@sema-agent/core 7.33.8 → 7.34.0

package/dist/core/ask-origin.js

@@ -3,11 +3,6 @@ const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
 export function isAskOrigin(v) {
     return ASK_ORIGIN_SET.has(v);
 }
-export const RULE_STORE_UNREADABLE_KINDS = ["store", "call"];
-const RULE_STORE_UNREADABLE_SET = new Set(RULE_STORE_UNREADABLE_KINDS);
-export function isRuleStoreUnreadable(v) {
-    return RULE_STORE_UNREADABLE_SET.has(v);
-}
 export function askOriginOf(decision, facts) {
     const origin = originLadder(decision, facts);
     if (ORIGIN_IMPLIES_REAL_APPROVAL[origin] === "at_derivation" && decision.requiresRealApproval !== true) {
@@ -28,7 +23,8 @@ export function stampAskOrigin(decision, facts) {
 }
 export function ruleClearanceOf(ask, marks) {
     const marksWord = persistedRuleMandateOf({ ...marks, probeMandated: ask?.probeMandated === true });
-    const doorOutsideTable = ask?.requiresRealApproval === true || ask?.decisionReason === "hook" || ask?.inheritedUnresolved === true || ask?.ancestorResolved === true;
+    const foldedDoor = (ask?.foldedAskClasses ?? []).some((c) => !MODE_ARBITRATION[c].ruleMayClear);
+    const doorOutsideTable = ask?.requiresRealApproval === true || ask?.decisionReason === "hook" || ask?.decisionReason === "mode" || foldedDoor || ask?.authoredBy === "deployment" || ask?.inheritedUnresolved === true || ask?.ancestorResolved === true;
     const mandated = ask?.mandated === true || doorOutsideTable || marksWord !== undefined;
     const stampedWord = ask?.mandated === true && isPersistedRuleMandate(ask.mandate) ? ask.mandate : undefined;
     const mandate = doorOutsideTable || (ask?.mandated === true && stampedWord === undefined) ? undefined : (stampedWord ?? marksWord);
@@ -39,6 +35,10 @@ export function ruleClearanceOf(ask, marks) {
             return "shadowed";
         if (ask?.decisionReason === "hook")
             return "mandated";
+        if (ask?.decisionReason === "mode" || foldedDoor)
+            return "mandated";
+        if (ask?.authoredBy === "deployment")
+            return "mandated";
         if (ask?.matchedAskRule !== undefined)
             return "shadowed";
         if (ask?.inheritedUnresolved === true)
@@ -51,12 +51,15 @@ export function ruleClearanceOf(ask, marks) {
 }
 export function askMandateMember(ask) {
     const { mandated, mandate } = ruleClearanceOf(ask, {});
-    return mandated ? { mandated: true, ...(mandate !== undefined ? { mandate } : {}) } : {};
+    const authored = ask?.authoredBy === "deployment" ? { authoredBy: "deployment" } : {};
+    return mandated ? { mandated: true, ...(mandate !== undefined ? { mandate } : {}), ...authored } : authored;
 }
 export function ownedClearanceFacts(d) {
-    const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated } = d;
+    const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated, authoredBy, foldedAskClasses } = d;
     return {
         ...(mandated === true ? { mandated } : {}),
+        ...(Array.isArray(foldedAskClasses) && foldedAskClasses.length > 0 ? { foldedAskClasses: [...foldedAskClasses] } : {}),
+        ...(authoredBy === "deployment" ? { authoredBy } : {}),
         ...(requiresRealApproval === true ? { requiresRealApproval } : {}),
         ...(decisionReason !== undefined ? { decisionReason } : {}),
         ...(typeof matchedAskRule === "string" ? { matchedAskRule } : {}),
@@ -72,7 +75,7 @@ function originLadder(decision, facts) {
         return "org_unavailable";
     if (facts.org === "rule")
         return "org_rule";
-    if (facts.ruleStore !== undefined)
+    if (facts.ruleCallUnreadable === true)
         return "rule_store_unavailable";
     if (decision.decisionReason === "hook")
         return "hook";
@@ -99,44 +102,11 @@ export const ORIGIN_IMPLIES_REAL_APPROVAL = {
     safety_tighten: false,
     policy: false,
 };
-const CLASSIFIER_MAY_ANSWER = {
-    content_question: false,
-    ancestor_marked: false,
-    org_unavailable: false,
-    org_rule: false,
-    rule_store_unavailable: false,
-    hook: false,
-    ask_rule: false,
-    denial_limit_fallback: false,
-    shell_gate_tighten: true,
-    safety_tighten: true,
-    policy: true,
-};
-export function classifierMayAnswer(origin) {
-    return CLASSIFIER_MAY_ANSWER[origin];
-}
 export const PERSISTED_RULE_MANDATES = ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "write_protection_unresolved"];
 const PERSISTED_RULE_MANDATE_SET = new Set(PERSISTED_RULE_MANDATES);
 export function isPersistedRuleMandate(v) {
     return PERSISTED_RULE_MANDATE_SET.has(v);
 }
-const MANDATE_LANE_ANSWERS = {
-    operator_always: { classifier: true, sandboxAdmission: true },
-    tool_marks: { classifier: true, sandboxAdmission: true },
-    probe_mandate: { classifier: false, sandboxAdmission: false },
-    probe_unanswered: { classifier: false, sandboxAdmission: false },
-    write_protection: { classifier: true, sandboxAdmission: true },
-    write_protection_unresolved: { classifier: false, sandboxAdmission: true },
-};
-export function classifierMayAnswerMandate(mandate) {
-    return mandate === undefined || MANDATE_LANE_ANSWERS[mandate].classifier;
-}
-export function sandboxMayAdmitMandate(mandate) {
-    return mandate === undefined || MANDATE_LANE_ANSWERS[mandate].sandboxAdmission;
-}
-function bindsEveryAutomaticLane(mandate) {
-    return mandate !== undefined && !classifierMayAnswerMandate(mandate) && !sandboxMayAdmitMandate(mandate);
-}
 const MANDATE_DISCLOSURE = {
     probe_mandate: "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule",
     probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call reads outside the directories allowed for this session is unknown — it is cleared by confirming this call, never by a standing allow rule",
@@ -150,7 +120,7 @@ export function mandateDisclosureOf(mandate) {
 }
 export function persistedRuleMandateOf(marks) {
     const word = irreversibilityMandateOf(marks);
-    if (bindsEveryAutomaticLane(word))
+    if (word === "probe_mandate" || word === "probe_unanswered")
         return word;
     if (marks.writeProtectionUnresolved === true)
         return "write_protection_unresolved";
@@ -178,6 +148,214 @@ export function safetyAxisOf(marks) {
     const shell = raised && marks.shellGated === true;
     return egress || raised ? { egress, irreversible: raised && !shell, ...(shell ? { shell: true } : {}) } : undefined;
 }
-export function probeMandatedAsk(ask) {
-    return bindsEveryAutomaticLane(persistedRuleMandateOf({ probeMandated: ask.probeMandated === true }));
+export const PERMISSION_MODES = ["default", "acceptEdits", "plan", "auto", "bypassPermissions", "dontAsk"];
+const PERMISSION_MODE_SET = new Set(PERMISSION_MODES);
+export function isPermissionMode(v) {
+    return PERMISSION_MODE_SET.has(v);
+}
+export const PERMISSION_MODE_RANK = { plan: 0, default: 1, dontAsk: 1, acceptEdits: 2, auto: 3, bypassPermissions: 4 };
+export function clampPermissionMode(declared, ceiling) {
+    if (declared === undefined)
+        return { effective: ceiling, clamped: false };
+    if (declared === ceiling)
+        return { effective: declared, clamped: false };
+    if (declared === "bypassPermissions")
+        return { effective: ceiling, clamped: true };
+    if ((declared === "acceptEdits" && ceiling === "auto") || (declared === "auto" && ceiling === "acceptEdits"))
+        return { effective: ceiling, clamped: true };
+    return PERMISSION_MODE_RANK[declared] <= PERMISSION_MODE_RANK[ceiling] ? { effective: declared, clamped: false } : { effective: ceiling, clamped: true };
+}
+export const ASK_CLASSES = [
+    "content_question",
+    "hook",
+    "ancestor",
+    "unverifiable_delete",
+    "transcript_write",
+    "org_rule",
+    "governance_unavailable",
+    "rule_unreadable",
+    "ask_rule",
+    "denial_limit_fallback",
+    "operator_forced",
+    "write_protection_unresolved",
+    "probe",
+    "write_protection",
+    "tool_marks_mcp",
+    "tool_marks_a2a",
+    "policy_rra",
+    "artifact_shared_read",
+    "mode",
+    "ordinary",
+];
+const ASK_CLASS_SET = new Set(ASK_CLASSES);
+export function isAskClass(v) {
+    return ASK_CLASS_SET.has(v);
+}
+export const MODE_ARBITRATION = {
+    content_question: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
+    hook: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
+    ancestor: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
+    unverifiable_delete: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
+    transcript_write: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
+    org_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
+    governance_unavailable: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
+    rule_unreadable: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
+    ask_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
+    denial_limit_fallback: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
+    operator_forced: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
+    write_protection_unresolved: { bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false },
+    probe: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
+    write_protection: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
+    tool_marks_mcp: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
+    tool_marks_a2a: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
+    policy_rra: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
+    artifact_shared_read: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
+    mode: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
+    ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true },
+};
+export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "ancestor", "artifact_shared_read"]);
+export const RELEASABLE_ASK_CLASSES = ASK_CLASSES.filter((c) => !MODE_ARBITRATION[c].bypassImmune);
+export function decisionAskClassesOf(d) {
+    const out = new Set();
+    if (d.guard === "unverifiable_delete")
+        out.add("unverifiable_delete");
+    if (d.guard === "transcript_write")
+        out.add("transcript_write");
+    if (d.guard === "artifact_shared_read")
+        out.add("artifact_shared_read");
+    if (d.ruleUnreadable !== undefined)
+        out.add("rule_unreadable");
+    if (d.matchedAskRule !== undefined)
+        out.add("ask_rule");
+    if (d.denialLimitFallback !== undefined)
+        out.add("denial_limit_fallback");
+    if (d.authoredBy === "deployment")
+        out.add("operator_forced");
+    if (d.probeMandated === true)
+        out.add("probe");
+    if (d.decisionReason === "hook")
+        out.add("hook");
+    if (d.decisionReason === "mode")
+        out.add("mode");
+    if (d.requiresRealApproval === true && ![...out].some((c) => RRA_EXPLAINERS.has(c)))
+        out.add("policy_rra");
+    if (out.size === 0 && d.mandated === true)
+        out.add("operator_forced");
+    for (const c of d.foldedAskClasses ?? [])
+        out.add(c);
+    return out;
+}
+export function foldArbitrationRow(classes) {
+    if (classes.size === 0)
+        return MODE_ARBITRATION.ordinary;
+    let bypassImmune = false, classifierEligible = true, sandboxAdmission = true, ruleMayClear = true;
+    for (const c of classes) {
+        const row = MODE_ARBITRATION[c];
+        bypassImmune ||= row.bypassImmune;
+        classifierEligible &&= row.classifierEligible;
+        sandboxAdmission &&= row.sandboxAdmission;
+        ruleMayClear &&= row.ruleMayClear;
+    }
+    return { bypassImmune, classifierEligible, sandboxAdmission, ruleMayClear };
+}
+export function classifyAsk(d, facts) {
+    const classes = decisionAskClassesOf({ ...d, foldedAskClasses: undefined });
+    classes.delete("policy_rra");
+    if (facts.contentQuestion)
+        classes.add("content_question");
+    if (facts.markedUnresolvable)
+        classes.add("ancestor");
+    if (facts.org === "rule")
+        classes.add("org_rule");
+    if (facts.org === "unavailable")
+        classes.add("governance_unavailable");
+    if (facts.ruleCallUnreadable === true)
+        classes.add("rule_unreadable");
+    const marks = facts.mandateMarks;
+    if (marks.shellGated === true && marks.irreversibility === "always")
+        classes.add("operator_forced");
+    const toolMarked = marks.shellGated !== true && (marks.egress === true || marks.irreversibility === "always" || marks.irreversibility === "maybe");
+    if (toolMarked) {
+        const sources = facts.toolMarkSources;
+        if (sources === undefined || sources.size === 0 || sources.has("deployment"))
+            classes.add("operator_forced");
+        if (sources?.has("mcp_annotation"))
+            classes.add("tool_marks_mcp");
+        if (sources?.has("a2a_default"))
+            classes.add(facts.a2aIsolatePeers === true ? "operator_forced" : "tool_marks_a2a");
+    }
+    if (marks.probeUnanswered === true)
+        classes.add("probe");
+    if (marks.writeProtectionUnresolved === true)
+        classes.add("write_protection_unresolved");
+    if (marks.writeProtected === true)
+        classes.add("write_protection");
+    for (const c of facts.ancestorClasses ?? [])
+        classes.add(c);
+    if (d.requiresRealApproval === true && ![...classes].some((c) => RRA_EXPLAINERS.has(c)))
+        classes.add("policy_rra");
+    for (const c of d.foldedAskClasses ?? [])
+        classes.add(c);
+    if (classes.size === 0 && d.mandated === true)
+        classes.add("operator_forced");
+    if (classes.size === 0)
+        classes.add("ordinary");
+    const askClass = ASK_CLASSES.find((c) => classes.has(c));
+    return { classes, askClass, row: foldArbitrationRow(classes) };
+}
+export function headlessDenialMessage(toolName, askMessage) {
+    return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (no approver is wired for "${toolName}" — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;
+}
+export function headlessApprovalRemedy(input) {
+    const approver = "wire an approver (`onAsk`) to put it to a person";
+    const c = input.classification;
+    if (input.mode === "acceptEdits" && input.unplacedOptions !== undefined && (c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"))))
+        return `${fileCommandOptionsSentence(input.unplacedOptions.program)} Spell the ${input.unplacedOptions.program} without option words for the mode to answer it, or ${approver}`;
+    if (c?.row.bypassImmune === true)
+        return `no permission mode releases this ask (${c.askClass}): ${approver}, or change the call`;
+    if (input.mode === "plan" && c?.classes.has("mode") === true)
+        return `the plan permission mode asks before every write and every call to a tool the engine does not define that is not read-only — leave plan mode (\`setPermissionMode\` to another mode, or approve the plan) to run it, or ${approver}`;
+    const onlyOrdinary = c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"));
+    if (input.coveredWrite && onlyOrdinary) {
+        if (input.mode === "acceptEdits")
+            return `under \`permissionMode: "acceptEdits"\` the mode asks only for a write outside the working directories — if this target is outside them, add its directory to \`additionalDirectories\`; otherwise (or besides) ${approver}`;
+        if (input.mode === undefined || input.mode === "default" || input.mode === "auto")
+            return `the mode's write gate asks every write under \`default\`: \`permissionMode: "acceptEdits"\` lets writes inside the working directories (the task root and \`additionalDirectories\`) through without asking (a question another policy raised still stands), or ${approver}`;
+    }
+    return `run with \`permissionMode: "bypassPermissions"\` to release this ask (the release is disclosed on the call), or ${approver}`;
+}
+export function fileCommandOptionsSentence(program) {
+    return `${program} with flags requires manual approval to ensure path safety: the mode cannot automatically validate ${program} commands that use flags, as some flags like --target-directory=PATH can bypass path validation.`;
+}
+export function arbitrateByMode(mode, c, disclosure, call) {
+    const has = (k) => c.classes.has(k);
+    const classes = ASK_CLASSES.filter((k) => c.classes.has(k));
+    switch (mode) {
+        case "dontAsk":
+            return has("hook") || has("org_rule") || has("operator_forced") || has("governance_unavailable") ? { kind: "ask" } : { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
+        case "bypassPermissions":
+            if (has("write_protection_unresolved"))
+                return { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
+            if (c.row.bypassImmune)
+                return { kind: "ask" };
+            return {
+                kind: "released",
+                mode,
+                askClass: c.askClass,
+                classes,
+                ...(disclosure?.origin !== undefined ? { origin: disclosure.origin } : {}),
+                ...(disclosure?.mandate !== undefined ? { mandate: disclosure.mandate } : {}),
+                ...(has("rule_unreadable") ? { reason: "rule_unreadable" } : {}),
+            };
+        case "acceptEdits":
+            return call?.fileCommand === true && c.classes.size === 1 && c.classes.has("ordinary") ? { kind: "accepted", mode } : { kind: "ask" };
+        case "plan":
+        case "default":
+        case "auto":
+            return { kind: "ask" };
+        default: {
+            const _exhaustive = mode;
+            return _exhaustive;
+        }
+    }
 }

package/dist/core/ask-unresolvable-notice.d.ts

@@ -45,6 +45,9 @@ export interface AskUnresolvableFacts {
     /** Whether a durable approval park lane was ARMED for this run (`true`: the park had its one attempt and
      *  did not take the call — it declined or failed; `false`: no park lane at all, the usual shape). */
     readonly parkLaneExisted: boolean;
+    /** `no_approver_wired` only: the caller-side change that would have let the call run, as the gate minted it for the
+     *  refusal's tool text (`headlessApprovalRemedy`, ask-origin.ts) — carried verbatim, never re-composed here. */
+    readonly remedy?: string;
 }
 /**
  * Compose the `delegation.ask_unresolvable` notice from the gate's deny-exit facts.
@@ -55,7 +58,7 @@ export interface AskUnresolvableFacts {
  * an empty session or tool name, or a cause outside the closed set, is refused at the mint with a
  * `TypeError` rather than shaped into a notice that would route nowhere or say nothing.
  *
- * `detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted }` — `sessionId` is lifted onto the
- * typed key by {@link import("./engine-notice.js").deliverEngineNotice}, the one throat.
+ * `detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted, remedy? }` — `remedy` rides a headless
+ * auto-deny only (the sentence the refusal's tool text carries); `sessionId` is lifted onto the typed key by {@link import("./engine-notice.js").deliverEngineNotice}, the one throat.
  */
 export declare function askUnresolvableNotice(facts: AskUnresolvableFacts): EngineNotice;

package/dist/core/ask-unresolvable-notice.js

@@ -1,4 +1,5 @@
 export const ASK_UNRESOLVABLE_CAUSES = ["approver_unavailable", "no_approver_wired", "mandate_unreconstructible"];
+Object.freeze(ASK_UNRESOLVABLE_CAUSES);
 const ASK_UNRESOLVABLE_CAUSE_SET = new Set(ASK_UNRESOLVABLE_CAUSES);
 export function isAskUnresolvableCause(v) {
     return ASK_UNRESOLVABLE_CAUSE_SET.has(v);
@@ -9,7 +10,7 @@ const CAUSE_CLAUSE = {
     mandate_unreconstructible: "an inherited durable-approval mandate binds this ask and this leg has no park facility to honor it",
 };
 export function askUnresolvableNotice(facts) {
-    const { sessionId, toolName, toolCallId, cause, parkLaneExisted } = facts;
+    const { sessionId, toolName, toolCallId, cause, parkLaneExisted, remedy } = facts;
     if (typeof sessionId !== "string" || sessionId.length === 0) {
         throw new TypeError("delegation.ask_unresolvable: sessionId is required — a user-audience notice with no session routes nowhere");
     }
@@ -26,8 +27,8 @@ export function askUnresolvableNotice(facts) {
     return {
         code: "delegation.ask_unresolvable",
         message: `approval for "${toolName}" could not be resolved: ${CAUSE_CLAUSE[cause]} and ${park} — ` +
-            `the call was denied fail-closed and did not run. To let such approvals wait for a person, run with a checkpoint store and a ` +
+            `the call was denied fail-closed and did not run. ${typeof remedy === "string" && remedy.length > 0 ? `To let it run: ${remedy}. ` : ""}To let such approvals wait for a person, run with a checkpoint store and a ` +
             `durable approval opt-in (or a live approver reachable for delegated children).`,
-        detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted: parkLaneExisted === true },
+        detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted: parkLaneExisted === true, ...(typeof remedy === "string" && remedy.length > 0 ? { remedy } : {}) },
     };
 }

package/dist/core/auto-mode-arming.d.ts

@@ -1,4 +1,4 @@
-import type { AutoModeRules, AutoModeWindowOptions } from "./auto-mode-prompt.js";
+import type { AutoModeRules, AutoModeWindowOptions, DerivedDenyRule } from "./auto-mode-prompt.js";
 import type { AutoModeDenialLimitOptions } from "./auto-mode.js";
 /** The recipe format's version. A reader that does not know a version REFUSES it (never guesses): the
  *  recipe names the criteria a classifier enforces, and a partially-understood criteria set is the one
@@ -22,6 +22,14 @@ export interface AutoModeArmingRecipe {
     rules?: AutoModeRules;
     /** Settings-plane deny rules rendered into `<settings_deny_rules>`. */
     settingsDenyRules?: readonly string[];
+    /**
+     * The ENGINE's deny lines rendered beside them — the arming leg's effective read-deny table as rules
+     * (`readDenyClassifierRules`: the rule text and its letter-case note). Prompt BODY, compared by the fold exactly as `settingsDenyRules` is: a
+     * redeeming host recomputes its own from its deployment's read-deny configuration and the row's task
+     * additions, and a difference refuses the rebuild (`settings_moved`) — the same rule as a moved deployment
+     * setting, no exemption.
+     */
+    derivedDenyRules?: readonly DerivedDenyRule[];
     /** `## Session Context` facts appended to the assembled document. */
     sessionContext?: readonly string[];
     /** Transcript-window bounds for the classify prompt. */
@@ -125,10 +133,14 @@ export declare function sanitizeAutoModeArmingRecipe(value: unknown): AutoModeAr
  * caller is expected to say so out loud rather than park a silently thinner arming.
  *
  * Used on BOTH ends of the boundary: the Runner mints it at arming time (so a park can record it), and a
- * redeeming host mints its OWN face into the `current` half of {@link foldAutoModeArming}.
+ * redeeming host mints its OWN face into the `current` half of {@link foldAutoModeArming}. `bind` carries
+ * what is the ENGINE's rather than the deployment's: the assembled prompt's digest (the arming side only)
+ * and the engine's deny lines (`derivedDenyRules`, both sides — a redeeming host passes the lines its own
+ * read-deny configuration yields over the row's task additions, `readDenyClassifierRules`).
  */
 export declare function autoModeArmingRecipeOf(face: AutoModeArmingFace, bind?: {
     promptDigest?: string;
+    derivedDenyRules?: readonly DerivedDenyRule[];
 }): AutoModeArmingRecipe | undefined;
 /** Why a rebuild refused. Every arm leaves the redemption on the PRE-#503 path (honest `unavailable` →
  *  the frozen approver chain → a human), so a refusal costs a second park, never a widened gate. */
@@ -172,8 +184,9 @@ export type AutoModeArmingFold = {
  *   ITS OWN declared settings rather than by whatever the previous redeemer happened to run under. A
  *   deployment that wants a tightening to be durable tightens its own settings, where it is auditable.
  * · bodies EQUAL ⇒ rebuild, with `timeoutMs` taking the MINIMUM of the two — fail-closed: a shorter
- *   timeout turns a slow classifier into `unavailable` (a deny that says so) sooner, and can never widen
- *   a verdict. The denial-limit triple
+ *   timeout turns a slow classifier into `unavailable` sooner (the call goes on to a person where the
+ *   station has an approval seat, and is refused with a sentence that says so where it has none), and can
+ *   never widen a verdict. The denial-limit triple
  *   (#556) folds the same way through {@link tightenDenialLimit} — fewer blocks before a person looks,
  *   and no window ever lengthened or removed.
  * · bodies DIFFER ⇒ refuse. `settings_moved` normally; `epoch_inconsistent` when the two sides

package/dist/core/auto-mode-arming.js

@@ -12,6 +12,22 @@ function canonicalStrings(v) {
     }
     return v.length === 0 ? undefined : v.slice();
 }
+function canonicalDerivedDenyRules(v) {
+    if (v === undefined)
+        return undefined;
+    if (!Array.isArray(v))
+        return null;
+    const out = [];
+    for (let i = 0; i < v.length; i++) {
+        const e = v[i];
+        if (!(i in v) || !isPlainRecord(e) || typeof e.rule !== "string")
+            return null;
+        if (e.anyCase !== undefined && typeof e.anyCase !== "boolean")
+            return null;
+        out.push({ rule: e.rule, ...(e.anyCase === true ? { anyCase: true } : {}) });
+    }
+    return out.length === 0 ? undefined : out;
+}
 function canonicalRuleSection(v) {
     const list = canonicalStrings(v);
     if (list === null || list === undefined)
@@ -74,10 +90,11 @@ export function sanitizeAutoModeArmingRecipe(value) {
     if (value.v !== AUTO_MODE_ARMING_RECIPE_VERSION)
         return undefined;
     const settingsDenyRules = canonicalStrings(value.settingsDenyRules);
+    const derivedDenyRules = canonicalDerivedDenyRules(value.derivedDenyRules);
     const sessionContext = canonicalStrings(value.sessionContext);
     const timeoutMs = canonicalNumber(value.timeoutMs, 1, false);
     const denialLimit = canonicalDenialLimit(value.denialLimit);
-    if (settingsDenyRules === null || sessionContext === null || timeoutMs === null || denialLimit === null)
+    if (settingsDenyRules === null || derivedDenyRules === null || sessionContext === null || timeoutMs === null || denialLimit === null)
         return undefined;
     let rules;
     if (value.rules !== undefined) {
@@ -128,6 +145,7 @@ export function sanitizeAutoModeArmingRecipe(value) {
         ...(crossSessionMessagesRule === true ? { crossSessionMessagesRule: true } : {}),
         ...(rules !== undefined ? { rules } : {}),
         ...(settingsDenyRules !== undefined ? { settingsDenyRules } : {}),
+        ...(derivedDenyRules !== undefined ? { derivedDenyRules } : {}),
         ...(sessionContext !== undefined ? { sessionContext } : {}),
         ...(window !== undefined ? { window } : {}),
         ...(timeoutMs !== undefined ? { timeoutMs } : {}),
@@ -139,6 +157,7 @@ export function autoModeArmingRecipeOf(face, bind) {
     return sanitizeAutoModeArmingRecipe({
         v: AUTO_MODE_ARMING_RECIPE_VERSION,
         ...(bind?.promptDigest !== undefined ? { promptDigest: bind.promptDigest } : {}),
+        ...(bind?.derivedDenyRules !== undefined ? { derivedDenyRules: bind.derivedDenyRules } : {}),
         ...(face.rules !== undefined ? { rules: face.rules } : {}),
         ...(face.settingsDenyRules !== undefined ? { settingsDenyRules: face.settingsDenyRules } : {}),
         ...(face.sessionContext !== undefined ? { sessionContext: face.sessionContext } : {}),
@@ -156,6 +175,7 @@ function sameArmingBody(a, b) {
         r.rules?.hardDeny ?? null,
         r.rules?.environment ?? null,
         r.settingsDenyRules ?? null,
+        r.derivedDenyRules ?? null,
         r.sessionContext ?? null,
         r.window?.maxEntries ?? null,
         r.window?.maxCharsPerEntry ?? null,
@@ -163,13 +183,17 @@ function sameArmingBody(a, b) {
     ]);
     return body(a) === body(b);
 }
+function armableRecipe(r) {
+    return r !== undefined && (r.timeoutMs === undefined || r.timeoutMs <= MAX_TIMER_DELAY_MS) ? r : undefined;
+}
 export function foldAutoModeArming(recorded, current) {
-    const rec = sanitizeAutoModeArmingRecipe(recorded);
+    const rec = armableRecipe(sanitizeAutoModeArmingRecipe(recorded));
     if (rec === undefined) {
         return {
             ok: false,
             reason: "malformed_recipe",
-            message: "the recorded auto-mode arming recipe is not readable by this build (unknown recipe version, or not plain recipe data) — " +
+            message: "the recorded auto-mode arming recipe is not readable by this build (unknown recipe version, not plain recipe data, or a " +
+                "classifier budget outside the range the live knob takes) — " +
                 "no classifier is rebuilt; the redemption keeps its honest refusal and the inherited ask flows the original chain",
         };
     }
@@ -182,12 +206,13 @@ export function foldAutoModeArming(recorded, current) {
                 "with no overrides of its own still declares that, and the declaration is what the bound is made of)",
         };
     }
-    const cur = sanitizeAutoModeArmingRecipe(current);
+    const cur = armableRecipe(sanitizeAutoModeArmingRecipe(current));
     if (cur === undefined) {
         return {
             ok: false,
             reason: "malformed_current_settings",
-            message: "the redeeming deployment's own auto-mode settings did not canonicalize into a recipe, so the recorded arming cannot be " +
+            message: "the redeeming deployment's own auto-mode settings did not canonicalize into a recipe its own arming accepts (a malformed " +
+                "member, or a classifier budget outside the range the live knob takes), so the recorded arming cannot be " +
                 "bounded by the settings in force — no classifier is rebuilt (fail-closed: an unbounded rebuild is the one outcome this fold exists to prevent)",
         };
     }
@@ -203,7 +228,7 @@ export function foldAutoModeArming(recorded, current) {
             : {
                 ok: false,
                 reason: "settings_moved",
-                message: "the auto-mode settings moved between the recorded arming and this deployment's current ones (rule sections / settings-deny rules / " +
+                message: "the auto-mode settings moved between the recorded arming and this deployment's current ones (rule sections / settings-deny rules / the engine's read-deny lines / " +
                     "session context / window bounds / the cross-session lane rule differ), and free-text rule sets have no sound stricter-than ordering — refusing to rebuild " +
                     "(the strictest decidable answer: the inherited ask flows the original chain to a human)",
             };

package/dist/core/auto-mode-defaults.d.ts

@@ -1,12 +1,21 @@
 /**
- * Hard cap on one classification RUNG (both attempts) when `AutoModeDeciderOptions.timeoutMs` is omitted — CC
- * 2.1.259's per-attempt classifier base (`j7e = 60000`; 2.1.250 `oue`, the same number), which upstream
- * stretches to 120 s with prompt size and sema leaves to the deployment knob. The 15 s that stood here was
- * never upstream's: live 2026-09-15 a thinking-by-default gateway answers in 5–165 s (Qwen 3.8 p50 11–24 s,
- * kimi and GLM p50 ~10 s), so 15 s turned most classifications into `unavailable (timed out)`. Worst-case
- * walk = this × rungs (2) = 120 s.
+ * Hard cap on one classification RUNG (both attempts) when `AutoModeDeciderOptions.timeoutMs` /
+ * `RunnerDeps.autoMode.timeoutMs` is omitted. Sized for a self-hosted gateway, not a cloud API: a
+ * thinking-by-default gateway answers a classification in 5–165 s (Qwen 3.8 p50 11–24 s, kimi and GLM p50
+ * ~10 s), and queueing plus prefill of 2–5 min is a normal wait on such a gateway (`docs/TIMEOUTS.md`). 180 s
+ * clears the slowest classification observed with margin; CC 2.1.259's per-attempt base is 60 s (`j7e`,
+ * stretched to 120 s with prompt size). Worst-case walk = this × rungs (2) = 360 s. Where the leg has an
+ * approval seat a rung that runs out of time costs a question to a person, not a refusal (see the gate's
+ * classifier station).
  */
-export declare const AUTO_MODE_DEFAULT_TIMEOUT_MS = 60000;
+export declare const AUTO_MODE_DEFAULT_TIMEOUT_MS = 180000;
+/**
+ * The classifier call's transient retry budget — the reference implementation's short ladder (2.1.280 `J9e = 4`): a
+ * provider error (an HTTP 5xx, a dropped connection) is retried this many times inside the rung's budget, then the rung
+ * reports `unavailable` / `error`. Where the leg has an approval seat that question goes to a person, so a long ladder
+ * would only make the person wait out the rung's budget and hear "timed out" for a failure that was not one.
+ */
+export declare const AUTO_MODE_CLASSIFIER_MAX_RETRIES = 4;
 /**
  * What an arming RECORDING that carries no `timeoutMs` meant when it was written: the default of its day. Every
  * recipe minted since the deadline moved to 60 s MATERIALISES its bound, so an absent recorded knob dates the

package/dist/core/auto-mode-defaults.js

@@ -1,4 +1,5 @@
-export const AUTO_MODE_DEFAULT_TIMEOUT_MS = 60_000;
+export const AUTO_MODE_DEFAULT_TIMEOUT_MS = 180_000;
+export const AUTO_MODE_CLASSIFIER_MAX_RETRIES = 4;
 export const AUTO_MODE_RECORDED_ABSENT_TIMEOUT_MS = 15_000;
 export const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
 export const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2_000;

package/dist/core/auto-mode-directive.d.ts

@@ -1,4 +1,6 @@
-import type { ApproverPosture } from "./task-spec.js";
+import type { AskEffective } from "./wiring-manifest.js";
+/** The permission-mode words the composition reads (the engine's closed set, as the wire spells it). */
+import type { PermissionMode } from "./ask-origin.js";
 /** The auto-mode directive body (title + the two paragraphs). Rendered when the run's auto-mode
  *  INTENT is resolved true — the seat, the chain it inherited, or the bit a suspend recorded. */
 export declare const AUTO_MODE_DIRECTIVE: string;
@@ -8,39 +10,25 @@ export declare const BASH_FIRST_DIRECTIVE: string;
 /** The bypass-posture directive body: the reference implementation's heading over the shell-first
  *  paragraph, the exact pair its bypass arm renders. */
 export declare const BYPASS_POSTURE_DIRECTIVE: string;
-/** The posture words this engine accepts, as literals (the door refuses anything else loudly). The
- *  TYPE is declared beside the seat it belongs to ({@link ApproverPosture}, task-spec.ts); this array
- *  is its runtime twin, and the assignment below is the compile-time tie between them. */
-export declare const APPROVER_POSTURES: readonly ApproverPosture[];
-/** Value-shape check for the word — used by the spec door below and by the chain/checkpoint readers. */
-export declare function isApproverPosture(value: unknown): value is ApproverPosture;
-/** The SEAT's door screen, declared beside the vocabulary it screens against. The renderer keys on the
- *  exact word, so any other present value would render zero bytes and be indistinguishable from "no
- *  posture declared"; it is refused instead. The value that passed is the value RETURNED — the render
- *  reads that snapshot, never the caller's spec object again. */
-export declare function refuseInvalidApproverPosture(spec: {
-    approverPosture?: ApproverPosture;
-}): ApproverPosture | undefined;
-/** The resolved posture facts of one leg: both already folded across seat, chain and checkpoint. */
+/** The mode facts of one leg, both the ENGINE's own resolution — never a requested value, never spec shape. */
 export interface ApprovalPostureFacts {
-    /** The run's resolved auto-mode intent (seat ∨ inherited chain ∨ checkpoint seed). */
-    autoMode: boolean;
-    /** The declared approver posture, absent when the host declared none. */
-    approverPosture?: ApproverPosture;
+    /** The leg's EFFECTIVE permission mode (a requested mode the deployment refused has already folded back). */
+    mode: PermissionMode;
+    /** The wiring manifest's ask derivation — `auto_allow` means no person answers an ask on this leg. */
+    askEffective: AskEffective;
 }
 /**
- * The ONE composition, and the ONE invariant: **the segment the run's posture calls for is stated
- * exactly once in the active model context**. `alreadyStated` is the transcript's ENGINE REGIONS (read
- * by metadata — a caller's own bytes are never in one, so a spliced copy cannot suppress the engine's);
- * a segment already standing there is not restated, and a segment that has left the context — compacted
- * away, or never delivered — is. Returns `undefined` when there is nothing left to say, which is both
- * "no posture declared" (zero bytes, byte-identical to the pre-seat shape) and "already said".
+ * The ONE composition, and the ONE invariant: **the segment the leg's mode calls for is stated exactly
+ * once in the active model context**. `statedBodies` is the transcript's ENGINE REGIONS (read by metadata
+ * — a caller's own bytes are never in one, so a spliced copy cannot suppress the engine's); a segment
+ * already standing there is not restated, and a segment that has left the context — compacted away, or
+ * never delivered — is. Returns `undefined` when there is nothing left to say, which is both "no segment
+ * for this mode" (zero bytes) and "already said".
  *
- * Segment-wise rather than body-wise on purpose: a leg whose posture CHANGES — it gains the bypass fact,
- * so the segment it owes changes — must state the new segment without restating one already standing,
- * and must be able to read a body an earlier leg minted under a composition that joined two. The caller
- * wraps the result in the engine's marked reminder shell; this module never wraps, so the mark stays
- * owned by its own mint home.
+ * Segment-wise rather than body-wise on purpose: a leg whose mode CHANGES — it now runs under bypass, so the
+ * segment it owes changes — must state the new segment without restating one already standing, and must be
+ * able to read a body an earlier leg minted under a composition that joined two. The caller wraps the result
+ * in the engine's marked reminder shell; this module never wraps, so the mark stays owned by its own mint home.
  */
 export declare function composeApprovalPostureDirective(facts: ApprovalPostureFacts, statedBodies?: readonly string[]): string | undefined;
 /** SHA-256 of a directive body — the pins' lock port, so the lock is computed the one way. */