@sema-agent/core 7.26.0 → 7.26.2

package/dist/core/permission-rule-store.js

@@ -5,6 +5,71 @@ import { thrownText } from "./thrown-value.js";
 export function sameRuleOwner(a, b) {
     return a.kind === "principal" ? b.kind === "principal" && a.principal === b.principal : b.kind === "local-owner";
 }
+export function isRuleRevision(rev) {
+    return typeof rev === "number" && Number.isSafeInteger(rev) && rev >= 0;
+}
+function outcomeWord(value) {
+    if (value === undefined)
+        return "no revision at all";
+    if (value === null)
+        return "a null revision";
+    if (typeof value === "number")
+        return `the number ${String(value)}, which is not a revision`;
+    return `a ${typeof value} where a revision belongs`;
+}
+function isReadableDrop(drop) {
+    if (drop === null || typeof drop !== "object")
+        return false;
+    const dot = drop.dot;
+    if (dot === null || typeof dot !== "object")
+        return false;
+    return typeof dot.actor === "string" && typeof dot.counter === "number" && typeof drop.reason === "string";
+}
+function readSyncReport(sync) {
+    if (sync === undefined)
+        return {};
+    if (sync === null || typeof sync !== "object")
+        return { unreadable: `the landing carried a ${sync === null ? "null" : typeof sync} where its sync report belongs` };
+    for (const member of ["droppedInbound", "quarantined"]) {
+        const value = sync[member];
+        if (value === undefined)
+            continue;
+        if (!Array.isArray(value))
+            return { unreadable: `the landing's sync report carried a ${typeof value} as \`${member}\`, which a reader cannot walk` };
+        const bad = value.findIndex((row) => !isReadableDrop(row));
+        if (bad !== -1)
+            return { unreadable: `the landing's sync report carried a \`${member}\` entry (#${String(bad)}) that is not a drop record, so what was dropped cannot be read` };
+    }
+    return { report: sync };
+}
+export function readRuleWriteOutcome(res) {
+    if (res === null || typeof res !== "object") {
+        return { kind: "unreadable", why: `the store answered ${res === null ? "null" : `a ${typeof res}`} where a write outcome belongs` };
+    }
+    const tagged = res;
+    const refusal = tagged.refused;
+    const conflict = tagged.conflict;
+    if (refusal !== undefined && conflict !== undefined) {
+        return { kind: "unreadable", why: "the store answered a refusal and a decline at once, and an answer that is two arms is not an answer about either" };
+    }
+    if (refusal !== undefined) {
+        return typeof refusal === "string" && refusal !== ""
+            ? { kind: "refused", refused: refusal }
+            : { kind: "unreadable", why: `the store tagged its answer as a refusal and named it with a ${refusal === null ? "null" : typeof refusal}, so which refusal it is cannot be read` };
+    }
+    if (conflict !== undefined) {
+        if (conflict !== true)
+            return { kind: "unreadable", why: `the store tagged its answer as a decline with \`${String(conflict)}\`, which does not say a compare-and-set lost` };
+        return isRuleRevision(tagged.rev)
+            ? { kind: "conflict", rev: tagged.rev }
+            : { kind: "unreadable", why: `the store declined the write with ${outcomeWord(tagged.rev)}, so the revision to re-anchor the next attempt to is unknown` };
+    }
+    if (!isRuleRevision(tagged.rev)) {
+        return { kind: "unreadable", why: `the store answered neither a conflict nor a refusal, and carried ${outcomeWord(tagged.rev)} — a landing reports the revision it committed at, so this answer cannot say whether the write landed` };
+    }
+    const { report, unreadable } = readSyncReport(tagged.sync);
+    return { kind: "landed", rev: tagged.rev, ...(report !== undefined ? { sync: report } : {}), ...(unreadable !== undefined ? { reportUnreadable: unreadable } : {}) };
+}
 export function unknownRuleWriteDeltaError(delta) {
     const kind = delta?.kind;
     return new Error(`the permission-rule store cannot apply a write delta of kind ${escapeForDisclosure(typeof kind === "string" ? kind : String(kind))} — the write face folds exactly four named arms (redemption-add, tighten-add, tighten-delete, sync-join), and an unnamed one is refused rather than read as any of them`);
@@ -405,13 +470,32 @@ function resolveRuleWriter(store) {
         w = writerOf(store);
     }
     catch (err) {
-        return { unavailable: `the permission-rule store's write face could not be acquired (${errText(err)})` };
+        return { unavailable: `the permission-rule store's write face could not be acquired (${errText(err)})`, committed: "unknown" };
     }
-    return w === undefined ? { unavailable: "the resolved permission-rule store has no write face" } : { writer: w };
+    return w === undefined ? { unavailable: "the resolved permission-rule store has no write face", committed: "no" } : { writer: w };
 }
 function ruleIdentityStands(rules, identity) {
     return rules.some((r) => sameRuleIdentity(r, identity) && isRuleLive(r));
 }
+async function witnessRuleAdd(store, writer, delta) {
+    const identity = { behavior: delta.behavior, rule: delta.rule, scope: delta.scope };
+    const dot = delta.add.dot;
+    try {
+        if (delta.scope.kind === "session") {
+            const view = await store.effective({ sessionId: delta.scope.sessionId });
+            if (view.unreadable !== undefined)
+                return { unreadable: view.unreadable };
+            return { seen: view.rules.some((r) => sameRuleIdentity(r, identity) && r.adds.some((a) => sameDot(a.dot, dot))), rev: view.rev };
+        }
+        const raw = await writer.readRaw();
+        const inRows = raw.rules.some((r) => sameRuleIdentity(r, identity) && r.adds.some((a) => sameDot(a.dot, dot)));
+        const inQuarantine = (raw.quarantined ?? []).some((q) => sameDot(q.add.dot, dot));
+        return { seen: inRows || inQuarantine, rev: raw.rev };
+    }
+    catch (err) {
+        return { unreadable: errText(err) };
+    }
+}
 async function readRuleLiveness(store, identity) {
     try {
         const after = await store.effective();
@@ -448,7 +532,7 @@ export async function removePersistedRule(opts) {
     const store = owner.kind === "local-owner" ? provider.forLocalOwner() : provider.forPrincipal(owner.principal);
     const face = resolveRuleWriter(store);
     if ("unavailable" in face) {
-        return { status: "failed", error: `${face.unavailable} — rules cannot be removed through it`, committed: "no" };
+        return { status: "failed", error: `${face.unavailable} — rules cannot be removed through it`, committed: face.committed };
     }
     const writer = face.writer;
     let snapshot;
@@ -474,30 +558,35 @@ export async function removePersistedRule(opts) {
     const tombstone = { behavior, rule, scope, removedDots, deletedBy };
     let expectedRev = snapshot.rev;
     let lastError = "";
-    let applyThrew = false;
+    let settlement = "no";
     for (let attempt = 0; attempt < REMOVE_MAX_ATTEMPTS; attempt++) {
         try {
-            const res = await writer.apply({ kind: "tighten-delete", tombstone }, { expectedRev });
-            if ("refused" in res) {
-                return { status: "failed", error: `the store refused the tombstone (${res.refused}) — nothing was removed`, committed: "no" };
+            const reading = readRuleWriteOutcome(await writer.apply({ kind: "tighten-delete", tombstone }, { expectedRev }));
+            if (reading.kind === "refused") {
+                return { status: "failed", error: `the store refused the tombstone (${reading.refused}) — nothing was removed`, committed: "no" };
+            }
+            if (reading.kind === "unreadable") {
+                settlement = "unknown";
+                lastError = `the permission-rule store answered the write unreadably: ${reading.why}`;
+                break;
             }
-            if (!("conflict" in res)) {
-                return { status: "removed", rev: res.rev, stillLive: await readRuleLiveness(store, identity) };
+            if (reading.kind === "landed") {
+                return { status: "removed", rev: reading.rev, stillLive: await readRuleLiveness(store, identity) };
             }
-            expectedRev = res.rev;
+            expectedRev = reading.rev;
         }
         catch (err) {
-            applyThrew = true;
+            settlement = "unknown";
             lastError = errText(err);
             break;
         }
     }
-    const reason = applyThrew
+    const reason = settlement === "unknown"
         ? lastError !== ""
             ? lastError
             : "the permission-rule store threw while applying the tombstone, with no message"
         : `optimistic-concurrency retries exhausted after ${REMOVE_MAX_ATTEMPTS} attempts`;
-    const committed = applyThrew ? "unknown" : "no";
+    const committed = settlement;
     try {
         const after = await writer.readRaw();
         const landed = after.tombstones.some((t) => t.deletedBy.actor === tombstone.deletedBy.actor && t.deletedBy.counter === tombstone.deletedBy.counter);
@@ -506,7 +595,7 @@ export async function removePersistedRule(opts) {
         }
         return {
             status: "failed",
-            error: applyThrew
+            error: settlement === "unknown"
                 ? `${reason}; the store retains no tombstone for this removal, which cannot tell a write that never landed from one whose evidence was collected — the outcome is indeterminate, reconcile with list()`
                 : `${reason} (read-back confirms no tombstone was written)`,
             committed,
@@ -515,7 +604,7 @@ export async function removePersistedRule(opts) {
     catch (err) {
         return {
             status: "failed",
-            error: applyThrew
+            error: settlement === "unknown"
                 ? `${reason}; the read-back also failed (${errText(err)}) so this outcome is indeterminate — reconcile with list()`
                 : `${reason}; the read-back also failed (${errText(err)}), but every attempt was answered by the store, so nothing was written`,
             committed,
@@ -555,10 +644,21 @@ export async function landRuleAdd(args) {
         catch (err) {
             return { landed: false, reason: `the permission-rule store refused the write: ${errText(err)}`, committed: "unknown" };
         }
-        if ("refused" in res)
+        const reading = readRuleWriteOutcome(res);
+        if (reading.kind === "refused")
             return { landed: false, reason: SESSION_ENDED_REFUSAL, committed: "no" };
-        if (!("conflict" in res))
-            return { landed: true, rev: res.rev };
+        if (reading.kind === "unreadable")
+            return { landed: false, reason: `the permission-rule store answered the write unreadably: ${reading.why}`, committed: "unknown" };
+        if (reading.kind === "landed") {
+            const witness = await witnessRuleAdd(args.store, args.writer, args.delta);
+            if ("unreadable" in witness) {
+                return { landed: false, reason: `the permission-rule store reported a landing at revision ${String(reading.rev)}, and the read-back that would have witnessed it could not be taken (${witness.unreadable})`, committed: "unknown" };
+            }
+            if (!witness.seen) {
+                return { landed: false, reason: `the permission-rule store reported a landing at revision ${String(reading.rev)}, and a read-back of this add's own dot finds no trace of it — a revision says the ANSWER was well formed, not that a row exists, so nothing here can say the write landed`, committed: "unknown" };
+            }
+            return { landed: true, rev: reading.rev };
+        }
     }
     return { landed: false, reason: `optimistic-concurrency retries exhausted after ${RULE_ADD_MAX_ATTEMPTS} attempts`, committed: "no" };
 }
@@ -592,7 +692,7 @@ export async function addPersistedRule(opts) {
     const store = owner.kind === "local-owner" ? provider.forLocalOwner() : provider.forPrincipal(owner.principal);
     const face = resolveRuleWriter(store);
     if ("unavailable" in face) {
-        return { status: "failed", error: `${face.unavailable} — rules cannot be added through it`, committed: "no" };
+        return { status: "failed", error: `${face.unavailable} — rules cannot be added through it`, committed: face.committed };
     }
     const writer = face.writer;
     const query = scope.kind === "session" ? { sessionId: scope.sessionId } : undefined;

package/dist/core/permission-rule-sync.js

@@ -1,5 +1,5 @@
 import { escapeForDisclosure, isRuleBehavior, parseRuleText } from "./permission-rule-model.js";
-import { applyTombstones, errText, joinFrontiers, joinRuleStates, normalizePersistedRule, ruleSyncVector, sameRuleIdentity, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
+import { applyTombstones, errText, joinFrontiers, joinRuleStates, normalizePersistedRule, readRuleWriteOutcome, ruleSyncVector, sameRuleIdentity, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
 import { emitTrace } from "./trace.js";
 export const PERMISSION_RULE_SYNC_PATH = "/v1/permission-rules/sync";
 export const LOCAL_OWNER_UNSYNCABLE_CODE = "permission_rules.local_owner_unsyncable";
@@ -174,11 +174,12 @@ export async function syncPermissionRules(opts) {
                 warnings: [...warnings, `the store refused the sync landing: ${escapeForDisclosure(errText(err))} — nothing landed, the local state is unchanged`],
             });
         }
-        if ("conflict" in res) {
+        const reading = readRuleWriteOutcome(res);
+        if (reading.kind === "conflict") {
             current = await writer.readRaw();
             continue;
         }
-        if ("refused" in res) {
+        if (reading.kind === "refused" || reading.kind === "unreadable") {
             return disclose({
                 ok: false,
                 pushed: { addDots: raw.rules.reduce((n, r) => n + r.adds.length, 0), tombstones: raw.tombstones.length },
@@ -186,7 +187,12 @@ export async function syncPermissionRules(opts) {
                 resurrected: [],
                 dropped,
                 rev: current.rev,
-                warnings: [...warnings, `the store refused the sync landing (${res.refused}) — nothing landed, the local state is unchanged`],
+                warnings: [
+                    ...warnings,
+                    reading.kind === "refused"
+                        ? `the store refused the sync landing (${reading.refused}) — nothing landed, the local state is unchanged`
+                        : `the store answered the sync landing unreadably: ${reading.why} — this round is not reported as landed; re-read before trusting the local state`,
+                ],
             });
         }
         const landedRaw = await writer.readRaw();
@@ -211,7 +217,10 @@ export async function syncPermissionRules(opts) {
         const tombKeyOf = (t) => JSON.stringify([t.behavior, t.rule, t.scope.kind, t.scope.kind === "project" ? t.scope.root : t.scope.kind === "session" ? t.scope.sessionId : null, dotKeyOf(t.deletedBy)]);
         const preTombs = new Set(current.tombstones.map(tombKeyOf));
         const newTombstones = landedRaw.tombstones.filter((t) => !preTombs.has(tombKeyOf(t))).length;
-        const landedReport = res.sync;
+        const landedReport = reading.sync;
+        if (reading.reportUnreadable !== undefined) {
+            warnings.push(`${reading.reportUnreadable} — the join landed, but what it dropped or quarantined cannot be reported from this round`);
+        }
         for (const d of landedReport?.droppedInbound ?? []) {
             if (!dropped.some((x) => x.dot.actor === d.dot.actor && x.dot.counter === d.dot.counter && x.reason === d.reason))
                 dropped.push(d);

package/dist/core/runner/contracts.d.ts

@@ -36,6 +36,7 @@ import type { MemoryEngine } from "../memory-engine/engine.js";
 import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import type { HarvestReport, MemorySessionHandle } from "../memory-engine/types.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
+import type { SafeNotifier } from "../safe-notify.js";
 import type { RecoveredOrphan } from "../session-reconcile.js";
 import type { SessionStore, StoredSession } from "../session.js";
 import type { TaskOutcome } from "../task-outcome.js";
@@ -2063,6 +2064,49 @@ export interface RunInternals {
      * threads it too) — a resumed leg's restore re-fires the observation with the settled root.
      */
     onWorkspaceResolved?: (workspace: ResolvedWorkspace) => void;
+    /**
+     * A TRUSTED run-scoped WIRING-MANIFEST sink, filled ONLY by a core caller and NEVER a {@link
+     * TaskSpec} field — the posture of {@link onActivity} and {@link onWorkspaceResolved} beside it.
+     * Handed the very object this leg's `wiring_manifest` frame carries, at the moment that frame is
+     * pushed: ONCE per prepared leg, after prepare and before the leg's first model or tool
+     * interaction. Rides `internals` on FRESH and RESUMED legs alike, because the mint sits in the
+     * run body both entries share.
+     *
+     * WHY a seat, when the frame already rides the stream: a COMPOSITION entry (the verify gate, the
+     * cascade) drains its inner legs' queues ITSELF, so the host holds no TaskStream for any of them
+     * and an inner leg's manifest dies inside the gate — the hole {@link onStatusEvent} was opened
+     * for, one frame family over. A direct `runTask` caller needs neither seat: its own stream
+     * carries both frames.
+     *
+     * `leg` is the LEG IDENTITY, and the engine mints NONE of it. It is present only where a
+     * composition labelled the leg it dispatched: the verify entries hand each leg a per-dispatch
+     * copy of this object whose sink closes over that leg's identity, so a consumer can tell the
+     * implementation leg from round 2's verifier without inferring it from arrival order (the
+     * ordering is all the sibling sinks have — see the attribution paragraph on `verifyCompleted`).
+     * ABSENT therefore means "nobody labelled this leg", never "implementation": a plain `runTask`,
+     * a workflow agent call and a cascade rung all reach this sink with no identity, and reading one
+     * in would be the engine fabricating a fact it does not hold. NOT the same axis as the manifest's
+     * OWN `leg` field ({@link WiringManifest.leg}, `root` / `child` / `resume`), which is a fact about
+     * how the ENGINE reached this run; this one is a fact about the composition that dispatched it, and
+     * a resumed fix leg carries both at once — `manifest.leg.kind === "resume"` and `leg.kind === "fix"`
+     * are both true of it. `round` is 1-based over the gate's verification rounds: a `verifier` leg
+     * carries the one it verifies, a `fix` leg the one whose findings it answers, and the entry
+     * implementation leg carries 0 — before the first. The axis is relative to the gate INVOCATION,
+     * not to the session's history: a resume entry's work leg is THAT invocation's implementation leg
+     * (`impl`, round 0) even when the checkpoint it resumes was minted inside a previous invocation's
+     * fix round, because the invocation's own round counter (`VerificationResult.rounds`) restarts with
+     * it — one axis for both fields, rather than a leg that reads "fix round 1" inside a result whose
+     * rounds begin at 1 again.
+     *
+     * Observe-only and failure-isolated through the SAME per-run notifier as {@link onActivity} (one
+     * isolation scope for every sink on this object, so a broken sink is counted and disclosed once,
+     * not once per site family): a throw — or an `async` sink returning a rejecting promise — is
+     * contained and never faults the leg whose manifest it was handed.
+     */
+    onWiringManifest?: (manifest: WiringManifest, leg?: {
+        readonly kind: "impl" | "verifier" | "fix";
+        readonly round: number;
+    }) => void;
 }
 /**
  * The payload of {@link RunInternals.onWorkspaceResolved}: the working root this task actually
@@ -2541,6 +2585,10 @@ export interface HarnessHandlersDeps {
     runnerHooks: {
         onError: RunnerDeps["onError"];
     };
+    /** The run's ONE isolation scope for the {@link RunInternals} observation sinks, minted by the
+     *  identity-wiring lane (which calls the first of them) and shared with these handlers, so the
+     *  "first failure per site" disclosure is one account for the whole run rather than one per lane. */
+    internalsNotifier: SafeNotifier;
 }
 /**
  * The Runner as the modules it drives and the compositions over it see it — the delegation tools

package/dist/core/runner/decide-continuation.js

@@ -119,7 +119,9 @@ export function resumeContinuation(resume, mark) {
     }
     const decided = resume.outcome.decision === "allow"
         ? "was APPROVED and has now been executed — its result is in the tool results above"
-        : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}`;
+        : resume.outcome.hostDecision.decidedBy === "policy"
+            ? "was DENIED by this deployment's own policy, not by a person — the refusal and its reason are in the tool results above"
+            : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}`;
     return formatHookFeedback(`The pending tool call "${pendingAction.toolName}" ${decided}. ` +
         `This is a RESUMED task — every step before this point is already done and its results are in the ` +
         `conversation above. Do NOT restart the task or re-run any tool you already ran; continue from this ` +

package/dist/core/runner/denial-limit-arms.d.ts

@@ -168,9 +168,10 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
 export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;
-/** A deny nobody made, at a wrapper arm: no approver wired, or a blanket `onAsk:"allow"` refused as
- *  no approver. `approver_unavailable` is NOT headless here — it floats to the main gate, which owns
- *  that arm (a park, or the fail-closed refusal). */
+/** A deny nobody JUDGED, at a wrapper arm — read off the one table over the settlement words
+ *  ({@link SETTLEMENT_NOBODY_JUDGED}) rather than listed here, so a word added to the set answers this
+ *  question by getting a row and not by falling out of a disjunction. `approver_unavailable` is NOT
+ *  headless here — it floats to the main gate, which owns that arm (a park, or the fail-closed refusal). */
 export declare function headlessDenyAtFold(r: FallbackResolution): boolean;
 /** The re-check's reading: the approved-edit helper has NO park route (an approved edit is
  *  re-adjudicated in place), so an approver that reports unavailable is as headless as none at all. */

package/dist/core/runner/denial-limit-arms.js

@@ -1,6 +1,7 @@
 import { classifierParseFailureDenyMessage, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
 import { attestClassifierDenyCause, attestClassifierRound } from "../tool-policy.js";
+import { SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { askOriginOf, classifierMayAnswer, probeMandatedAsk } from "../ask-origin.js";
@@ -109,7 +110,7 @@ export async function judgeInheritedClassifier(opts) {
     return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, INHERITED_STATION_FACTS) };
 }
 export function headlessDenyAtFold(r) {
-    return r.settlement?.kind === "no_approver" || r.settlement?.kind === "blanket_allow_refused";
+    return r.settlement !== undefined && SETTLEMENT_NOBODY_JUDGED[r.settlement.kind];
 }
 export function headlessDenyAtRecheck(r) {
     return headlessDenyAtFold(r) || r.settlement?.kind === "approver_unavailable" || r.approverUnavailable === true;

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -41,7 +41,7 @@ import { type HookEnvCapabilities, type Hooks } from "../hooks.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
 import type { DelegationContentSafety } from "../memory-engine/delegation-provenance.js";
-import type { SessionPermissionRules } from "../session-policy-store.js";
+import { type SessionPermissionRules } from "../session-policy-store.js";
 import type { SessionStore } from "../session.js";
 import { type OnAsk } from "../tool-policy.js";
 import type { ApproverPosture, RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";

package/dist/core/runner/prepare-inherited-gate.js

@@ -2,6 +2,7 @@ import { forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/s
 import { isLiveQuestionFace } from "../ask-question.js";
 import { parentSpecSeatOf } from "../parent-spec-seat.js";
 import { createPreToolUseConstraintPolicy } from "../hooks.js";
+import { continuesLineage } from "../session-policy-store.js";
 import { StubExecutionEnv } from "../stub-env.js";
 import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
@@ -21,7 +22,7 @@ export function prepareInheritedGate(input) {
             return [...seedRules];
         const merged = seedRules.map((s) => {
             const live = liveRules.find((l) => l.sessionId === s.sessionId && l.principal === s.principal);
-            const sameLineage = live === undefined || live.gen === undefined || s.gen === undefined || live.gen === s.gen;
+            const sameLineage = live === undefined || continuesLineage(live, s);
             return live !== undefined && sameLineage && live.rev >= s.rev ? live : s;
         });
         const extras = liveRules.filter((l) => !seedRules.some((s) => s.sessionId === l.sessionId && s.principal === l.principal));

package/dist/core/runner/resume-apply.js

@@ -176,7 +176,9 @@ export async function resumeApply(input) {
         const facts = plainPolicyOutcome.hostDecision;
         const settlement = facts.decidedBy === "sla_timeout"
             ? { kind: "park_sla_expired", who: { party: "host", ...(facts.approver !== undefined ? { approver: facts.approver } : {}) }, when: Date.now() }
-            : settledByPerson(plainPolicyOutcome.decision === "allow" ? "human_allowed" : "human_refused", facts.approver, plainPolicyOutcome.decision === "deny" ? plainPolicyOutcome.reason : undefined);
+            : facts.decidedBy === "policy"
+                ? { kind: "policy_refused", who: { party: "none" }, when: Date.now() }
+                : settledByPerson(plainPolicyOutcome.decision === "allow" ? "human_allowed" : "human_refused", facts.approver, plainPolicyOutcome.decision === "deny" ? plainPolicyOutcome.reason : undefined);
         plainPolicyOutcome = { ...plainPolicyOutcome, gateOutcome: mintGateOutcome({ ...(plainPolicyOutcome.decision === "deny" ? { deniedBy: "ask_resolution" } : {}), settled: { settlement, origin: parkedOrigin } }) };
     }
     const outcomeForStore = plainPolicyOutcome ?? plainReviewOutcome ?? plainParkOutcome;

package/dist/core/runner/resume-policy-outcome.js

@@ -5,7 +5,7 @@ import { sanitizeUntrustedText } from "../untrusted-text.js";
 import { assertOutcomeText, describeSuppliedValue, pendingContentAskCallId, sameWinner } from "./decide-continuation.js";
 const REFUSED_DECIDE_KEYS = [
     ["gateOutcome", "the settlement record is minted by core from the host's decision facts and the row's origin, never supplied"],
-    ["settledBy", 'a retired key — the host supplies decision FACTS as hostDecision{decidedBy: "person" | "sla_timeout", approver?} and core mints the settlement word from them'],
+    ["settledBy", 'a retired key — the host supplies decision FACTS as hostDecision{decidedBy: "person" | "sla_timeout" | "policy", approver?} and core mints the settlement word from them'],
     ["approver", "a retired key — the attribution rides the facts it belongs to, as hostDecision.approver"],
 ];
 export function resumePolicyOutcome(input) {
@@ -49,14 +49,14 @@ export function resumePolicyOutcome(input) {
         }
         const hostDecisionRaw = decide.hostDecision;
         if (typeof hostDecisionRaw !== "object" || hostDecisionRaw === null) {
-            throw new CheckpointError("checkpoint.invalid_outcome", `resume carries no hostDecision — a policy_ask decide names who decided it ({ decidedBy: "person" | "sla_timeout", approver? }); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
+            throw new CheckpointError("checkpoint.invalid_outcome", `resume carries no hostDecision — a policy_ask decide names who decided it ({ decidedBy: "person" | "sla_timeout" | "policy", approver? }); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
         }
         const decidedBy = hostDecisionRaw.decidedBy;
-        if (decidedBy !== "person" && decidedBy !== "sla_timeout") {
-            throw new CheckpointError("checkpoint.invalid_outcome", `resume hostDecision.decidedBy "${describeSuppliedValue(decidedBy)}" is outside the closed set — it is exactly "person" or "sla_timeout"; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
+        if (decidedBy !== "person" && decidedBy !== "sla_timeout" && decidedBy !== "policy") {
+            throw new CheckpointError("checkpoint.invalid_outcome", `resume hostDecision.decidedBy "${describeSuppliedValue(decidedBy)}" is outside the closed set — it is exactly "person", "sla_timeout" or "policy"; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
         }
-        if (decidedBy === "sla_timeout" && decision === "allow") {
-            throw new CheckpointError("checkpoint.invalid_outcome", `resume carries decision "allow" decided by "sla_timeout" — an elapsed SLA window cannot be what approved an action that EXECUTES; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
+        if (decidedBy !== "person" && decision === "allow") {
+            throw new CheckpointError("checkpoint.invalid_outcome", `resume carries decision "allow" decided by "${decidedBy}" — only a person approves an action that EXECUTES, and that word names a decision nobody made; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
         }
         const attribution = screenApproverAttribution(hostDecisionRaw.approver);
         if (attribution.defect !== undefined) {

package/dist/core/runner/run-harness-handlers.js

@@ -1,4 +1,4 @@
-import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
+import { observeThenableRejection } from "../safe-notify.js";
 import { forwardSafely } from "./forward-sink.js";
 import { emitTrace } from "../trace.js";
 import { primaryActivityArg } from "../arg-summary.js";
@@ -12,10 +12,7 @@ import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { batchResponseDigest, toolEndBodyFrom } from "./tool-end-body.js";
 export function createHarnessHandlers(input) {
     const { prepared, stats, rs, deps } = input;
-    const { spec, queue, internals, ident, parentToolCallId, subagentName, pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf, toolLabels, postToolBatchHook, batchArgs } = deps;
-    const internalsNotifier = createSafeNotifier({
-        onError: (f) => console.warn(`[sema-core] ${f.site}: run-internals activity sink threw (contained; further failures counted, not re-disclosed): ${f.error.message}`),
-    });
+    const { spec, queue, internals, ident, parentToolCallId, subagentName, pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf, toolLabels, postToolBatchHook, batchArgs, internalsNotifier } = deps;
     let lastWorkspaceCwd = prepared.cwdRef?.current;
     const announceWorkspaceMove = () => {
         const cwdNow = prepared.cwdRef?.current;

package/dist/core/runner/run-identity-wiring.d.ts

@@ -1,4 +1,5 @@
 import type { PeerInboundChainRef } from "../../agents/peer-admission.js";
+import { type SafeNotifier } from "../safe-notify.js";
 import { type NotificationInjectionOutcome, type PendingSessionNotifications, type SystemInjectionPriority, type TaskNotificationPayload } from "../task-notification.js";
 import type { PushQueue } from "../push-queue.js";
 import type { TaskEvent, TaskSpec } from "../types.js";
@@ -75,6 +76,11 @@ export interface RunIdentityWiringResult {
             followUp: number;
         } | undefined;
     };
+    /** The run's ONE isolation scope for the {@link RunInternals} observation sinks: minted here because
+     *  the manifest sink below is the run's first call into one, and handed on to the harness-handlers lane
+     *  so its activity beats are contained by the SAME account — bounded disclosure is per notifier, so a
+     *  second scope would report one broken sink twice and count it in two places. */
+    internalsNotifier: SafeNotifier;
     /** Did the run END with a person's steer / follow-up still pending (queued, or drained at the final boundary and
      *  never served)? A READ FACE over this lane's own `let`, written by the same undrained-inputs sink on BOTH its arms
      *  (park or not): the terminal-adoption lane folds it into the answer-settled verdict — a "stop" answer the person had

package/dist/core/runner/run-identity-wiring.js

@@ -1,5 +1,5 @@
 import { uuidv7 } from "../../internal/harness.js";
-import { createSafeNotifier } from "../safe-notify.js";
+import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { discloseDroppedPending, renderTaskNotificationXml, taskNotificationDedupKey } from "../task-notification.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
 export function runIdentityWiring(input) {
@@ -14,7 +14,12 @@ export function runIdentityWiring(input) {
     const parentToolCallId = internals?.parentToolCallId;
     const ident = () => parentToolCallId !== undefined ? { eventId: uuidv7(), parentToolCallId, sourceTaskId: runSourceTaskId } : { eventId: uuidv7() };
     notificationLane.ident = ident;
-    queue.push({ type: "wiring_manifest", manifest: prepared.wiringManifest, ...ident() });
+    const internalsNotifier = createSafeNotifier({
+        onError: (f) => console.warn(`[sema-core] ${f.site}: run-internals sink threw (contained; further failures counted, not re-disclosed): ${f.error.message}`),
+    });
+    const wiringManifest = prepared.wiringManifest;
+    queue.push({ type: "wiring_manifest", manifest: wiringManifest, ...ident() });
+    internalsNotifier.notify(() => observeThenableRejection(internals?.onWiringManifest?.(wiringManifest), internalsNotifier, "runtask.onWiringManifest"), "runtask.onWiringManifest");
     prepared.toolRosterDeltas.subscribe((delta) => queue.push({ type: "tool_roster_delta", delta, ...ident() }));
     prepared.toolDisclosure?.subscribe((snapshot) => queue.push({ type: "tool_disclosure", ...snapshot, ...ident() }));
     const delegationLifecycleNotifier = createSafeNotifier({
@@ -90,5 +95,5 @@ export function runIdentityWiring(input) {
     const loopLatch = { ended: false, userInterrupted: false, userHalted: false };
     onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch, reminderMark: prepared.reminderMark, sessionId: prepared.sessionId, runId: prepared.runId, hookTimeoutMs: prepared.hookTimeoutMs, hookIdentity: prepared.hookIdentity });
     const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, totalInputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
-    return { runSourceTaskId, parentToolCallId, ident, emitDelegationLifecycle, loopLatch, stats, undrainedUserAtEnd: { get current() { return undrainedUserAtEnd; } }, userInputLostAtEnd: { get current() { return userInputLostAtEnd; } } };
+    return { runSourceTaskId, parentToolCallId, ident, emitDelegationLifecycle, loopLatch, stats, internalsNotifier, undrainedUserAtEnd: { get current() { return undrainedUserAtEnd; } }, userInputLostAtEnd: { get current() { return userInputLostAtEnd; } } };
 }

package/dist/core/runner/run-leg.js

@@ -3,6 +3,7 @@ import { redactThenCut } from "../../agents/subagent-steps.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { CheckpointError, readPendingSteerQueue, realApprovalOrgFact, remainingBudgetMicroUsd } from "../checkpoint-store.js";
 import { normalizePersistedRuleHit } from "../gate-lanes.js";
+import { decidersNote } from "../gate-outcome.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permission-rule-org.js";
@@ -11,7 +12,7 @@ import { computeCostMicroUsd } from "../pricing.js";
 import { composeApprovalPostureDirective } from "../auto-mode-directive.js";
 import { mintSystemReminder, statedReminderBodiesOf } from "../reminder-mint.js";
 import { hasDestroy } from "../remote-env.js";
-import { advertisedWritableRootsSeat, refuseOutOfContractDecision } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
 import { callFaceSeat, judgeParkedToolIdentity, rosterEntryNamed, toolCallFaceOf } from "../tool-roster.js";
 import { deliverEngineNotice } from "../types.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
@@ -566,10 +567,15 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         ...(outcome.gateOutcome?.settlement !== undefined && outcome.gateOutcome.origin !== undefined ? { settled: { settlement: outcome.gateOutcome.settlement, origin: outcome.gateOutcome.origin } } : {}),
     });
     if (outcome.decision === "deny") {
-        const defaultDenial = outcome.gateOutcome?.settlement?.kind === "park_sla_expired"
+        const settlementKind = outcome.gateOutcome?.settlement?.kind;
+        const defaultDenial = settlementKind === "park_sla_expired"
             ? `No one answered the approval request for the pending tool call "${pendingAction.toolName}" — the approval window elapsed with no answer, so it was not executed.`
             : `The pending tool call "${pendingAction.toolName}" was denied by an approver.`;
-        const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason, REVIEWER_NOTE_MAX_BODY) : defaultDenial;
+        const reason = settlementKind === "policy_refused"
+            ? policyRefusalMessage(pendingAction.toolName, undefined, decidersNote(outcome.reason))
+            : outcome.reason
+                ? delimitUntrusted("reviewer note", outcome.reason, REVIEWER_NOTE_MAX_BODY)
+                : defaultDenial;
         await settleEnd(true, { content: formatHookFeedback(reason, prepared.reminderMark) });
         const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(reason, prepared.reminderMark), true));
         emitCommitted(eid, "toolResult", pendingAction.toolCallId);

package/dist/core/runner/runtask.js

@@ -414,7 +414,7 @@ export class Runner {
             runner: this.depsSeat, self: this, sessions: this.sessions, sessionReadStates: this.sessionReadStates, pendingSessionNotifications: this.pendingSessionNotifications,
             prepareTask,
             next: ({ prepared, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef, modelCatalog, notificationLane, unsubscribeTaskNotifications }) => {
-                const { runSourceTaskId, parentToolCallId, ident, emitDelegationLifecycle, loopLatch, stats, undrainedUserAtEnd, userInputLostAtEnd } = runIdentityWiring({
+                const { runSourceTaskId, parentToolCallId, ident, emitDelegationLifecycle, loopLatch, stats, internalsNotifier, undrainedUserAtEnd, userInputLostAtEnd } = runIdentityWiring({
                     spec, queue, prepared, internals, taskIdRef, onReady, manualCompactRef, notifyRef, captureOptOutRef, mcpRedialRef, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef,
                     notificationLane, pendingSessionNotifications: this.pendingSessionNotifications, runner: this.depsSeat,
                 });
@@ -442,7 +442,7 @@ export class Runner {
                             deps: {
                                 spec, queue, internals, ident, parentToolCallId, subagentName,
                                 pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf,
-                                toolLabels, postToolBatchHook, batchArgs,
+                                toolLabels, postToolBatchHook, batchArgs, internalsNotifier,
                                 runnerHooks: { onError: (e, info) => this.deps.onError?.(e, info) },
                             },
                         });

package/dist/core/runner/session-rule-policy.d.ts

@@ -1,7 +1,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ToolEffect } from "../types.js";
 import { type NamedToolPolicy } from "../tool-policy.js";
-import type { SessionPermissionRules, SessionPolicyStore, StoredSessionRules } from "../session-policy-store.js";
+import { type SessionPermissionRules, type SessionPolicyStore, type StoredSessionRules } from "../session-policy-store.js";
 /** Tool names whose write target is the `file_path`/`path` arg ({@link fileArgPath}).
  *
  *  REF-B3 — the ONE definition of that narrower set. Production consumer today:

package/dist/core/runner/session-rule-policy.js

@@ -1,5 +1,6 @@
 import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from "../../tools/fs/safety.js";
 import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
+import { continuesLineage } from "../session-policy-store.js";
 import { thrownText } from "../thrown-value.js";
 import { ruleDenialSentence } from "../rule-denial-sentence.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
@@ -61,13 +62,11 @@ export function createLiveSessionRules(store, floor, hooks) {
             return enforced;
         }
         if (enforced.rev > 0) {
-            if (live.gen !== undefined && enforced.gen !== undefined) {
-                if (live.gen !== enforced.gen) {
-                    announce(`session ${JSON.stringify(floor.sessionId)} has a rules row of a new lineage (generation ${live.gen}, rev ${live.rev}), which does not continue the row this leg enforces (generation ${enforced.gen})`);
-                    return enforced;
-                }
+            if (!continuesLineage(live, enforced)) {
+                announce(`session ${JSON.stringify(floor.sessionId)} has a rules row of a new lineage (generation ${live.gen}, rev ${live.rev}), which does not continue the row this leg enforces (generation ${enforced.gen})`);
+                return enforced;
             }
-            else if (vanished) {
+            if (vanished && live.gen === undefined) {
                 announce(`session ${JSON.stringify(floor.sessionId)} has a new rules row at rev ${live.rev} after the row this leg enforced was deleted, and its backend carries no lineage to continue it by`);
                 return enforced;
             }
@@ -89,7 +88,7 @@ export function createLiveSessionRules(store, floor, hooks) {
         if (handedRead !== undefined) {
             handed.delete(toolCallId);
             const claimed = await handedRead;
-            if (claimed.rev >= enforced.rev)
+            if (continuesLineage(claimed, enforced) && claimed.rev >= enforced.rev)
                 return claimed;
         }
         const p = read(signal);