@sema-agent/core 7.33.7 → 7.34.0

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -1,8 +1,8 @@
 /**
  * PrepareTask's INHERITED-GATE phase, verbatim from the driver: the live/seed fold of the
- * chain this run inherits (ancestor rules rev-monotonic per (session, principal), shellGate by max rank, the
- * re-supplied parent constraints with their rebuilt denial trackers, the auto-mode intent, the org-admission
- * freeze with its tighten-only intersection and the monotonic governed bit), the effective shellGate against the
+ * chain this run inherits (ancestor rules rev-monotonic per (session, principal), the shell floor, the
+ * re-supplied parent constraints with their rebuilt denial trackers, the permission mode's live seat, the org-admission
+ * freeze with its tighten-only intersection and the monotonic governed bit), the effective shell floor against the
  * spec, the three cells later phases fill for the children's chain (own session rules, own admitted org scopes,
  * own org verdict), the checkpoint-section closures the suspend serializer reads (face / org / F-012 stamps), the
  * FROZEN ask and question seats (spec over deps), the parent SPEC seat the children inherit, the two delegation refs the memory phase binds late, the ONE
@@ -44,9 +44,10 @@ import type { DelegationContentSafety } from "../memory-engine/delegation-proven
 import { type SessionPermissionRules } from "../session-policy-store.js";
 import type { SessionStore } from "../session.js";
 import { type OnAsk } from "../tool-policy.js";
-import type { ApproverPosture, RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskEvent, TaskSpec, ToolExecuteContext, ToolSpec } from "../types.js";
+import type { PermissionMode, RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskEvent, TaskSpec, ToolExecuteContext, ToolSpec } from "../types.js";
+import { PermissionModeController } from "../mode-policy.js";
 import type { ActiveSkillScope } from "./active-skill-scope.js";
-import type { InheritedGate, Prepared, PrepareResume, RunInternals, StopForDenialLimit, ToolFaceSnapshot } from "./contracts.js";
+import type { InheritedGate, Prepared, PrepareResume, RunInternals, StopForDenialLimit, ToolFaceSnapshot, WriteFaceSeat } from "./contracts.js";
 export interface PrepareInheritedGateInput {
     /** borrowed-readonly — the REBOUND spec. Read: `shellGate` (the own doctrine the chain fold tightens), `durableApproval`
      *  (the mandate tests + the children's copy), `onAsk`/`onQuestion` (the frozen seats), `handsReadOnly` / `interactiveTools`
@@ -68,7 +69,7 @@ export interface PrepareInheritedGateInput {
     internals: Pick<RunInternals, "inheritedGate" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork" | "questionFaceStripped"> | undefined;
     /** borrowed-readonly — the resume leg, or undefined on a fresh one: `seed.inheritedGate` is the CHECKPOINT half of the chain
      *  fold (the trust floor the live half may only tighten), `seed.readFace` the hands-less re-park's carried section. */
-    resume: Pick<PrepareResume, "seed"> | undefined;
+    resume: Pick<PrepareResume, "seed" | "outcome"> | undefined;
     /** borrowed-readonly — the session store's fork face: `fork` / `release` are bound into the ctx's `hostSessionFork` (present
      *  only when the store can fork). */
     sessions: Pick<SessionStore, "fork" | "release">;
@@ -95,10 +96,9 @@ export interface PrepareInheritedGateInput {
     promptProfile: ToolExecuteContext["promptProfile"];
     /** borrowed-readonly — the resolved interaction posture (ctx seat; absent ⇒ no key). */
     resolvedInteractionPosture: ToolExecuteContext["interactionPosture"];
-    /** borrowed-readonly — the task's own auto-mode intent seat, screened and snapshotted before the first await. */
-    autoModeSeat: boolean;
-    /** borrowed-readonly — the task's own approver-posture seat, screened and snapshotted before the first await. */
-    approverPostureSeat: ApproverPosture | undefined;
+    /** borrowed-readonly — the task's own permission-mode key, screened and snapshotted before the first await (undefined =
+     *  declared nothing: a root runs `default`, a child inherits). */
+    permissionModeSeat: PermissionMode | undefined;
     /** borrowed-readonly — whether an execution env is wired at all (the full-shell predicate's first term). */
     handsEnabled: boolean;
     /** borrowed-readonly — the nested-usage sink the ctx forwards. */
@@ -121,8 +121,8 @@ export interface PrepareInheritedGateInput {
     }) => void;
     /** borrowed-readonly — see `requestReview`. */
     requestStopAfterTurn: () => void;
-    /** borrowed-readonly — see `requestReview`. */
-    enterPlanMode: () => void;
+    /** borrowed-readonly — see `requestReview`; a steer of the leg's mode seat into `plan`. */
+    enterPlanMode: () => Promise<void>;
     /** borrowed-readonly — the leg's reminder mark (ctx seat). */
     reminderMark: string;
     /** borrowed-readonly — the leg's disclosure counters (ctx seat; the outlets that bump them are not in this phase). */
@@ -163,8 +163,8 @@ export interface PrepareInheritedGateInput {
     observersActive: () => boolean;
     /** borrowed-readonly — LATE-BOUND: the hands mount's resolved read face (undefined until/unless hands mount). */
     resolvedReadFace: () => ContainmentFace | undefined;
-    /** borrowed-readonly — LATE-BOUND: the hands mount's resolved WRITE face (the read seat's twin). */
-    resolvedWriteFace: () => ContainmentFace | undefined;
+    /** borrowed-readonly — LATE-BOUND: the hands mount's WRITE face seat (the read seat's twin; read per call, and whether its fence is declared). */
+    resolvedWriteFace: () => WriteFaceSeat | undefined;
     /** borrowed-readonly — LATE-BOUND: the normalized deny additions in force (empty until the hands mount resolves them). */
     readDenyAdditionsNormalized: () => ReadonlyArray<{
         pattern: string;
@@ -173,7 +173,7 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — LATE-BOUND: the hands-less legs' resolved face (the carrier's second source). */
     handsLessResolvedFace: () => ContainmentFace | undefined;
     /** borrowed-readonly — LATE-BOUND: the hands-less legs' resolved WRITE face (same second source, write seat). */
-    handsLessResolvedWriteFace: () => ContainmentFace | undefined;
+    handsLessResolvedWriteFace: () => WriteFaceSeat | undefined;
     /** borrowed-readonly — LATE-BOUND: the adopted center artifact (ctx `centerArtifactDigest` / `centerSourceRevision`). */
     centerAdoption: () => {
         artifact: PromptEpochArtifact;
@@ -189,22 +189,22 @@ export interface PrepareInheritedGateResult {
     seedInheritedGate: PrepareResume["seed"]["inheritedGate"];
     /** owned — the rev-monotonic fold of the two halves' ancestor rules (live replaces per (session, principal) only at ≥ rev). */
     inheritedAncestorRules: InheritedGate["ancestorRules"];
-    /** owned — the max-rank fold of the two halves' shellGate doctrines (before the spec's own is applied). */
+    /** owned — the chain's shell floor (live or seed; the seed's migrated word), before the spec's own is applied. */
     inheritedShellGate: InheritedGate["shellGate"];
     /** owned — the live parent constraints with a fresh denial tracker attached per rebuilt decider. */
     inheritedParentConstraints: NonNullable<InheritedGate["parentConstraints"]>[number][] | undefined;
-    /** owned — the auto-mode INTENT (own seat ∨ live chain ∨ checkpoint bit); the arming site judges the other two arms. */
-    autoModeIntent: boolean;
-    /** owned — the resolved approver POSTURE (own seat, else the live chain's, else the checkpoint's); rendered, never enforced. */
-    approverPosture: ApproverPosture | undefined;
+    /** owned — the leg's live permission-mode seat: the spec's request clamped under the chain's ceiling (a parent's live
+     *  seat, or the checkpoint's recorded word), folded against the arming facts the caps phase binds later. Every mode
+     *  consumer reads `current` at its own call; the steer verb writes it. */
+    permissionMode: PermissionModeController;
     /** owned — the seed ∩ live admitted org scopes (one side absent ⇒ the other; both absent ⇒ undefined). */
     inheritedAdmittedOrgScopes: readonly string[] | undefined;
     /** owned — the prior own org verdict: checkpoint ∩ same-session ref (either alone stands; neither ⇒ undefined). */
     priorOwnOrgVerdict: OwnOrgAdmissionVerdict | undefined;
     /** owned — the monotonic governed-provenance bit for this leg. */
     orgGovernedProvenance: boolean;
-    /** owned — the spec's own shellGate tightened by the inherited doctrine. */
-    effectiveShellGate: ShellGateDoctrine;
+    /** owned — the operator's shell floor in force (the spec's, or the chain's); undefined = no floor. */
+    effectiveShellGate: ShellGateDoctrine | undefined;
     /** borrowed-mutable — THIS task's own session-rule snapshot for its children's chain. Writers (R-3): the policy-chain
      *  station's session-policy read, once per leg, when a store is wired and the task carries its own sessionId. Read by
      *  `inheritedGateForChildren` at spawn time. */

package/dist/core/runner/prepare-inherited-gate.js

@@ -5,10 +5,13 @@ import { createPreToolUseConstraintPolicy } from "../hooks.js";
 import { continuesLineage } from "../session-policy-store.js";
 import { StubExecutionEnv } from "../stub-env.js";
 import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
+import { deliverEngineNotice } from "../types.js";
+import { PermissionModeController, modeRequestAfterResume } from "../mode-policy.js";
+import { migrateLegacyModeSeed } from "../checkpoint-store.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { asThrownError } from "../thrown-value.js";
 export function prepareInheritedGate(input) {
-    const { spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, autoModeSeat, approverPostureSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
+    const { spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
     const seedInheritedGate = resume?.seed.inheritedGate;
     const inheritedAncestorRules = (() => {
@@ -28,19 +31,31 @@ export function prepareInheritedGate(input) {
         const extras = liveRules.filter((l) => !seedRules.some((s) => s.sessionId === l.sessionId && s.principal === l.principal));
         return [...merged, ...extras];
     })();
-    const shellGateRank = { off: 0, classify: 1, always: 2 };
-    const liveShellGate = liveInheritedGate?.shellGate;
-    const seedShellGate = seedInheritedGate?.shellGate;
-    const inheritedShellGate = liveShellGate === undefined
-        ? seedShellGate
-        : seedShellGate === undefined
-            ? liveShellGate
-            : shellGateRank[liveShellGate] >= shellGateRank[seedShellGate]
-                ? liveShellGate
-                : seedShellGate;
+    const modeSeed = migrateLegacyModeSeed(seedInheritedGate);
+    if (modeSeed.migrated !== undefined) {
+        deliverEngineNotice(deps.onNotice, {
+            code: "resume.legacy_mode_seed_migrated",
+            message: `the resumed checkpoint row carried pre-mode keys (${modeSeed.migrated.droppedKeys.join(", ")}); read once into ${modeSeed.migrated.permissionMode !== undefined ? `permissionMode: "${modeSeed.migrated.permissionMode}"` : "no mode of its own (the chain's ceiling stands)"}${modeSeed.shellGate !== undefined ? ' with the shell floor "always" kept' : ""} — the next suspend writes the one key; from 7.35.0 a row still carrying these keys is refused`,
+            detail: { migrated: { ...(modeSeed.migrated.permissionMode !== undefined ? { permissionMode: modeSeed.migrated.permissionMode } : {}), droppedKeys: [...modeSeed.migrated.droppedKeys] }, sessionId, runId },
+        });
+    }
+    const inheritedShellGate = liveInheritedGate?.shellGate ?? modeSeed.shellGate;
     const inheritedParentConstraints = attachRebuiltDenialTrackers(liveInheritedGate?.parentConstraints, deps.autoMode?.denialLimit);
-    const autoModeIntent = autoModeSeat || liveInheritedGate?.autoModeRequested === true || seedInheritedGate?.autoModeRequested === true;
-    const approverPosture = [approverPostureSeat, liveInheritedGate?.approverPosture, seedInheritedGate?.approverPosture].find((w) => w !== undefined);
+    const parentSeat = liveInheritedGate?.permissionModeCeiling;
+    const ceiling = parentSeat ?? liveInheritedGate?.permissionMode;
+    const announceModeFold = (receipt) => {
+        if (receipt.foldedBy === undefined)
+            return;
+        const requested = receipt.requested ?? "default";
+        const because = receipt.foldedBy === "operator_deny" ? "the deployment denies it for this principal" : receipt.foldedBy === "face_absent" ? "no auto-mode classifier face is wired on this deployment" : `the parent leg's mode is the ceiling a child's declaration is clamped under`;
+        const message = `permission mode "${requested}" is not available on this leg (${because}) — it runs under "${receipt.effective}"`;
+        deliverEngineNotice(deps.onNotice, { code: "config.permission_mode_unavailable", message, detail: { requested, effective: receipt.effective, by: receipt.foldedBy, sessionId, runId } });
+        if (receipt.foldedBy === "inherited_ceiling" && parentSeat !== undefined) {
+            deliverEngineNotice(deps.onNotice, { code: "config.permission_mode_unavailable", message: `${message} (a child leg, ${sessionId})`, detail: { requested, effective: receipt.effective, by: receipt.foldedBy, sessionId: parentSeat.sessionId, childSessionId: sessionId, runId } });
+        }
+    };
+    const permissionMode = new PermissionModeController(modeRequestAfterResume(permissionModeSeat, modeSeed, resume?.outcome), ceiling, { onFold: announceModeFold, ...(modeSeed.prePlanMode !== undefined ? { prePlanMode: modeSeed.prePlanMode } : {}) });
+    announceModeFold(permissionMode.receipt());
     const liveAdmittedOrg = liveInheritedGate?.admittedOrgScopes;
     const seedAdmittedOrg = seedInheritedGate?.admittedOrgScopes;
     const inheritedAdmittedOrgScopes = liveAdmittedOrg === undefined ? seedAdmittedOrg : seedAdmittedOrg === undefined ? liveAdmittedOrg : liveAdmittedOrg.filter((s) => seedAdmittedOrg.includes(s));
@@ -64,8 +79,7 @@ export function prepareInheritedGate(input) {
         deps.compliancePostureResolver !== undefined ||
         inheritedOrgGoverned ||
         priorOwnOrgVerdict !== undefined;
-    const specShellGate = spec.shellGate ?? "off";
-    const effectiveShellGate = inheritedShellGate !== undefined && shellGateRank[inheritedShellGate] > shellGateRank[specShellGate] ? inheritedShellGate : specShellGate;
+    const effectiveShellGate = spec.shellGate ?? inheritedShellGate;
     const ownSessionRulesRef = {};
     const ancestorSessionRulesRef = { current: new Map() };
     const ancestorRulesNow = () => inheritedAncestorRules === undefined ? undefined : inheritedAncestorRules.map((a, i) => ancestorSessionRulesRef.current.get(i) ?? a);
@@ -92,8 +106,8 @@ export function prepareInheritedGate(input) {
     };
     const faceCheckpointState = () => faceCheckpointSection() !== undefined;
     const writeFaceCheckpointSection = () => {
-        const face = input.resolvedWriteFace() ?? input.handsLessResolvedWriteFace();
-        return face === "open" ? { face } : undefined;
+        const seat = input.resolvedWriteFace() ?? input.handsLessResolvedWriteFace();
+        return seat === undefined ? undefined : seat.inForce() === "open" ? { face: "open" } : seat.fenced ? { face: "roots" } : undefined;
     };
     const f012CheckpointState = () => (inheritedParentConstraints?.length ?? 0) > 0 ||
         seedInheritedGate?.constraintChain !== undefined ||
@@ -114,7 +128,7 @@ export function prepareInheritedGate(input) {
     const delegationSettlementRef = {};
     const delegationSettlementForChildren = () => delegationSettlementRef.current;
     const inheritedGateForChildren = () => {
-        const autoModeDecider = input.autoModeDecider();
+        const autoModeDecider = permissionMode.current === "auto" ? input.autoModeDecider() : undefined;
         const autoModeDenialTracking = input.autoModeDenialTracking();
         const autoModeArming = input.autoModeArming();
         const ancestorRules = [
@@ -166,16 +180,16 @@ export function prepareInheritedGate(input) {
         ];
         return {
             ...(ancestorRules.length > 0 ? { ancestorRules } : {}),
-            ...(effectiveShellGate !== "off" ? { shellGate: effectiveShellGate } : {}),
-            ...(autoModeIntent ? { autoModeRequested: true } : {}),
-            ...(approverPosture !== undefined ? { approverPosture } : {}),
+            ...(effectiveShellGate !== undefined ? { shellGate: effectiveShellGate } : {}),
+            permissionMode: permissionMode.current,
+            permissionModeCeiling: { get current() { return permissionMode.current; }, sessionId },
             ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
             admittedOrgScopes: memoryAdmittedOrgScopesRef.current,
             ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
         };
     };
     const carrierReadFace = () => input.resolvedReadFace() ?? input.handsLessResolvedFace();
-    const carrierWriteFace = () => input.resolvedWriteFace() ?? input.handsLessResolvedWriteFace();
+    const carrierWriteFace = () => (input.resolvedWriteFace() ?? input.handsLessResolvedWriteFace())?.inForce();
     const fullShellReachable = handsEnabled &&
         !(executionEnv instanceof StubExecutionEnv) &&
         spec.handsReadOnly !== true &&
@@ -281,5 +295,5 @@ export function prepareInheritedGate(input) {
             ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
         };
     };
-    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, approverPosture, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
+    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
 }

package/dist/core/runner/prepare-park-ask.d.ts

@@ -114,8 +114,8 @@ export interface PrepareParkAskInput {
     /** borrowed-readonly — the shell-seat provenance set: the shell-running tools whose tier is the engine's shell seat's, not a
      *  deployment mark (the risk descriptor's `shellGated` is the gated tool's membership). */
     shellGatedTools: ReadonlySet<string>;
-    /** borrowed-readonly — the effective shell-gate doctrine persisted on the descriptor. */
-    effectiveShellGate: ShellGateDoctrine;
+    /** borrowed-readonly — the operator's shell floor (`"always"`), persisted on a shell-gated descriptor; undefined = no floor. */
+    effectiveShellGate: ShellGateDoctrine | undefined;
     /** borrowed-readonly — the EFFECTIVE durable-approval opt-in (the caller's, or the synthesized mandate scope): picks the
      *  gate kind, the scope and the ttl. */
     durableApproval: TaskSpec["durableApproval"];

package/dist/core/runner/prepare-park-ask.js

@@ -242,7 +242,7 @@ export function prepareParkAsk(input) {
                     ...(probeReason !== undefined ? { probeReason } : {}),
                     ...(probeCause !== undefined ? { probeCause } : {}),
                     shellGated: shellGatedTools.has(req.toolName),
-                    shellGateDoctrine: effectiveShellGate,
+                    ...(effectiveShellGate !== undefined ? { shellGateDoctrine: effectiveShellGate } : {}),
                 });
                 gate =
                     safety !== undefined || rowRealApproval !== undefined
@@ -281,6 +281,7 @@ export function prepareParkAsk(input) {
                 const clearanceFacts = {
                     ...(carry?.mandated === true || storedShapeMandated ? { mandated: true } : {}),
                     ...(carry?.mandate !== undefined && !storedShapeMandated ? { mandate: carry.mandate } : {}),
+                    ...(carry?.authoredBy === "deployment" ? { authoredBy: "deployment" } : {}),
                     ...(rowRealApproval !== undefined ? { requiresRealApproval: true } : {}),
                     ...(shadowedRule !== undefined ? { persistedRuleShadowed: shadowedRule } : {}),
                     ...(askDecisionReason !== undefined ? { decisionReason: askDecisionReason } : {}),

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -32,6 +32,8 @@ import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { ReadDenyMatcher } from "../../tools/fs/read-deny.js";
 import { type ActiveSkillScope } from "./active-skill-scope.js";
 import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, StopForDenialLimit } from "./contracts.js";
+import { type Arbitration } from "../ask-origin.js";
+import { type ModeGateSeats, type PermissionModeController } from "../mode-policy.js";
 import { createRuleOffersOf, type PermissionRuleLanes } from "./permission-rule-lanes.js";
 export interface PreparePolicyChainInput {
     /** borrowed-readonly — the REBOUND spec. Read: `sessionId` / `principal` (the session-rule read and the lanes' identity),
@@ -54,6 +56,9 @@ export interface PreparePolicyChainInput {
     hostTaskId: string;
     /** borrowed-readonly — the FINAL task root (path rules resolve against it; the lanes' and the offers' root). */
     taskRootFinal: string;
+    /** borrowed-readonly — the leg's canonical write roots beyond the task root (`additionalDirectories` + advertised writable
+     *  dirs): the `acceptEdits` mode gate allows writes inside the root and these, and asks outside them all. */
+    additionalRootsCanonical: readonly string[];
     /** borrowed-readonly — the run's resolved env (path rules resolve in it; the sandbox declaration is read off it). */
     executionEnv: ExecutionEnv;
     /** borrowed-readonly — the frozen preflight: `toolPolicy` (the caller slot) and `basePolicyForResumeEdit` (the lock-aware
@@ -83,6 +88,8 @@ export interface PreparePolicyChainInput {
     handsCwdRef: CwdRef | undefined;
     /** borrowed-readonly — the compiled read-deny judge, or undefined (the offer factory's directory negative control). */
     readDenyMatcher: ReadDenyMatcher | undefined;
+    /** borrowed-readonly — the run's one notice for a person's rule store that could not be read (`ruleStoreUnreadableNotice`). */
+    announceRuleStoreSkipped: (at: "prepare" | "call") => void;
     /** borrowed-readonly — whether the question tool mounted (the lanes' question-tool exclusion). */
     questionToolMounted: boolean;
     /** borrowed-readonly — the resolved per-principal entitlements; only `forceDurableGate` (the mandate-park facility and
@@ -117,8 +124,15 @@ export interface PreparePolicyChainInput {
     hookEnvSource: unknown;
     /** borrowed-readonly — the own-hook crash reporter (the timeout seat's bad-value disclosure). */
     notifyOwnHookCrash: (err: unknown) => void;
-    /** borrowed-readonly — this task's own classifier instance, or undefined (the pass-through test's decider term). */
-    autoModeDecider: AutoModeDecider | undefined;
+    /** borrowed-readonly — LATE-BOUND: this task's own classifier instance (the pass-through test's decider term), read at chain
+     *  assembly (the arming runs after this phase, and again on a steer into `auto`). */
+    autoModeDecider: () => AutoModeDecider | undefined;
+    /** borrowed-readonly — the leg's live permission-mode seat: the mode gate policy layer and the inherited stations' arbitration
+     *  read `current` per call. */
+    permissionMode: PermissionModeController;
+    /** borrowed-readonly — the task's scratchpad directory (the mode write gate's one exemption), or undefined. */
+    scratchpadDir: string | undefined;
+    /** borrowed-readonly — the leg's live roster seat; the mode write gate reads `current` per call. */ toolRosterDeltas: NonNullable<ModeGateSeats["roster"]>;
     /** borrowed-readonly — the run's ONE typed stop for a denial-limit bound (the fallback settlements call it). */
     stopForDenialLimit: StopForDenialLimit;
     /** borrowed-readonly — the effective delegation facts; only `isDelegatedChild` (the ask source identity). */
@@ -161,6 +175,12 @@ export interface PreparePolicyChainResult {
     /** borrowed-mutable — the inherited-unavailable marker channel. Writers: the inherited arms here (mark); the gate station
      *  (the lifecycle-end sweep) and the park lane's consumers (delete on consumption). */
     inheritedUnavailableAsks: Set<string>;
+    /** owned — the inherited stations' MODE ARBITRATIONS by tool call (a release or a refusal made inside the fold,
+     *  where an ancestor's ask is arbitrated before its frozen approver). Writers: the three inherited stations here; the gate's
+     *  exit reads it onto the disposition and the gate station deletes it at the call's end. */
+    ancestorArbitrations: Map<string, Exclude<Arbitration, {
+        kind: "ask";
+    }>>;
     /** borrowed-mutable — the grant record. Writers: the inherited arms here (record a clean allow at a live approver);
      *  the gate station (consume on reuse, sweep at settlement). */
     inheritedAskGrants: Map<string, {

package/dist/core/runner/prepare-policy-chain.js

@@ -1,5 +1,6 @@
 import { policyAskClassOf } from "../ask-class.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
+import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
 import { assertHookSeatsCallable } from "../hook-seats.js";
@@ -10,16 +11,27 @@ import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
 import { createActiveSkillScopePolicy } from "./active-skill-scope.js";
-import { askMandateMember, probeMandatedAsk } from "../ask-origin.js";
+import { arbitrateByMode, askMandateMember, classifyAsk } from "../ask-origin.js";
+import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
-import { headlessDenyAtFold, headlessDenyAtRecheck, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
+import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
 import { settleReadRootGrant } from "./read-root-grant.js";
 import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
 import { thrownText } from "../thrown-value.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const ancestorArbitrations = new Map();
+    const arbitrateInherited = (ask, toolCallId) => {
+        const verdict = arbitrateByMode(permissionMode.current, classifyAsk(ask, INHERITED_STATION_FACTS), { ...(ask.origin !== undefined ? { origin: ask.origin } : {}), ...(ask.mandate !== undefined ? { mandate: ask.mandate } : {}) });
+        if (verdict.kind === "ask" || verdict.kind === "accepted")
+            return undefined;
+        ancestorArbitrations.set(toolCallId, verdict);
+        if (verdict.kind === "released")
+            return { action: "allow", message: `released by the ${verdict.mode} permission mode at an inherited ancestor layer (the ${verdict.askClass} ask was not put to anyone)`, decisionReason: "mode", ...(ask.updatedInput !== undefined ? { updatedInput: ask.updatedInput } : {}) };
+        return { action: "deny", message: `refused by the ${verdict.mode} permission mode at an inherited ancestor layer (${verdict.askClass})`, decisionReason: "mode" };
+    };
     const policy = lockedPreflight.toolPolicy;
     const auditPolicyNames = (auditee) => {
         const nameGroups = toolPolicyNameSets(auditee);
@@ -288,6 +300,8 @@ export async function preparePolicyChain(input) {
         questionToolName: ASK_USER_QUESTION_TOOL_NAME,
         onRevisionDefect: (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }),
         onDisclosure: (message) => emitTrace(deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: hostTaskId, message, ts: Date.now() })),
+        onStoreUnreadable: announceRuleStoreSkipped,
+        signal: abortController.signal,
     });
     const ruleOffersOf = createRuleOffersOf({
         laneArmed: permissionRuleLane !== undefined,
@@ -336,7 +350,7 @@ export async function preparePolicyChain(input) {
             }
             if (re.updatedInput !== undefined)
                 editArgs = re.updatedInput;
-            const judged = await judgeInheritedClassifier({ autoMode: ancestorDecider !== undefined ? { decider: ancestorDecider, denialTracking: ancestorTracker } : undefined, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs });
+            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorDecider !== undefined ? { decider: ancestorDecider, denialTracking: ancestorTracker } : undefined, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
                 const cleared = { ...judged.result };
                 carryEngineAttestations(judged.result, cleared);
@@ -347,6 +361,12 @@ export async function preparePolicyChain(input) {
                 return vetoed(judged.result);
             const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
             re = editAsk;
+            const editArbitrated = arbitrateInherited(re, creq.toolCallId);
+            if (editArbitrated !== undefined) {
+                const out = editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs } : editArbitrated;
+                carryPrecedingSettlement(settledBy, out);
+                return out;
+            }
             const rr = await resolveAsk({
                 toolName: creq.toolName,
                 toolCallId: creq.toolCallId,
@@ -381,7 +401,7 @@ export async function preparePolicyChain(input) {
         pc.contentMandate !== true &&
         askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
         pc.hookEnv === hookEnvSource &&
-        pc.autoMode?.decider === autoModeDecider
+        pc.autoMode?.decider === autoModeDecider()
         ? { check: () => ({ action: "allow" }) }
         : policy !== undefined && pc.policy === policy
             ? {
@@ -412,16 +432,19 @@ export async function preparePolicyChain(input) {
                             return first;
                         return mandateUnreconstructibleDeny(creq);
                     }
-                    const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call" });
+                    const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call", unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
                     if (judged.kind === "allow")
                         return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName) && !probeMandatedAsk(inheritedAsk)) {
+                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName) && classifyAsk(inheritedAsk, INHERITED_STATION_FACTS).row.sandboxAdmission) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return { action: "allow" };
                     }
+                    const arbitrated = arbitrateInherited(inheritedAsk, creq.toolCallId);
+                    if (arbitrated !== undefined)
+                        return arbitrated;
                     const presentedArgs = creq.args;
                     const askT0 = now();
                     const resolved = await resolveAsk({
@@ -484,16 +507,19 @@ export async function preparePolicyChain(input) {
                         return mandateUnreconstructibleDeny(creq);
                     }
                     const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                    const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput });
+                    const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
                     if (judged.kind === "allow")
                         return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName) && !probeMandatedAsk(inheritedAsk)) {
+                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName) && classifyAsk(inheritedAsk, INHERITED_STATION_FACTS).row.sandboxAdmission) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
                     }
+                    const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId);
+                    if (arbitrated !== undefined)
+                        return arbitrated;
                     const askT0 = now();
                     const resolved = await resolveAsk({
                         toolName: creq.toolName,
@@ -555,6 +581,7 @@ export async function preparePolicyChain(input) {
             return d;
         },
     }));
+    const modeGateLayer = createModeGatePolicy(permissionMode, { env: executionEnv, rootPath: taskRootFinal, acceptDirs: [taskRootFinal, ...additionalRootsCanonical], roster: toolRosterDeltas, readOnlyDeclared: (name) => mountedToolDeclaresReadOnly(tools, name), ...(scratchpadDir !== undefined ? { exemptDirs: [scratchpadDir] } : {}) });
     const policyLayers = [
         ...narrowingLayers,
         ...instrumentedChain,
@@ -562,8 +589,8 @@ export async function preparePolicyChain(input) {
     ];
     const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy()];
     const guardedPolicyLayers = rewriteCapableLayers
-        ? [...integrityGuardLayers, ...policyLayers, ...integrityGuardLayers]
-        : [...integrityGuardLayers, ...policyLayers];
+        ? [...integrityGuardLayers, ...policyLayers, modeGateLayer, ...integrityGuardLayers]
+        : [...integrityGuardLayers, ...policyLayers, modeGateLayer];
     const foldedPolicy = guardedPolicyLayers.length === 1 ? guardedPolicyLayers[0] : combinePolicies(...guardedPolicyLayers);
     const effectivePolicy = foldedPolicy !== undefined && rewriteCapableLayers
         ? {
@@ -631,7 +658,7 @@ export async function preparePolicyChain(input) {
             },
         }
         : foldedPolicy;
-    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions };
+    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
 }
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -1,3 +1,28 @@
+/**
+ * PrepareTask's PROTOCOL-TOOLS phase, verbatim from the driver: the MCP materialization
+ * with its operator face (fail-open warnings once per session, the intake drops, the announce-lane prune), the
+ * reserved-name refusal, the roster push through the large-result wrapper, the RefreshMcpTools seam with its
+ * refresh closure, the two run-time seats the rebuild closures reach (`rebuildHarnessToolsRef`,
+ * `contentOriginWrapRef`) and the gate-armed honesty flag, the protocol-SHARED axis fold, and the A2A twin
+ * (materialize, warnings straight to the sink, its own reserved-name refusal, the same fold). The interface
+ * is the dependency list the segment had implicitly.
+ *
+ * ASYNC PHASE: the segment awaits the two materializers, exactly where the driver awaited them; the phase adds
+ * no yield BEFORE the first of those awaits. Read-stability of the host handles for the call:
+ * {@link RunInternals} (`@contract prepare.deps-read-stable`).
+ *
+ * The handles and the rollback stack. This phase is the first that acquires a handle INSIDE
+ * its body: the driver used to see `mcp` / `a2a` only because they were hoisted `let`s at function scope, so
+ * its catch could dispose a half-acquired pair. Those hoists are gone. The moment a materializer returns a
+ * real handle the phase pushes its `dispose` onto the driver-owned `rollback`; a prepare that throws AFTER
+ * this phase reaches the driver's catch, whose `unwindAll` disposes the peers, then the clients — the reverse
+ * acquisition order the hoisted legs kept, each bounded and reported. The two reserved-name arms only THROW:
+ * the release of what they refused is the rollback entry, called exactly once by that unwind (they used to
+ * dispose inline as well — a hoist-era leftover that leaned on dispose being idempotent; the transcript pins
+ * the single call). On the success path the stack is committed and the handles belong to `Prepared` (the
+ * Runner's finish releases them).
+ */
+import type { ToolMarkSource } from "../ask-origin.js";
 import type { AgentTool } from "../../internal/harness.js";
 import { type MaterializedMcp, type McpDroppedTool, type McpReconnectResult } from "../mcp.js";
 import { type MaterializedA2a } from "../a2a.js";
@@ -59,6 +84,9 @@ export interface PrepareProtocolToolsInput {
     irreversibleTools: Set<string>;
     /** borrowed-mutable — the egress set, added to by the fold (tighten-only; the effect:"write" invariant). */
     egressTools: Set<string>;
+    /** borrowed-mutable — WHO marked each tool (the safety scan's map); the protocol fold adds its own source word per
+     *  axis it tightens (`mcp_annotation` for a server's self-report, `a2a_default` for a peer skill's egress default). */
+    toolMarkSources: Map<string, Set<ToolMarkSource>>;
     /** borrowed-readonly — the run's abort controller; its `signal` rides into the A2A materialization. */
     abortController: Pick<AbortController, "signal">;
     /** borrowed-mutable — the driver-owned prepare-failure stack; this phase pushes one entry per REAL handle

package/dist/core/runner/prepare-protocol-tools.js

@@ -11,7 +11,14 @@ import { mintNamespacePrefix } from "../protocol-naming.js";
 import { applyMcpToolFaces } from "./tool-face-overlay.js";
 import { thrownText } from "../thrown-value.js";
 export async function prepareProtocolTools(input) {
-    const { lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, abortController, rollback } = input;
+    const { lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, toolMarkSources, abortController, rollback } = input;
+    const markedBy = (name, source) => {
+        const set = toolMarkSources.get(name);
+        if (set !== undefined)
+            set.add(source);
+        else
+            toolMarkSources.set(name, new Set([source]));
+    };
     const overPeer = (lockedPreflight.mcp ?? []).find((s) => s.name.length > TOOL_WIRE_NAME_MAX_CHARS);
     if (overPeer !== undefined) {
         throw Object.assign(new Error(`MCP server name ${JSON.stringify(overPeer.name.slice(0, 40) + "…")} is ${overPeer.name.length} characters; a peer rides every roster row of its tools and the roster's bound on a name is ${TOOL_WIRE_NAME_MAX_CHARS}.`), { code: "config.tool_name_too_long" });
@@ -123,10 +130,12 @@ export async function prepareProtocolTools(input) {
         }, { source: "builtin", mountedBy: "optional" });
     }
     const foldProtocolAxes = (axes, protocolLabel) => {
+        const source = protocolLabel === "A2A" ? "a2a_default" : "mcp_annotation";
         for (const axis of axes) {
             if (axis.irreversibility === "always") {
                 irreversibilityTier.set(axis.name, "always");
                 irreversibleTools.add(axis.name);
+                markedBy(axis.name, source);
             }
             if (axis.irreversibility === "never") {
                 axisExplicitNegatives.set(axis.name, { ...axisExplicitNegatives.get(axis.name), irreversible: false });
@@ -141,9 +150,10 @@ export async function prepareProtocolTools(input) {
                     throw e;
                 }
                 egressTools.add(axis.name);
+                markedBy(axis.name, source);
             }
-            if (!toolEffects.has(axis.name))
-                toolEffects.set(axis.name, axis.effect ?? "write");
+            if (axis.effect !== undefined && !toolEffects.has(axis.name))
+                toolEffects.set(axis.name, axis.effect);
         }
     };
     foldProtocolAxes(mcp.toolAxes, "MCP");

package/dist/core/runner/prepare-run-refs.d.ts

@@ -21,6 +21,7 @@ import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { TaskEvent, TaskSpec } from "../types.js";
 import { ActiveSkillScope } from "./active-skill-scope.js";
 import type { Prepared, RunInternals, ToolProgressLane } from "./contracts.js";
+import type { PermissionModeController } from "../mode-policy.js";
 import { type EditedFilesLedger } from "./edited-files-ledger.js";
 export interface PrepareRunRefsInput {
     /** borrowed-readonly — the REBOUND spec. Read: `forwardSubagentEvents` (widens the forwarding filter),
@@ -82,12 +83,11 @@ export interface PrepareRunRefsResult {
     stopRequestedRef: Prepared["stopRequestedRef"];
     /** owned — the ctx primitive: flips the latch and mirrors it onto the harness's one-way flag. */
     requestStopAfterTurn: () => void;
-    /** borrowed-mutable — the plan-mode flag (`Prepared.planModeRef`). Writers: `enterPlanMode` here, and the run
-     *  loop's resume ladder, which re-arms it when a REJECTED `plan_review` resumes into a re-plan. Read by the
-     *  tool-call gate (the write-effect refusal). */
-    planModeRef: Prepared["planModeRef"];
-    /** owned — the ctx primitive (mounted on the ctx only under `enablePlanMode`). */
-    enterPlanMode: () => void;
+    /** owned — binds the leg's permission-mode seat once the inherited-gate phase minted it; `enterPlanMode` steers it
+     *  (the run loop's resume ladder steers the same seat when a REJECTED `plan_review` resumes into a re-plan). */
+    bindPermissionModeSeat: (seat: PermissionModeController) => void;
+    /** owned — the ctx primitive (mounted on the ctx only under `enablePlanMode`): a steer of the bound seat into `plan`. */
+    enterPlanMode: () => Promise<void>;
     /** ownership-ref — the parent-run subagent-retain ledger, or undefined when the spec did not opt in. Its
      *  lifecycle protocol belongs to the Runner (disposed in the task's terminal finally); a
      *  prepare that throws has nothing to release here — the ledger is empty until a delegation retains. */

package/dist/core/runner/prepare-run-refs.js

@@ -37,11 +37,16 @@ export function prepareRunRefs(input) {
         stopRequestedRef.current = true;
         harnessRef.current?.requestStopAfterTurn();
     };
-    const planModeRef = { active: false };
-    const enterPlanMode = () => {
-        planModeRef.active = true;
+    let permissionModeSeat;
+    const bindPermissionModeSeat = (seat) => {
+        permissionModeSeat = seat;
+    };
+    const enterPlanMode = async () => {
+        if (permissionModeSeat === undefined)
+            throw new Error("enterPlanMode: the leg's permission-mode seat is not bound yet");
+        await permissionModeSeat.steer("plan");
     };
     const subagentRetain = spec.retainSubagentSessions ? new SubagentRetainLedger(spec.retainSubagentSessions) : undefined;
     const worktreeIsolation = spec.handsReadOnly !== true ? createSubagentWorktreeHelper(executionEnv, taskRootFinal) : undefined;
-    return { noteFileEdited, editedFilesSnapshot, harnessRef, toolProgressRef, skillScope, forwardEvent, reviewRequestRef, requestReview, stopRequestedRef, requestStopAfterTurn, planModeRef, enterPlanMode, subagentRetain, worktreeIsolation };
+    return { noteFileEdited, editedFilesSnapshot, harnessRef, toolProgressRef, skillScope, forwardEvent, reviewRequestRef, requestReview, stopRequestedRef, requestStopAfterTurn, bindPermissionModeSeat, enterPlanMode, subagentRetain, worktreeIsolation };
 }