@sema-agent/core 7.25.1 → 7.26.1

package/dist/core/runner/prepare-suspend-saga.js

@@ -79,7 +79,7 @@ function stampPlacementRootSessionId(placementRootResolved) {
     return placementValueOrAbsent(placementRootResolved);
 }
 export function prepareSuspendSaga(input) {
-    const { gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, autoModeIntent, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter } = input;
+    const { gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, autoModeIntent, approverPosture, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter } = input;
     if (!gateMachineryActive)
         return { saga: undefined };
     const inFlightSpendMicroUsd = () => {
@@ -139,6 +139,7 @@ export function prepareSuspendSaga(input) {
             return ancestorRulesAtMint !== undefined ||
                 inheritedShellGate !== undefined ||
                 autoModeIntentCarried ||
+                approverPosture !== undefined ||
                 inheritedAdmittedOrgScopes !== undefined ||
                 ownOrgVerdictRef.current !== undefined ||
                 orgGovernedProvenance ||
@@ -147,6 +148,7 @@ export function prepareSuspendSaga(input) {
                     ...(ancestorRulesAtMint !== undefined ? { ancestorRules: structuredClone(ancestorRulesAtMint) } : {}),
                     ...(inheritedShellGate !== undefined ? { shellGate: inheritedShellGate } : {}),
                     ...(autoModeIntentCarried ? { autoModeRequested: true } : {}),
+                    ...(approverPosture !== undefined ? { approverPosture } : {}),
                     ...(inheritedAdmittedOrgScopes !== undefined ? { admittedOrgScopes: [...inheritedAdmittedOrgScopes] } : {}),
                     ...(ownOrgVerdictRef.current !== undefined
                         ? { ownAdmittedOrgScopes: [...ownOrgVerdictRef.current.scopes], ownAdmittedOrgWriteScope: ownOrgVerdictRef.current.writeScope }

package/dist/core/runner/prepare-task.js

@@ -9,6 +9,7 @@ import { hasSessionFork } from "../session.js";
 import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { loadAnnounceOnceLedger } from "./announce-once-ledger.js";
 import { isValidReminderMark, mintReminderMark } from "../reminder-mint.js";
+import { refuseInvalidApproverPosture } from "../auto-mode-directive.js";
 import { emitTrace } from "../trace.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
 import { STALL_CONNECT_MS, STALL_FIRST_TOKEN_MS, STALL_IDLE_MS, withBrainCallGuardrail } from "../../brain/timeout.js";
@@ -265,6 +266,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     spec = doors.spec;
     const checkpointStore = resolveCheckpointStore(spec, deps), checkpointSeat = checkpointSeatOf(spec, checkpointStore);
     const autoModeSeat = refuseInvalidAutoModeSeat(spec);
+    const approverPostureSeat = refuseInvalidApproverPosture(spec);
     const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, microCompactKnob, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const modelGateManifest = toolModelGateManifest(doors.modelGate);
@@ -376,7 +378,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         let readDenyAdditionsNormalized = [];
         let handsLessResolvedFace;
         let handsLessResolvedWriteFace;
-        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDecider, autoModeDenialTracking: () => autoModeDenialTracking, autoModeArming: () => autoModeArming, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, resolvedWriteFace: () => resolvedWriteFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, handsLessResolvedWriteFace: () => handsLessResolvedWriteFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
+        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, approverPosture: approverPostureResolved, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, approverPostureSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDecider, autoModeDenialTracking: () => autoModeDenialTracking, autoModeArming: () => autoModeArming, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, resolvedWriteFace: () => resolvedWriteFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, handsLessResolvedWriteFace: () => handsLessResolvedWriteFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
         const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, parentSpecSeat, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
         const tools = roster.tools;
         const pausedRef = {};
@@ -700,15 +702,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             });
         }
         const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash });
-        const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, autoModeIntent, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
+        const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, autoModeIntent, approverPosture: approverPostureResolved, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
         const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
         prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
-        const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
+        const postureFrameRef = {};
+        const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, gitStatusRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, approvalPosture: { autoMode: autoModeIntent, ...(approverPostureResolved !== undefined ? { approverPosture: approverPostureResolved } : {}) }, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
         rollback.commit();
         const prepared = buildPrepared();
         preparedHolder.current = prepared;

package/dist/core/runner/run-leg.js

@@ -8,7 +8,8 @@ import { buildHumanInputEvent, projectHumanInput } from "../human-input-projecti
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { applyPersistedTightening, disclosedRuleSet } from "../persisted-rule-arms.js";
 import { computeCostMicroUsd } from "../pricing.js";
-import { mintSystemReminder } from "../reminder-mint.js";
+import { composeApprovalPostureDirective } from "../auto-mode-directive.js";
+import { mintSystemReminder, statedReminderBodiesOf } from "../reminder-mint.js";
 import { hasDestroy } from "../remote-env.js";
 import { advertisedWritableRootsSeat, refuseOutOfContractDecision } from "../tool-policy.js";
 import { callFaceSeat, judgeParkedToolIdentity, rosterEntryNamed, toolCallFaceOf } from "../tool-roster.js";
@@ -375,6 +376,13 @@ export async function runLeg(input) {
                     effectiveObjective = `${firstFrames.map((f) => mintSystemReminder(sanitizeUntrustedText(f.body, attachmentEnvelopeTags(f.source)), prepared.reminderMark)).join("\n")}\n${effectiveObjective}`;
                 }
             }
+            if (composeApprovalPostureDirective(prepared.approvalPosture) !== undefined) {
+                const postureDirective = composeApprovalPostureDirective(prepared.approvalPosture, await statedReminderBodiesOf(prepared.session, prepared.reminderMark));
+                if (postureDirective !== undefined) {
+                    prepared.postureFrameRef.protectedText = mintSystemReminder(postureDirective, prepared.reminderMark);
+                    effectiveObjective = `${prepared.postureFrameRef.protectedText}\n${effectiveObjective}`;
+                }
+            }
             const gitQueuedChars = gitLegDelivered !== undefined && gitLegDelivered.standalone ? gitLegDelivered.wrapped.length : 0;
             const precallMicroUsd = rs.budget.maxCostMicroUsd === undefined
                 ? 0

package/dist/core/runner/run-recovery-lanes.js

@@ -6,7 +6,7 @@ import { emitTrace } from "../trace.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { rebaseCadenceWindows } from "./turn-attachments.js";
 import { buildWorkingFileAttachments, centerAdoptionOption, contextInstructionFilesOption, emitInputTruncated, forkContextOption } from "./compaction-call-options.js";
-import { gitRestateOption } from "./git-leg-delivery.js";
+import { compactionRestateOptions } from "./compaction-restate.js";
 import { COMPACTION_FREED_EPSILON, COMPACTION_REGROWTH_FACTOR, MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
 import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions } from "./compaction-seams.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
@@ -41,7 +41,7 @@ export function runRecoveryLanes(input) {
                 ...contextInstructionFilesOption(prepared),
                 ...(prepared.onCompactionApplied ? { onApplied: prepared.onCompactionApplied } : {}),
                 ...seamCCompactionOptions(runner, prepared),
-                ...gitRestateOption(prepared),
+                ...compactionRestateOptions(prepared),
                 ...windowSafetyOptions(prepared.harness.getModel()),
                 ...compactionHookOptions(runner, spec, prepared.sessionId, "forced", prepared.hookIdentity, { timeoutMs: prepared.hookTimeoutMs, signal: passSignal }),
             });

package/dist/core/runner/run-terminal-adoption.js

@@ -7,7 +7,7 @@ import { answerSettled, errorCodeOf } from "./assemble-result.js";
 import { awaitChargeWithSlowDisclosure, discloseUnevaluableWindow } from "./clock-and-limits.js";
 import { buildWorkingFileAttachments, centerAdoptionOption, contextInstructionFilesOption, emitInputTruncated, forkContextOption } from "./compaction-call-options.js";
 import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions } from "./compaction-seams.js";
-import { gitRestateOption } from "./git-leg-delivery.js";
+import { compactionRestateOptions } from "./compaction-restate.js";
 import { MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
 import { reconciledToolEndBody } from "./tool-end-body.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
@@ -149,7 +149,7 @@ async function finish(spec, prepared, opts, runner, sessions) {
                 ...contextInstructionFilesOption(prepared),
                 ...(prepared.onCompactionApplied ? { onApplied: prepared.onCompactionApplied } : {}),
                 ...seamCCompactionOptions(runner, prepared),
-                ...gitRestateOption(prepared),
+                ...compactionRestateOptions(prepared),
                 ...compactionHookOptions(runner, spec, prepared.sessionId, "auto", prepared.hookIdentity, {
                     timeoutMs: prepared.hookTimeoutMs,
                     ...(opts?.cancelled === true ? { signal: prepared.abortController.signal } : {}),

package/dist/core/runner/run-turn-boundary.js

@@ -13,7 +13,7 @@ import { droppedToolDigest, withAnnounceDigests } from "./announce-once-ledger.j
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
 import { workflowSizeGuidelineChangeNotice } from "../../orchestration/workflow-size-guideline.js";
 import { awaitChargeWithSlowDisclosure, discloseUnevaluableWindow, ENV_DUE_GOVERNANCE_READ_BUDGET_MS, GOVERNANCE_READ_STALLED, LIMIT_APPROACH_DEFAULT_THRESHOLDS, limitApproachFrames, platformLimitTerminal, raceUntilDeadline } from "./clock-and-limits.js";
-import { gitRestateOption } from "./git-leg-delivery.js";
+import { compactionRestateOptions } from "./compaction-restate.js";
 import { COMPACTION_FREED_EPSILON, COMPACTION_REGROWTH_FACTOR, MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
 import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions } from "./compaction-seams.js";
 import { contextUsageSections } from "../../prompt-assembly/section-usage.js";
@@ -583,7 +583,7 @@ export function createTurnBoundary(input) {
                 ...contextInstructionFilesOption(prepared),
                 ...(prepared.onCompactionApplied ? { onApplied: prepared.onCompactionApplied } : {}),
                 ...seamCCompactionOptions(runner, prepared),
-                ...gitRestateOption(prepared),
+                ...compactionRestateOptions(prepared),
                 ...windowSafetyOptions(event.model),
                 ...compactionHookOptions(runner, spec, prepared.sessionId, passTrigger, prepared.hookIdentity, { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }),
             });

package/dist/core/runner/session-rule-policy.d.ts

@@ -1,7 +1,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ToolEffect } from "../types.js";
 import { type NamedToolPolicy } from "../tool-policy.js";
-import type { SessionPermissionRules, SessionPolicyStore, StoredSessionRules } from "../session-policy-store.js";
+import { type SessionPermissionRules, type SessionPolicyStore, type StoredSessionRules } from "../session-policy-store.js";
 /** Tool names whose write target is the `file_path`/`path` arg ({@link fileArgPath}).
  *
  *  REF-B3 — the ONE definition of that narrower set. Production consumer today:

package/dist/core/runner/session-rule-policy.js

@@ -1,5 +1,6 @@
 import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from "../../tools/fs/safety.js";
 import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
+import { continuesLineage } from "../session-policy-store.js";
 import { thrownText } from "../thrown-value.js";
 import { ruleDenialSentence } from "../rule-denial-sentence.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
@@ -61,13 +62,11 @@ export function createLiveSessionRules(store, floor, hooks) {
             return enforced;
         }
         if (enforced.rev > 0) {
-            if (live.gen !== undefined && enforced.gen !== undefined) {
-                if (live.gen !== enforced.gen) {
-                    announce(`session ${JSON.stringify(floor.sessionId)} has a rules row of a new lineage (generation ${live.gen}, rev ${live.rev}), which does not continue the row this leg enforces (generation ${enforced.gen})`);
-                    return enforced;
-                }
+            if (!continuesLineage(live, enforced)) {
+                announce(`session ${JSON.stringify(floor.sessionId)} has a rules row of a new lineage (generation ${live.gen}, rev ${live.rev}), which does not continue the row this leg enforces (generation ${enforced.gen})`);
+                return enforced;
             }
-            else if (vanished) {
+            if (vanished && live.gen === undefined) {
                 announce(`session ${JSON.stringify(floor.sessionId)} has a new rules row at rev ${live.rev} after the row this leg enforced was deleted, and its backend carries no lineage to continue it by`);
                 return enforced;
             }
@@ -89,7 +88,7 @@ export function createLiveSessionRules(store, floor, hooks) {
         if (handedRead !== undefined) {
             handed.delete(toolCallId);
             const claimed = await handedRead;
-            if (claimed.rev >= enforced.rev)
+            if (continuesLineage(claimed, enforced) && claimed.rev >= enforced.rev)
                 return claimed;
         }
         const p = read(signal);

package/dist/core/session-policy-store.d.ts

@@ -131,6 +131,24 @@ export declare function normalizeRules(rules: SessionPermissionRules): SessionPe
  * allowDirs: removing confinement, or adding a dir not within some prior dir, loosens (coarse raw containment).
  */
 export declare function loosenReasons(prior: SessionPermissionRules, next: SessionPermissionRules): string[];
+/**
+ * Does row `a` belong to the SAME lineage as row `b` — the one question every reader asks before it compares
+ * two rows' `rev`, asked in ONE place so a `gen` that is ABSENT cannot mean three different things at three
+ * stations. It means what {@link StoredSessionRules.gen} says it means: generation ZERO. A row that spells
+ * `gen: 0` and a row that omits it are therefore the same row's generation, and a row of generation 1 does not
+ * continue either of them — which is the case the readings used to disagree on, each treating absence as
+ * "unknown, so do not judge" and letting a recreated row pass for a continuation of the one it enforced.
+ *
+ * ABSENCE STILL CARRIES ONE OTHER FACT, and it is a different question: a backend that stamps no lineage at
+ * ALL gives its reader no recycle evidence, so a reader that has one of its own (it watched the row vanish)
+ * keeps using it. That test asks whether the FIELD is there, never what it compares to, and it is the caller's
+ * to make — this predicate answers only "same lineage or not".
+ */
+export declare function continuesLineage(a: {
+    gen?: number;
+}, b: {
+    gen?: number;
+}): boolean;
 /** strip any caller-passed `rev` from a rules object so the store is the sole authority on it. */
 export declare function stripRev(rules: SessionPermissionRules): SessionPermissionRules;
 /**

package/dist/core/session-policy-store.js

@@ -69,6 +69,9 @@ export function loosenReasons(prior, next) {
     }
     return reasons;
 }
+export function continuesLineage(a, b) {
+    return (a.gen ?? 0) === (b.gen ?? 0);
+}
 export function stripRev(rules) {
     const { ...rest } = rules;
     delete rest.rev;

package/dist/core/store-contracts/permission-rule-write-contract.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The permission-rule WRITE-FACE contract: what every backend behind `PermissionRuleWriter.apply` owes
+ * its caller. The sibling kit (`permission-rule-sync-contract.ts`) pins the pure JOIN; this one pins the
+ * DOOR it arrives through. A delta is DATA — a foreign caller, a replayed record, a deserialized join —
+ * so "the type system says it cannot happen" is not an answer a door may give, and a kind outside the
+ * union must be refused rather than folded as whichever arm a dispatch chain happens to end with. The
+ * positive control rides the same run on purpose: a backend that throws at everything refuses the
+ * unnamed kind too, so a suite without the control proves nothing.
+ *
+ * KIT form: vitest-free (`node:assert`), runner seam via {@link ContractAssertionRunner}, no skip hook.
+ */
+import type { WritableDurableRulePartition } from "../permission-rule-store.js";
+import { type ContractAssertionRunner } from "./contract-harness.js";
+export interface PermissionRuleWriteContractHooks {
+    /** Open ONE fresh, EMPTY partition with a write face — once per case; teardown stays with the caller. */
+    make: () => WritableDurableRulePartition | Promise<WritableDurableRulePartition>;
+    runAssertion?: ContractAssertionRunner;
+}
+/** Run the full conformance suite. Throws (assert) on the first violated clause. */
+export declare function permissionRuleWriteContract(hooks: PermissionRuleWriteContractHooks): Promise<void>;

package/dist/core/store-contracts/permission-rule-write-contract.js

@@ -0,0 +1,90 @@
+import assert from "node:assert";
+import { PERMISSION_RULE_WRITER, isRuleRevision } from "../permission-rule-store.js";
+import { beginContract } from "./contract-harness.js";
+const GLOBAL = { kind: "global" };
+function add(actor, counter) {
+    return { dot: { actor, counter }, origin: "user", createdAt: "2026-01-01T00:00:00.000Z" };
+}
+const IDENTITY = { behavior: "deny", rule: "Bash(curl:*)", scope: GLOBAL, tool: "Bash", match: "prefix", command: "curl" };
+function tombstoneFor(removed, deletedBy) {
+    return { behavior: IDENTITY.behavior, rule: IDENTITY.rule, scope: GLOBAL, removedDots: removed.map((a) => a.dot), deletedBy };
+}
+function liveDots(rules) {
+    return new Set(rules.flatMap((r) => r.adds.map((a) => `${r.behavior}|${r.rule}|${a.dot.actor}#${a.dot.counter}`)));
+}
+async function rawShape(part) {
+    const raw = await part[PERMISSION_RULE_WRITER].readRaw();
+    const dots = [...liveDots(raw.rules)].sort();
+    const tombs = raw.tombstones.map((t) => `${t.behavior}|${t.rule}|${t.deletedBy.actor}#${t.deletedBy.counter}`).sort();
+    return JSON.stringify({ rev: raw.rev, dots, tombs });
+}
+function assertDecline(outcome, what) {
+    const answer = (outcome ?? {});
+    assert.equal(answer.conflict, true, `${what} must answer \`conflict: true\` — a decline tagged with anything else is an answer the engine reads as unreadable, so a kit accepting it certifies a backend the engine cannot use`);
+    assert.equal(answer.refused, undefined, `${what} must not wear the refusal tag as well — an answer that is two arms is an answer about neither`);
+}
+function assertRevision(outcome, what) {
+    const rev = outcome?.rev;
+    assert.ok(isRuleRevision(rev), `${what} must carry a revision — a non-negative safe integer — and this answer carried ${rev === undefined ? "none at all" : `a ${typeof rev}`}`);
+}
+export async function permissionRuleWriteContract(hooks) {
+    const { run, settle } = beginContract(hooks.runAssertion);
+    run("the named arms land, a landing ADVANCES the revision, and a spent revision is ANSWERED (positive control)", async () => {
+        const part = await hooks.make();
+        const writer = part[PERMISSION_RULE_WRITER];
+        const a1 = add("kit", 1);
+        const held = (await part.list()).rev;
+        const first = await writer.apply({ kind: "tighten-add", ...IDENTITY, add: a1 }, { expectedRev: held });
+        assert.ok(!("conflict" in first) && !("refused" in first), "a well-formed tighten-add must land");
+        assertRevision(first, "the tighten-add landing");
+        const afterAdd = await part.list();
+        assert.deepEqual(liveDots(afterAdd.rules), new Set([`deny|${IDENTITY.rule}|kit#1`]), "the added dot must be visible through list()");
+        assert.ok(afterAdd.rev > held, "a landed write must ADVANCE the revision — a constant one is not a fence, it is a number");
+        assert.equal((await part[PERMISSION_RULE_WRITER].readRaw()).rev, afterAdd.rev, "every face must report ONE revision");
+        const rawBefore = await rawShape(part);
+        const stale = await writer.apply({ kind: "tighten-add", ...IDENTITY, add: add("kit", 2) }, { expectedRev: held });
+        assertDecline(stale, "a spent expectedRev");
+        assertRevision(stale, "the declining conflict");
+        const staleDelete = await writer.apply({ kind: "tighten-delete", tombstone: tombstoneFor([a1], { actor: "kit", counter: 8 }) }, { expectedRev: held });
+        assertDecline(staleDelete, "a spent expectedRev on the delete arm");
+        assertRevision(staleDelete, "the declining conflict on the delete arm");
+        assert.equal(await rawShape(part), rawBefore, "a declined write must move nothing — rows, tombstones or revision");
+        const beforeDelete = (await part.list()).rev;
+        const removed = await writer.apply({ kind: "tighten-delete", tombstone: tombstoneFor([a1], { actor: "kit", counter: 9 }) }, { expectedRev: beforeDelete });
+        assert.ok(!("conflict" in removed) && !("refused" in removed), "a well-formed tighten-delete must land");
+        assertRevision(removed, "the tighten-delete landing");
+        assert.deepEqual(liveDots((await part.list()).rules), new Set(), "the tombstoned dot must leave the live view");
+        assert.ok((await part.list()).rev > beforeDelete, "a landed delete must advance the revision too");
+        const raw = await part[PERMISSION_RULE_WRITER].readRaw();
+        assert.ok(liveDots(raw.rules).has(`deny|${IDENTITY.rule}|kit#1`), "the raw face must RETAIN a tombstoned add (list() filters; the evidence may not be filtered too)");
+        const tomb = raw.tombstones.find((t) => t.deletedBy.actor === "kit" && t.deletedBy.counter === 9);
+        assert.ok(tomb !== undefined, "the raw face must retain the tombstone a landed delete wrote");
+        assert.deepEqual({ behavior: tomb.behavior, rule: tomb.rule, scope: tomb.scope, removedDots: tomb.removedDots }, { behavior: IDENTITY.behavior, rule: IDENTITY.rule, scope: GLOBAL, removedDots: [a1.dot] }, "the retained tombstone must be the WHOLE one — a partial one identifies nothing");
+    });
+    run("a delta whose kind is outside the union is REFUSED — not folded as the arm it resembles", async () => {
+        for (const [label, payload] of [
+            ["① a legal tombstone under an unnamed kind", { kind: "tighten-purge", tombstone: tombstoneFor([add("kit", 1)], { actor: "kit", counter: 9 }) }],
+            ["② a legal add payload under an unnamed kind", { kind: "import-add", ...IDENTITY, add: add("kit", 2) }],
+        ]) {
+            const part = await hooks.make();
+            const writer = part[PERMISSION_RULE_WRITER];
+            const seeded = add("kit", 7);
+            await writer.apply({ kind: "tighten-add", ...IDENTITY, add: seeded }, { expectedRev: (await part.list()).rev });
+            const before = await part.list();
+            const rawShapeBefore = await rawShape(part);
+            let threw = false;
+            try {
+                await writer.apply(payload, { expectedRev: before.rev });
+            }
+            catch {
+                threw = true;
+            }
+            assert.equal(threw, true, `${label}: the write face must refuse an unnamed delta kind`);
+            const after = await part.list();
+            assert.deepEqual(liveDots(after.rules), liveDots(before.rules), `${label}: a refused delta must not change the rows`);
+            assert.equal(after.rev, before.rev, `${label}: a refused delta must not advance the revision`);
+            assert.equal(await rawShape(part), rawShapeBefore, `${label}: a refused delta must move nothing in the RAW state either`);
+        }
+    });
+    await settle();
+}

package/dist/core/store-contracts/read-back-shape-contract.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The CROSS-STORE read-back rule (`@contract store.read_back_shape_judged`, quoted for integrators in
+ * `docs/INTEGRATION-CORE.md` §5.0) and the acceptance suite that pins it. Kit form as the sibling kits
+ * (see `permission-rule-write-contract.ts`): no test framework, no skip hook.
+ */
+import { type ContractAssertionRunner } from "./contract-harness.js";
+/**
+ * @contract store.read_back_shape_judged — every read a store answers, a single get and an enumeration
+ * alike, judges the SHAPE of what it read before answering: a body that is not the shape this store
+ * writes is CORRUPT, and a corrupt body is answered in the store's own corrupt vocabulary — a loud
+ * refusal, or an absence that carries a disclosure naming the loss — never as an empty set, an empty
+ * object or a default value, because an answer a caller cannot tell apart from "there is nothing here"
+ * turns a recoverable incident into a silent one. Which read-back failures a store TOLERATES (an
+ * enumeration that skips one unreadable row and serves the rest, a torn trailing write read as absent)
+ * is a per-store fact registered beside that store's own contract, never assumed from another store's.
+ */
+export declare const CORRUPT_BODY_FORMS: readonly ["not-an-object", "missing-required", "wrong-type", "torn-json"];
+/** One way a persisted body can fail to be the shape its store writes. */
+export type CorruptBodyForm = (typeof CORRUPT_BODY_FORMS)[number];
+export interface ReadBackShapeSubject {
+    /** Declared ONCE per subject, and only by a backend that keeps no bytes a foreign writer could damage
+     *  (a process-local map holding objects it minted itself). Never per attempt: a planter that cannot
+     *  find bytes it knows exist must FAIL rather than exempt its backend. */
+    readonly unplantable?: string;
+    /** Plant ONE corrupt body of `form`, with `sentinel` inside the planted bytes wherever the form allows
+     *  (that is how clause 3 detects a body handed straight back). No declining return: a backend with no
+     *  bodies declares that at the subject, and a planter that cannot find bytes it knows exist THROWS. */
+    plant: (form: CorruptBodyForm, sentinel: string) => Promise<void>;
+    /** Perform the read under test. THROWING IS AN ANSWER — the loud refusal — and is not a suite failure. */
+    read: () => Promise<unknown>;
+    /** Write ONE well-formed row — clause 1's subject. */
+    seed: () => Promise<void>;
+    close?: () => void;
+}
+export interface StoreReadBackShapeHooks {
+    /** The face under test, named as a reader would name it (`"FileCheckpointStore.get"`). Failure text only. */
+    face: string;
+    /** Open a FRESH, EMPTY store and return its subject. Called once per observation; teardown is `close`. */
+    open: () => Promise<ReadBackShapeSubject>;
+    runAssertion?: ContractAssertionRunner;
+}
+/**
+ * Run the read-back shape suite over ONE read face. Throws (assert) on the first violated clause.
+ *
+ * Clauses: (1) a seeded row and an empty store both ANSWER, answer differently, and the empty answer is
+ * REPRODUCIBLE — a face that throws at everything, answers everything alike, or carries incidental data
+ * (a read id, a timestamp) proves nothing by differing under corruption;
+ * (2) each of the four {@link CORRUPT_BODY_FORMS}, planted, is answered differently from an empty store;
+ * (3) and the answer never contains the planted bytes.
+ *
+ * CEILING: clause 2 proves the corrupt case is DISTINGUISHABLE, not that the distinguishing answer is
+ * right — a face answering one invalid row where a good read answers rows passes. Whether the store then
+ * named the loss correctly is judged by its own section in §5.0, by a person; the four forms are a
+ * fixture set, not the space of corrupt bodies.
+ */
+export declare function storeReadBackShapeContract(hooks: StoreReadBackShapeHooks): Promise<void>;

package/dist/core/store-contracts/read-back-shape-contract.js

@@ -0,0 +1,78 @@
+import assert from "node:assert";
+import { thrownText } from "../thrown-value.js";
+import { beginContract } from "./contract-harness.js";
+export const CORRUPT_BODY_FORMS = ["not-an-object", "missing-required", "wrong-type", "torn-json"];
+async function observe(subject) {
+    try {
+        const value = await subject.read();
+        return { threw: false, body: safeStringify(value) };
+    }
+    catch (err) {
+        return { threw: true, message: thrownText(err) };
+    }
+}
+function safeStringify(value) {
+    const seen = new WeakSet();
+    try {
+        return (JSON.stringify(value, (_k, v) => {
+            if (typeof v === "object" && v !== null) {
+                if (seen.has(v))
+                    return "[circular]";
+                seen.add(v);
+            }
+            return v;
+        }) ?? String(value));
+    }
+    catch {
+        return String(value);
+    }
+}
+function render(o) {
+    return o.threw ? `threw(${o.message})` : `answered ${o.body}`;
+}
+async function withSubject(hooks, fn) {
+    const subject = await hooks.open();
+    try {
+        return await fn(subject);
+    }
+    finally {
+        subject.close?.();
+    }
+}
+export async function storeReadBackShapeContract(hooks) {
+    const { run, settle } = beginContract(hooks.runAssertion);
+    const where = hooks.face;
+    run(`${where}: the read face tells a present row from an absent one (positive control)`, async () => {
+        const empty = await withSubject(hooks, observe);
+        const seeded = await withSubject(hooks, async (s) => {
+            await s.seed();
+            return observe(s);
+        });
+        assert.equal(empty.threw, false, `${where}: reading an EMPTY store must answer, not throw (${render(empty)}) — absence is not damage`);
+        assert.equal(seeded.threw, false, `${where}: reading a well-formed row must answer, not throw (${render(seeded)})`);
+        const again = await withSubject(hooks, observe);
+        assert.deepEqual(again, empty, `${where}: two reads of two EMPTY stores answered differently (${render(empty)} then ${render(again)}) — this suite's oracle is "the corrupt answer differs from the empty one", which is free for a face carrying incidental data; project it away in the binding`);
+        assert.notDeepEqual(seeded, empty, `${where}: a seeded store and an empty one answered identically (${render(empty)}) — this face reports nothing a corrupt body could differ from, so every clause below would pass without meaning anything`);
+    });
+    for (const form of CORRUPT_BODY_FORMS) {
+        run(`${where}: a ${form} body is not read as an absent row`, async () => {
+            const sentinel = `sema-corrupt-sentinel-${form}`;
+            const empty = await withSubject(hooks, observe);
+            const corrupt = await withSubject(hooks, async (s) => {
+                if (s.unplantable !== undefined) {
+                    assert.ok(s.unplantable.length > 0, `${where}: a subject declaring no plantable body must say WHY`);
+                    return undefined;
+                }
+                await s.plant(form, sentinel);
+                return observe(s);
+            });
+            if (corrupt === undefined)
+                return;
+            assert.notDeepEqual(corrupt, empty, `${where}: a ${form} body was answered exactly as an absent row is (${render(empty)}) — a corrupt body must reach the caller as a refusal or as an absence that names the loss, never as the store's empty answer`);
+            if (!corrupt.threw) {
+                assert.ok(!corrupt.body.includes(sentinel), `${where}: a ${form} body was handed back through the read face (the planted marker is in the answer) — the read judged nothing`);
+            }
+        });
+    }
+    await settle();
+}

package/dist/core/task-result.d.ts

@@ -121,11 +121,22 @@ export type EffectiveMemoryScopes = {
     state: "mounted";
     reason?: never;
     contract: "v2" | "legacy";
+    /** `shadowed` = how many of this scope's entries the session's write home retires from the
+     *  DEFAULT read face by name (they stay reachable by id and through `includeShadowed`).
+     *  PRESENT-IFF non-zero, and never on the write home's own row — absence is "none", which is
+     *  why zero is not spelled. A mount-time snapshot: the tool faces re-derive it per call, so a
+     *  later challenge or tombstone can make the live answer smaller than this number. */
     scopes: Array<{
         scope: string;
         origin: "deployment" | "request";
+        shadowed?: number;
     }>;
     writeScope: string | null;
+    /** The project identity the assembly point DECLARED for this task, echoed verbatim
+     *  ({@link import("./memory.js").MemoryProjectKey}). PRESENT-IFF the spec carried one:
+     *  absence means the deployment said nothing, which is not the same as `{ absent }`, which
+     *  means it looked and found none. */
+    projectKey?: import("./memory.js").MemoryProjectKey;
     materializedResidue?: never;
 } | {
     state: "memoryless";

package/dist/core/task-spec.d.ts

@@ -35,6 +35,11 @@ export type ImageInput = {
  *  shell-gated ask (`RiskDescriptor.shellGateDoctrine`) and folds across a delegation chain (max-rank: `off` <
  *  `classify` < `always`). One closed set; every seat that names a doctrine spells it through this alias. */
 export type ShellGateDoctrine = "off" | "classify" | "always";
+/** The approval POSTURE a host declares for a task — {@link TaskSpec.approverPosture}'s value set: a
+ *  statement about who answers this run's approval cards, never an instruction to the gate. One word
+ *  today (`"bypass"` — the host answers every card itself, automatically). The engine only RENDERS it,
+ *  so adding a word here changes what the model is told and nothing else. */
+export type ApproverPosture = "bypass";
 export interface TaskSpec {
     taskId?: string;
     /** The instruction / latest user message for this turn. */
@@ -924,6 +929,32 @@ export interface TaskSpec {
      * deployment's face and the resuming principal's deny bit are judged afresh on every leg.
      */
     autoModeRequested?: true;
+    /**
+     * The host's declared APPROVER POSTURE for this task — a typed fact seat, the same ownership split
+     * as {@link shellGate} and {@link autoModeRequested}: the service layer declares it (it is the layer
+     * that knows who sits at the cards), core only CONSUMES it. `"bypass"` says the host answers every
+     * approval card itself, automatically.
+     *
+     * **The gate does not read it.** Cards are raised, routed and recorded byte-identically with and
+     * without this seat — no rule is relaxed, no ask is skipped, no decision is pre-empted. The seat's
+     * one effect is that the ENGINE tells the model which posture the run is under, in its own marked
+     * `<system-reminder>` on the first turn. That is the whole point of the seat: a posture is a fact of
+     * the run, and a host that instead splices the sentence into the objective hands the model
+     * reminder-shaped text with no engine mark, which the mark declaration tells it to treat as data and
+     * flag. One fact, one seat, one mint.
+     *
+     * Absent ⇒ no posture declared, zero bytes rendered (byte-identical to the pre-seat shape). Only the
+     * literal `"bypass"` is a value: any other present value is refused at the door
+     * (`config.approver_posture_invalid`) rather than folded back to absence — a marshalled typo must not
+     * silently un-declare a posture the host meant to declare.
+     *
+     * **Inheritance / resume:** session-wide, exactly like {@link autoModeRequested} — an engine-spawned
+     * child inherits it through the trusted constraint chain (`InheritedGate.approverPosture`), and the
+     * resolved value is recorded on the checkpoint's data half so a redemption in another process still
+     * knows the posture without the seat being re-passed. Re-passing it is honoured; the sources fold
+     * seat-first.
+     */
+    approverPosture?: ApproverPosture;
     /** Task-scoped MCP servers, materialized into tools then disposed. */
     mcp?: McpServerSpec[];
     /** Task-scoped A2A peers (remote agents), whose advertised skills mount as `a2a__<peer>__<skill>`

package/dist/core/tool-catalog-entries.js

@@ -123,9 +123,9 @@ export const TOOL_CATALOG_ENTRIES = [
     { id: "exit-plan-mode", name: "ExitPlanMode", source: "builtin", definedIn: "src/core/present-plan-tool.ts", mountedBy: ["optional"], cards: ["exit-plan-mode"], face: { family: "plan", effect: "read", contract: c("core.exit_plan_mode@1"), renderHints: { userFacingName: "", approvalCard: "plan" } } },
     { id: "enter-plan-mode", name: "EnterPlanMode", source: "builtin", definedIn: "src/core/present-plan-tool.ts", mountedBy: ["optional"], cards: ["enter-plan-mode"], face: { family: "plan", effect: "read", contract: c("core.enter_plan_mode@1") } },
     { id: "refresh-mcp-tools", name: REFRESH_MCP_TOOLS_TOOL_NAME, source: "builtin", definedIn: "src/core/runner/prepare-protocol-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "protocol", effect: "read" } },
-    { id: "memory-search", name: "memory_search", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", effect: "read", contentOrigin: "local", contract: c("core.memory_search@1", "6"), offload: false } },
-    { id: "memory-get", name: "memory_get", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", effect: "read", contentOrigin: "local", contract: c("core.memory_get@1", "6"), offload: false } },
-    { id: "memory-index", name: "memory_index", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", effect: "read", contentOrigin: "local", contract: c("core.memory_index@1"), offload: false } },
+    { id: "memory-search", name: "memory_search", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", effect: "read", contentOrigin: "local", contract: c("core.memory_search@1", "7"), offload: false } },
+    { id: "memory-get", name: "memory_get", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", effect: "read", contentOrigin: "local", contract: c("core.memory_get@1", "7"), offload: false } },
+    { id: "memory-index", name: "memory_index", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", effect: "read", contentOrigin: "local", contract: c("core.memory_index@1", "2"), offload: false } },
     { id: "memory-list", name: "memory_list", source: "builtin", definedIn: "src/core/shared-memory/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", effect: "read", contract: c("core.memory_list@1"), offload: false } },
     { id: "memory-read", name: "memory_read", source: "builtin", definedIn: "src/core/shared-memory/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", effect: "read", contract: c("core.memory_read@1"), offload: false } },
     { id: "cron-create", name: "CronCreate", source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-create"], face: { family: "other", effect: "write", contract: c("core.cron_create@1") } },