@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/read-only-shell.js

@@ -1,6 +1,22 @@
+import { posix } from "node:path";
 import { readShellCommand } from "./shell-lexer.js";
 import { FIND_ACTION_PRIMARIES, FIND_NEWER_PRIMARY, FIND_VALUE_PRIMARIES, FLAG_VALUE_ACCEPTS, READ_ONLY_BARE_ONLY, READ_ONLY_BARE_PROGRAMS, READ_ONLY_COMMAND_TABLE, READ_ONLY_ENV_NAMES, READ_ONLY_EXACT_FORMS, READ_ONLY_GLOB_PROGRAMS, XARGS_READ_ONLY_TARGETS, dockerRetargetDanger, } from "./read-only-shell-table.js";
 const NOT = (reason) => ({ readOnly: false, reason });
+export const CD_GIT_COMPOUND_SENTENCE = "This command changes directory before running a version-control command, which can pick up untrusted hooks or repository configuration from the target directory. Approve only if you trust it.";
+export function changesDirectoryBeforeGit(shape, cwd) {
+    const programs = shape.segments.map((s) => peelBuiltinPrefix(s.argv.slice(leadingAssignmentCount(s.argv)).map((w) => w.text))[0] ?? "");
+    if (shape.segments.length < 2 || !programs.includes("cd") || !programs.includes("git"))
+        return false;
+    const cds = shape.segments.filter((_, i) => programs[i] === "cd");
+    const [cd] = cds;
+    if (cwd === undefined || cds.length !== 1 || cd === undefined || cd.redirections.length > 0 || cd.argv.length !== 2 || cd.argv[0].raw !== "cd")
+        return true;
+    const target = cd.argv[1];
+    if (target.expands !== false || !/^(?:\.\.?(?:\/|$)|\/)/.test(target.text) || /[$`*?[\\]/.test(target.raw))
+        return true;
+    const trim = (p) => p.replace(/\/+$/, "") || "/";
+    return trim(posix.resolve(cwd, target.text)) !== trim(cwd);
+}
 const READ_ONLY = { readOnly: true };
 const BARE_PROGRAMS = new Set(READ_ONLY_BARE_PROGRAMS.filter((p) => !p.includes(" ")));
 const BARE_MULTIWORD = READ_ONLY_BARE_PROGRAMS.filter((p) => p.includes(" ")).map((p) => p.split(" "));
@@ -23,15 +39,10 @@ const PRINTF_ESCAPE = new RegExp(`%[^%a-zA-Z]*${PRINTF_LENGTH}\\\\[0-7xX]`);
 const PRINTF_NUMERIC = new RegExp(`%[-+ 0#']*[0-9.*]*${PRINTF_LENGTH}[diouxXeEfFgGaAn]`);
 const JQ_DANGER_FLAG = /^['"]?-[a-zA-Z]*[fL]/;
 const JQ_DANGER_TEXT = /--from-file|--rawfile|--slurpfile|--run-tests|--library-path|\benv\b|\$ENV\b|\binclude\b|\bimport\b/;
-export function readOnlyShellVerdict(command, shape = readShellCommand(command)) {
-    if (shape.grouped)
-        return NOT("a subshell, group or control structure — not a flat list of simple commands");
-    if (shape.segments.length === 0)
-        return NOT("no command");
-    if (shape.backgrounded)
-        return NOT("a background `&` defers execution past the approval-time reading");
-    if (shape.strayRedirection)
-        return NOT("a redirection on a piece that runs no program — the shell still opens its target");
+export function readOnlyShellVerdict(command, shape = readShellCommand(command), cwd) {
+    const line = lineStructureObjection(shape);
+    if (line !== undefined)
+        return NOT(line);
     for (const seg of shape.segments) {
         if (seg.unreadable !== undefined)
             return NOT(seg.unreadable);
@@ -46,9 +57,8 @@ export function readOnlyShellVerdict(command, shape = readShellCommand(command))
                 return NOT("a shell-specific expansion spelling (`=cmd`, `~[…]`)");
         }
     }
-    const programs = shape.segments.map((s) => peelBuiltinPrefix(s.argv.slice(leadingAssignmentCount(s.argv)).map((w) => w.text))[0] ?? "");
-    if (shape.segments.length > 1 && programs.includes("cd") && programs.includes("git"))
-        return NOT("a compound that changes directory and runs git");
+    if (changesDirectoryBeforeGit(shape, cwd))
+        return NOT(CD_GIT_REASON);
     for (const seg of shape.segments) {
         const verdict = segmentVerdict(seg);
         if (!verdict.readOnly)
@@ -56,6 +66,22 @@ export function readOnlyShellVerdict(command, shape = readShellCommand(command))
     }
     return READ_ONLY;
 }
+const CD_GIT_REASON = "a compound that changes directory and runs git";
+function lineStructureObjection(shape) {
+    if (shape.grouped)
+        return "a subshell, group or control structure — not a flat list of simple commands";
+    if (shape.segments.length === 0)
+        return "no command";
+    if (shape.backgrounded)
+        return "a background `&` defers execution past the approval-time reading";
+    if (shape.strayRedirection)
+        return "a redirection on a piece that runs no program — the shell still opens its target";
+    return undefined;
+}
+export function readOnlyLineObjection(command, cwd) {
+    const shape = readShellCommand(command);
+    return lineStructureObjection(shape) ?? (changesDirectoryBeforeGit(shape, cwd) ? CD_GIT_REASON : undefined);
+}
 function expansionKind(w) {
     if (w.expands === false)
         return "none";

package/dist/core/retired-keys.d.ts

@@ -12,8 +12,14 @@ export declare function retiredKeyOf(bag: object, table: Readonly<Record<string,
     replacement: string;
 } | undefined;
 /**
- * The deps-bag door: a retired seat still wired by a deployment is refused BY NAME (`config.deps_retired_key`)
- * instead of vanishing silently — a seat that is silently dropped reads to the deployment as wired. `owner` is
- * the bag's type name for the sentence (`RunnerDeps`, `RunWorkflowToolDeps`).
+ * The retired-key door: a retired seat still wired by a deployment is refused BY NAME (`config.deps_retired_key`
+ * on a deps bag, `config.spec_retired_key` on a `TaskSpec`) instead of vanishing silently — a seat that is silently
+ * dropped reads to the caller as wired. `owner` is the bag's type name for the sentence (`RunnerDeps`,
+ * `RunWorkflowToolDeps`, `TaskSpec`).
  */
 export declare function assertNoRetiredKeys(bag: object, table: Readonly<Record<string, string>>, owner: string): void;
+/** The RETIRED `TaskSpec` keys, each with the sentence that names its replacement — the table the spec door reads
+ *  ({@link assertNoRetiredKeys} with owner `TaskSpec`). A caller still writing one of these is refused by name
+ *  (`config.spec_retired_key`), never read as absence: a mode a caller believes it declared must not silently run
+ *  as another. */
+export declare const RETIRED_TASK_SPEC_KEYS: Readonly<Record<string, string>>;

package/dist/core/retired-keys.js

@@ -10,6 +10,10 @@ export function assertNoRetiredKeys(bag, table, owner) {
     if (hit === undefined)
         return;
     const e = new Error(`${owner}.${hit.key} is retired and is not read by this engine — ${hit.replacement}. Refused rather than ignored: a seat that is silently dropped reads to the deployment as wired.`);
-    e.code = "config.deps_retired_key";
+    e.code = owner === "TaskSpec" ? "config.spec_retired_key" : "config.deps_retired_key";
     throw e;
 }
+export const RETIRED_TASK_SPEC_KEYS = Object.freeze({
+    autoModeRequested: 'the permission mode is one key now — write `permissionMode: "auto"`',
+    approverPosture: 'a posture never authorized anything; drop the key (the engine renders the posture from the effective mode). Releasing asks is a separate decision: `permissionMode: "bypassPermissions"`',
+});

package/dist/core/runner/active-skill-scope.js

@@ -3,6 +3,7 @@ import { pathTargetValue } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
 import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
 import { parseSkillToolEntry, skillSpecifierRejection } from "../skill-tool-specifier.js";
+import { ruleNamesOf } from "../tool-roster.js";
 export class ActiveSkillScope {
     frames = [];
     push(frame) {
@@ -22,7 +23,7 @@ export function createActiveSkillScopePolicy(opts) {
     const { scope, env, rootPath, toolEffects } = opts;
     return {
         async check(req, signal) {
-            const toolName = req.toolName;
+            const names = ruleNamesOf(req);
             const frames = scope.active();
             if (frames.length === 0)
                 return { action: "allow" };
@@ -47,7 +48,7 @@ export function createActiveSkillScopePolicy(opts) {
                 }
                 return { manifest: m, byName };
             });
-            if (perFrame.length === 0 || perFrame.some((f) => !f.byName.has(toolName))) {
+            if (perFrame.length === 0 || perFrame.some((f) => !names.some((n) => f.byName.has(n)))) {
                 const ids = manifests.map((m) => m.lineageId).join(", ");
                 return {
                     action: "deny",
@@ -56,7 +57,7 @@ export function createActiveSkillScopePolicy(opts) {
                 };
             }
             for (const frame of perFrame) {
-                const alternatives = frame.byName.get(toolName) ?? [];
+                const alternatives = names.flatMap((n) => frame.byName.get(n) ?? []);
                 const rejections = [];
                 let admitted = false;
                 for (const entry of alternatives) {
@@ -79,7 +80,7 @@ export function createActiveSkillScopePolicy(opts) {
             const declaredTarget = req.face?.pathTarget;
             const skillScopeEligible = declaredTarget !== undefined && declaredTarget.skillScopeEligible === true;
             if (pathConstrainingActive && !skillScopeEligible) {
-                const eff = toolEffects?.get(toolName) ?? "write";
+                const eff = toolEffects?.get(req.toolName) ?? "write";
                 if (eff !== "read") {
                     const ids = manifests.filter((m) => m.allowPaths?.length).map((m) => m.lineageId).join(", ");
                     return {

package/dist/core/runner/assemble-result.js

@@ -1,5 +1,5 @@
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
-import { extractErrorCode, stripErrorCodePrefix } from "../../brain/errors.js";
+import { extractErrorCode, isProviderEchoShape, stripErrorCodePrefix } from "../../brain/errors.js";
 import { terminalProjection } from "./terminal-projection.js";
 import { haltConsumed } from "./halt-attribution.js";
 import { providerReportedModel } from "../message-utils.js";
@@ -127,7 +127,7 @@ export function terminalCauseOf(final, stats, flags) {
         if (final.isApiErrorMessage === true) {
             apiFailure = {
                 ...(final.apiErrorStatus !== undefined ? { status: final.apiErrorStatus } : {}),
-                ...(final.requestId !== undefined ? { requestId: final.requestId } : {}),
+                ...(typeof final.requestId === "string" && isProviderEchoShape(final.requestId) ? { requestId: final.requestId } : {}),
             };
         }
         const lifted = extractErrorCode(message);

package/dist/core/runner/classifier-ladder.d.ts

@@ -34,7 +34,8 @@
  */
 import type { AssistantMessage, Model } from "../../internal/llm.js";
 import { type AutoModeClassified } from "../auto-mode.js";
-import type { RunnerDeps } from "../types.js";
+import type { ClassifierUnavailableInfo, ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
+import type { EngineNotice, RunnerDeps } from "../types.js";
 /**
  * The rungs a classification walks, in order: the classifier seat, and — under `classifierFallback: "main"` (the
  * default) — the run's main model behind it. The knob is screened by `autoModeClassifierFallbackOf`, here and
@@ -108,6 +109,47 @@ export declare function announceClassifierRoleDefaulted(args: {
     sessionId?: string;
     runId?: string;
 }): void;
+/**
+ * The `classifier.unavailable` notice — a classification that could not RULE (the classifier leg failed, or its
+ * per-level budget ran out) and where the call went: `"asked"` = on down the ask chain to this leg's approval seat (a
+ * person or a durable park decides; the handed-on ask carries `requiresRealApproval`, so no automatic lane answers it),
+ * `"denied"` = refused (no approval seat: nobody to ask). Audience `user`: the refusal is the session user's own
+ * call, and on a lane with no approval face (`-p`) this line is the only place they hear why it did not run. Once
+ * per classification that could not answer, from both classifier stations (the leg's gate and an ancestor's frozen
+ * classifier in the policy fold) — a call judged by more than one classifier can carry one line per classifier. It is never a block: the denial limit does not count it, so this line is not a step toward the
+ * limit's card either.
+ *
+ * `detail: { toolName, toolCallId, cause, disposition, sessionId?, runId? }` — `cause` is the
+ * `AutoModeUnavailableCause` word (`timeout` / `error`). The sentence names the seat the station forked on — `leg` (this
+ * run's own approval seat) or `ancestor` (the frozen approver of the ancestor layer whose classifier it was) — and, on a
+ * timeout, the budget the classifier actually held (`budgetMs`, the decider's {@link AutoModeDecider.timeoutMs}; a
+ * hand-built decider states none, and the sentence names the knob alone).
+ */
+export declare function classifierUnavailableNotice(args: ClassifierUnavailableInfo & ClassifierUnavailableStation & {
+    sessionId?: string;
+    runId?: string;
+}): EngineNotice;
+/** A classifier station's fork facts, wired once per leg: whether an ask the station hands on reaches a person, and
+ *  the `classifier.unavailable` notice through the one throat. Both stations (the gate, the inherited fold) take it. */
+export declare function classifierUnavailableSeat(args: ClassifierUnavailableStation & {
+    approvalSeat: boolean;
+    onNotice: RunnerDeps["onNotice"];
+    sessionId?: string;
+    runId?: string;
+}): ClassifierUnavailableSeat;
+/** Which station forked (`leg` — the leg's gate, on its own approval seat; `ancestor` — an ancestor's frozen classifier in
+ *  the policy fold, on that ancestor's frozen approver) and the per-level budget its classifier held, when stated.
+ *
+ *  ONE question at both stations — does the route a handed-on ask takes from HERE end at a person — asked of two routes:
+ *  the leg's gate hands its ask down the leg's own chain (`askReachesPerson(wiring_manifest.ask)`: a live approver, or the
+ *  durable park); the inherited station resolves at the ancestor's frozen approver, whose only road to a person is being
+ *  a live function (`isLiveApproverSeat`: a blanket or absent seat there ends in a refusal, and the leg's park is reached
+ *  only through a live approver's `unavailable`). Reading the leg's route at the inherited station would hand the ask to a
+ *  frozen seat that cannot answer it. */
+export interface ClassifierUnavailableStation {
+    station: "leg" | "ancestor";
+    budgetMs?: number;
+}
 /**
  * The classifier's REASONING SEAT, read off the model a classification is actually asked on — ONE predicate:
  * does the wire SPELL off ({@link thinkingOffSpelled})? Yes ⇒ `off` + the verdict-sized cap (the request pays

package/dist/core/runner/classifier-ladder.js

@@ -94,6 +94,35 @@ export function announceClassifierRoleDefaulted(args) {
         ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
     });
 }
+export function classifierUnavailableNotice(args) {
+    const whose = args.station === "ancestor" ? "the classifier of the ancestor layer that asked" : "the classifier";
+    const why = args.cause === "timeout"
+        ? `${whose} did not answer within its per-level budget (${args.budgetMs !== undefined ? `${args.budgetMs} ms, ` : ""}RunnerDeps.autoMode.timeoutMs)`
+        : `${whose} could not run (error)`;
+    const next = args.disposition === "asked"
+        ? args.station === "ancestor"
+            ? "so the call was handed on to that layer's approver rather than refused by the classifier."
+            : "so the call was handed on to a person (a live approver or a durable park) rather than refused by the classifier."
+        : (args.station === "ancestor" ? "and that layer has no live approver" : "and this run has no approval seat") +
+            ", so the call was refused and did not run." +
+            (args.cause === "timeout" ? " A deployment on a slow gateway raises the budget." : "");
+    return {
+        code: "classifier.unavailable",
+        message: `auto mode could not judge "${args.toolName}": ${why}, ${next}`,
+        detail: {
+            toolName: args.toolName,
+            toolCallId: args.toolCallId,
+            cause: args.cause,
+            disposition: args.disposition,
+            ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+            ...(args.runId !== undefined ? { runId: args.runId } : {}),
+        },
+    };
+}
+export function classifierUnavailableSeat(args) {
+    const { approvalSeat, onNotice, sessionId, runId, station, budgetMs } = args;
+    return { approvalSeat, onUnavailable: (info) => deliverEngineNotice(onNotice, classifierUnavailableNotice({ ...info, station, ...(budgetMs !== undefined ? { budgetMs } : {}), ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) })) };
+}
 function classifierFallbackAnnouncer(args) {
     const announced = new Set();
     return (attribution) => {

package/dist/core/runner/contracts.d.ts

@@ -22,6 +22,11 @@ import type { Model } from "../../internal/llm.js";
 import type { WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import type { ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { CwdRef, ContainmentFace } from "../../tools/fs/index.js";
+/** A leg's WRITE face: the face in force (read per call, following the mode's face) and whether a seat or a clamp DECLARED the fence (a checkpoint row records it; a resume keeps it). */
+export interface WriteFaceSeat {
+    readonly inForce: () => ContainmentFace;
+    readonly fenced: boolean;
+}
 import type { MaterializedA2a } from "../a2a.js";
 import type { CompactionForkContext, CompactionPhaseDurations, MaybeCompactOptions, RapidRefillState } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
@@ -47,12 +52,14 @@ import type { SystemInjectionPriority, TaskNotificationPayload } from "../task-n
 import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
-import type { AgentDefinition, ApproverPosture, Brain, CompactOutcome, ModelRef, ModelRoles, NestedUsageAccum, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskEventIdentity, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
+import type { AgentDefinition, Brain, CompactOutcome, ModelRef, ModelRoles, NestedUsageAccum, PermissionMode, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskEventIdentity, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
+import type { PermissionModeController } from "../mode-policy.js";
 import type { WiringManifest } from "../wiring-manifest.js";
 import type { ActiveSkillFrame } from "./active-skill-scope.js";
 import type { BudgetAxis } from "./assemble-result.js";
 import type { GitStatusLaneRef } from "./git-status-frame.js";
 import type { SessionReadFileStates } from "./session-read-file-states.js";
+import type { LegModeCeiling, SessionModeSeats } from "./session-mode-seats.js";
 import type { BlockedRef, OutputRef, SkillListingEntry } from "./synthetic-tools.js";
 import type { createAttachmentState, WriteFamily } from "./turn-attachments.js";
 import type { cacheFamilyOf } from "./usage-accounting.js";
@@ -275,10 +282,11 @@ export interface Prepared {
     reminderDisclosureCounts: import("../reminder-disclosure.js").ReminderDisclosureCounts;
     /** Whether the full shell is on this leg's roster (the inherited-gate phase's bit, asserted against the mount). */
     fullShellReachable: boolean;
-    /** The run's RESOLVED approval-posture facts — the auto-mode intent and the declared approver posture,
-     *  folded once by the chain assembly. The first user turn renders them into the engine's own marked
-     *  reminder; nothing else reads them, and no gate decision keys on either. */
+    /** The run's approval-posture facts as prepared — the effective permission mode and the ask seam's effective
+     *  answer. The first user turn renders them into the engine's own marked reminder; no gate decision keys on them. */
     approvalPosture: import("../auto-mode-directive.js").ApprovalPostureFacts;
+    /** The leg's live permission-mode seat: the effective mode every mode consumer reads, the steer verb writes. */
+    permissionMode: PermissionModeController;
     /** The ISOLATION-AWARE working-tree root for this task (a worktree's cwd when `isolation: "worktree"`, else
      *  `deps.rootPath ?? executionEnv.cwd`) — the same value the hands/LSP/policy/restore use. The Runner's
      *  rewind/snapshot path MUST key off THIS, not `deps.rootPath`, or a worktree-isolated turn snapshots the base
@@ -413,9 +421,9 @@ export interface Prepared {
     denyNarrowingPolicy?: ToolPolicy;
     /** The person's own persisted-rule lane (deny/ask rows), re-adjudicated on RESUME at the same
      *  station as the deny-narrowing layers: a deny row added while the call was parked vetoes the execution
-     *  (`deniedBy: "persisted_rule"`); an ask row or an unreadable store fails closed the same way (the approval
-     *  answered a question the person has since asked to be asked again — re-issue and re-approve). Absent when
-     *  no rule store is wired. */
+     *  (`deniedBy: "persisted_rule"`), and so does a call the lane could not read against the rows (re-issue and
+     *  re-approve); an ask row does not (the approval is its answer), and a store that could not be read
+     *  contributes no row. Absent when no rule store is wired. */
     persistedRuleLane?: {
         adjudicate: (req: ToolCallRequest) => Promise<import("../hooks.js").PersistedRuleAnswer>;
     };
@@ -436,6 +444,8 @@ export interface Prepared {
     };
     /** Removes the `spec.signal` abort listener on task end (else a long-lived signal leaks listeners). */
     releaseSignal: () => void;
+    /** The leg has stopped: its children's mode ceiling moves to the session's current leg (called once its loop settled). */
+    endModeCeiling: () => void;
     /**
      * End-of-leg sweep for questions this leg's gate routed to a person. Called once by the
      * run loop at task end, on every exit path. A binding that is still present means a person ANSWERED and
@@ -1019,12 +1029,6 @@ export interface Prepared {
          *  `drain` and calls `releaseRun` with it at the run's terminal. */
         runIdent: string;
     };
-    /** The live plan-mode flag (`enter_plan_mode` flips it, run-local one-way). Exposed
-     *  so the run loop's plan-mode attachment producer reads the SAME flag the write-deny enforces —
-     *  never a second source of truth. Always present (`active:false` when plan mode is unused). */
-    planModeRef: {
-        active: boolean;
-    };
     /** The ctx `requestStopAfterTurn` primitive's run-local mirror (one-way, set when a tool asked for a
      *  clean stop after the current turn). The harness latch itself is private to the loop; the turn
      *  boundary reads THIS to know that no next request follows — a boundary bundle collected there
@@ -1271,6 +1275,9 @@ export interface PrepareResume {
     /** The §4.bis correctness-state snapshot to re-seed (activeTools / outputRef / nestedStats /
      *  readFileState). */
     seed: CheckpointState;
+    /** The decision this resume carries (the gate word and, for a review, approve / edit / reject) — read by the mode seed
+     *  (`modeRequestAfterResume`: an approved or edited `plan_review` exits a recorded plan to its pre-plan word). Absent on a prepare that resumes nothing. */
+    outcome?: ResumeRun["outcome"];
     /** How many times this task already suspended (the resumed checkpoint's
      *  `suspendCount`). The next suspend mints `priorSuspendCount + 1`; past `maxSuspends` it fails
      *  (`suspend.loop`) instead of re-suspending. Absent/0 ⇒ no prior suspends. */
@@ -1316,11 +1323,12 @@ export interface PrepareResume {
  * Parent effective-policy inheritance (tighten-only, {@link RunInternals.inheritedGate}): the spawning
  * chain's already-evaluated FINAL gate, split into two halves —
  *
- * - **Data half** (`ancestorRules`, `shellGate`): serializable snapshots. Each ancestor's per-session
+ * - **Data half** (`ancestorRules`, `shellGate`, `permissionMode`): serializable snapshots. Each ancestor's per-session
  *   permission rules ride as (sessionId, principal, rev, rules) so the child's prepare can re-read them
  *   LIVE (rev-monotonic — a lagging replica never loosens the snapshot) and re-compile them against the
- *   CHILD's own env/root/effects as extra deny-narrowing layers. `shellGate` folds by max-rank
- *   (off < classify < always): a child can only tighten the parent's shell doctrine, never relax it.
+ *   CHILD's own env/root/effects as extra deny-narrowing layers. `shellGate` is the operator floor
+ *   (`"always"`): a child inherits it and cannot lift it. `permissionMode` is the ceiling a child's own
+ *   declaration is clamped under.
  * - **Opaque half** (`parentConstraints`): each ancestor's live caller `ToolPolicy` plus its FROZEN
  *   `onAsk`, ancestors first — and, for a hook-wired ancestor, a SECOND entry: its PreToolUse screening
  *   face folded into a `ToolPolicy` (`createPreToolUseConstraintPolicy`), carrying its own frozen
@@ -1346,30 +1354,29 @@ export interface InheritedGate {
         gen?: number;
         rules: SessionPermissionRules;
     }>;
-    /** The chain's effective shell-gate doctrine — the child folds it by max-rank with its own spec. */
+    /** The chain's shell floor (`"always"`) — a child inherits it; its own spec cannot lift it. */
     shellGate?: ShellGateDoctrine;
     /**
-     * The chain's AUTO-MODE INTENT (`TaskSpec.autoModeRequested`, session-wide like a permission mode):
-     * emitted when the spawning task carried the intent itself or inherited it, so an engine-spawned
-     * child of an auto-mode task arms its OWN per-run classifier exactly as its parent did — the
-     * intent half only; the child's deny bit (`RuntimeCaps.autoMode === false`) and deployment face
-     * (`RunnerDeps.autoMode`) are evaluated for the child. Trusted chain data (Runner-assembled, never a
-     * model-authored argument); absent ⇒ the child is an auto-mode task only if its own spec says so.
-     * Persists on the checkpoint's data half (`CheckpointState.inheritedGate.autoModeRequested`) so a
-     * redemption in another process — no seat re-passed, no waking chain — reads the same intent the
-     * suspend leg had; the intent folds by OR across seat, live chain and seed, while the deny bit and
-     * the deployment face stay per-leg.
-     */
-    autoModeRequested?: true;
-    /**
-     * The chain's declared APPROVER POSTURE (`TaskSpec.approverPosture`, session-wide like a permission
-     * mode): emitted when the spawning task declared it or inherited it, so an engine-spawned child is told
-     * what its parent was told. Trusted chain data, never a model-authored argument — it authorizes nothing
-     * and no gate lane reads it; absent ⇒ the child declares a posture only if its own spec does. Persists
-     * on the checkpoint's data half so a redemption elsewhere reads the posture the suspend leg was under;
-     * the sources fold seat-first (own seat, then the live chain, then the seed).
-     */
-    approverPosture?: ApproverPosture;
+     * The chain's EFFECTIVE permission mode at spawn (data half, session-wide like every mode): the CEILING a
+     * child's own declaration is clamped under (`TaskSpec.permissionMode` absent ⇒ inherit; declared ⇒ adopted only
+     * where the rank table admits it, else folded and disclosed). Persists on the checkpoint's data half
+     * (`CheckpointState.inheritedGate.permissionMode`) so a redemption in another process resumes under the same
+     * declared mode — and re-judges the deployment's deny bits for its own leg.
+     */
+    permissionMode?: PermissionMode;
+    /**
+     * The parent's live mode ceiling (opaque half; never serialized): the parent leg's mode while that leg runs, its
+     * SESSION's current leg after it — the child's effective mode is DERIVED from it on every read, so a parent's steer
+     * reaches a running child on the child's next arbitration without a forwarding frame, and the session's next leg
+     * reaches a child that outlived the leg that spawned it (a session-scoped background child). `sessionId` is the
+     * parent's, the address of the user notice a folded child declaration is announced on. `hold` (the engine's own
+     * ceiling): the child is re-judged at each move of the ceiling, and a fold that produces is announced as at prepare.
+     */
+    permissionModeCeiling?: {
+        readonly current: PermissionMode;
+        readonly sessionId: string;
+        readonly hold?: LegModeCeiling["hold"];
+    };
     /**
      * Org-memory admission freeze (ruled 2026-08-05): the spawning chain's FROZEN admitted org-scope
      * set — every org memory scope the parent actually mounted (deployment-origin + admitted request).
@@ -1459,6 +1466,14 @@ export interface InheritedGate {
              * the one every gate consults, here and on every descendant.
              */
             arming?: AutoModeArmingRecipe;
+            /**
+             * The ancestor's live mode ceiling (opaque, never serialized; the chain's `permissionModeCeiling`): the classifier
+             * answers the ancestor's asks only while this reads `auto` — else they go to the frozen approver. Absent (a
+             * re-supplied entry) ⇒ the classifier answers as recorded.
+             */
+            liveMode?: {
+                readonly current: PermissionMode;
+            };
         };
         /**
          * Set ONLY on an entry whose `policy` is the folded form of an ancestor's PreToolUse screening face
@@ -1993,6 +2008,13 @@ export interface RunInternals {
      * channel, same posture as every other field here.
      */
     sessionReadStates?: SessionReadFileStates;
+    /**
+     * The Runner's per-session permission-mode seats ({@link SessionModeSeats}): the chain a leg hands its children
+     * carries its SESSION's seat as the children's ceiling, and each leg binds itself to that seat once its prepare
+     * commits — so a session-scoped background child follows the session's current leg. Always set by the Runner's own
+     * prepare call (overriding any caller value); absent on a standalone prepareTask, which mints a seat of its own.
+     */
+    sessionModeSeats?: SessionModeSeats;
     /** Trusted system-injection sink (`Runner.runLocked` wires it to the live TaskStream queue plus the
      *  current harness lanes; never a public TaskSpec field), ADDRESSED TO THE SESSION rather than to this
      *  run: a producer wired here (a background shell, a watch, a delegation settle) keeps the closure long
@@ -2780,6 +2802,8 @@ export interface LiveHandle {
     runId: string;
     hookTimeoutMs: number;
     hookIdentity: HookInvocationIdentity;
+    /** The leg's live permission-mode seat (`TaskStream.setPermissionMode` steers it). */
+    permissionMode: PermissionModeController;
 }
 /** The run body's backstop CARRIER: the effective ids and the post-prepare
  *  observations the run body publishes as they are minted, so the stream layer's failure backstop names the

package/dist/core/runner/denial-limit-arms.d.ts

@@ -1,8 +1,9 @@
 import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type DenialLimitFallback, type UnarmedDenialLimitFallback } from "../auto-mode.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
+import { type ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
-import { type AskOrigin, type RuleStoreUnreadable } from "../ask-origin.js";
+import { type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import type { Prepared, StopForDenialLimit } from "./contracts.js";
 /**
  * The classifier DENIAL-LIMIT arms of the tool gate's inherited (delegation) lane, extracted
@@ -26,6 +27,10 @@ export interface InheritedAutoMode {
     decider: AutoModeDecider;
     denialTracking?: AutoModeDenialTracker;
     arming?: AutoModeArmingRecipe;
+    /** The ancestor's live mode seat: the decider answers only while it reads `auto` (absent ⇒ as recorded). */
+    liveMode?: {
+        readonly current: import("../ask-origin.js").PermissionMode;
+    };
 }
 /**
  * A re-supplied chain entry (a cross-process redemption rebuilt its ancestor's classifier from the
@@ -83,13 +88,29 @@ export declare function createDenialLimitStop(opts: {
 export type InheritedAsk = Extract<PermissionResult, {
     action: "ask";
 }>;
+/**
+ * The delegation half of the live gate's classifier eligibility: the SAME class row (`classifyAsk` over the
+ * ask's own members) answers for the FROZEN classifier — an ask raised by a hook, minted by an
+ * explicit `ask` permission rule, or already a denial-limit fallback is exactly as out of the frozen
+ * decider's reach as the live one's, because the person's / hook's standing decision travels with the
+ * frozen entry and a frozen decider resolving it would re-open the same hole one process over. The
+ * three GATE-HELD facts of the derivation are not this station's to judge: an ancestor's frozen
+ * classifier runs inside the policy fold, BEFORE the live gate's org layer has spoken and before its
+ * question-tool and marked-call lanes run, so they read as absent here and those asks meet their
+ * exclusions downstream, where the facts exist. Excluded asks fall through to the frozen approver
+ * chain, the delegation lane's original chain. The word is derived inside {@link judgeInheritedClassifier}
+ * — once off the incoming ask for the exclusion and the unchanged-ask branches, once off the re-spoken
+ * ask this station mints at the bound — and threaded to the request mint, never re-read off the
+ * caller-owned object there.
+ * The MANDATE marks are empty for the same reason — no tool seat of this task, no tighten of its own;
+ * what the ancestor's ask carries on ITSELF still answers, read off the decision by the one predicate.
+ */
+export declare const INHERITED_STATION_FACTS: AskOriginFacts;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
  *  they spell themselves: the ask's origin word and its denial-limit fallback. */
 export interface AskRequestCarry {
     origin?: AskOrigin;
-    /** Rides only from the gate's OWN station (the inherited stations' facts never read a rule store). */
-    ruleStoreUnreadable?: RuleStoreUnreadable;
     denialLimitFallback?: DenialLimitFallback;
 }
 /** The GATE's own mint station: both members are read off the surviving decision, which is the gate's
@@ -126,8 +147,8 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  unchanged-ask branches it is the SAME read the exclusion judged by (a caller-owned decision with a
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
  *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
-/** `ask` is the incoming ask unchanged (the caller's own object); an UNAVAILABLE round never reaches this arm —
-*  it is a `deny` whose attested cause reads `unavailable`. */
+/** `ask` is the incoming ask unchanged (the caller's own object), or — an UNAVAILABLE classification with a live frozen
+*  approver — that ask with the classifier sentence appended; without one it is a `deny` whose attested cause reads `unavailable`. */
  | {
     kind: "resolve";
     ask: A;
@@ -142,8 +163,9 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  * gate would have produced; `block` AT the bound ⇒ the ask is re-spoken in the classifier's voice as
  * the fallback (`decisionReason:"classifier"`, `requiresRealApproval`, the member carrying counts +
  * window) for the arm to resolve at the frozen approver; `parse_error` ⇒ the same block path with the CC
- * parse-failure sentence (counted); `unavailable` ⇒ a DENY that says so, carrying the fact (CC
- * 2.1.250 form); excluded / no classifier ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
+ * parse-failure sentence (counted); `unavailable` ⇒ the gate's own exit (`classifierUnavailableArm`) on the
+ * frozen approver — a live one resolves the incoming ask, none ⇒ a DENY that says so (CC 2.1.250 form), never
+ * counted; excluded / no classifier ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
  * ask (a deeper ancestor's fallback, minted inside the nested fold — the case the exclusion names):
  * it rides to the approver and the headless arm unchanged, whichever tracker minted it; only a
  * tracker that counted THIS streak is reset by the person's later allow (`mintedHere`).
@@ -160,6 +182,10 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  */
 export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     autoMode: InheritedAutoMode | undefined;
+    /** The leg's live permission mode (the gate's seat): under `dontAsk` / `bypassPermissions` / `plan` the decider is not
+     *  dispatched (the mode's arbitration decides first). Absent ⇒ a decider on the chain is dispatched (subject to the
+     *  entry's own `autoMode.liveMode`). */
+    liveMode?: () => import("../ask-origin.js").PermissionMode;
     ask: A;
     req: ToolCallRequest;
     signal: AbortSignal;
@@ -167,6 +193,8 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     /** The rewrite the arm's allow would have carried (the ask's own `updatedInput`, the re-check's edited
      *  args) — handed IN so the allow is minted here, attested, once; absent ⇒ a bare allow. */
     allowRewrite?: unknown;
+    /** An `unavailable` verdict's fork facts (`classifierUnavailableArm`): is the frozen approver live; who hears it. */
+    unavailableSeat?: ClassifierUnavailableSeat;
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
 export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;

package/dist/core/runner/denial-limit-arms.js

@@ -1,10 +1,11 @@
-import { classifierParseFailureDenyMessage, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
+import { classifierParseFailureDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
+import { classifierUnavailableArm } from "../classifier-unavailable-arm.js";
 import { attestClassifierDenyCause, attestClassifierRound } from "../tool-policy.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { askOriginOf, classifierMayAnswer, probeMandatedAsk } from "../ask-origin.js";
+import { askOriginOf, classifyAsk } from "../ask-origin.js";
 export function attachRebuiltDenialTrackers(entries, denialLimit) {
     if (entries === undefined)
         return undefined;
@@ -58,7 +59,7 @@ export function createDenialLimitStop(opts) {
     };
     return { gateStopRef, stopForDenialLimit };
 }
-const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} };
+export const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} };
 function fallbackCarry(fallback, liveApprover, tracker) {
     if (fallback === undefined)
         return {};
@@ -67,7 +68,6 @@ function fallbackCarry(fallback, liveApprover, tracker) {
 export function gateAskCarry(decision, liveApprover, tracker) {
     return {
         ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
-        ...(decision.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: decision.ruleStoreUnreadable } : {}),
         ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
     };
 }
@@ -80,22 +80,28 @@ export function inheritedAskCarry(judged, liveApprover, tracker) {
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, ask, req } = opts;
     const origin = askOriginOf(ask, INHERITED_STATION_FACTS);
-    if (autoMode === undefined || !classifierMayAnswer(origin) || probeMandatedAsk(ask)) {
+    const classifierStandsDown = () => {
+        const live = opts.liveMode?.();
+        return live === "dontAsk" || live === "bypassPermissions" || live === "plan" || (autoMode?.liveMode !== undefined && autoMode.liveMode.current !== "auto");
+    };
+    if (autoMode === undefined || classifierStandsDown() || !classifyAsk(ask, INHERITED_STATION_FACTS).row.classifierEligible) {
         return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
     }
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
+    if (verdict.kind === "allow" && classifierStandsDown())
+        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
     const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
     if (verdict.kind === "allow") {
         autoMode.denialTracking?.recordAllow();
         return { kind: "allow", result: attributed({ action: "allow", ...(opts.allowRewrite !== undefined ? { updatedInput: opts.allowRewrite } : {}) }) };
     }
     if (verdict.kind === "unavailable") {
-        return {
-            kind: "deny",
-            result: attributed(attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req)),
-        };
+        const arm = classifierUnavailableArm({ ask, req, cause: verdict.cause, seat: opts.unavailableSeat, aborted: opts.signal.aborted });
+        if (arm.kind === "asked")
+            return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+        return { kind: "deny", result: attributed(arm.deny) };
     }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
     const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";