@sema-agent/core 7.24.3 → 7.25.0

package/dist/core/runner/prepare-wiring-manifest.js

@@ -115,7 +115,7 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive } = input;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, sessionBox, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, lspDiagnosticsLive } = input;
     const onAsk = spec.onAsk ?? deps.onAsk;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
     const hasEffectAwareGate = Boolean(policyLayers.length > 0 || (hooks?.preToolUse !== undefined && !preToolUseObservational));
@@ -193,7 +193,7 @@ export function prepareWiringManifest(input) {
         parkCapable: checkpointStore !== undefined,
         parkDurableApprovalOptIn: spec.durableApproval !== undefined,
         parkForceDurableGate: runtimeCaps?.forceDurableGate === true,
-        parkSafetyVocabularyArmed: irreversibleTools.size > 0 || egressTools.size > 0,
+        parkSafetyVocabularyArmed: irreversibleTools.size > 0 || egressTools.size > 0 || shellReadStationArmed,
         ...(checkpointStore !== undefined ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
         sessionDurability: resolveDeclaredDurability(sessions, "sessionStore"),
         backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
@@ -217,7 +217,8 @@ export function prepareWiringManifest(input) {
         ...(lspManagerWired ? { lsp: deriveLspSeam(toolRoster.entries.some((e) => e.contract.contractId === LSP_CONTRACT_ID), lspDiagnosticsLive) } : {}),
     });
     peerLaneRefs.askEffective = wiringManifest.ask.effective;
-    if (peerLaneActive && internals?.onTaskNotification !== undefined) {
+    const sessionBoxBound = sessionBox !== undefined && internals?.onTaskNotification !== undefined ? sessionBox : undefined;
+    if (sessionBoxBound !== undefined && internals?.onTaskNotification !== undefined) {
         bindPeerLaneDrain(harness, {
             deps,
             sessionId,
@@ -235,6 +236,7 @@ export function prepareWiringManifest(input) {
         hooks?.preToolUse !== undefined ||
         egressTools.size > 0 ||
         irreversibleTools.size > 0 ||
+        shellReadStationArmed ||
         resourceSuspendEligible ||
         platformSuspendArmed ||
         spec.enablePlanMode === true;
@@ -246,9 +248,11 @@ export function prepareWiringManifest(input) {
         isDelegatedChild: delegation.isDelegatedChild,
         ...(internals?.insideFork === true ? { insideFork: true } : {}),
         ...(internals?.agentName !== undefined ? { agentName: internals.agentName } : {}),
+        ...(internals?.explicitAgentName !== undefined ? { spawnName: internals.explicitAgentName } : {}),
+        ...(internals?.spawnAgentType !== undefined ? { agentType: internals.spawnAgentType } : {}),
         ...(internals?.parentToolCallId !== undefined ? { parentToolCallId: internals.parentToolCallId } : {}),
     });
     const hookContextConsumerWired = hooks?.preToolUse !== undefined || hooks?.postToolUse !== undefined || hooks?.postToolUseFailure !== undefined;
     const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
-    return { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, platformSuspendArmed, durableApproval, wiringManifest, writeProtectionCheck: writeProtection?.check, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace };
+    return { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, platformSuspendArmed, durableApproval, wiringManifest, writeProtectionCheck: writeProtection?.check, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound };
 }

package/dist/core/runner/resume-apply.js

@@ -26,6 +26,8 @@ export async function resumeApply(input) {
                 isDelegatedChild: effectiveDelegationFacts(internals, cp.state.isDelegatedChild).isDelegatedChild,
                 ...(internals?.insideFork === true ? { insideFork: true } : {}),
                 ...(internals?.agentName !== undefined ? { agentName: internals.agentName } : {}),
+                ...(internals?.explicitAgentName !== undefined ? { spawnName: internals.explicitAgentName } : {}),
+                ...(internals?.spawnAgentType !== undefined ? { agentType: internals.spawnAgentType } : {}),
                 ...(internals?.parentToolCallId !== undefined ? { parentToolCallId: internals.parentToolCallId } : {}),
             });
             const screenTimeoutMs = resolveHookTimeoutMs(resumeScreenHooks?.timeoutMs, (badErr) => {

package/dist/core/runner/run-harness-handlers.js

@@ -309,6 +309,7 @@ export function createHarnessHandlers(input) {
                 ...(internals?.cycleSeq !== undefined ? { seq: internals.cycleSeq } : {}),
                 ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
                 ...(subagentName ? { name: subagentName } : {}),
+                ...(internals?.explicitAgentName !== undefined ? { spawnName: internals.explicitAgentName } : {}),
                 model: prepared.model.id,
                 usage: { totalTokens: stats.tokens, toolUses: stats.toolCalls, durationMs: Date.now() - rs.telemetry.taskStart },
                 status: "running",

package/dist/core/runner/run-identity-wiring.d.ts

@@ -1,5 +1,5 @@
 import type { PeerInboundChainRef } from "../../agents/peer-admission.js";
-import { type PendingSessionNotifications, type SystemInjectionPriority, type TaskNotificationPayload } from "../task-notification.js";
+import { type NotificationInjectionOutcome, type PendingSessionNotifications, type SystemInjectionPriority, type TaskNotificationPayload } from "../task-notification.js";
 import type { PushQueue } from "../push-queue.js";
 import type { TaskEvent, TaskSpec } from "../types.js";
 import type { Stats } from "./assemble-result.js";
@@ -32,7 +32,7 @@ export interface RunIdentityWiringInput {
     /** borrowed-readonly — the notification lane's ONE injection entry (the R0 lane's). */
     injectTaskNotification: (notification: TaskNotificationPayload, opts?: {
         priority?: SystemInjectionPriority;
-    }) => Promise<"queued" | "parked" | "dropped_duplicate">;
+    }) => Promise<NotificationInjectionOutcome>;
     /** borrowed-mutable — the turn-open dedup set (the cross-layer double-park dedup): a redelivered frame's key is registered here. */
     deliveredAtTurnOpen: Set<string>;
     /** borrowed-mutable — the peer inbound chain, overwritten by each consumed peer-class payload. */

package/dist/core/runner/run-leg.js

@@ -19,6 +19,7 @@ import { DEFAULT_PRECALL_OUTPUT_TOKENS, platformLimitTerminal } from "./clock-an
 import { deepJsonEqual, resumeContinuation } from "./decide-continuation.js";
 import { settleExecutionRecord } from "./execution-record.js";
 import { mintGateOutcome } from "./gate-exit.js";
+import { withGateTimeout } from "../gate-bounded-await.js";
 import { resolveGitLegDelivery, wrapGitFrame } from "./git-leg-delivery.js";
 import { GIT_STATUS_ECHO_PREVIEW } from "./git-status-frame.js";
 import { toImageContent } from "./image.js";
@@ -30,6 +31,7 @@ import { announceListingTruncation } from "../skill-listing-budget.js";
 import { attachmentEnvelopeTags, commitAgentListing, commitSkillsListing, reduceToolEnd, renderAgentListingFrame, renderOrphanedBackgroundTasks, renderSkillsListingFrame, stampWriteAnchor } from "./turn-attachments.js";
 import { flushOwedAnnouncedSnapshot } from "./announce-once-ledger.js";
 import { asThrownError, thrownMarksOf, thrownText } from "../thrown-value.js";
+import { ruleSourcePhrase } from "../rule-denial-sentence.js";
 export async function runLeg(input) {
     const { spec, queue, prepared, resume, rs, isDelegatedChild, entryActor, effectiveTimeoutMs, timeout, pushContent, ident, emitCommitted, writeFamilyOf, startedToolCallIds, announceWorkspaceMove, withBrainSinks, flushGitMirror, loopLatch, notificationLane, unsubscribeTaskNotifications, unsubGitRetry, unsubBoundary, unsub, runner, next } = input;
     let final;
@@ -645,7 +647,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs),
         }, prepared.abortController.signal));
         if (narrowed.action === "deny") {
-            const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`, prepared.reminderMark);
+            const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by ${ruleSourcePhrase("narrowing")} and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`, prepared.reminderMark);
             await settleEnd(true, { content: narrowedDenial }, vetoed("policy"));
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, narrowedDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
@@ -677,6 +679,31 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             return;
         }
     }
+    if (prepared.shellReadCheck !== undefined) {
+        const edited = outcome.updatedInput !== undefined && !deepJsonEqual(outcome.updatedInput, pendingAction.args);
+        const judged = prepared.shellReadCheck.judge(pendingAction.toolName, resolvedArgs, prepared.cwdRef?.current, prepared.abortController.signal, {
+            toolCallId: pendingAction.toolCallId,
+            ...(edited ? { seat: "rejudge" } : {}),
+        });
+        if (judged !== null) {
+            let verdict;
+            let answered = true;
+            try {
+                verdict = await withGateTimeout(judged, ORG_ADJUDICATION_TIMEOUT_MS, prepared.abortController.signal, "shellReadStation");
+            }
+            catch {
+                answered = false;
+                verdict = prepared.shellReadCheck.unanswered(pendingAction.toolName, "the read station could not answer on the resumed leg");
+            }
+            if (!answered || verdict.disposition === "refuse" || (edited && verdict.disposition !== "vouch")) {
+                const readDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${verdict.sentence ?? "the read boundary does not vouch for what it reads on this leg"} This approval is spent — the call has to be re-issued and approved again.`, prepared.reminderMark);
+                await settleEnd(true, { content: readDenial, ...(verdict.details !== undefined ? { details: verdict.details } : {}) }, vetoed("read_boundary"));
+                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, readDenial, true));
+                emitCommitted(eid, "toolResult", pendingAction.toolCallId);
+                return;
+            }
+        }
+    }
     const tool = prepared.tools.find((t) => t.name === pendingAction.toolName);
     if (!tool) {
         const e = new Error(`the approved tool "${pendingAction.toolName}" is no longer available on resume`);

package/dist/core/runner/run-notification-lane.d.ts

@@ -1,7 +1,7 @@
 import { type PeerInboundChainRef } from "../../agents/peer-admission.js";
 import type { PushQueue } from "../push-queue.js";
 import type { SessionStore } from "../session.js";
-import { type PendingSessionNotifications, type SystemInjectionPriority, type TaskNotificationPayload } from "../task-notification.js";
+import { type NotificationInjectionOutcome, type PendingSessionNotifications, type SystemInjectionPriority, type TaskNotificationPayload } from "../task-notification.js";
 import type { RunnerDeps, TaskEvent, TaskSpec } from "../types.js";
 import type { SessionReadFileStates } from "./prepare-hands-readface.js";
 import type { NotificationLaneBindings, Prepared, PrepareTaskFn, ResumeRun, RunInternals, RunnerDepsSeat, RunnerSelfSeat, TaskIdRef } from "./contracts.js";
@@ -41,7 +41,7 @@ export interface RunNotificationLaneResult {
     /** The ONE injection entry every notification producer rides (the identity lane binds the notify() bridge to it). */
     injectTaskNotification: (notification: TaskNotificationPayload, opts?: {
         priority?: SystemInjectionPriority;
-    }) => Promise<"queued" | "parked" | "dropped_duplicate">;
+    }) => Promise<NotificationInjectionOutcome>;
     /** The turn-open dedup set (the cross-layer double-park dedup): the identity lane registers a redelivered frame's key here. */
     deliveredAtTurnOpen: Set<string>;
     /** The peer inbound chain ref this run carries (the spawn chain's, or a fresh one). */

package/dist/core/runner/run-notification-lane.js

@@ -118,9 +118,10 @@ export async function runNotificationLane(input) {
             }
             catch {
             }
-            injectTaskNotification(notification, opts);
+            return injectTaskNotification(notification, opts);
         },
     }, self, taskIdRef);
+    pendingSessionNotifications.bindSessionBox(prepared.sessionId, prepared.sessionBox);
     const notificationLane = {
         get harness() { return notificationHarness; }, set harness(h) { notificationHarness = h; },
         get sessionId() { return notificationSessionId; },

package/dist/core/runner/run-settle-and-teardown.js

@@ -266,6 +266,7 @@ export async function runSettleAndTeardown(input) {
                 ...(internals?.cycleSeq !== undefined ? { seq: internals.cycleSeq } : {}),
                 ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
                 ...(subagentName ? { name: subagentName } : {}),
+                ...(internals?.explicitAgentName !== undefined ? { spawnName: internals.explicitAgentName } : {}),
                 model: prepared.model.id,
                 usage: { totalTokens: stats.tokens, toolUses: stats.toolCalls, durationMs: Date.now() - rs.telemetry.taskStart },
                 status: result.terminal.kind === "completed" ? "completed" : "failed",

package/dist/core/runner/session-rule-policy.d.ts

@@ -1,7 +1,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ToolEffect } from "../types.js";
 import { type NamedToolPolicy } from "../tool-policy.js";
-import type { SessionPermissionRules } from "../session-policy-store.js";
+import type { SessionPermissionRules, SessionPolicyStore, StoredSessionRules } from "../session-policy-store.js";
 /** Tool names whose write target is the `file_path`/`path` arg ({@link fileArgPath}).
  *
  *  REF-B3 — the ONE definition of that narrower set. Production consumer today:
@@ -48,6 +48,73 @@ export declare const PATH_CONFINABLE_WRITE_TOOLS: ReadonlySet<string>;
  *  separate functions on purpose — that one is private to the fence and keyed on canonical roots — but
  *  they must never disagree on a verdict; the empty-root arm below is that alignment. */
 export declare function isWithin(root: string, p: string): boolean;
+/**
+ * Where a session-rule layer takes the rules it enforces.
+ *
+ * @contract session_rules.every_gate_re_reads — a session-rule layer re-reads its rule source at EVERY
+ * tool gate, not once at prepare: an operator's mid-run write (a new deny, a narrowed allowlist) binds the
+ * very next call of the SAME run, on the same beat as the permission-rule store's per-call read. `seed` is
+ * the prepare-time snapshot and stays the FLOOR — a read that fails, a row that was deleted, or a lagging
+ * replica whose `rev` is below the snapshot's enforces the seed rather than loosening toward it — and it is
+ * also what the prepare-time policy-name audit sees, so a rule written after prepare is enforced but not
+ * audited. A source with no `read` is a constant one: the seed at every gate, which is what a caller that
+ * hands a plain rules object gets.
+ */
+export interface SessionRuleSource {
+    /** The prepare-time snapshot: the audit's view, and the floor no live read may loosen. */
+    seed: SessionPermissionRules;
+    /** The per-call read, keyed on the call being adjudicated, and bounded by the gate's own signal. Absent
+     *  ⇒ the seed is the whole source. */
+    read?: (toolCallId: string, signal?: AbortSignal) => Promise<SessionPermissionRules>;
+}
+/**
+ * The LIVE half of {@link SessionRuleSource}: re-read `(sessionId, principal)` from the store on each
+ * adjudicated call, floored by `seed`.
+ *
+ * ONE law, two consumers (this task's own session rules and each inherited ancestor's), where the policy
+ * chain used to carry a hand-written live-preferring read for ancestors only and a frozen snapshot for the
+ * task's own rules. Direction, unchanged from that read and stated once here: a whole-row replacement
+ * includes RELAXATION — an operator's authorized post-prepare rule change propagates in BOTH directions;
+ * what the floor forbids is an UNAUTHORIZED loosening (a lagging replica, a deleted row, an unreachable
+ * store), and nothing task-side can edit the rules row itself.
+ *
+ * The floor RATCHETS to the highest-rev row this layer has actually served, and a live row replaces it only
+ * on a STRICTLY GREATER `rev`. Two reasons, and the second is why "greater or equal" is not good enough:
+ *  · pinning the floor to the prepare snapshot would make "a failed read never loosens" false in the one
+ *    sequence that matters — a row tightened mid-run, enforced at one gate, then unreadable at the next
+ *    would fall back PAST the tightening to the snapshot the run started with;
+ *  · `rev` is per-ROW, and both bundled backends compute it as `(prior?.rev ?? 0) + 1`, so a row that is
+ *    DELETED and written again starts over at 1. At `>=`, a recreated row whose rev merely TIES the
+ *    enforced one would replace it — an unauthorized loosening dressed as an update. At `>`, a tie enforces
+ *    the floor, which is a no-op for the honest case (equal rev is the same row) and fail-closed for the
+ *    recycled one. Closed since 7.25.0 by the STORE's lineage identity (`StoredSessionRules.gen`): a
+ *    recreated row is another generation and is never compared to the enforced one, whatever its rev, and
+ *    a backend without lineages (gen 0 throughout) keeps the `>` protection above.
+ *
+ * The per-call handoff mirrors the permission-rule lanes': the first reader of a `toolCallId` takes the read
+ * and hands it on, a second reader of the SAME call claims that one snapshot, and an unclaimed entry is
+ * evicted first-in-first-out past a bound. It is a cost device, never a semantic one — a reader that cannot
+ * claim simply reads again. Its firing path here is the fold itself: `policyLayers` re-appends the narrowing
+ * layers AFTER a rewrite-capable caller layer, so one adjudication asks this layer twice under one id, and
+ * the leading (original args) and trailing (rewritten args) passes must judge ONE set of rules.
+ *
+ * Two bounds keep a handed entry from ever being a STALE one, because `toolCallId` is not always unique —
+ * the turn-boundary read-visibility query reuses one synthetic id for every path it screens and for every
+ * turn of the run. The entry is taken ONCE, and a claimed snapshot is served only while its `rev` still
+ * stands at the enforced floor; a claim from a later adjudication, whose floor has moved on, falls through
+ * to a fresh read. A real tool call's id is minted per call and never repeats.
+ */
+export declare function createLiveSessionRules(store: SessionPolicyStore, floor: {
+    sessionId: string;
+    principal?: string;
+    seed: StoredSessionRules;
+}, hooks?: {
+    /** A rule source this layer could not read, once per distinct reason. */
+    onUnreadable?: (reason: string) => void;
+    /** The store row this layer now enforces, each time the floor ADVANCES. Never called for the synthetic
+     *  empty seed: it reports rows the store actually served, which is what a child may inherit. */
+    onEnforced?: (row: StoredSessionRules) => void;
+}): (toolCallId: string, signal?: AbortSignal) => Promise<SessionPermissionRules>;
 /**
  * Build the per-session deny-narrowing policy. For each tool call:
  *  - `toolDeny` → deny the listed tools.
@@ -63,8 +130,12 @@ export declare function isWithin(root: string, p: string): boolean;
  * matching sees the actual filesystem (a remote/E2B task resolves in its container). A relative
  * TARGET prefers the call's live tracked cwd ({@link ToolCallRequest.cwd}) when the engine stamps one;
  * `allowDirs` entries always resolve against `rootPath`.
+ *
+ * The rules are taken from a {@link SessionRuleSource} at EVERY call
+ * ({@link SessionRuleSource} carries the law); a plain rules object is the constant source, which is what
+ * every caller outside the policy chain hands, and what a layer whose rules cannot change under it needs.
  */
-export declare function createSessionRulePolicy(rules: SessionPermissionRules, opts: {
+export declare function createSessionRulePolicy(rules: SessionPermissionRules | SessionRuleSource, opts: {
     env: ExecutionEnv;
     rootPath?: string;
     toolEffects?: ReadonlyMap<string, ToolEffect>;

package/dist/core/runner/session-rule-policy.js

@@ -1,5 +1,8 @@
 import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from "../../tools/fs/safety.js";
 import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
+import { thrownText } from "../thrown-value.js";
+import { ruleDenialSentence } from "../rule-denial-sentence.js";
+import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames, skillScopeWriteToolNames } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
 export const PATH_WRITE_TOOLS = skillScopeWriteToolNames();
@@ -20,32 +23,129 @@ export function isWithin(root, p) {
     const base = r.endsWith("/") ? r : r + "/";
     return c.startsWith(base);
 }
-const deny = (message) => ({ action: "deny", message, decisionReason: "rule" });
+const deny = (tool, detail) => ({
+    action: "deny",
+    message: ruleDenialSentence({ source: "session", tool, ...(detail !== undefined ? { detail } : {}) }),
+    decisionReason: "rule",
+});
+const HANDOFF_BOUND = 256;
+const ANNOUNCED_REASONS_BOUND = 8;
+export function createLiveSessionRules(store, floor, hooks) {
+    const announced = new Set();
+    const announce = (reason) => {
+        if (announced.has(reason) || announced.size >= ANNOUNCED_REASONS_BOUND)
+            return;
+        announced.add(reason);
+        hooks?.onUnreadable?.(reason);
+    };
+    let enforced = floor.seed;
+    let servedRow = false;
+    let vanished = false;
+    const read = async (signal) => {
+        let live;
+        try {
+            live = await withGateTimeout(store.getRules(floor.sessionId, floor.principal), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "sessionRulesRead");
+        }
+        catch (err) {
+            const wait = gateWaitFailureOf(err);
+            announce(wait !== undefined
+                ? `the session-policy store read for session ${JSON.stringify(floor.sessionId)} ended without an answer (${wait})`
+                : `the session-policy store threw while re-reading session ${JSON.stringify(floor.sessionId)}: ${thrownText(err)}`);
+            return enforced;
+        }
+        if (live === null) {
+            if (servedRow && !vanished) {
+                vanished = true;
+                announce(`the rules row of session ${JSON.stringify(floor.sessionId)} was deleted while this leg enforced it`);
+            }
+            return enforced;
+        }
+        if (enforced.rev > 0) {
+            if (live.gen !== undefined && enforced.gen !== undefined) {
+                if (live.gen !== enforced.gen) {
+                    announce(`session ${JSON.stringify(floor.sessionId)} has a rules row of a new lineage (generation ${live.gen}, rev ${live.rev}), which does not continue the row this leg enforces (generation ${enforced.gen})`);
+                    return enforced;
+                }
+            }
+            else if (vanished) {
+                announce(`session ${JSON.stringify(floor.sessionId)} has a new rules row at rev ${live.rev} after the row this leg enforced was deleted, and its backend carries no lineage to continue it by`);
+                return enforced;
+            }
+        }
+        if (live.rev <= enforced.rev) {
+            if (live.rev < enforced.rev) {
+                announce(`the session-policy store served session ${JSON.stringify(floor.sessionId)} at rev ${live.rev}, below the enforced rev ${enforced.rev}`);
+            }
+            return enforced;
+        }
+        enforced = live;
+        servedRow = true;
+        hooks?.onEnforced?.(live);
+        return live;
+    };
+    const handed = new Map();
+    return async (toolCallId, signal) => {
+        const handedRead = handed.get(toolCallId);
+        if (handedRead !== undefined) {
+            handed.delete(toolCallId);
+            const claimed = await handedRead;
+            if (claimed.rev >= enforced.rev)
+                return claimed;
+        }
+        const p = read(signal);
+        handed.set(toolCallId, p);
+        if (handed.size > HANDOFF_BOUND) {
+            const oldest = handed.keys().next().value;
+            if (oldest !== undefined)
+                handed.delete(oldest);
+        }
+        return p;
+    };
+}
+function compileSessionRules(rules) {
+    return {
+        toolDeny: new Set(rules.toolDeny ?? []),
+        toolAllow: rules.toolAllow ? new Set(rules.toolAllow) : undefined,
+        toolDenyCovering: namespacedCoveringEntries(rules.toolDeny),
+        toolAllowCovering: namespacedCoveringEntries(rules.toolAllow),
+        cmdPolicy: rules.commandAllow || rules.commandDeny
+            ? createCoarseCommandNamePolicy({
+                ...(rules.commandAllow ? { allow: rules.commandAllow } : {}),
+                ...(rules.commandDeny ? { deny: rules.commandDeny } : {}),
+                defaultAction: "deny",
+            })
+            : undefined,
+        allowDirs: rules.allowDirs && rules.allowDirs.length > 0 ? rules.allowDirs : undefined,
+    };
+}
 export function createSessionRulePolicy(rules, opts) {
     const { env, rootPath, toolEffects } = opts;
-    const toolDeny = new Set(rules.toolDeny ?? []);
-    const toolAllow = rules.toolAllow ? new Set(rules.toolAllow) : undefined;
-    const toolDenyCovering = namespacedCoveringEntries(rules.toolDeny);
-    const toolAllowCovering = namespacedCoveringEntries(rules.toolAllow);
-    const cmdPolicy = rules.commandAllow || rules.commandDeny
-        ? createCoarseCommandNamePolicy({
-            ...(rules.commandAllow ? { allow: rules.commandAllow } : {}),
-            ...(rules.commandDeny ? { deny: rules.commandDeny } : {}),
-            defaultAction: "deny",
-        })
-        : undefined;
-    const allowDirs = rules.allowDirs && rules.allowDirs.length > 0 ? rules.allowDirs : undefined;
+    const source = "seed" in rules ? rules : { seed: rules };
+    const seed = source.seed;
+    const readRules = source.read ?? (() => Promise.resolve(seed));
+    let compiledFor;
+    let compiled;
+    const compile = (r) => {
+        if (compiled === undefined || compiledFor !== r) {
+            compiled = compileSessionRules(r);
+            compiledFor = r;
+        }
+        return compiled;
+    };
     return {
-        nameSets: [{ ...(rules.toolDeny?.length ? { deny: [...rules.toolDeny] } : {}), ...(rules.toolAllow?.length ? { allow: [...rules.toolAllow] } : {}) }],
+        nameSets: [{ ...(seed.toolDeny?.length ? { deny: [...seed.toolDeny] } : {}), ...(seed.toolAllow?.length ? { allow: [...seed.toolAllow] } : {}) }],
         async check(req, signal) {
+            const { toolDeny, toolAllow, toolDenyCovering, toolAllowCovering, cmdPolicy, allowDirs } = compile(await readRules(req.toolCallId, signal));
             const toolName = req.toolName;
             if (toolDeny.has(toolName) || namespacedCoveringHit(toolDenyCovering, toolName))
-                return deny(`tool "${req.toolName}" is denied by a session rule`);
+                return deny(req.toolName);
             if (toolAllow && !toolAllow.has(toolName) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
-                return deny(`tool "${req.toolName}" is not in the session-rule allowlist`);
+                return deny(req.toolName, "it is not in the session-rule allowlist");
             }
             if (cmdPolicy) {
                 const d = await cmdPolicy.check(req, signal);
+                if (d.action === "deny")
+                    return { ...d, message: ruleDenialSentence({ source: "session", tool: req.toolName, ...(d.message !== undefined ? { detail: d.message } : {}) }) };
                 if (d.action !== "allow")
                     return d;
             }
@@ -53,21 +153,21 @@ export function createSessionRulePolicy(rules, opts) {
                 if (!isProtectedWrite(req)) {
                     const eff = toolEffects?.get(toolName) ?? "write";
                     if (eff !== "read") {
-                        return deny(`write-capable tool "${req.toolName}" denied: session rule confines writes to allowDirs but this tool cannot be path-confined`);
+                        return deny(req.toolName, "it is write-capable and cannot be path-confined, while the rule confines writes to allowDirs");
                     }
                 }
                 else {
                     const declared = declaredPathTargetOf(req);
                     if (declared === undefined) {
-                        return deny(`write tool "${req.toolName}" denied: session rule confines writes to allowDirs but the tool declares no path target to confine`);
+                        return deny(req.toolName, "it declares no path target to confine, while the rule confines writes to allowDirs");
                     }
                     const path = writeTargetPath(req, declared);
                     if (typeof path !== "string" || path.length === 0) {
-                        return deny(`write tool "${req.toolName}" denied: session rule confines writes to allowDirs but the call has no resolvable path`);
+                        return deny(req.toolName, "the call has no resolvable path to confine, while the rule confines writes to allowDirs");
                     }
                     const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootPath, cwd: req.cwd ?? env.cwd }), pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
                     if (!canon.ok) {
-                        return deny(`write to "${path}" denied: its real target could not be resolved against the session-rule allowDirs`);
+                        return deny(req.toolName, `the real target of the write to ${JSON.stringify(path)} could not be resolved against the session-rule allowDirs`);
                     }
                     const roots = [];
                     for (const raw of allowDirs) {
@@ -76,7 +176,7 @@ export function createSessionRulePolicy(rules, opts) {
                             roots.push(r.key);
                     }
                     if (!roots.some((root) => isWithin(root, canon.key))) {
-                        return deny(`write to "${path}" is outside the session-rule allowDirs (${allowDirs.join(", ")})`);
+                        return deny(req.toolName, `the write to ${JSON.stringify(path)} is outside the session-rule allowDirs (${allowDirs.join(", ")})`);
                     }
                 }
             }

package/dist/core/session-policy-store.d.ts

@@ -36,6 +36,11 @@ export interface SessionPermissionRules {
 /** {@link SessionPermissionRules} plus the monotonic `rev` the store stamps (the OCC key). */
 export interface StoredSessionRules extends SessionPermissionRules {
     rev: number;
+    /** The row's LINEAGE: which generation of this key the row belongs to. `rev` counts within one lineage; an
+     *  erase (`deleteBySession`) ends it, and the next write on the key starts the next generation, so a reader
+     *  can tell a recreated row from a continuation of the one it enforces whatever `rev` the new row wears.
+     *  Absent = generation 0 (a backend that predates the mark, or a row written before it). */
+    gen?: number;
 }
 /** Options for {@link SessionPolicyStore.putRules}. */
 export interface PutRulesOptions {
@@ -47,10 +52,11 @@ export interface PutRulesOptions {
     operator?: boolean;
 }
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`
- *  = a non-operator write tried to relax the rules. */
+ *  = a non-operator write tried to relax the rules; `corrupt` = a backend could not read the erase-surviving
+ *  rev mark ({@link SessionPolicyStore.deleteBySession}) and refuses rather than stamp an unproven rev. */
 export declare class SessionPolicyError extends Error {
-    readonly code: "conflict" | "loosen_forbidden";
-    constructor(code: "conflict" | "loosen_forbidden", message: string);
+    readonly code: "conflict" | "loosen_forbidden" | "corrupt";
+    constructor(code: "conflict" | "loosen_forbidden" | "corrupt", message: string);
 }
 /**
  * The seam a deployment implements for DURABLE, cross-replica per-session rules. Unset on `RunnerDeps` ⇒ the
@@ -80,6 +86,17 @@ export interface SessionPolicyStore {
      * rows — without this seam they survive the overwrite and keep enforcing the old branch's rules against
      * the new content. Optional like {@link listBySession} (a sync-capable backend implements both); the two
      * bundled impls do. Idempotent: deleting a session with no records is a no-op.
+     *
+     * @contract session_policy.rev_survives_delete — a key's `rev` (one key = `(sessionId, principal)`, the unit
+     * a row is stored under) is a HIGH-WATER MARK that survives this erase: the first `putRules` on that key
+     * after a `deleteBySession` stamps a `rev` strictly greater than every rev the key ever carried, so no later
+     * row of that key reads a smaller `rev` than an earlier one (another principal's row on the same session
+     * counts on its own), and a
+     * tighten-only (non-operator) write landing after an erase cannot slip under a floor a reader already
+     * enforced. A backend that reads "no row" as rev 0 must therefore keep the mark past the row (the bundled
+     * in-memory store and a deployment's SQL twin both do). The erase also ends the row's LINEAGE: the next
+     * write on the key carries the next `gen`, so a reader that enforces a row treats a later row of another
+     * generation as not comparable whatever its rev — a recreated row cannot pass for a continuation.
      */
     deleteBySession?(sessionId: string): Promise<void>;
 }
@@ -123,6 +140,13 @@ export declare function stripRev(rules: SessionPermissionRules): SessionPermissi
  */
 export declare class InMemorySessionPolicyStore implements SessionPolicyStore {
     private readonly map;
+    /**
+     * The per-key mark {@link SessionPolicyStore.deleteBySession} may not erase: the largest `rev` this key has
+     * ever been stamped with, kept outside the row so removing the row cannot roll the counter back. Written by
+     * every stamp, read by the next one, never read by anything else, and never collected — an erase frees the
+     * row and keeps this, so the cost is one integer per distinct key the process has ever written.
+     */
+    private readonly highWater;
     private key;
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;

package/dist/core/session-policy-store.js

@@ -76,6 +76,7 @@ export function stripRev(rules) {
 }
 export class InMemorySessionPolicyStore {
     map = new Map();
+    highWater = new Map();
     key(sessionId, principal) {
         return JSON.stringify([sessionId, principal ?? null]);
     }
@@ -96,8 +97,12 @@ export class InMemorySessionPolicyStore {
                 throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
             }
         }
-        const next = { ...structuredClone(clean), rev: (prior?.rev ?? 0) + 1 };
+        const mark = this.highWater.get(key) ?? { rev: 0, gen: 0 };
+        const floor = Math.max(prior?.rev ?? 0, mark.rev);
+        const gen = prior?.gen ?? mark.gen;
+        const next = { ...structuredClone(clean), rev: floor + 1, gen };
         this.map.set(key, next);
+        this.highWater.set(key, { rev: next.rev, gen });
         return structuredClone(next);
     }
     async listBySession(sessionId) {
@@ -110,10 +115,13 @@ export class InMemorySessionPolicyStore {
         return out;
     }
     async deleteBySession(sessionId) {
-        for (const k of [...this.map.keys()]) {
+        for (const [k, row] of [...this.map.entries()]) {
             const [sid] = JSON.parse(k);
-            if (sid === sessionId)
-                this.map.delete(k);
+            if (sid !== sessionId)
+                continue;
+            const mark = this.highWater.get(k) ?? { rev: 0, gen: 0 };
+            this.highWater.set(k, { rev: Math.max(mark.rev, row.rev), gen: mark.gen + 1 });
+            this.map.delete(k);
         }
     }
 }

package/dist/core/store-contracts/background-agent-store-contract.js

@@ -75,6 +75,16 @@ export async function backgroundAgentStoreContract(mk, runAssertion) {
         const store = make();
         await assert.rejects(store.put(record({ scope: "" })), "an empty scope must be refused loudly, not stored");
     });
+    run("a row carrying a key this build does not declare round-trips: no refusal, every declared field intact", async (make) => {
+        const store = make();
+        await store.put({ ...record({ handle: "a-extra", name: "worker", agentType: "reader" }), teamName: "retired-column" });
+        const row = await held(store, "a-extra");
+        assert.equal(row.name, "worker");
+        assert.equal(row.agentType, "reader");
+        assert.equal(row.status, "running");
+        await store.update("a-extra", S, { ...row, status: "completed" }, { rev: row.rev });
+        assert.equal((await held(store, "a-extra")).status, "completed", "a CAS update over such a row still lands");
+    });
     run("get returns DETACHED copies: mutating a read never reaches the stored row", async (make) => {
         const store = make();
         await store.put(record({ handle: "a1", usage: { totalTokens: 5 } }));

package/dist/core/store-contracts/peer-directory-contract.d.ts

@@ -0,0 +1,23 @@
+import { type PeerDirectory, type PeerSessionRecord } from "../../agents/peer-directory.js";
+import { type ContractAssertionRunner } from "./contract-harness.js";
+/** The scope every case registers rows under; the scope-wall case constructs a second one. */
+export declare const PEER_DIRECTORY_CONTRACT_SCOPE = "peer-kit-A";
+export interface PeerDirectoryContractHooks {
+    /** Write (or replace) one row through the host's own write protocol. The kit never writes a row
+     *  the engine's reader would refuse. */
+    write: (dir: PeerDirectory, record: PeerSessionRecord) => void | Promise<void>;
+    runAssertion?: ContractAssertionRunner;
+}
+/**
+ * The directory contract. Four readings, each the reason the engine can do something:
+ *  1. **scope wall** — a listing is the ACCESSOR's scope only; the cross-principal wall's mechanical
+ *     seat is this filter, so a row leaking across scopes is a tenant leak, not a display bug;
+ *  2. **the full set, copies** — live, dead AND deleted rows are all listed (a `name [ref]` is minted
+ *     over the full set; a dead row is the name truth offline delivery resolves through; a deleted
+ *     row resolves only to refuse), and a listed row is a COPY (mutating it changes no later listing);
+ *  3. **resolution feeds on the listing** — the engine's own resolver, over the rows as listed, finds
+ *     a live row by name, still finds a dead one, and answers `deleted` for a tombstone;
+ *  4. **restore is CAS-on-absent** (only where the host implements it) — an absent row is restored and
+ *     then listed; a present row is never overwritten (`false`, the existing row byte-unchanged).
+ */
+export declare function peerDirectoryContract(mk: () => PeerDirectory, hooks: PeerDirectoryContractHooks): Promise<void>;