubagentEvents } from "./prepare-run-refs.js";
 import { generatePromptSuggestions } from "./prompt-suggestions.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
+import { autoRunConsolidationFromRecommendation, autoRunOnRecommendationEffective, scopeHasUnconsumedRecommendation } from "./memory-consolidation-driver.js";
 import { amendTerminal, terminalProjection } from "./terminal-projection.js";
 export async function runSettleAndTeardown(input) {
     const { spec, queue, prepared, resume, internals, rs, stats, ident, parentToolCallId, subagentName, loopLatch, timeout, ownCommittedTailRef, emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, setResult, onSuggestions, onSuspend, runner, sessions } = input;
@@ -240,6 +241,10 @@ export async function runSettleAndTeardown(input) {
         if (prepared.memoryEngineSession) {
             const mes = prepared.memoryEngineSession;
             await settleTeardownLeg(() => mes.harvest(), "memoryEngineSession.harvest (settle leg)", (e) => runner.deps.onError?.(e, { phase: "config", sessionId: prepared.sessionId }));
+            const scope = mes.handle.writeScope;
+            if (scope !== null && autoRunOnRecommendationEffective(runner.deps) && scopeHasUnconsumedRecommendation(mes.engine, scope)) {
+                void autoRunConsolidationFromRecommendation({ deps: runner.deps, engine: mes.engine, scope, sessionId: prepared.sessionId, onNotice: runner.deps.onNotice, onError: runner.deps.onError });
+            }
         }
         emitTrace(rs.telemetry.tracer, () => ({
             kind: "task.end",

package/dist/core/runner/write-protection-station.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The leg's write-protection MOUNT — one compile, and the loud outlet for the reading it could not get.
+ *
+ * The always-on write-protection judge re-judges a table-missing spelling on its RESOLVED real target,
+ * which needs a filesystem to resolve in. A deployment that wires no execution environment (a tool-only
+ * or MCP-only host) hands it none, so the spelling becomes the whole judgment and a covered write that
+ * reaches a protected row only through an alias is cleared. That verdict is the judge's documented
+ * absence law and is deliberately unchanged here: the announcement dialect applies (announce, do not
+ * refuse) — refusing every covered write instead would break exactly the deployments this shape exists
+ * for, and the reference implementation falls back to the same spelling-only set when resolution is
+ * unavailable. What this seat removes is the SILENCE.
+ *
+ * Two readers, one compile: the gate station mounts `check`, and the leg's wiring manifest reports
+ * `targetView`. Compiling twice would be two judges free to disagree about the seats they were handed.
+ */
+import type { ExecutionEnv } from "../../internal/harness.js";
+import type { RunnerDeps } from "../runner-deps.js";
+import type { ToolRoster } from "../tool-roster.js";
+import { type WriteProtectionMount } from "../write-protect.js";
+/**
+ * Compile the leg's write-protection judge and announce a missing target view.
+ *
+ * Returns the mount, or `undefined` when the deployment emptied the table (`[]`): no judge, no tighten
+ * mounted at all, and nothing announced — an explicit opt-out is not a degrade. A garbage table refuses
+ * prepare loudly from here, as it did from the gate station before, so an unusable table cannot lie
+ * dormant on a write-tool-less task.
+ *
+ * The notice fires exactly once per prepared leg and only when a judge with NO target view sits beside at
+ * least one tool whose writes it covers. Coverage runs the judge's OWN per-call test ({@link
+ * protectivePathTargetOf}) rather than a copy of it, over every name a row DISPATCHES under — its own and
+ * its aliases, because the gate hands the judge the name the call was made with. A row that declares a
+ * path target is covered by that declaration under every name; a row that declares none is covered under
+ * whichever of its names the catalog gives a non-read slot to. Both halves are load-bearing: a tool named
+ * `Write` that declares nothing, and a tool aliased to `Write` that declares nothing, are each judged by
+ * spelling alone on a hands-less leg, and each would otherwise go unnamed by the very line that exists to
+ * name them. Reported by the ROW's own name — what the deployment mounted.
+ *
+ * SNAPSHOT BOUNDARY, deliberate and disclosed: the roster read here is the LEG-START one, the same one
+ * the wiring manifest reports and for the same reason — this is one announcement per prepared leg, not a
+ * subscription. A run that gains its FIRST covered write tool after prepare (a mid-run roster delta) is
+ * judged by the same spelling-only judge and is not announced; the leg's `writeProtection.targetView`
+ * still reports the judge's reading correctly, because the judge never gains an environment mid-run —
+ * only the covered SET can widen.
+ */
+export declare function mountWriteProtection(input: {
+    /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
+     *  table, `[]` ⇒ opted out), the data root the memory library is materialized under
+     *  (`memoryEngineDir`; absent ⇒ the resolver's env/default chain) and the operator sink. */
+    deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "onNotice">;
+    /** The HANDS' environment, or `undefined` with no hands — the driver's own predicate, not a second
+     *  reading of the env seats, so the judge sees exactly the environment the write tools do. */
+    env: ExecutionEnv | undefined;
+    /** The base a `base: "root"` write tool's relative spelling resolves against. */
+    rootPath: string;
+    /** The leg's minted roster — what actually MOUNTED. */
+    roster: ToolRoster;
+    sessionId: string;
+    runId: string;
+}): WriteProtectionMount | undefined;

package/dist/core/runner/write-protection-station.js

@@ -0,0 +1,32 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+import { protectivePathTargetOf } from "../tool-registry.js";
+import { createWriteProtectionCheck } from "../write-protect.js";
+export function mountWriteProtection(input) {
+    const mount = createWriteProtectionCheck(input.deps.writeProtectedPaths, {
+        ...(input.deps.memoryEngineDir !== undefined ? { dataRoot: input.deps.memoryEngineDir } : {}),
+        ...(input.env !== undefined ? { env: input.env } : {}),
+        rootPath: input.rootPath,
+    });
+    if (mount === undefined || mount.targetView !== "spelling-only")
+        return mount;
+    const covered = input.roster.entries
+        .filter((e) => [e.name, ...e.aliases].some((name) => {
+        const target = protectivePathTargetOf({ toolName: name, args: {}, face: e.pathTarget !== undefined ? { pathTarget: e.pathTarget } : {} });
+        return target !== undefined && target.access !== "read";
+    }))
+        .map((e) => e.name)
+        .sort();
+    if (covered.length === 0)
+        return mount;
+    deliverEngineNotice(input.deps.onNotice, {
+        code: "config.write_protection_target_view_absent",
+        message: `This run mounted path-confinable write tools [${covered.join(", ")}] while its write-protection judge has NO execution environment, ` +
+            `so the judge compares path SPELLINGS against its table and nothing else. A write whose spelling misses the table but whose real target ` +
+            `resolves onto a protected path — through a symlink, a bind mount or a ".." walk — is cleared, and cleared silently: the resolved-target ` +
+            `half of the judgment needs a filesystem to resolve in. Nothing about this run changed. Wire an execution environment (RunnerDeps.executionEnv) ` +
+            `to get the target view back, or accept the spelling-only floor knowingly — the leg's wiring manifest reports which one is in force at ` +
+            `writeProtection.targetView.`,
+        detail: { tools: covered, sessionId: input.sessionId, runId: input.runId },
+    });
+    return mount;
+}

package/dist/core/runner-deps.d.ts

@@ -391,6 +391,27 @@ export interface RunnerDeps {
         maxCycles?: number;
         mintRepairBudget?: number;
     };
+    /**
+     * The advisory-to-execution BRIDGE: when `true`, a terminal harvest that crosses
+     * the consolidation threshold (the same edge that mints `memory.consolidation_recommended`) fires
+     * ONE host consolidation run for the recommended scope at the post-task tail — fire-and-forget,
+     * result-first, never on the harvest tail itself. Explicit `false` = OFF (the deployment's own off
+     * switch; it beats the default). ABSENT = the named default `AUTO_RUN_ON_RECOMMENDATION_DEFAULT`
+     * (`memory-consolidation-driver.ts`, read through `autoRunOnRecommendationEffective` — the ONE
+     * resolver), applied ONLY where a run could actually happen (the protocol switch wired AND a model
+     * seat resolvable): a default-on value never arms a deployment that wired no consolidation.
+     *
+     * DEPLOYMENT seat ONLY (no TaskSpec twin), the same law as {@link RunnerDeps.memoryConsolidation} /
+     * {@link RunnerDeps.memoryConsolidationDriver}: arming this is an EGRESS decision — memory content crosses
+     * to the consolidation model automatically after every recommending task, never a task author's call.
+     *
+     * `true` with nothing to run (no {@link RunnerDeps.memoryConsolidation}, or no resolvable driver model
+     * seat), or a non-boolean, is refused at prepare (`config.auto_consolidation`) — never folded to off.
+     *
+     * Reported on the effective wiring manifest as `WiringManifest.autoConsolidation`, PRESENT IFF armed
+     * (absent and fingerprint-identical when off).
+     */
+    autoRunOnRecommendation?: boolean;
     /**
      * design/199 件A — the DEPLOYMENT's read-face declaration
      * ({@link import("../tools/fs/containment-face.js").ContainmentFace}; see {@link TaskSpec.readFace} for the

package/dist/core/sensitive-path-policy.js

@@ -4,6 +4,7 @@ import { canonicalizeTarget, expandHomeTilde, isAbsoluteForFamily, isWinFormPath
 import { compileSegmentPattern, matchSegmentPatterns, READ_FACE_BUILTIN_DENY_TABLE } from "../tools/fs/read-deny.js";
 import { isProtectedWrite, protectivePathTargetOf } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
+import { symlinkChainHops } from "./path-identity.js";
 export function agentConfigDenyPatterns() {
     return READ_FACE_BUILTIN_DENY_TABLE.filter((row) => row.tier === "agent-config").map((row) => row.pattern);
 }
@@ -147,6 +148,18 @@ export function createSensitivePathPolicy(opts) {
                     decisionReason: "safety",
                 };
             }
+            if (relative === null) {
+                for (const hop of await symlinkChainHops(opts.env, path, signal, pathFamilyOf({ root: opts.rootPath, cwd: req.cwd ?? opts.env.cwd }), pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }))) {
+                    const viaHop = matchSensitive(hop, compiled, false);
+                    if (viaHop) {
+                        return {
+                            action: "deny",
+                            message: `write to "${path}" is blocked: its symlink chain passes through the guarded sensitive path "${viaHop}"`,
+                            decisionReason: "safety",
+                        };
+                    }
+                }
+            }
             return { action: "allow" };
         },
     };

package/dist/core/wiring-manifest.d.ts

@@ -24,6 +24,7 @@ import type { RunnerDeps, TaskSpec } from "./types.js";
 import { type StoreDurability } from "./checkpoint-store.js";
 import type { WiringManifestHookEntry } from "./hook-seats.js";
 import type { McpDelivered, McpFailureKind } from "./mcp-failure.js";
+import type { WriteProtectionTargetView } from "./write-protect.js";
 export type { StoreDurability };
 /** The manifest-face projection of {@link StoreDurability}: `"declared_durable"` (the name says it —
  *  a DECLARATION relayed, not a verification) vs `"process_local"` (declared so, or fail-closed
@@ -319,6 +320,46 @@ export interface WiringManifest {
         mounted: boolean;
         lane?: LspLane;
     };
+    /**
+     * EFFECTIVE half only, PRESENT IFF this leg compiled a write-protection judge — a deployment that
+     * replaced the table with `[]` opted the layer out entirely, and reports nothing here rather than a
+     * judge-shaped word about a judge that does not exist (absence = "no judge on this leg", which is a
+     * different fact from either value below, and strictly weaker than both).
+     *
+     * `targetView` is the JUDGE'S OWN word (`WriteProtectionMatcher.targetView`, relayed verbatim), and it
+     * is how an operator tells a hands-less deployment's write floor from a hands-ful one without inspecting
+     * the engine's seats — the same fact `config.write_protection_target_view_absent` announces once per run
+     * when a covered write tool is mounted beside a `"spelling-only"` judge.
+     *
+     * IN the fingerprint below (unlike `tools`/`lsp`/`hooks`): which view the judge got is an ASSEMBLY fact
+     * — it follows the table seat and whether the deployment wired hands at all — so legs of one assembly
+     * agree on it, which is exactly the equality the fingerprint advertises.
+     *
+     * @contract write_protection.target_view_disclosed — WHICH reading of a write's target the leg's
+     * write-protection judge holds is DISCLOSED, never inferred: the judge self-reports one of two words at
+     * its compile (`"target"` — it holds an execution environment and re-judges a table-missing spelling on
+     * its resolved real target; `"spelling-only"` — it holds none, so the spelling is the whole judgment and
+     * an alias onto a protected path is cleared), the leg's wiring manifest relays that word verbatim, and a
+     * `"spelling-only"` judge with a covered write tool mounted also announces
+     * `config.write_protection_target_view_absent` exactly once per run; the disclosure changes no verdict —
+     * the absence law it makes readable is the judge's own and stands unaltered.
+     */
+    writeProtection?: {
+        targetView: WriteProtectionTargetView;
+    };
+    /**
+     * EFFECTIVE half only. PRESENT IFF auto-consolidation is EFFECTIVELY armed on this
+     * deployment (`autoRunOnRecommendationEffective`: an explicit `true`, or an absent seat under the
+     * named default `AUTO_RUN_ON_RECOMMENDATION_DEFAULT` where both consolidation seats are wired): a
+     * terminal harvest that crosses the threshold auto-runs one host consolidation — memory content
+     * auto-egresses to the configured model. ABSENT (and the manifest, including `configFingerprint`,
+     * byte-identical) when not armed — an explicit `false`, or a default that does not arm it.
+     * IN the fingerprint (an assembly fact, the same class as {@link WiringManifest.writeProtection}); always
+     * `{ onRecommendation: true }` when present — the prepare door refuses an armed-but-unrunnable state.
+     */
+    autoConsolidation?: {
+        onRecommendation: true;
+    };
     /** EFFECTIVE half only — a short, non-sensitive fingerprint (sha256 prefix over the canonical
      *  JSON of this manifest's own resolved facts; every field here is an enum/boolean/count, no
      *  secrets) so an operator can correlate legs that ran under the same resolved assembly. */
@@ -397,6 +438,12 @@ export interface WiringFacts {
         mounted: boolean;
         lane?: LspLane;
     };
+    /** Effective half only — the compiled write-protection judge's OWN target-view word
+     *  ({@link WiringManifest.writeProtection}); absent ⇒ this leg compiled no judge (an emptied table). */
+    writeProtectionTargetView?: WriteProtectionTargetView;
+    /** Effective half only — `RunnerDeps.autoRunOnRecommendation === true`
+     *  ({@link WiringManifest.autoConsolidation}); false ⇒ no section (byte-identical manifest). */
+    autoConsolidationOnRecommendation?: boolean;
 }
 /** Named view of the deps seats the static half reads (a `Pick` of the real {@link RunnerDeps} —
  *  single-source shapes, no parallel hand-copied interface). */

package/dist/core/wiring-manifest.js

@@ -141,6 +141,8 @@ export function deriveWiringManifest(facts) {
         ...(facts.half === "effective" && facts.tools !== undefined ? { tools: facts.tools } : {}),
         ...(facts.half === "effective" && facts.hooks !== undefined && facts.hooks.length > 0 ? { hooks: facts.hooks.map((h) => ({ ...h })) } : {}),
         ...(facts.half === "effective" && facts.lsp !== undefined ? { lsp: { ...facts.lsp } } : {}),
+        ...(facts.half === "effective" && facts.writeProtectionTargetView !== undefined ? { writeProtection: { targetView: facts.writeProtectionTargetView } } : {}),
+        ...(facts.half === "effective" && facts.autoConsolidationOnRecommendation === true ? { autoConsolidation: { onRecommendation: true } } : {}),
     };
     if (facts.half === "effective") {
         const { leg: _leg, mcp: _mcp, tools: _tools, lsp: _lsp, hooks: _hooks, ...assembly } = manifest;

package/dist/core/write-protect.d.ts

@@ -51,7 +51,8 @@ export declare function resolveWriteProtectedTable(entries?: readonly WriteProte
  * The judge's answer for ONE covered write ({@link WriteProtectionMatcher.judge}):
  *  · `clear` — no row on either view: the write is not this layer's business;
  *  · `hit` — a row matched; `via` says which view named it: `"spelling"` (the anchored spelling, no
- *    filesystem consulted) or `"target"` (the resolved real target, the spelling being innocent);
+ *    filesystem consulted), `"chain"` (a spelling the leaf symlink chain passes through, judged as a
+ *    spelling) or `"target"` (the resolved real target, the spelling being innocent);
  *  · `unresolvable` — the real target could not be resolved (an unfollowable symlink, an errored probe, a
  *    namespace spelling the tree refuses); `cause` is the canonicalizer's own sentence and the consumer
  *    REFUSES, an unjudged target never being vouched.
@@ -61,7 +62,7 @@ export type WriteProtectionVerdict = {
 } | {
     readonly kind: "hit";
     readonly hit: WriteProtectedHit;
-    readonly via: "spelling" | "target";
+    readonly via: "spelling" | "chain" | "target";
 } | {
     readonly kind: "unresolvable";
     readonly cause: string;
@@ -78,10 +79,24 @@ export interface WriteProtectionJudgeContext {
     /** Bounds the filesystem probes of the target view. */
     readonly signal?: AbortSignal;
 }
+/**
+ * WHICH reading of a write's TARGET a compiled judge has — its own word, and the vocabulary the wiring
+ * manifest discloses it with. `"target"`: the judge holds an execution environment, so a spelling that
+ * misses the table is judged a SECOND time on its resolved real target (an alias, a symlink, a `..` walk
+ * that lands on a protected row is seen). `"spelling-only"`: no environment, so the spelling IS the whole
+ * judgment and a path reaching a row only through an alias is cleared — the module header's absence law,
+ * unchanged by this word, which only makes it READABLE. Never derived by a reader from the judge's seats.
+ */
+export declare const WRITE_PROTECTION_TARGET_VIEWS: readonly ["spelling-only", "target"];
+/** One of {@link WRITE_PROTECTION_TARGET_VIEWS}. */
+export type WriteProtectionTargetView = (typeof WRITE_PROTECTION_TARGET_VIEWS)[number];
 /** The compiled judge over one resolved table. `matchPath` is the SPELLING view alone (literal folded
  *  comparisons, no filesystem access — the admin preview face); `judge` is the whole judgment (see the
  *  module header for the two views). */
 export interface WriteProtectionMatcher {
+    /** WHICH reading of a target this judge HAS — minted at compile and read verbatim by everyone who needs
+     *  the fact; a reader re-deriving it from the seats is a second opinion, free to drift. */
+    readonly targetView: WriteProtectionTargetView;
     /** The resolved rows this judge was compiled from (canonical names — the disclosure face). */
     readonly rows: readonly WriteProtectedRow[];
     /** Judge ONE path SPELLING. Returns the first matching row (basename rows first, then segment,
@@ -147,6 +162,17 @@ export declare function compileWriteProtection(entries?: readonly WriteProtected
  *  · `clear` ⇒ `undefined`: the surviving decision stands.
  */
 export declare function writeProtectionTightenDecision(toolName: string, verdict: WriteProtectionVerdict): PermissionResult | undefined;
+/**
+ * @contract write_protection.verdict_is_the_mandate — the judge's two non-clear verdicts are the two facts
+ * a standing allow rule may not retire, and `clear` is neither: a MATCHED row is the mandate a live decider
+ * may still clear, a target it could not RESOLVE is the mandate no automatic lane may. These two predicates
+ * are the ONE reading of a verdict as either fact, beside the decision mint, so the fold records what the
+ * judge said and never re-derives "was this write protection?" from the decision it got back.
+ */
+export declare function writeProtectionMandated(verdict: WriteProtectionVerdict): boolean;
+/** The second half of {@link writeProtectionMandated}'s contract: the judge could not name this target
+ *  (the arm that owns the ACTION denies on the same verdict). */
+export declare function writeProtectionUnresolved(verdict: WriteProtectionVerdict): boolean;
 /**
  * The ENGINE-FILLED gate input (`ToolGateInput.writeProtectionCheck`). Returns `null` SYNCHRONOUSLY when the
  * call is not this layer's business — not a covered write, or no resolvable target string — and otherwise
@@ -154,6 +180,18 @@ export declare function writeProtectionTightenDecision(toolName: string, verdict
  * a call the judge does not cover must not cost the fold a suspension point.
  */
 export type WriteProtectionCheck = (toolName: string, args: unknown, face?: ToolCallLike["face"], cwd?: string, signal?: AbortSignal) => Promise<WriteProtectionVerdict> | null;
+/**
+ * ONE leg's write-protection mount: the gate input and the judge's own {@link WriteProtectionTargetView},
+ * handed back together so the two readers of this compile — the gate station that mounts the check and the
+ * disclosure face that reports which reading it got — read ONE compile. `undefined` in place of the whole
+ * record is "no judge" (an emptied table), a different fact from a judge whose target view is absent.
+ */
+export interface WriteProtectionMount {
+    /** The gate input (`ToolGateInput.writeProtectionCheck`). */
+    readonly check: WriteProtectionCheck;
+    /** The compiled judge's own word for the reading it has of a write's target. */
+    readonly targetView: WriteProtectionTargetView;
+}
 /**
  * Build the ENGINE-FILLED gate input (`ToolGateInput.writeProtectionCheck`): covered tools are the
  * path-confinable write set (Write/Edit/NotebookEdit — the shared spelling), the judged target is
@@ -167,4 +205,4 @@ export type WriteProtectionCheck = (toolName: string, args: unknown, face?: Tool
  * Returns `undefined` when the resolved table is empty — nothing to judge, mount nothing.
  * `opts` are the judge's own seats, passed straight through ({@link compileWriteProtection}).
  */
-export declare function createWriteProtectionCheck(entries?: readonly WriteProtectedEntry[], opts?: WriteProtectionCompileOptions): WriteProtectionCheck | undefined;
+export declare function createWriteProtectionCheck(entries?: readonly WriteProtectedEntry[], opts?: WriteProtectionCompileOptions): WriteProtectionMount | undefined;