@sema-agent/core 7.33.8 → 7.34.0

package/dist/core/task-spec.d.ts

@@ -4,6 +4,7 @@
  * beside it in `task-limits.ts`; the terminal record it produces in `task-result.ts`. Layer 0
  * vocabulary; `types.ts` re-exports the three, so no consumer's import changes.
  */
+import type { PermissionMode } from "./ask-origin.js";
 import type { TSchema } from "typebox";
 import type { ThinkingLevel } from "../internal/harness.js";
 import type { ActorAssertion, Model, ResilienceOptions } from "../internal/llm.js";
@@ -31,15 +32,12 @@ export type ImageInput = {
     url: string;
 };
 /** A single self-contained task with its full configuration. */
-/** The shell-gate doctrine vocabulary — {@link TaskSpec.shellGate}'s value set, and the word the engine persists on a
- *  shell-gated ask (`RiskDescriptor.shellGateDoctrine`) and folds across a delegation chain (max-rank: `off` <
- *  `classify` < `always`). One closed set; every seat that names a doctrine spells it through this alias. */
-export type ShellGateDoctrine = "off" | "classify" | "always";
-/** The approval POSTURE a host declares for a task — {@link TaskSpec.approverPosture}'s value set: a
- *  statement about who answers this run's approval cards, never an instruction to the gate. One word
- *  today (`"bypass"` — the host answers every card itself, automatically). The engine only RENDERS it,
- *  so adding a word here changes what the model is told and nothing else. */
-export type ApproverPosture = "bypass";
+/** The shell-gate FLOOR vocabulary — {@link TaskSpec.shellGate}'s value set, the word the engine persists on a
+ *  shell-gated ask (`RiskDescriptor.shellGateDoctrine`) and carries down a delegation chain. One value: `"always"`
+ *  (every shell command is confirmed, under every permission mode — an operator's mandate). The shape tier itself
+ *  is installed on every full shell regardless; what a permission mode does with the resulting ask is the gate's
+ *  arbitration, never a doctrine word. */
+export type ShellGateDoctrine = "always";
 export interface TaskSpec {
     taskId?: string;
     /** The instruction / latest user message for this turn. */
@@ -791,8 +789,8 @@ export interface TaskSpec {
     /**
      * Interactive read-boundary whitelist (ruled 2026-08-05, both-arms ruling, arm A): extra directories
      * the READ faces may access — and nothing else. Joins the containment allowlist of the read-only
-     * tools (read_file / grep / glob / repo_map / `bash_readonly`) and the `shellGate:"classify"`
-     * read-boundary (so a provably read-only command like `head <dir>/settings.json` auto-allows instead
+     * tools (read_file / grep / glob / repo_map / `bash_readonly`) and the shell read station's
+     * boundary (so a provably read-only command like `head <dir>/settings.json` auto-allows instead
      * of asking on every call), but is NEVER admitted by the write faces (edit_file / write_file /
      * notebook_edit refuse these paths exactly as before). Use `additionalDirectories` when the task
      * should also write there. Same canonicalization and fail-closed skip rules as
@@ -805,7 +803,7 @@ export interface TaskSpec {
      * design/199 件B — TASK-layer ADDITIONS to the built-in sensitive-path READ deny set
      * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}). Judged by the
      * structured read faces (Read/Grep/Glob/RepoMap, their traversals, the compaction attachment reader) and
-     * by the shell READ STATION under every doctrine — the full shell (`Bash`, `Monitor`, whatever
+     * by the shell READ STATION under every mode — the full shell (`Bash`, `Monitor`, whatever
      * {@link shellGate} says) and the `bash_readonly` shell mounted by {@link handsReadOnly} alike: a
      * deny-listed shell read is REFUSED at the gate (`deniedBy: "read_boundary"`), never asked, with the same
      * sentence the structured faces refuse with — one deny judge for every read face — in BOTH containment
@@ -814,8 +812,8 @@ export interface TaskSpec {
      * {@link RunnerDeps.readDenyPatterns}; `[]` ≡ absent (union identity); NOTHING at the task layer
      * can remove a built-in — the one removal channel is the DEPLOYMENT's built-in configuration
      * ({@link RunnerDeps.readDenyBuiltinTiers} / {@link RunnerDeps.readDenyBuiltinExclude}, #245
-     * revision of D-4), which no TaskSpec key reaches — and that half is OFF by default, so on an
-     * unconfigured deployment the entries here are the WHOLE judged set. Bad entry shapes refuse loudly at prepare
+     * revision of D-4), which no TaskSpec key reaches (an unconfigured deployment judges the default tiers,
+     * {@link import("../tools/fs/read-deny.js").READ_DENY_DEFAULT_TIERS}). Bad entry shapes refuse loudly at prepare
      * (#123). The write faces are untouched.
      */
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
@@ -890,87 +888,41 @@ export interface TaskSpec {
      */
     enableFork?: boolean;
     /**
-     * design/80 D-2 (part-1): gate the injected `bash` hand tool, since a full shell can run egress (`curl`,
-     * `git push`) and irreversible (`rm`) commands that the per-tool egress/irreversibility marks otherwise miss.
-     * The §4-OQ4 doctrine: shell-in-presence ⇒ always-gate UNLESS a real parsed classifier is wired.
-     *  - `"off"` (default): `bash` is unmarked — the current behavior (subject only to the deployment's policy).
-     *  - `"always"`: every `bash` command tightens to an `irreversible_ask` durable suspend (fail-closed; the
-     *    correct default for an unattended/supervisor deployment with no classifier).
-     *  - `"classify"`: mark `bash` `irreversibility:"maybe"` with {@link import("../tools/fs/index.js").bashReversibilityProbe}
-     *    — the SHAPE classifier alone: a provably-benign single allowlisted read-only command (no operators)
-     *    auto-allows; everything else (writes, egress, pipes, unknown commands) tightens to ask. WHERE a command
-     *    reads is not this doctrine's question under any value: the gate's shell read station judges every
-     *    shell call's read candidates against the deny set and the containment roots (a deny-listed read is
-     *    refused, an out-of-root read is a mandated ask) whether `shellGate` is `"off"`, `"classify"` or
-     *    `"always"`. An egress command (e.g. `curl`) suspends under
-     *    the IRREVERSIBLE axis (the shell mark is irreversibility, not egress) — the kind is non-budgetable either
-     *    way, so the budget resolver still never auto-approves it; the axis label is informational.
-     *    NOT unconditional: a POSITIVE per-tool mark on the shell tool keeps its seat — an explicit
-     *    `irreversibility:"always"` is never downgraded (the tier combine is tighten-only) and an explicit
-     *    `"maybe"` keeps its own probe (a probe-less explicit `"maybe"` stays fail-closed ask; the doctrine's
-     *    generic probe installs only on doctrine-owned seats). An explicit `"never"` is NOT a mark — the
-     *    doctrine governs that seat as if unmarked.
-     * No effect under `handsReadOnly` (that mounts `bash_readonly`, already allowlisted) or with no execution env.
-     * **Re-supply on resume:** like `toolPolicy`/`tools`/`durableApproval`, `shellGate` is part of the resume
-     * task config — a resume that omits it leaves the resumed run's SUBSEQUENT `bash` calls ungated (the approved
-     * pending call itself runs once, having been adjudicated). Re-pass the same value the original task used.
+     * The OPERATOR's shell floor: `"always"` ⇒ every `bash` / `Monitor` command is a confirmed ask (an
+     * `operator_forced` ask — kept under `bypassPermissions`, not settled by `dontAsk`; a standing allow rule never
+     * clears it). Absent ⇒ no floor: the shape tier the engine installs on every full shell (a provably read-only
+     * single command runs, everything else asks) is arbitrated by the task's {@link permissionMode}. The retired
+     * values `"off"` / `"classify"` are refused at the door (`config.shell_gate_value_retired`): the tier is no longer a
+     * doctrine a caller chooses, and the read boundary is judged on every shell call under every mode. A positive
+     * per-tool mark keeps its seat (an explicit `irreversibility:"always"` is never downgraded). No effect under
+     * `handsReadOnly` or with no execution env. Re-supplied on resume like `toolPolicy` (a checkpoint carries the
+     * chain's floor). Delegation: the floor travels the inherited-gate lane; a child cannot lift it.
      */
     shellGate?: ShellGateDoctrine;
     /**
-     * The caller's AUTO-MODE INTENT for this task — the "user turned auto on" half of the classifier
-     * arming (CC 2.1.250 polarity: auto mode is something the USER enables at the permission-mode
-     * seat, and something an ORGANIZATION may only DENY; it is never something an organization grants
-     * on a user's behalf). The engine arms its per-run classifier only when ALL THREE hold:
-     *  - this seat is `true` (intent),
-     *  - {@link RunnerDeps.autoMode} is present (the deployment is classifier-capable — the trust gate;
-     *    classifier RULES still enter ONLY through that face, never through this seat), and
-     *  - {@link RuntimeCaps.autoMode} is not `false` (the per-principal DENY bit; ABSENT is NOT a denial).
+     * The task's PERMISSION MODE — the ONE key that says how the engine answers a surviving ask (six words,
+     * {@link import("./ask-origin.js").PERMISSION_MODES}; spelled as the wire spells it). ROOT task absent ⇒
+     * `"default"`; an engine-spawned CHILD absent ⇒ its parent's effective mode (a child's own declaration is
+     * adopted only where the reference implementation's rank table admits it under the parent's — a folded
+     * declaration is disclosed on `wiring_manifest.permissionMode.foldedBy: "inherited_ceiling"` and announced,
+     * never silent). A value outside the set is refused at the door (`config.permission_mode_invalid`).
      *
-     * **Ownership** — same split as {@link shellGate}: the service layer TRANSLATES the effective
-     * permission mode into this seat (at the same point it translates the mode into `shellGate`);
-     * core only CONSUMES it. Absent ⇒ not an auto-mode task (byte-identical to the pre-seat shape:
-     * asks flow the original chain). Only the literal `true` is a value here: any other present value
-     * (`false`, `"true"`, `1`) is refused at the door (`config.auto_mode_requested_invalid`) rather than
-     * read as either polarity — a marshalled string must never silently arm, or silently disarm, a
-     * classifier.
+     * What the mode DOES is one table and one predicate ({@link import("./ask-origin.js").MODE_ARBITRATION},
+     * {@link import("./ask-origin.js").arbitrateByMode}) read after every rule, tighten and classifier station:
+     * `bypassPermissions` releases every ask but the immune classes (an explicit ask rule, a hook's ask, the
+     * question tool, an unverifiable recursive delete, an org rule, an operator's forced confirmation, unreadable
+     * governance, the classifier's denial-limit fallback) and discloses each release; `dontAsk` refuses every ask
+     * but a hook's or an operator authority's; `auto` arms the classifier (`RunnerDeps.autoMode` present and
+     * `RuntimeCaps.autoMode` not `false`, else folded to `default` and announced); `plan` reads only and mounts the
+     * plan pair; `acceptEdits` writes inside the root without asking; `default` asks. The mode also installs its own
+     * seats ({@link import("./mode-policy.js").modePolicyOf}).
      *
-     * **Inheritance**: the intent is session-wide, like a permission mode — an engine-spawned child of
-     * an auto-mode task inherits it through the trusted constraint chain
-     * (`InheritedGate.autoModeRequested`), never through a model-authored argument; the child's own
-     * deny bit and deployment face are still evaluated for the child. **On resume:** the intent the
-     * suspend leg resolved (this seat, or the bit its chain carried) is recorded on the checkpoint's
-     * data half (`CheckpointState.inheritedGate.autoModeRequested`) and read back as one more intent
-     * source, so a redemption in another process arms as the suspend leg did without re-passing the
-     * seat; re-passing it is still honoured (the sources fold by OR). Intent only — the resuming
-     * deployment's face and the resuming principal's deny bit are judged afresh on every leg.
-     */
-    autoModeRequested?: true;
-    /**
-     * The host's declared APPROVER POSTURE for this task — a typed fact seat, the same ownership split
-     * as {@link shellGate} and {@link autoModeRequested}: the service layer declares it (it is the layer
-     * that knows who sits at the cards), core only CONSUMES it. `"bypass"` says the host answers every
-     * approval card itself, automatically.
-     *
-     * **The gate does not read it.** Cards are raised, routed and recorded byte-identically with and
-     * without this seat — no rule is relaxed, no ask is skipped, no decision is pre-empted. The seat's
-     * one effect is that the ENGINE tells the model which posture the run is under, in its own marked
-     * `<system-reminder>` on the first turn. That is the whole point of the seat: a posture is a fact of
-     * the run, and a host that instead splices the sentence into the objective hands the model
-     * reminder-shaped text with no engine mark, which the mark declaration tells it to treat as data and
-     * flag. One fact, one seat, one mint.
-     *
-     * Absent ⇒ no posture declared, zero bytes rendered (byte-identical to the pre-seat shape). Only the
-     * literal `"bypass"` is a value: any other present value is refused at the door
-     * (`config.approver_posture_invalid`) rather than folded back to absence — a marshalled typo must not
-     * silently un-declare a posture the host meant to declare.
-     *
-     * **Inheritance / resume:** session-wide, exactly like {@link autoModeRequested} — an engine-spawned
-     * child inherits it through the trusted constraint chain (`InheritedGate.approverPosture`), and the
-     * resolved value is recorded on the checkpoint's data half so a redemption in another process still
-     * knows the posture without the seat being re-passed. Re-passing it is honoured; the sources fold
-     * seat-first.
+     * `bypassPermissions` is a REQUEST: it takes effect only where the deployment does not deny it
+     * ({@link RuntimeCaps.bypassPermissions} not `false`); a denied request runs in `default`, announced
+     * (`config.permission_mode_unavailable`). A running leg changes mode through `TaskStream.setPermissionMode`.
+     * Persists on the checkpoint's data half (`CheckpointState.inheritedGate.permissionMode`), re-judged on every leg.
      */
-    approverPosture?: ApproverPosture;
+    permissionMode?: PermissionMode;
     /** Task-scoped MCP servers, materialized into tools then disposed. */
     mcp?: McpServerSpec[];
     /** Task-scoped A2A peers (remote agents), whose advertised skills mount as `a2a__<peer>__<skill>`

package/dist/core/task-stream.d.ts

@@ -275,6 +275,22 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
     }): Promise<{
         outcome: "created" | "existed";
     }>;
+    /**
+     * Change the running leg's PERMISSION MODE (`TaskSpec.permissionMode`'s live half — a shell's mode toggle, a serving
+     * layer's `permission_mode` control frame). The requested word is rewritten on the leg's mode seat; the deployment's
+     * fold is re-judged (`bypassPermissions` where `RuntimeCaps.bypassPermissions` is `false`, or `auto` with no
+     * classifier face / a `false` deny bit, runs `default` and is announced `config.permission_mode_unavailable`); a leg
+     * that became `auto` arms its classifier now — an arming that fails rolls the steer back (the word it replaced stands)
+     * and the verb rejects with the arming's code; the NEXT tool call reads the new mode at the gate's arbitration point
+     * (a tightening and a loosening both take effect one call later, on one seat), and a child leg derives its own
+     * effective mode from this seat on its next read. Resolves the same three-member receipt `wiring_manifest.permissionMode`
+     * carries — `{ requested, effective, foldedBy? }` — on EVERY call, moved or not, so a caller renders what the engine
+     * says and never what it sent. Typed refusals: `steering.invalid_content` (a word outside the closed set) and the
+     * steer-family `steering.not_running` once the task has finished. AUTHORITY (steer-lane law): holding this stream IS
+     * the capability handle; a service exposing the verb owns the principal check at its own face — and a deployment that
+     * must never let a caller reach `bypassPermissions` says so with the deny bit, which this verb honours.
+     */
+    setPermissionMode(mode: import("./ask-origin.js").PermissionMode): Promise<import("./mode-policy.js").PermissionModeReceipt>;
     /**
      * **RE-DIAL one MCP server** on the running task, the action `RefreshMcpTools` deliberately
      * is not (its contract is "never dials or re-dials"). Core holds no MCP connection across task

package/dist/core/terminal-cause.js

@@ -4,6 +4,7 @@ export const TERMINAL_CAUSE_IS_REPLAYABLE = {
     blocked: false,
     paused: false,
 };
+Object.freeze(TERMINAL_CAUSE_IS_REPLAYABLE);
 export function isTerminalCauseKind(kind) {
     return typeof kind === "string" && Object.hasOwn(TERMINAL_CAUSE_IS_REPLAYABLE, kind);
 }

package/dist/core/tighten-task-spec.d.ts

@@ -13,8 +13,8 @@ export declare class TaskSpecTightenError extends Error {
  *    would drop the base policy entirely.
  *  - **`handsReadOnly`** — `true` is stricter. `base:true` + `override:false` ⇒ **throw** (loosening). Otherwise
  *    the stricter (`true` if either is true) wins.
- *  - **`shellGate`** — `off < classify < always`. `override` may only equal-or-raise the rank; lowering it ⇒
- *    **throw**. The stricter of the two wins.
+ *  - **`shellGate`** — one value (`"always"`, the operator floor). Either side set ⇒ the floor stands; it cannot
+ *    be loosened because absence is the only other state and an override cannot unset a base value.
  *  - **`onAsk`** — no safe automatic merge (the approver and the policy must be coordinated). Both set to
  *    DIFFERENT values ⇒ **throw**; equal ⇒ keep; one set ⇒ that one.
  *  - **`hooks`** — no standard composition (stacking hook results is caller-specific). Both set ⇒ **throw**;

package/dist/core/tighten-task-spec.js

@@ -1,9 +1,5 @@
 import { combinePolicies } from "./tool-policy.js";
-const SHELL_GATE_RANK = {
-    off: 0,
-    classify: 1,
-    always: 2,
-};
+import { clampPermissionMode } from "./ask-origin.js";
 export class TaskSpecTightenError extends Error {
     constructor(message) {
         super(message);
@@ -51,16 +47,18 @@ export function tightenTaskSpec(base, overrides) {
     if (base.handsReadOnly !== undefined || overrides.handsReadOnly !== undefined) {
         merged.handsReadOnly = base.handsReadOnly === true || overrides.handsReadOnly === true;
     }
-    if (base.shellGate !== undefined || overrides.shellGate !== undefined) {
-        const baseGate = base.shellGate ?? "off";
-        const overrideGate = overrides.shellGate;
-        if (overrideGate !== undefined && SHELL_GATE_RANK[overrideGate] < SHELL_GATE_RANK[baseGate]) {
-            throw new TaskSpecTightenError(`tightenTaskSpec: cannot loosen shellGate from "${baseGate}" to "${overrideGate}" (override may only tighten)`);
+    if (base.permissionMode !== undefined && overrides.permissionMode !== undefined) {
+        const { effective, clamped } = clampPermissionMode(overrides.permissionMode, base.permissionMode);
+        if (clamped) {
+            throw new TaskSpecTightenError(`tightenTaskSpec: permissionMode override "${overrides.permissionMode}" would loosen the base "${base.permissionMode}" (the override may only tighten; a bypass override needs a bypass base, acceptEdits and auto never adopt each other)`);
         }
-        merged.shellGate =
-            overrideGate !== undefined && SHELL_GATE_RANK[overrideGate] > SHELL_GATE_RANK[baseGate]
-                ? overrideGate
-                : (base.shellGate ?? overrideGate);
+        merged.permissionMode = effective;
+    }
+    else if (base.permissionMode !== undefined || overrides.permissionMode !== undefined) {
+        merged.permissionMode = overrides.permissionMode ?? base.permissionMode;
+    }
+    if (base.shellGate !== undefined || overrides.shellGate !== undefined) {
+        merged.shellGate = base.shellGate ?? overrides.shellGate;
     }
     if (base.onAsk !== undefined && overrides.onAsk !== undefined && base.onAsk !== overrides.onAsk) {
         throw new TaskSpecTightenError("tightenTaskSpec: conflicting onAsk on base and overrides — onAsk cannot be merged automatically " +

package/dist/core/tool-catalog-entries.js

@@ -56,7 +56,7 @@ export const TOOL_CATALOG_ENTRIES = [
     },
     {
         id: "bash", name: "Bash", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"],
-        cards: ["bash", "readonly_out_of_root", "bash_invalid_timeout"],
+        cards: ["bash", "readonly_out_of_root", "read_unestablished", "bash_invalid_timeout"],
         face: {
             family: "shell", effect: "write", contentOrigin: "execution", contract: c(FULL_SHELL_CONTRACT_ID),
             ruleFace: SHELL_RULE_FACE,
@@ -66,7 +66,7 @@ export const TOOL_CATALOG_ENTRIES = [
     },
     {
         id: "bash-readonly", name: "Bash", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"],
-        cards: ["bash", "readonly_out_of_root", "bash_invalid_timeout"],
+        cards: ["bash", "readonly_out_of_root", "read_unestablished", "bash_invalid_timeout"],
         face: {
             family: "shell", effect: "read", contract: c(READONLY_SHELL_CONTRACT_ID),
             ruleFace: SHELL_RULE_FACE,
@@ -108,7 +108,7 @@ export const TOOL_CATALOG_ENTRIES = [
     { id: "task-stop-hands", name: "TaskStop", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", effect: "write", contract: TASK_STOP_CONTRACT } },
     { id: "task-output", name: "TaskOutput", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-output"], face: { family: "delegate", effect: "read", contract: TASK_OUTPUT_CONTRACT } },
     { id: "task-stop", name: "TaskStop", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-stop"], face: { family: "delegate", effect: "write", contract: TASK_STOP_CONTRACT } },
-    { id: "monitor", name: "Monitor", source: "builtin", definedIn: "src/tools/monitor.ts", mountedBy: ["backgroundTasks"], cards: ["monitor-start", "readonly_out_of_root"], face: { family: "other", effect: "write", contract: c("core.monitor@1"), offloadThresholdChars: 10_000 } },
+    { id: "monitor", name: "Monitor", source: "builtin", definedIn: "src/tools/monitor.ts", mountedBy: ["backgroundTasks"], cards: ["monitor-start", "readonly_out_of_root", "read_unestablished"], face: { family: "other", effect: "write", contract: c("core.monitor@1"), offloadThresholdChars: 10_000 } },
     { id: "send-message", name: "SendMessage", source: "builtin", definedIn: "src/agents/send-message-tool.ts", mountedBy: ["delegation", "hostInternals", "peerLane"], cards: ["send-message"], face: { family: "protocol", effect: "write", contract: c("core.send_message@1") } },
     { id: "agent-transcript", name: "AgentTranscript", source: "builtin", definedIn: "src/agents/agent-transcript-tool.ts", mountedBy: ["delegation"], cards: ["agent-transcript"], face: { family: "delegate", effect: "read", contract: c("core.agent_transcript@1") } },
     { id: "list-agents", name: "ListAgents", source: "builtin", definedIn: "src/agents/list-agents-tool.ts", mountedBy: ["delegation", "peerLane"], cards: ["list-agents"], face: { family: "protocol", effect: "read", aliases: ["ListPeers"], contract: c("core.list_agents@1") } },
@@ -156,6 +156,7 @@ export const ENGINE_CARDS = Object.freeze({
     path_not_in_root: "src/tools/fs/safety.ts",
     read_path_denied: "src/tools/fs/safety.ts",
     readonly_out_of_root: "src/tools/fs/shell-read-check.ts",
+    read_unestablished: "src/tools/fs/shell-read-check.ts",
 });
 const byId = new Map();
 for (const e of TOOL_CATALOG_ENTRIES) {

package/dist/core/tool-policy.d.ts

@@ -1,4 +1,4 @@
-import type { AskOrigin } from "./ask-origin.js";
+import { type AskOrigin } from "./ask-origin.js";
 import { type ReadRootGrantScreen } from "./read-root-grant-screen.js";
 import { type Settlement } from "./gate-outcome.js";
 /** A tool call presented to a policy before it executes. */
@@ -325,9 +325,8 @@ export type PermissionResult = {
     /** This ask is MANDATED — no persisted allow rule and no STANDING ANSWER (a release remembered from an
      *  earlier call, at any scope, a session included) may retire it; only an answer produced for THIS call
      *  clears it — a person, a hook, a deployment's blanket `onAsk: "allow"` seat, or the live deciders the
-     *  mandate tables admit ({@link import("./ask-origin.js").classifierMayAnswerMandate} /
-     *  `sandboxMayAdmitMandate`); {@link requiresRealApproval} is the stronger demand that also refuses the
-     *  blanket seat. ENGINE-STAMPED at the gate's single origin stamp from the ONE derivation
+     *  ask's class row admits ({@link import("./ask-origin.js").MODE_ARBITRATION}); {@link requiresRealApproval}
+     *  is the stronger demand that also refuses the blanket seat. ENGINE-STAMPED at the gate's single origin stamp from the ONE derivation
      *  the approval card's rule-offer word also reads ({@link import("./ask-origin.js").ruleClearanceOf},
      *  which lists the doors). TIGHTENING-ONLY: a layer below the mint may not clear one a layer above
      *  set, and a policy self-declaring it only opts its own ask OUT of automatic answering. Carried
@@ -376,19 +375,34 @@ export type PermissionResult = {
      *  fallback / the reserved question tool / a marked call / plain policy). ENGINE-STAMPED inside the
      *  gate at the same single stamp point as `ruleEvidence`, derived from what the gate's own layers
      *  did ({@link import("./ask-origin.js").askOriginOf}) — a policy that self-declares it is overwritten
-     *  there, so the member is never a channel a policy can loosen through. Consumers: the gate's
-     *  auto-mode classifier step admits an ask by ONE table lookup on this word
-     *  ({@link import("./ask-origin.js").classifierMayAnswer}) instead of a chain of per-kind
-     *  exclusions; an approval surface may render the card by it. Optional on the TYPE only because a
-     *  decision is caller-composable; every ask the gate hands to its resolver carries it. */
+     *  there, so the member is never a channel a policy can loosen through. A DISCLOSURE word: the lanes
+     *  read the ask's class set ({@link import("./ask-origin.js").classifyAsk}), an approval surface may
+     *  render the card by it. Optional on the TYPE only because a decision is caller-composable; every ask
+     *  the gate hands to its resolver carries it. */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** #688 C3 (additive): WHICH mechanism stands behind an `origin: "rule_store_unavailable"` — one word from
-     *  {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS} (`store`: the wired store could not be read;
-     *  `call`: the call could not be read against the person's rows — the lexer's sentence is in `message`).
-     *  ENGINE-STAMPED at the same single stamp point as `origin`, from the gate's own lane read; a policy's
-     *  self-declared value is overwritten or removed there. Present ⇔ the origin is `rule_store_unavailable`.
-     *  Carried onto the approval request and the durable row beside the origin word. */
-    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
+    /** WHICH integrity guard minted this ask — the unverifiable recursive delete or the session-transcript
+     *  write. ENGINE-STAMPED by the two guard policies; a fold-internal fact the class derivation reads
+     *  ({@link import("./ask-origin.js").classifyAsk}) so the two guards, which mint the same
+     *  `requiresRealApproval` ask, are told apart by a fact and not by their prose. Never copied onto the
+     *  approval request or the park row. */
+    guard?: "unverifiable_delete" | "transcript_write" | "artifact_shared_read";
+    /** The call could not be READ against a rule that may reach it — a content-form deny row, a content-form
+     *  ask row, or a persisted-rule row (the lexer's word). ENGINE-STAMPED at the three unreadable mint sites;
+     *  the class derivation reads it as `rule_unreadable` (a mode may release it, a person may clear it, no
+     *  automatic lane may). It replaces the former practice of stamping `matchedAskRule` on an unreadable
+     *  read: a rule that COULD NOT be matched is not a rule that matched. Fold-internal; not on the request. */
+    ruleUnreadable?: "content_deny" | "content_ask" | "persisted_call";
+    /** The ask was authored by the DEPLOYMENT's own governance (an operator's must-ask list, a managed command
+     *  policy's default ask) — a fact a host's policy states on its own ask so the class derivation reads it
+     *  as `operator_forced`: a permission mode releases nothing an operator mandated, and `dontAsk` does not
+     *  settle it. Public: a host composing such a policy sets it; {@link combinePolicies} carries it onto the
+     *  surviving ask (tighten-only). Not on the approval request — the card shows `origin` / `mandate`. */
+    authoredBy?: "deployment";
+    /** The classes of the OTHER asks a policy fold collapsed into this one
+     *  ({@link import("./ask-origin.js").decisionAskClassesOf} per contributing ask, unioned), so a member the
+     *  fold does not copy — a guard mark, an unreadable-rule fact, a bare real-approval bit — is not lost behind
+     *  the ask that won the slot. ENGINE-WRITTEN by {@link combinePolicies}; fold-internal, never on the request. */
+    foldedAskClasses?: readonly import("./ask-origin.js").AskClass[];
 } | {
     action: "deny";
     updatedInput?: unknown;
@@ -495,7 +509,23 @@ export interface ToolPolicy {
      * describes the policy must read that bit, not the field's presence.
      */
     readonly projection?: ToolPolicyProjection;
+    /** The policy's path DENY rules that speak for a face of the engine's deny table (a `Read(<pattern>)` / `Edit(<pattern>)`
+     *  deny compiled by `createPermissionRulePolicy`), as rows the prepared leg joins to its read and write tables — so the
+     *  shell's reads and writes and the traversals meet the rule, not only the tool it names. Carried through
+     *  {@link combinePolicies}; read with {@link toolPolicyPathDenyRules}. Deny-only: a row can only refuse more. */
+    readonly pathDenyRules?: readonly import("../tools/fs/read-deny.js").PathRuleDenyRow[];
+    /** Does this policy guard a write to this ABSOLUTE target — would it refuse the write if a write tool made it? The
+     *  policy's answer for a writer it cannot see as a call (the shell's file commands), read by the shell station's
+     *  `writesPlaced` fact alone: a guarded target is not placed, so no permission mode answers the command and its ask
+     *  reaches a person — it is not refused. A PURE judgment: no side effect, no audit record, no hook, no approver; `true`
+     *  on a target it cannot judge. Carried through {@link combinePolicies} (any member's `true` is the answer). */
+    readonly writeTargetGuard?: (target: string, signal?: AbortSignal) => Promise<boolean>;
 }
+/** Every path deny row the given policies carry (combined policies included), in order — the deny tables' rule rows. */
+export declare function toolPolicyPathDenyRules(policies: readonly (ToolPolicy | undefined)[]): readonly import("../tools/fs/read-deny.js").PathRuleDenyRow[];
+/** The one write-target guard the given policies carry together (combined policies included): `true` when any member
+ *  guards the target, a member that throws counting as guarding it. `undefined` when none carries one. */
+export declare function toolPolicyWriteTargetGuard(policies: readonly (ToolPolicy | undefined)[]): ToolPolicy["writeTargetGuard"];
 /**
  * One deterministic DENY component of a {@link ToolPolicyProjection} (F-012 L1). All fields are plain
  * serializable data — a component round-trips JSON/`structuredClone` unchanged, which is what lets a
@@ -910,10 +940,10 @@ export declare const COARSE_SHELL_TOOLS: string[];
  * you MUST compose explicitly: `combinePolicies(deploymentBaseline, createCoarseCommandNamePolicy(…))`
  * (deny-wins — both policies' denies still fire). {@link tightenTaskSpec} does this for you.
  *
- * Under `TaskSpec.shellGate: "classify"` a plain `ask` from this policy stays a plain ask: the shell seat's
- * `"maybe"` tier is the doctrine's probe instrument, not a risk label, so the park is the budgetable kind
+ * On the full shell face a plain `ask` from this policy stays a plain ask: the shell seat's
+ * `"maybe"` tier is the shape probe's instrument, not a risk label, so the park is the budgetable kind
  * (`human` under `durableApproval`) unless the probe mandated the call (an out-of-root read) or could not
- * answer. A command the doctrine's OWN tighten refuses (`rm -rf …` with no policy asking first) still parks
+ * answer. A command the shape tier's OWN tighten refuses (`rm -rf …` with no policy asking first) still parks
  * non-budgetable — the safety axis is judged per call by `safetyAxisOf`.
  */
 export declare function createCoarseCommandNamePolicy(opts: {
@@ -1299,6 +1329,11 @@ export interface AskRequest {
      * gate, never caller/worker-settable; tightening-only.
      */
     readonly mandated?: true;
+    /** The ask was minted by the deployment's own governance layer (the {@link PermissionResult} ask arm's member of the same
+     *  name, carried through every request mint and onto the park row): a person's question under every mode — no persisted
+     *  rule, standing answer or mode release retires it. A host approval seat that settles asks from a session grant reads
+     *  it to keep its hands off. Filled by the gate, never caller/worker-settable. */
+    readonly authoredBy?: "deployment";
     /** WHICH word of the closed {@link import("./ask-origin.js").PERSISTED_RULE_MANDATES} set {@link mandated} stands
      *  on — present ⇔ that table word is the bit's WHOLE reason (`probe_mandate` = a read outside the session's
      *  directories). ABSENT beside `mandated: true` = another door holds too (governance, a hook, an ancestor's
@@ -1317,12 +1352,6 @@ export interface AskRequest {
      *  that forwards a decision's member here does not compile, which is the point: the window is the
      *  route's fact, and forwarding it silently is how a configured window becomes a wait with none. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
-    /** #688 C3 (additive) — the wire twin of the {@link PermissionResult} ask-arm member of the same name: which
-     *  mechanism stands behind an `origin: "rule_store_unavailable"` (`store` / `call`,
-     *  {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS}). Present ⇔ that origin; a consumer that
-     *  renders "the rule store is unreachable" vs "this command could not be read against your rules" branches
-     *  here, never on the message text. Filled by the gate's own carry station from the engine-stamped decision. */
-    readonly ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /** (additive) WHICH AUTHORITY raised this ask — the wire twin of the {@link PermissionResult} ask-arm
      *  member of the same name, one word from the closed {@link import("./ask-origin.js").AskOrigin} set.
      *  The gate's own mint station copies the engine-stamped word; the three inherited-lane stations

package/dist/core/tool-policy.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { brandPolicyAskClass } from "./ask-class.js";
+import { decisionAskClassesOf, headlessDenialMessage } from "./ask-origin.js";
 import { ownReadRootCandidate, readRootGrantSeat } from "./read-root-grant-screen.js";
 import { decidersNote, settledByPerson } from "./gate-outcome.js";
 import { sanitizeAutoModeArmingRecipe } from "./auto-mode-arming.js";
@@ -121,6 +122,26 @@ export const ASK_EVIDENCE_ABSENCE_VALUES = ["not_wired", "not_adjudicated", "una
 export function decisionText(d) {
     return d.message;
 }
+export function toolPolicyPathDenyRules(policies) {
+    return policies.flatMap((p) => (Array.isArray(p?.pathDenyRules) ? p.pathDenyRules : []));
+}
+export function toolPolicyWriteTargetGuard(policies) {
+    const guards = policies.flatMap((p) => (typeof p?.writeTargetGuard === "function" ? [p.writeTargetGuard] : []));
+    if (guards.length === 0)
+        return undefined;
+    return async (target, signal) => {
+        for (const guard of guards) {
+            try {
+                if ((await guard(target, signal)) !== false)
+                    return true;
+            }
+            catch {
+                return true;
+            }
+        }
+        return false;
+    };
+}
 export function namespacedCoveringEntries(entries) {
     return (entries ?? []).filter(isNamespacedCoveringRuleName);
 }
@@ -452,6 +473,8 @@ export function createApprovalPolicy(opts) {
 }
 export function combinePolicies(...policies) {
     const nameSets = policies.flatMap(toolPolicyNameSets);
+    const pathDenyRules = toolPolicyPathDenyRules(policies);
+    const writeTargetGuard = toolPolicyWriteTargetGuard(policies);
     const childProjections = policies.map((p) => p.projection);
     const projectedComponents = [];
     let combinedRemainder = false;
@@ -472,6 +495,8 @@ export function combinePolicies(...policies) {
     return {
         ...(combinedProjection !== undefined ? { projection: combinedProjection } : {}),
         ...(nameSets.length > 0 ? { nameSets } : {}),
+        ...(pathDenyRules.length > 0 ? { pathDenyRules } : {}),
+        ...(writeTargetGuard !== undefined ? { writeTargetGuard } : {}),
         async check(req, signal) {
             let asked;
             let current = req;
@@ -482,6 +507,8 @@ export function combinePolicies(...policies) {
             let probeMandateSeen = false;
             let mandateSeen = false;
             let fallbackSeen;
+            let authoredBySeen = false;
+            const contributors = [];
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
@@ -516,6 +543,10 @@ export function combinePolicies(...policies) {
                     mandateSeen = true;
                 if (d.action === "ask" && d.denialLimitFallback !== undefined && fallbackSeen === undefined)
                     fallbackSeen = d.denialLimitFallback;
+                if (d.action === "ask" && d.authoredBy === "deployment")
+                    authoredBySeen = true;
+                if (d.action === "ask")
+                    contributors.push(d);
             }
             if (asked) {
                 const merged = rewrite?.updatedInput;
@@ -523,7 +554,14 @@ export function combinePolicies(...policies) {
                 const withMark = probeMandateSeen && withRuleAsk.probeMandated !== true ? { ...withRuleAsk, probeMandated: true } : withRuleAsk;
                 const withMandate = mandateSeen && withMark.mandated !== true ? { ...withMark, mandated: true } : withMark;
                 const withFallback = fallbackSeen !== undefined && withMandate.denialLimitFallback === undefined ? { ...withMandate, denialLimitFallback: fallbackSeen, requiresRealApproval: true } : withMandate;
-                return merged !== undefined ? { ...withFallback, updatedInput: merged } : withFallback;
+                const withAuthor = authoredBySeen && withFallback.authoredBy === undefined ? { ...withFallback, authoredBy: "deployment" } : withFallback;
+                const folded = new Set(withAuthor.foldedAskClasses ?? []);
+                for (const c of contributors)
+                    if (c !== asked)
+                        for (const k of decisionAskClassesOf(c))
+                            folded.add(k);
+                const withClasses = folded.size > 0 ? { ...withAuthor, foldedAskClasses: [...folded] } : withAuthor;
+                return merged !== undefined ? { ...withClasses, updatedInput: merged } : withClasses;
             }
             const allowed = rewrite ?? ALLOW;
             if (!anyRecord)
@@ -829,6 +867,7 @@ export function createUnverifiableDeletePolicy(opts) {
                 action: "ask",
                 decisionReason: "safety",
                 requiresRealApproval: true,
+                guard: "unverifiable_delete",
                 message: `Unverifiable recursive delete (fail-closed unless cleared): ${finding}. ` +
                     `Re-run the delete with the resolved literal path written into the command itself ` +
                     `(or assign the variable in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`,
@@ -905,6 +944,7 @@ export function createTranscriptIntegrityPolicy(opts) {
         action: "ask",
         decisionReason: "safety",
         requiresRealApproval: true,
+        guard: "transcript_write",
         message: `Session-transcript write (fail-closed unless cleared): ${what}. Session transcripts (the .jsonl files ` +
             `under the agent data dir's sessions/ directory) are harness-written session state, not agent working ` +
             `files — modifying or deleting them tampers with the run's own audit trail. Reading them (ls/cat/grep ` +
@@ -956,6 +996,7 @@ export function isLiveApproverSeat(onAsk) {
     return typeof onAsk === "function";
 }
 export const DURABLE_MANDATE_SOURCES = ["force_durable_gate", "durable_approval"];
+Object.freeze(DURABLE_MANDATE_SOURCES);
 export function durableMandateSourceOf(args) {
     if (args.forceDurableGate)
         return "force_durable_gate";
@@ -1250,7 +1291,7 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
     if (onAsk === undefined || onAsk === "deny") {
         return {
             action: "deny",
-            message: `approval required for "${req.toolName}" but no approver is wired (headless auto-deny): ${req.message}`,
+            message: headlessDenialMessage(req.toolName, req.message),
             decisionReason: "mode",
             settlement: settledByNobody("no_approver"),
         };

package/dist/core/tool-registry.d.ts

@@ -28,6 +28,8 @@ export declare function pathConfinableWriteToolNames(): ReadonlySet<string>;
 export declare function skillScopeWriteToolNames(): ReadonlySet<string>;
 /** A-8 — every definition that names a path target at all (read or write): the file-tool glob lane. */
 export declare function pathTargetingToolNames(): ReadonlySet<string>;
+/** The tools whose declared path target is a READ (a file read, a search root): the file read station's membership. */
+export declare function readTargetToolNames(): ReadonlySet<string>;
 /** A-10 — the micro-compaction whitelist (`compactable: true`). */
 export declare function compactableToolNames(): ReadonlySet<string>;
 /** A-5 — the aggregate-budget exemptions (`budgetExempt: true`). */

package/dist/core/tool-registry.js

@@ -31,6 +31,9 @@ export function skillScopeWriteToolNames() {
 export function pathTargetingToolNames() {
     return names((e) => e.face.pathTarget !== undefined);
 }
+export function readTargetToolNames() {
+    return names((e) => e.face.pathTarget?.access === "read");
+}
 export function compactableToolNames() {
     return names((e) => e.face.compactable === true);
 }