@sema-agent/core 7.24.3 → 7.24.4

package/CHANGELOG.md

@@ -1,6 +1,28 @@
 # Changelog
 
-## Unreleased
+## 7.24.4 — 2026-09-20
+
+### Every rule source is re-read at every gate (#978 ①; P2; behavior-face widening of when a session rule binds; no wire key; @server @cli @test)
+- **Before.** `sessionPolicyStore.getRules` was read ONCE, at prepare, and the compiled rules were frozen for the leg; only the ANCESTOR snapshots were re-read live, and only at prepare too. The permission-rule store, meanwhile, is read at every adjudicated call. So a deployment that wrote a `deny` to a session's policy row while the run was going — the ordinary shape of an operator narrowing a task already in flight — watched the run's next calls execute anyway; the deny bound the NEXT run. Measured downstream: the row was written at the first `tool_end` and 3/3 later calls of that tool still ran. Worse, a session with NO row at prepare composed no layer at all, so a session's FIRST rule could never bind mid-run whatever the read tempo.
+- **After — one law, both stores.** A session-rule layer takes its rules from a `SessionRuleSource` at EVERY gate. The prepare read is a SEED, not the reading: it is what the prepare-time policy-name audit sees and the floor a live read may never loosen. The layer is composed whenever the store is wired for the session, including when the row is empty (an empty seed constrains nothing, and a layer that was never composed cannot re-read anything). The ancestor lane uses the same reader rather than its own hand-written live-preferring read.
+- **Direction, unchanged.** Whole-row replacement at `live.rev >= floor.rev` — an operator's AUTHORIZED change propagates in both directions (tighten and relax). What the floor forbids is an UNAUTHORIZED loosening: a lagging replica, a deleted row and an unreachable store each enforce the floor instead. The floor RATCHETS to the highest-rev row the layer has served, so a row tightened mid-run and then unreadable cannot fall back past the tightening.
+- **Cost and loudness.** One store read per adjudicated call per layer, shared inside one call by the same bounded per-call handoff the permission-rule lanes use (first reader hands, second claims). That handoff has a real firing path here: `policyLayers` re-appends the narrowing layers AFTER a rewrite-capable caller layer, so one adjudication asks the layer twice under one id and both passes must judge one set of rules. A source that cannot be read discloses once per distinct reason through `onError` (`phase: "config"`, `code: "config.session_rules_unreadable"`) — the advisory channel the policy-name audit already uses, not a new notice code.
+- **The read is BOUNDED.** This is the only I/O the narrowing fold performs, and the resumed-execution path awaits that fold with a consumed approval already claimed — a store that never settled would strand the call rather than refuse it. The read now rides `withGateTimeout` on the gate's own signal and the tree's default deadline; an elapsed or aborted wait takes the same fail-closed arm as a throwing store (enforce the floor, disclose once).
+- **A vanished row ends its rev line.** `rev` counts within ONE row's lifetime — both bundled backends restart it at 1 after a delete, and the tighten gate has no prior row to judge the first write against, so a recreated row's rev can be climbed past an enforced floor by ordinary non-operator writes (measured: enforce rev 2, delete, three `{}` writes, rev 3 replaces the restriction). Once a row this layer served is observed GONE, nothing that appears afterwards is comparable to it and the floor is final for the leg. COST: a legitimate delete-then-recreate is not picked up until the next run, and a backend that answers "no row" transiently ends the line early — both conservative. A session that simply never had a row is unaffected and silent (absence is not a deletion).
+- **Five bounds an adversarial round added.** (a) A live row replaces the floor only on a STRICTLY GREATER `rev`: both bundled backends compute `rev` as `(prior?.rev ?? 0) + 1`, so a DELETED-and-recreated row restarts at 1, and at `>=` a recreated row that merely tied the enforced one would replace it — an unauthorized loosening wearing an update's shape. A tie now enforces the floor (a no-op for the honest case, where equal rev is the same row). This raises the cost of the recycle rather than closing it — the rev can still be climbed past the floor by repeated writes, because the tighten gate has no prior row to judge against after a delete; closing it belongs to the STORE's rev lifecycle (a counter that survives deletion, or a generation identity) and is a cross-backend contract change. (b) A handed read is CLAIMED only while its `rev` still stands at the enforced floor: `toolCallId` is not always unique (the turn-boundary read-visibility query reuses one synthetic id for every path and every turn), and a claim from a later adjudication would otherwise walk back past a tightening the layer already applied. (c) The enforced row is published for the child chain from the same place it is enforced, each time the floor advances — so a rule written mid-run reaches a child spawned after it, and a child whose own store read fails falls back to its parent's CURRENT floor rather than an older one. The empty seed is never published (it is not a row a child may inherit).
+- **Reach.** `createSessionRulePolicy`'s first parameter widens to `SessionPermissionRules | SessionRuleSource` (additive; a plain rules object is still the constant source and every existing caller is unchanged). No wire key, code or closed-set member moves. RESIDUAL, recorded: a child spawned BEFORE the session's first row exists inherits no ancestor entry — seeding an empty one would put an `ancestorRules` row on every delegated child of every store-bearing deployment, which other readers take to mean "this leg is delegated". `test/backlog978-session-rules-every-gate.test.ts` pins the mid-run first deny, the mid-run tighten, the authorized relaxation, the three fail-closed arms (store down, lagging replica, deleted row), the ancestor lane, the read count, the handoff, the rev-recycle / claim-revalidation / vanished-row / bounded-read arms, the child-chain publication, and the two no-rule controls; 8 of the 10 Runner-level ones are red on 7.24.2.
+
+### One sentence for "a rule refused this call" (#978 ②; P2; refusal TEXT change on two lanes; no wire key; @cli @server @test)
+- **Before.** Two rule stores can refuse a call and each spelled it its own way: `tool "X" is denied by a session rule`, `denied by permission rule "R" (layer)`, plus four further shapes for the session lane's containment arms (`write-capable tool "X" denied: …`, `write to "p" is outside …`), and a session `commandDeny` that came out as the coarse policy's generic `command "curl" is denied by policy`. The resumed-execution re-check asserted `a session rule` for a fold that also holds inherited ancestor rules, the frozen constraint projections and the skill scope. A consumer could not read which store had spoken — the confusion that produced the wrong answer to "is the rule store re-read at every gate?".
+- **After.** `src/core/rule-denial-sentence.ts` mints them all: `[tool "<tool>" is ]denied by <source>[ "<rule>"][ (<origin>)][: <detail>]`, over a closed source vocabulary derived from its own phrase table (`session` / `permission` / `narrowing`). The seven session-lane exits now differ only in the `detail` that says WHY; the session `commandDeny` refusal is re-minted as the session lane's own, carrying the coarse policy's sentence as its detail; the resumed re-check names the fold instead of one of its layers.
+- **What a reader keyed on the old text sees.** The permission lane's sentence gained a head and kept its tail byte-for-byte (`denied by permission rule "Bash(rm -r:*)" (settings.permissions.deny)` still `toContain`s). The session lane's plain tool-name denial is unchanged. The containment arms and the allowlist miss are REWORDED and keep their diagnostic substrings (`cannot be path-confined`, `declares no path target`, `no resolvable path`, `outside the session-rule allowDirs`, `not in the session-rule allowlist`). The ASK sentence (`flagged by permission rule …`) is deliberately untouched: an ask is a question on a card, not a refusal in a tool result.
+- **Reach.** No wire key, code, closed-set member or export moves; `PermissionResult.message` is a rendered string and this is a rendering change. `@cli` renders these in tool results — a fence pinned on a session-lane containment wording should re-pin on the substrings above. `test/backlog978-rule-denial-sentence.test.ts` pins the grammar, the two lanes' agreement on it, every session exit, the mint's composition, and a source scan holding the denial spellings to one module (its ceiling is stated: code lines only, and the ask / non-rule-store `denied by policy` faces are out of scope).
+
+### A workflow agent's fleet row now says which attempt it is on (#979; P2; presence change on an existing wire key, additive; no new key, no export; @client-core @server)
+- **Before.** `BackgroundChildEvent.seq` is contracted as "present whenever a cycle number is knowable, absent when no carrier exists". The `a*` delegation lanes have carried it on spawn / tick / terminal since #258; the `wa*` workflow lane carried it on NONE of its three frames — while it has held a carrier all along: the orchestration layer's stall/throttle retry re-runs the same logical agent on a fresh session under the SAME `wa*` id, which is exactly the "one row, two cycles" shape the field exists to separate. A fleet consumer folding rows by generation had a structurally unreachable third branch on this lane.
+- **After.** The `wa*` row carries a generation: a fresh spawn is `1`, and each retry of the same agent bumps it, so a tick or terminal says which attempt produced it. The number is the ROW's, taken at emit — never copied from a forwarded descendant's frame, the same rule `agentType` and `model` already follow on this lane.
+- **The carrier is the ATTEMPT counter, not the session rebind.** A retry also rebinds the row's transcript coordinate, and today the two move together — but the coordinate is a different fact (it is skipped for a spec shape that mints no id, and once the run is finalized), so counting rebinds would make the generation a property of whether a coordinate existed.
+- **Reach.** `seq` is now ALWAYS present on a `wa*` row, where it was always absent; a consumer that read that absence as "this lane has no generation" must now read the number, and an absent `seq` on a `wa*` row dates the producer as pre-7.24.4. `task_progress.seq` is UNCHANGED and still absent for workflow agents (no `a*` registry row). `@client-core` B4 folds rows by generation; `@server` relays the frame unchanged; `@cli` has no `wa*` fleet renderer. `docs/wire-consumption/unreleased-979.md` carries the table, including the disclosure that one Workflow fan-out's children all share ONE `parentToolCallId` (up to `maxAgents`, default 50) — `seq` separates one row's cycles, not two rows. `test/backlog979-workflow-bce-seq.test.ts` pins the six readings with a five-row mutation table.
 
 ## 7.24.3 — 2026-09-20
 

package/dist/core/permission-rules.js

@@ -5,6 +5,7 @@ import { PATH_RULE_BASE_LABEL, isUsablePathBase, parseRuleText, pathRuleReachOf,
 import { pathFamilyOf } from "../tools/fs/safety.js";
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
+import { ruleDenialSentence } from "./rule-denial-sentence.js";
 export { parsePermissionRule };
 export const BASH_GENERIC_PARAMS = new Set(catalogRuleFaceOf("Bash")?.params ?? []);
 const DEFAULT_CAPS = {
@@ -267,8 +268,11 @@ function matchParamRules(rules, args, maxScalarValueChars) {
     }
     return undefined;
 }
-function ruleMessage(kind, ruleText, source) {
-    return `${kind} by permission rule "${ruleText}"${source ? ` (${source})` : ""}`;
+function ruleDenial(req, ruleText, source) {
+    return ruleDenialSentence({ source: "permission", tool: req.toolName, rule: ruleText, ...(source ? { origin: source } : {}) });
+}
+function ruleAskMessage(ruleText, source) {
+    return `flagged by permission rule "${ruleText}"${source ? ` (${source})` : ""}`;
 }
 export function createPermissionRulePolicy(rules, opts) {
     const caps = { ...DEFAULT_CAPS, ...opts?.caps };
@@ -357,45 +361,45 @@ export function createPermissionRulePolicy(rules, opts) {
             const entry = byTool.get(req.toolName);
             const covering = hasCovering && protocolOf(req.toolName) !== undefined;
             if (entry?.bare.deny) {
-                return { action: "deny", message: ruleMessage("denied", entry.bare.deny.ruleText, entry.bare.deny.source) };
+                return { action: "deny", message: ruleDenial(req, entry.bare.deny.ruleText, entry.bare.deny.source) };
             }
             if (covering) {
                 const coveringDeny = coveringHit(namespacedCovering.deny, req.toolName);
                 if (coveringDeny)
-                    return { action: "deny", message: ruleMessage("denied", coveringDeny.ruleText, coveringDeny.source) };
+                    return { action: "deny", message: ruleDenial(req, coveringDeny.ruleText, coveringDeny.source) };
             }
             const contentDeny = entry !== undefined ? contentHit(entry.content.deny, req) : undefined;
             if (contentDeny !== undefined && contentDeny.unreadable === undefined) {
-                return { action: "deny", message: ruleMessage("denied", contentDeny.rule.ruleText, contentDeny.rule.source) };
+                return { action: "deny", message: ruleDenial(req, contentDeny.rule.ruleText, contentDeny.rule.source) };
             }
             if (entry) {
                 const paramDeny = matchParamRules(entry.param.deny, req.args, caps.maxScalarValueChars);
                 if (paramDeny) {
-                    return { action: "deny", message: ruleMessage("denied", paramDeny.ruleText, paramDeny.source) };
+                    return { action: "deny", message: ruleDenial(req, paramDeny.ruleText, paramDeny.source) };
                 }
             }
             if (contentDeny?.unreadable !== undefined)
                 return unreadableAsk({ rule: contentDeny.rule, unreadable: contentDeny.unreadable }, req);
             if (entry) {
                 if (entry.bare.ask) {
-                    return { action: "ask", message: ruleMessage("flagged", entry.bare.ask.ruleText, entry.bare.ask.source), matchedAskRule: entry.bare.ask.ruleText };
+                    return { action: "ask", message: ruleAskMessage(entry.bare.ask.ruleText, entry.bare.ask.source), matchedAskRule: entry.bare.ask.ruleText };
                 }
             }
             if (covering) {
                 const coveringAsk = coveringHit(namespacedCovering.ask, req.toolName);
                 if (coveringAsk)
-                    return { action: "ask", message: ruleMessage("flagged", coveringAsk.ruleText, coveringAsk.source), matchedAskRule: coveringAsk.ruleText };
+                    return { action: "ask", message: ruleAskMessage(coveringAsk.ruleText, coveringAsk.source), matchedAskRule: coveringAsk.ruleText };
             }
             if (entry) {
                 const contentAsk = contentHit(entry.content.ask, req);
                 if (contentAsk !== undefined) {
                     if (contentAsk.unreadable !== undefined)
                         return unreadableAsk({ rule: contentAsk.rule, unreadable: contentAsk.unreadable }, req);
-                    return { action: "ask", message: ruleMessage("flagged", contentAsk.rule.ruleText, contentAsk.rule.source), matchedAskRule: contentAsk.rule.ruleText };
+                    return { action: "ask", message: ruleAskMessage(contentAsk.rule.ruleText, contentAsk.rule.source), matchedAskRule: contentAsk.rule.ruleText };
                 }
                 const paramAsk = matchParamRules(entry.param.ask, req.args, caps.maxScalarValueChars);
                 if (paramAsk) {
-                    return { action: "ask", message: ruleMessage("flagged", paramAsk.ruleText, paramAsk.source), matchedAskRule: paramAsk.ruleText };
+                    return { action: "ask", message: ruleAskMessage(paramAsk.ruleText, paramAsk.source), matchedAskRule: paramAsk.ruleText };
                 }
                 if (entry.bare.allow) {
                     return { action: "allow" };

package/dist/core/rule-denial-sentence.d.ts

@@ -0,0 +1,75 @@
+/**
+ * The ONE mint for "a rule refused this call".
+ *
+ * WHY IT EXISTS. The engine has two rule stores that can refuse a tool call — the per-session policy rows
+ * a deployment writes against a session id, and the declarative permission rules compiled from a settings
+ * layer — and each used to spell its refusal in its own grammar at its own site: `tool "X" is denied by a
+ * session rule` beside `denied by permission rule "R" (layer)`, with the session lane's four containment
+ * arms in three further shapes and the resumed-execution re-check asserting a source ("a session rule")
+ * that was only ever one of the narrowing layers it speaks for. A consumer reading those strings could not
+ * tell WHICH store had spoken, which is precisely the confusion that produced the wrong answer to "is the
+ * rule store re-read at every gate?" — the two stores were being described as one.
+ *
+ * So: one grammar, one vocabulary of sources, one place to change either.
+ */
+/**
+ * The closed vocabulary of rule sources a refusal may name, each with the two spellings the sentence needs:
+ * `bare` when the source has no rule text to quote, `named` when it does. The type is DERIVED from this
+ * table, so a source without its spellings is not expressible and no fence is needed to say so.
+ *
+ * The words are the ENGINE'S rule-bearing faces, not a settings layer's (`source`/`origin` are different
+ * questions: WHICH STORE spoke, versus WHERE in that store's layering the row was written — the second
+ * rides `origin`).
+ */
+declare const RULE_SOURCE_PHRASE: {
+    /** The per-session policy rows (`SessionPolicyStore`), folded in as a deny-narrowing layer. */
+    readonly session: {
+        readonly bare: "a session rule";
+        readonly named: "session rule";
+    };
+    /** The declarative permission rules compiled from a deployment's settings layers. */
+    readonly permission: {
+        readonly bare: "a permission rule";
+        readonly named: "permission rule";
+    };
+    /**
+     * The deny-narrowing fold as a WHOLE — session rules, inherited ancestor rules, the frozen constraint
+     * projections and the active skill scope. Used where the refusing layer's own sentence is carried as the
+     * detail and the wrapper must not claim to know which of them spoke.
+     */
+    readonly narrowing: {
+        readonly bare: "a narrowing policy layer";
+        readonly named: "narrowing policy layer";
+    };
+};
+/** A rule-bearing face that can refuse a call ({@link RULE_SOURCE_PHRASE} holds the whole vocabulary). */
+export type RuleDenialSource = keyof typeof RULE_SOURCE_PHRASE;
+/** How a refusal names `source` in prose, with no rule text to quote — for a sentence this module does not
+ *  mint whole (a wrapper that carries the refusing layer's own sentence as its body). */
+export declare function ruleSourcePhrase(source: RuleDenialSource): string;
+/**
+ * Mint the refusal.
+ *
+ * @contract rule_denial.one_sentence — every refusal a RULE STORE mints reads
+ * `[tool "<tool>" is ]denied by <source>[ "<rule>"][ (<origin>)][: <detail>]`, composed here and nowhere
+ * else: the call is named first, then WHICH rule-bearing face refused (from the closed source vocabulary),
+ * then the rule's own text and the layer it was written in where the source has them, and last the reason
+ * this call failed the rule. A consumer reading a refusal can therefore always tell the session-policy
+ * store's answer from the permission rules' — and a carrier sentence that already named the call omits the
+ * head rather than spelling a second grammar.
+ *
+ * - `tool` — named when the sentence stands alone; omitted when a carrier sentence already named the call.
+ * - `rule` — the rule's own text, when the source has one to quote (a permission rule does; a session
+ *   policy row is structured fields, not a rule DSL, so it does not).
+ * - `origin` — where in that store's layering the row was written (e.g. a settings layer's key path).
+ * - `detail` — WHY this call failed the rule, when the source word alone does not say it (an allowlist
+ *   miss, a write the confinement cannot place, the refusing layer's own sentence).
+ */
+export declare function ruleDenialSentence(spec: {
+    source: RuleDenialSource;
+    tool?: string;
+    rule?: string;
+    origin?: string;
+    detail?: string;
+}): string;
+export {};

package/dist/core/rule-denial-sentence.js

@@ -0,0 +1,16 @@
+const RULE_SOURCE_PHRASE = {
+    session: { bare: "a session rule", named: "session rule" },
+    permission: { bare: "a permission rule", named: "permission rule" },
+    narrowing: { bare: "a narrowing policy layer", named: "narrowing policy layer" },
+};
+export function ruleSourcePhrase(source) {
+    return RULE_SOURCE_PHRASE[source].bare;
+}
+export function ruleDenialSentence(spec) {
+    const phrase = RULE_SOURCE_PHRASE[spec.source];
+    const by = spec.rule === undefined ? phrase.bare : `${phrase.named} ${JSON.stringify(spec.rule)}`;
+    const head = spec.tool === undefined ? "" : `tool ${JSON.stringify(spec.tool)} is `;
+    const origin = spec.origin === undefined ? "" : ` (${spec.origin})`;
+    const detail = spec.detail === undefined ? "" : `: ${spec.detail}`;
+    return `${head}denied by ${by}${origin}${detail}`;
+}

package/dist/core/runner/prepare-policy-chain.js

@@ -14,7 +14,7 @@ import { probeMandatedAsk } from "../ask-origin.js";
 import { headlessDenyAtFold, headlessDenyAtRecheck, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
 import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
-import { createSessionRulePolicy } from "./session-rule-policy.js";
+import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
 import { thrownText } from "../thrown-value.js";
 export async function preparePolicyChain(input) {
     const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
@@ -69,32 +69,42 @@ export async function preparePolicyChain(input) {
         }
     };
     auditPolicyNames(policy);
+    const announceSessionRulesUnreadable = (reason) => {
+        try {
+            const e = new Error(`session permission rules: ${reason} — the snapshot this leg already enforces stays in force (a failed read never loosens it)`);
+            e.code = "config.session_rules_unreadable";
+            deps.onError?.(e, { phase: "config", sessionId });
+        }
+        catch {
+        }
+    };
     let sessionRulePolicy;
     if (deps.sessionPolicyStore && spec.sessionId) {
-        const rules = await deps.sessionPolicyStore.getRules(spec.sessionId, spec.principal);
-        if (rules) {
-            sessionRulePolicy = createSessionRulePolicy(rules, { env: executionEnv, rootPath: taskRootFinal, toolEffects });
+        const store = deps.sessionPolicyStore;
+        const sessionRuleKey = { sessionId: spec.sessionId, ...(spec.principal !== undefined ? { principal: spec.principal } : {}) };
+        const rules = await store.getRules(spec.sessionId, spec.principal);
+        const seed = rules ?? { rev: 0 };
+        const publishOwnRules = (row) => {
             ownSessionRulesRef.current = {
-                sessionId: spec.sessionId,
-                ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
-                rev: rules.rev,
-                rules,
+                sessionId: sessionRuleKey.sessionId,
+                ...(sessionRuleKey.principal !== undefined ? { principal: sessionRuleKey.principal } : {}),
+                rev: row.rev,
+                rules: row,
             };
-        }
+        };
+        sessionRulePolicy = createSessionRulePolicy({ seed, read: createLiveSessionRules(store, { ...sessionRuleKey, seed }, { onUnreadable: announceSessionRulesUnreadable, onEnforced: publishOwnRules }) }, { env: executionEnv, rootPath: taskRootFinal, toolEffects });
+        if (rules)
+            publishOwnRules(rules);
     }
     const ancestorRulePolicies = [];
     for (const snap of inheritedAncestorRules ?? []) {
-        let ancestorRules = snap.rules;
-        if (deps.sessionPolicyStore) {
-            try {
-                const live = await deps.sessionPolicyStore.getRules(snap.sessionId, snap.principal);
-                if (live !== null && live.rev >= snap.rev)
-                    ancestorRules = live;
-            }
-            catch {
-            }
-        }
-        ancestorRulePolicies.push(createSessionRulePolicy(ancestorRules, { env: executionEnv, rootPath: taskRootFinal, toolEffects }));
+        const seed = { ...snap.rules, rev: snap.rev };
+        ancestorRulePolicies.push(createSessionRulePolicy({
+            seed,
+            ...(deps.sessionPolicyStore
+                ? { read: createLiveSessionRules(deps.sessionPolicyStore, { sessionId: snap.sessionId, ...(snap.principal !== undefined ? { principal: snap.principal } : {}), seed }, { onUnreadable: announceSessionRulesUnreadable }) }
+                : {}),
+        }, { env: executionEnv, rootPath: taskRootFinal, toolEffects }));
     }
     const skillScopePolicy = hasSkillManifest
         ? createActiveSkillScopePolicy({

package/dist/core/runner/run-leg.js

@@ -30,6 +30,7 @@ import { announceListingTruncation } from "../skill-listing-budget.js";
 import { attachmentEnvelopeTags, commitAgentListing, commitSkillsListing, reduceToolEnd, renderAgentListingFrame, renderOrphanedBackgroundTasks, renderSkillsListingFrame, stampWriteAnchor } from "./turn-attachments.js";
 import { flushOwedAnnouncedSnapshot } from "./announce-once-ledger.js";
 import { asThrownError, thrownMarksOf, thrownText } from "../thrown-value.js";
+import { ruleSourcePhrase } from "../rule-denial-sentence.js";
 export async function runLeg(input) {
     const { spec, queue, prepared, resume, rs, isDelegatedChild, entryActor, effectiveTimeoutMs, timeout, pushContent, ident, emitCommitted, writeFamilyOf, startedToolCallIds, announceWorkspaceMove, withBrainSinks, flushGitMirror, loopLatch, notificationLane, unsubscribeTaskNotifications, unsubGitRetry, unsubBoundary, unsub, runner, next } = input;
     let final;
@@ -645,7 +646,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs),
         }, prepared.abortController.signal));
         if (narrowed.action === "deny") {
-            const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`, prepared.reminderMark);
+            const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by ${ruleSourcePhrase("narrowing")} and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`, prepared.reminderMark);
             await settleEnd(true, { content: narrowedDenial }, vetoed("policy"));
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, narrowedDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);

package/dist/core/runner/session-rule-policy.d.ts

@@ -1,7 +1,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ToolEffect } from "../types.js";
 import { type NamedToolPolicy } from "../tool-policy.js";
-import type { SessionPermissionRules } from "../session-policy-store.js";
+import type { SessionPermissionRules, SessionPolicyStore, StoredSessionRules } from "../session-policy-store.js";
 /** Tool names whose write target is the `file_path`/`path` arg ({@link fileArgPath}).
  *
  *  REF-B3 — the ONE definition of that narrower set. Production consumer today:
@@ -48,6 +48,74 @@ export declare const PATH_CONFINABLE_WRITE_TOOLS: ReadonlySet<string>;
  *  separate functions on purpose — that one is private to the fence and keyed on canonical roots — but
  *  they must never disagree on a verdict; the empty-root arm below is that alignment. */
 export declare function isWithin(root: string, p: string): boolean;
+/**
+ * Where a session-rule layer takes the rules it enforces.
+ *
+ * @contract session_rules.every_gate_re_reads — a session-rule layer re-reads its rule source at EVERY
+ * tool gate, not once at prepare: an operator's mid-run write (a new deny, a narrowed allowlist) binds the
+ * very next call of the SAME run, on the same beat as the permission-rule store's per-call read. `seed` is
+ * the prepare-time snapshot and stays the FLOOR — a read that fails, a row that was deleted, or a lagging
+ * replica whose `rev` is below the snapshot's enforces the seed rather than loosening toward it — and it is
+ * also what the prepare-time policy-name audit sees, so a rule written after prepare is enforced but not
+ * audited. A source with no `read` is a constant one: the seed at every gate, which is what a caller that
+ * hands a plain rules object gets.
+ */
+export interface SessionRuleSource {
+    /** The prepare-time snapshot: the audit's view, and the floor no live read may loosen. */
+    seed: SessionPermissionRules;
+    /** The per-call read, keyed on the call being adjudicated, and bounded by the gate's own signal. Absent
+     *  ⇒ the seed is the whole source. */
+    read?: (toolCallId: string, signal?: AbortSignal) => Promise<SessionPermissionRules>;
+}
+/**
+ * The LIVE half of {@link SessionRuleSource}: re-read `(sessionId, principal)` from the store on each
+ * adjudicated call, floored by `seed`.
+ *
+ * ONE law, two consumers (this task's own session rules and each inherited ancestor's), where the policy
+ * chain used to carry a hand-written live-preferring read for ancestors only and a frozen snapshot for the
+ * task's own rules. Direction, unchanged from that read and stated once here: a whole-row replacement
+ * includes RELAXATION — an operator's authorized post-prepare rule change propagates in BOTH directions;
+ * what the floor forbids is an UNAUTHORIZED loosening (a lagging replica, a deleted row, an unreachable
+ * store), and nothing task-side can edit the rules row itself.
+ *
+ * The floor RATCHETS to the highest-rev row this layer has actually served, and a live row replaces it only
+ * on a STRICTLY GREATER `rev`. Two reasons, and the second is why "greater or equal" is not good enough:
+ *  · pinning the floor to the prepare snapshot would make "a failed read never loosens" false in the one
+ *    sequence that matters — a row tightened mid-run, enforced at one gate, then unreadable at the next
+ *    would fall back PAST the tightening to the snapshot the run started with;
+ *  · `rev` is per-ROW, and both bundled backends compute it as `(prior?.rev ?? 0) + 1`, so a row that is
+ *    DELETED and written again starts over at 1. At `>=`, a recreated row whose rev merely TIES the
+ *    enforced one would replace it — an unauthorized loosening dressed as an update. At `>`, a tie enforces
+ *    the floor, which is a no-op for the honest case (equal rev is the same row) and fail-closed for the
+ *    recycled one. It raises the cost of the recycle rather than closing it: the rev can still be climbed
+ *    past the floor by repeated writes, because the tighten gate has no prior row to compare against after
+ *    a delete. Closing it belongs to the STORE's rev lifecycle (a counter that survives deletion, or a
+ *    generation identity), which is a cross-backend contract change, not a reader-side one.
+ *
+ * The per-call handoff mirrors the permission-rule lanes': the first reader of a `toolCallId` takes the read
+ * and hands it on, a second reader of the SAME call claims that one snapshot, and an unclaimed entry is
+ * evicted first-in-first-out past a bound. It is a cost device, never a semantic one — a reader that cannot
+ * claim simply reads again. Its firing path here is the fold itself: `policyLayers` re-appends the narrowing
+ * layers AFTER a rewrite-capable caller layer, so one adjudication asks this layer twice under one id, and
+ * the leading (original args) and trailing (rewritten args) passes must judge ONE set of rules.
+ *
+ * Two bounds keep a handed entry from ever being a STALE one, because `toolCallId` is not always unique —
+ * the turn-boundary read-visibility query reuses one synthetic id for every path it screens and for every
+ * turn of the run. The entry is taken ONCE, and a claimed snapshot is served only while its `rev` still
+ * stands at the enforced floor; a claim from a later adjudication, whose floor has moved on, falls through
+ * to a fresh read. A real tool call's id is minted per call and never repeats.
+ */
+export declare function createLiveSessionRules(store: SessionPolicyStore, floor: {
+    sessionId: string;
+    principal?: string;
+    seed: StoredSessionRules;
+}, hooks?: {
+    /** A rule source this layer could not read, once per distinct reason. */
+    onUnreadable?: (reason: string) => void;
+    /** The store row this layer now enforces, each time the floor ADVANCES. Never called for the synthetic
+     *  empty seed: it reports rows the store actually served, which is what a child may inherit. */
+    onEnforced?: (row: StoredSessionRules) => void;
+}): (toolCallId: string, signal?: AbortSignal) => Promise<SessionPermissionRules>;
 /**
  * Build the per-session deny-narrowing policy. For each tool call:
  *  - `toolDeny` → deny the listed tools.
@@ -63,8 +131,12 @@ export declare function isWithin(root: string, p: string): boolean;
  * matching sees the actual filesystem (a remote/E2B task resolves in its container). A relative
  * TARGET prefers the call's live tracked cwd ({@link ToolCallRequest.cwd}) when the engine stamps one;
  * `allowDirs` entries always resolve against `rootPath`.
+ *
+ * The rules are taken from a {@link SessionRuleSource} at EVERY call
+ * ({@link SessionRuleSource} carries the law); a plain rules object is the constant source, which is what
+ * every caller outside the policy chain hands, and what a layer whose rules cannot change under it needs.
  */
-export declare function createSessionRulePolicy(rules: SessionPermissionRules, opts: {
+export declare function createSessionRulePolicy(rules: SessionPermissionRules | SessionRuleSource, opts: {
     env: ExecutionEnv;
     rootPath?: string;
     toolEffects?: ReadonlyMap<string, ToolEffect>;

package/dist/core/runner/session-rule-policy.js

@@ -1,5 +1,8 @@
 import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from "../../tools/fs/safety.js";
 import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
+import { thrownText } from "../thrown-value.js";
+import { ruleDenialSentence } from "../rule-denial-sentence.js";
+import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames, skillScopeWriteToolNames } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
 export const PATH_WRITE_TOOLS = skillScopeWriteToolNames();
@@ -20,32 +23,121 @@ export function isWithin(root, p) {
     const base = r.endsWith("/") ? r : r + "/";
     return c.startsWith(base);
 }
-const deny = (message) => ({ action: "deny", message, decisionReason: "rule" });
+const deny = (tool, detail) => ({
+    action: "deny",
+    message: ruleDenialSentence({ source: "session", tool, ...(detail !== undefined ? { detail } : {}) }),
+    decisionReason: "rule",
+});
+const HANDOFF_BOUND = 256;
+const ANNOUNCED_REASONS_BOUND = 8;
+export function createLiveSessionRules(store, floor, hooks) {
+    const announced = new Set();
+    const announce = (reason) => {
+        if (announced.has(reason) || announced.size >= ANNOUNCED_REASONS_BOUND)
+            return;
+        announced.add(reason);
+        hooks?.onUnreadable?.(reason);
+    };
+    let enforced = floor.seed;
+    let servedRow = false;
+    let vanished = false;
+    const read = async (signal) => {
+        let live;
+        try {
+            live = await withGateTimeout(store.getRules(floor.sessionId, floor.principal), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "sessionRulesRead");
+        }
+        catch (err) {
+            const wait = gateWaitFailureOf(err);
+            announce(wait !== undefined
+                ? `the session-policy store read for session ${JSON.stringify(floor.sessionId)} ended without an answer (${wait})`
+                : `the session-policy store threw while re-reading session ${JSON.stringify(floor.sessionId)}: ${thrownText(err)}`);
+            return enforced;
+        }
+        if (live === null) {
+            if (servedRow && !vanished) {
+                vanished = true;
+                announce(`the rules row of session ${JSON.stringify(floor.sessionId)} was deleted while this leg enforced it`);
+            }
+            return enforced;
+        }
+        if (vanished) {
+            announce(`session ${JSON.stringify(floor.sessionId)} has a new rules row at rev ${live.rev}, which does not continue the deleted row this leg enforces`);
+            return enforced;
+        }
+        if (live.rev <= enforced.rev) {
+            if (live.rev < enforced.rev) {
+                announce(`the session-policy store served session ${JSON.stringify(floor.sessionId)} at rev ${live.rev}, below the enforced rev ${enforced.rev}`);
+            }
+            return enforced;
+        }
+        enforced = live;
+        servedRow = true;
+        hooks?.onEnforced?.(live);
+        return live;
+    };
+    const handed = new Map();
+    return async (toolCallId, signal) => {
+        const handedRead = handed.get(toolCallId);
+        if (handedRead !== undefined) {
+            handed.delete(toolCallId);
+            const claimed = await handedRead;
+            if (claimed.rev >= enforced.rev)
+                return claimed;
+        }
+        const p = read(signal);
+        handed.set(toolCallId, p);
+        if (handed.size > HANDOFF_BOUND) {
+            const oldest = handed.keys().next().value;
+            if (oldest !== undefined)
+                handed.delete(oldest);
+        }
+        return p;
+    };
+}
+function compileSessionRules(rules) {
+    return {
+        toolDeny: new Set(rules.toolDeny ?? []),
+        toolAllow: rules.toolAllow ? new Set(rules.toolAllow) : undefined,
+        toolDenyCovering: namespacedCoveringEntries(rules.toolDeny),
+        toolAllowCovering: namespacedCoveringEntries(rules.toolAllow),
+        cmdPolicy: rules.commandAllow || rules.commandDeny
+            ? createCoarseCommandNamePolicy({
+                ...(rules.commandAllow ? { allow: rules.commandAllow } : {}),
+                ...(rules.commandDeny ? { deny: rules.commandDeny } : {}),
+                defaultAction: "deny",
+            })
+            : undefined,
+        allowDirs: rules.allowDirs && rules.allowDirs.length > 0 ? rules.allowDirs : undefined,
+    };
+}
 export function createSessionRulePolicy(rules, opts) {
     const { env, rootPath, toolEffects } = opts;
-    const toolDeny = new Set(rules.toolDeny ?? []);
-    const toolAllow = rules.toolAllow ? new Set(rules.toolAllow) : undefined;
-    const toolDenyCovering = namespacedCoveringEntries(rules.toolDeny);
-    const toolAllowCovering = namespacedCoveringEntries(rules.toolAllow);
-    const cmdPolicy = rules.commandAllow || rules.commandDeny
-        ? createCoarseCommandNamePolicy({
-            ...(rules.commandAllow ? { allow: rules.commandAllow } : {}),
-            ...(rules.commandDeny ? { deny: rules.commandDeny } : {}),
-            defaultAction: "deny",
-        })
-        : undefined;
-    const allowDirs = rules.allowDirs && rules.allowDirs.length > 0 ? rules.allowDirs : undefined;
+    const source = "seed" in rules ? rules : { seed: rules };
+    const seed = source.seed;
+    const readRules = source.read ?? (() => Promise.resolve(seed));
+    let compiledFor;
+    let compiled;
+    const compile = (r) => {
+        if (compiled === undefined || compiledFor !== r) {
+            compiled = compileSessionRules(r);
+            compiledFor = r;
+        }
+        return compiled;
+    };
     return {
-        nameSets: [{ ...(rules.toolDeny?.length ? { deny: [...rules.toolDeny] } : {}), ...(rules.toolAllow?.length ? { allow: [...rules.toolAllow] } : {}) }],
+        nameSets: [{ ...(seed.toolDeny?.length ? { deny: [...seed.toolDeny] } : {}), ...(seed.toolAllow?.length ? { allow: [...seed.toolAllow] } : {}) }],
         async check(req, signal) {
+            const { toolDeny, toolAllow, toolDenyCovering, toolAllowCovering, cmdPolicy, allowDirs } = compile(await readRules(req.toolCallId, signal));
             const toolName = req.toolName;
             if (toolDeny.has(toolName) || namespacedCoveringHit(toolDenyCovering, toolName))
-                return deny(`tool "${req.toolName}" is denied by a session rule`);
+                return deny(req.toolName);
             if (toolAllow && !toolAllow.has(toolName) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
-                return deny(`tool "${req.toolName}" is not in the session-rule allowlist`);
+                return deny(req.toolName, "it is not in the session-rule allowlist");
             }
             if (cmdPolicy) {
                 const d = await cmdPolicy.check(req, signal);
+                if (d.action === "deny")
+                    return { ...d, message: ruleDenialSentence({ source: "session", tool: req.toolName, ...(d.message !== undefined ? { detail: d.message } : {}) }) };
                 if (d.action !== "allow")
                     return d;
             }
@@ -53,21 +145,21 @@ export function createSessionRulePolicy(rules, opts) {
                 if (!isProtectedWrite(req)) {
                     const eff = toolEffects?.get(toolName) ?? "write";
                     if (eff !== "read") {
-                        return deny(`write-capable tool "${req.toolName}" denied: session rule confines writes to allowDirs but this tool cannot be path-confined`);
+                        return deny(req.toolName, "it is write-capable and cannot be path-confined, while the rule confines writes to allowDirs");
                     }
                 }
                 else {
                     const declared = declaredPathTargetOf(req);
                     if (declared === undefined) {
-                        return deny(`write tool "${req.toolName}" denied: session rule confines writes to allowDirs but the tool declares no path target to confine`);
+                        return deny(req.toolName, "it declares no path target to confine, while the rule confines writes to allowDirs");
                     }
                     const path = writeTargetPath(req, declared);
                     if (typeof path !== "string" || path.length === 0) {
-                        return deny(`write tool "${req.toolName}" denied: session rule confines writes to allowDirs but the call has no resolvable path`);
+                        return deny(req.toolName, "the call has no resolvable path to confine, while the rule confines writes to allowDirs");
                     }
                     const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootPath, cwd: req.cwd ?? env.cwd }), pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
                     if (!canon.ok) {
-                        return deny(`write to "${path}" denied: its real target could not be resolved against the session-rule allowDirs`);
+                        return deny(req.toolName, `the real target of the write to ${JSON.stringify(path)} could not be resolved against the session-rule allowDirs`);
                     }
                     const roots = [];
                     for (const raw of allowDirs) {
@@ -76,7 +168,7 @@ export function createSessionRulePolicy(rules, opts) {
                             roots.push(r.key);
                     }
                     if (!roots.some((root) => isWithin(root, canon.key))) {
-                        return deny(`write to "${path}" is outside the session-rule allowDirs (${allowDirs.join(", ")})`);
+                        return deny(req.toolName, `the write to ${JSON.stringify(path)} is outside the session-rule allowDirs (${allowDirs.join(", ")})`);
                     }
                 }
             }

package/dist/orchestration/workflow.js

@@ -714,7 +714,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         if (!bceSink)
             return;
         const id = waIdOf(callKey);
-        bceLive.set(id, { callKey, label, ...(agentType !== undefined ? { agentType } : {}), ...(sessionId !== undefined ? { sessionId } : {}), ...(model !== undefined ? { model } : {}) });
+        bceLive.set(id, { callKey, label, ...(agentType !== undefined ? { agentType } : {}), ...(sessionId !== undefined ? { sessionId } : {}), ...(model !== undefined ? { model } : {}), generation: 1 });
         bceEmit({
             kind: "spawn",
             taskId: id,
@@ -732,6 +732,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             ...(opts.originatingSessionId !== undefined ? { parentSessionId: opts.originatingSessionId } : {}),
             ...((opts.rootSessionId ?? opts.originatingSessionId) !== undefined ? { rootSessionId: opts.rootSessionId ?? opts.originatingSessionId } : {}),
             startedAt: Date.now(),
+            seq: 1,
         });
     };
     const bceBindSession = (callKey, sessionId) => {
@@ -739,6 +740,11 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         if (row !== undefined)
             row.sessionId = sessionId;
     };
+    const bceGeneration = (callKey, generation) => {
+        const row = bceLive.get(waIdOf(callKey));
+        if (row !== undefined)
+            row.generation = generation;
+    };
     const bceTick = (callKey, e, fromSessionId) => {
         if (!bceSink)
             return;
@@ -763,6 +769,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             progressTaskId: e.taskId,
             ...(e.parentTaskId !== undefined ? { progressParentTaskId: e.parentTaskId } : {}),
             ...(e.currentAction !== undefined ? { currentAction: e.currentAction } : {}),
+            seq: row.generation,
             usage: e.usage,
         });
     };
@@ -771,9 +778,9 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             return;
         const id = waIdOf(callKey);
         const row = bceLive.get(id);
-        if (!bceLive.delete(id))
+        if (row === undefined || !bceLive.delete(id))
             return;
-        const coord = sessionId ?? row?.sessionId;
+        const coord = sessionId ?? row.sessionId;
         bceEmit({
             kind: "terminal",
             taskId: id,
@@ -784,6 +791,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             ...(scope !== undefined ? { scope } : {}),
             ...(coord !== undefined ? { sessionId: coord, transcriptId: coord } : {}),
             status,
+            seq: row.generation,
             summary: boundedRedactedSummary(summary, 300),
             ...(stats !== undefined ? { usage: { tokens: stats.tokens, turns: stats.turns, ...(stats.costMicroUsd !== undefined ? { costMicroUsd: stats.costMicroUsd } : {}) } } : {}),
         });
@@ -1575,6 +1583,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 let approvalWaivedAttempts = 0;
                 for (;;) {
                     attempts += 1;
+                    bceGeneration(callKey, attempts);
                     const attemptStart = now();
                     const attemptCtl = new AbortController();
                     let stallFired = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.24.3",
+  "version": "7.24.4",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.24.4.json

@@ -0,0 +1,54 @@
+{
+  "repo": "core",
+  "version": "7.24.4",
+  "from": "583db3a8918e747e8dab1c5e2f457cf79171bd3f",
+  "to": "v7.24.4",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#978, P2, permissions): every rule source is re-read at every tool gate — a session-policy rule (`PUT /v1/sessions/:id/policy` on server; `sessionPolicyStore` in core) written after a run's first turn denies the matching call in the SAME run; and every rule denial is one minted sentence naming its source."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.isError",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "BackgroundChildEvent.seq",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SessionPermissionRules.toolDeny",
+      "assertions": [
+        "G1.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "NOT SCANNED: sema-cli, sema-server, sema-sdk — an empty list for those repos means \"not checked out\", not \"no consumer\""
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "5cbec5a04d5cd905a121a02e21c3c71087a7b4fe"
+}