@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/runner/env-capability-census.js

@@ -1,7 +1,7 @@
 import { isRemoteExecutionEnv } from "../remote-env.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 const BOOLEAN_CAPABILITY_KEYS = ["isolation", "suspendable", "canonicalPathAuthoritative"];
-const OPTIONAL_METHOD_KEYS = ["writeFileExclusive", "writeFileGuarded", "setFileMode", "readLink", "canonicalChain"];
+const OPTIONAL_METHOD_KEYS = ["writeFileExclusive", "writeFileGuarded", "setFileMode", "readLink", "canonicalChain", "fileIdentity"];
 export function malformedCapabilityDeclarations(env) {
     const out = [];
     for (const key of OPTIONAL_METHOD_KEYS) {

package/dist/core/runner/file-history-request.d.ts

@@ -0,0 +1,26 @@
+/** The file-history REQUEST door and its bad-value doors — the pre-acquire half of the file-history phase (`prepare-file-history.ts`). */
+import type { FileHistoryStore } from "../file-history-store.js";
+import type { RunnerDeps, TaskSpec } from "../types.js";
+/**
+ * The file-history REQUEST door: every refusal the request (`TaskSpec`) and the deployment's own seats decide
+ * without the session, the env or the store's contents — the three bad-value doors (`RunnerDeps.onTrackFailure`,
+ * `RunnerDeps.fileHistoryStore` / `fileHistoryCapture`, `TaskSpec.fileHistory`), the retired `rewindFiles` restore
+ * sense, the restoreFiles / resumeAt / rewindFilesTo contradictions, and a restore asked of a run that holds no
+ * history (`rewind.capture_disabled` / `rewind.store_unconfigured`). SYNCHRONOUS and side-effect free; the driver
+ * calls it BEFORE the session is acquired, so a request refused here leaves the session — its leaf included —
+ * exactly as it was. What it resolves rides into the file-history phase (`prepareFileHistory`) unchanged.
+ */
+export declare function resolveFileHistoryRequest(spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "fileHistory">, deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "fileHistoryCapture">): FileHistoryRequest;
+/** What {@link resolveFileHistoryRequest} resolved: the validated seats and words, the run's store (after every off
+ *  switch) and its capture store, and the restore target (`undefined` = no restore asked). */
+export interface FileHistoryRequest {
+    onTrackFailure: "refuse" | "proceed-unprotected";
+    wiredSeat: FileHistoryStore | "disabled" | undefined;
+    runDeclaredOff: boolean;
+    captureOff: boolean;
+    declaredOff: boolean;
+    fileHistoryStore: FileHistoryStore | undefined;
+    captureStore: FileHistoryStore | undefined;
+    rewindTarget: string | undefined;
+    rewindBefore: boolean;
+}

package/dist/core/runner/file-history-request.js

@@ -0,0 +1,90 @@
+export function resolveFileHistoryRequest(spec, deps) {
+    const onTrackFailure = deps.onTrackFailure === undefined ? "refuse" : deps.onTrackFailure;
+    if (onTrackFailure !== "refuse" && onTrackFailure !== "proceed-unprotected") {
+        const e = new Error(`RunnerDeps.onTrackFailure must be "refuse" or "proceed-unprotected"; got ${JSON.stringify(deps.onTrackFailure)} — refusing prepare rather than silently defaulting a first-touch-failure policy.`);
+        e.code = "config.invalid_on_track_failure";
+        throw e;
+    }
+    const wiredSeat = resolveWiredFileHistoryStore(deps.fileHistoryStore);
+    const runDeclaredOff = resolveRunFileHistoryWord(spec.fileHistory);
+    const captureOff = resolveFileHistoryCaptureWord(deps.fileHistoryCapture, wiredSeat);
+    const declaredOff = wiredSeat === "disabled" || runDeclaredOff;
+    const fileHistoryStore = declaredOff ? undefined : wiredSeat;
+    const captureStore = captureOff ? undefined : fileHistoryStore;
+    const legacyRewindFiles = spec.rewindFiles;
+    if (legacyRewindFiles === true) {
+        if (spec.resumeAt !== undefined) {
+            const e = new Error(`rewind-files: TaskSpec.rewindFiles is retired (design/381 — rewind now converges the per-edited-file history, not a whole-tree snapshot). This request pairs it with resumeAt, i.e. the RESTORE sense: set restoreFiles: true instead. (The capture sense needs no request anymore — first-touch tracking is on whenever a RunnerDeps.fileHistoryStore is wired and neither RunnerDeps.fileHistoryCapture nor TaskSpec.fileHistory turns it off.)`);
+            e.code = "rewind.rewind_files_retired";
+            throw e;
+        }
+    }
+    if (spec.restoreFiles === true && spec.resumeAt === undefined) {
+        const e = new Error(`rewind-files: restoreFiles: true needs a resumeAt anchor — restoring files means converging them to a specific prior entry's boundary, and this spec names none. Use resumeAt + restoreFiles to move conversation and files together, or rewindFilesTo alone for a code-only restore.`);
+        e.code = "rewind.invalid_spec";
+        throw e;
+    }
+    if (spec.resumeAt !== undefined && spec.rewindFilesTo !== undefined) {
+        const e = new Error(`rewind-files: resumeAt ("${spec.resumeAt}") and rewindFilesTo ("${spec.rewindFilesTo}") were both set — resumeAt already anchors the file restore when restoreFiles is true, so a separate rewindFilesTo target is a conflicting request. Drop one of the two.`);
+        e.code = "rewind.conflicting_targets";
+        throw e;
+    }
+    const rewindTarget = spec.resumeAt !== undefined ? (spec.restoreFiles === true ? spec.resumeAt : undefined) : spec.rewindFilesTo;
+    const rewindBefore = rewindTarget !== undefined && spec.resumeAt !== undefined && spec.resumeAtMode === "before";
+    if (rewindTarget !== undefined && fileHistoryStore === undefined) {
+        if (runDeclaredOff)
+            throw captureDisabledRefusal(rewindTarget);
+        const e = new Error(wiredSeat === "disabled"
+            ? `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment declared file history disabled (RunnerDeps.fileHistoryStore: "disabled"), so there is no history to restore — the files were NOT rewound`
+            : `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment wired no RunnerDeps.fileHistoryStore — no file history was ever recorded, so the files were NOT rewound`);
+        e.code = "rewind.store_unconfigured";
+        throw e;
+    }
+    return { onTrackFailure, wiredSeat, runDeclaredOff, captureOff, declaredOff, fileHistoryStore, captureStore, rewindTarget, rewindBefore };
+}
+function resolveWiredFileHistoryStore(candidate) {
+    if (candidate === undefined || candidate === "disabled")
+        return candidate;
+    const verbs = ["trackEdit", "annulTrack", "snapshot", "restore", "canRestore", "reap", "adoptScope"];
+    const verbOf = (v) => {
+        try {
+            return candidate[v];
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const probeable = (typeof candidate === "object" && candidate !== null) || typeof candidate === "function";
+    const missing = probeable ? verbs.filter((v) => typeof verbOf(v) !== "function") : [...verbs];
+    if (missing.length > 0) {
+        const shape = candidate === null ? "null" : probeable ? "a value that is not a FileHistoryStore" : `a ${typeof candidate}`;
+        const e = new Error(`RunnerDeps.fileHistoryStore was wired with ${shape} — missing contract verbs: ${missing.join(", ")}. Refusing prepare rather than half-wiring the rewind seat (a present-but-unusable store makes every Edit/Write/NotebookEdit fail its first-touch backup while restore requests report "no store wired"). Write "disabled" (or omit the key) to run without file history.`);
+        e.code = "config.invalid_file_history_store";
+        throw e;
+    }
+    return candidate;
+}
+function resolveRunFileHistoryWord(word) {
+    if (word === undefined || word === "disabled")
+        return word === "disabled";
+    const e = new Error(`rewind-files: TaskSpec.fileHistory holds ${shownWord(word)} — the only value is "disabled"; omit the key to leave the deployment's setting in force`);
+    e.code = "rewind.invalid_spec";
+    throw e;
+}
+function resolveFileHistoryCaptureWord(word, wiredSeat) {
+    if (word === undefined || (word === "off" && wiredSeat !== undefined && wiredSeat !== "disabled"))
+        return word === "off";
+    const e = new Error(word === "off"
+        ? `RunnerDeps.fileHistoryCapture: "off" requires a wired RunnerDeps.fileHistoryStore — nothing to switch off; to drop history entirely write fileHistoryStore: "disabled"`
+        : `RunnerDeps.fileHistoryCapture holds ${shownWord(word)} — the only value is "off"; omit the key to record whenever a fileHistoryStore is wired`);
+    e.code = "config.invalid_file_history_capture";
+    throw e;
+}
+function shownWord(word) {
+    return typeof word === "string" ? JSON.stringify(word.slice(0, 40)) : word === null || typeof word === "boolean" || typeof word === "number" ? String(word) : `a ${typeof word}`;
+}
+function captureDisabledRefusal(target) {
+    const e = new Error(`rewind-files: this run set TaskSpec.fileHistory: "disabled", so it neither records nor restores file history — restoring files to entry "${target}" was refused and the files were NOT rewound`);
+    e.code = "rewind.capture_disabled";
+    return e;
+}

package/dist/core/runner/gate-exit.d.ts

@@ -21,9 +21,9 @@
  * the reminder envelope and the text helpers. Its `import type` edges up to `hooks.ts` name the gate's public
  * contract (`ToolGateInput`, `ToolGateResult`, the observer payload), which stays declared there.
  */
-import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
+import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type ModeRefusal, type ModeRelease, type Settlement } from "../gate-outcome.js";
 import type { AutoModeClassifierRound } from "../auto-mode.js";
-import type { AskOrigin, AskOriginFacts } from "../ask-origin.js";
+import { type Arbitration, type AskClassification, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import type { SafeNotifier } from "../safe-notify.js";
 import type { HookSeatOutcome, PermissionDeniedPayload, PreToolUseResult, ToolGateInput, ToolGateResult } from "../hooks.js";
@@ -45,6 +45,10 @@ export interface GateExitFacts {
      *  Orthogonal to `deniedBy`: one that ALLOWED is attributed too (a fallback model's allow is exactly the case
      *  an operator needs to see), which is why it rides the disposition's shared member, not the deny arm. */
     classifier?: AutoModeClassifierRound;
+    /** The permission mode RELEASED the surviving ask (the allow exit's account of it); never beside `deniedBy`. */
+    released?: ModeRelease;
+    /** The permission mode REFUSED the surviving ask — only beside `deniedBy: "mode"`. */
+    modeRefusal?: ModeRefusal;
 }
 /**
  * Mint the outcome. A defect here is an ENGINE defect (a refusing site that did not say who refused, a
@@ -228,6 +232,14 @@ export interface GatePass {
      *  card on the gate result, so the refusal's `tool_end` still says WHAT was found (`readonly_out_of_root`) beside
      *  WHO refused (`ask_resolution`). Writer: the fold's read station. */
     shellReadDetails?: unknown;
+    /** The read station PLACED every write the command makes inside the write roots (`ShellReadVerdict.writesPlaced`) — the
+     *  one precondition the mode's file-command acceptance reads (the reference's path checks precede its acceptEdits arm). */
+    shellWritesPlaced?: true;
+    /** The read station did NOT place the command's writes because a `cp` / `mv` segment carries an option word
+     *  (`ShellReadVerdict.unplacedOptions`) — the one non-placement reason the mode's card and the headless refusal name. */
+    shellUnplacedOptions?: {
+        readonly program: "cp" | "mv";
+    };
     /** borrowed-mutable — the FORM of the classifier round behind a deny (`unavailable` / `parse_error`), written
      *  beside `deniedBy` by the gate's own classifier step (its attestation, read once) or by the fold / the
      *  re-check when an inherited station's attested deny arrives through the chain; undefined for a ruling
@@ -260,14 +272,19 @@ export interface GatePass {
      *  twin on the answered side, and narrower: the ask stays ordinary for every ANSWERER, and only the allow
      *  layer's read-only-command arm stands down. Writer: the fold. Reader: that arm, and nothing else. */
     probeBoundaryDeclined?: true;
+    /** borrowed-mutable — the shell read station could not establish what this command reads (finding `unestablishable`
+     *  or `declined`): a mode's release of the call is a release past the leg's read-deny table, announced as such.
+     *  Writer: the fold's read station. Reader: the release point. */
+    shellReadUnestablished?: true;
     /** borrowed-mutable — the shell read station minted the standing ask's directory-grant offer
      *  (`probeReadRootCandidate`). Read by the classify seat's shape probe, which withdraws the offer when its
      *  own objection stands beside the station's — the grant answers the station's finding, not the shape's.
      *  Writer: the fold's read station. */
     shellReadOffer?: true;
     /** borrowed-mutable — the write-protection judge covered this call and its table MATCHED: the allow
-     *  layer must not clear the surviving ask, a live decider still may. Writer: the fold's fourth tighten,
-     *  on BOTH its arms. Reader: the lanes' mandate. */
+     *  layer must not clear the surviving ask, a live decider still may. Writers: the fold's fourth tighten,
+     *  on BOTH its arms (a write tool's target), and the fold's read station (a shell command's written targets,
+     *  `ShellReadVerdict.writeProtected`). Reader: the lanes' mandate. */
     writeProtected?: true;
     /** borrowed-mutable — the same judge could NOT RESOLVE the target: no automatic lane may answer the
      *  ask. Writer and reader as above; the pair is mutually exclusive (one verdict per judgment). */
@@ -276,6 +293,15 @@ export interface GatePass {
      *  approved path (a redaction is not cancelled because a person confirmed). Writer: the fold. Readers: the
      *  fold's probe and write-protection judges, the lanes, the allow exit. */
     policyRewrite: unknown;
+    /** borrowed-mutable — the standing ask's CLASS SET and folded row (`classifyAsk`), written at the lanes' origin
+     *  stamp and at every re-mint (the denial-limit fallback, the approved-edit round); read by the classifier
+     *  station, the sandbox leg and the arbitration point. Writer: the lanes. */
+    askClassification?: AskClassification;
+    /** borrowed-mutable — the mode arbitration's verdict when it RELEASED or REFUSED the standing ask (the exit
+     *  projects it onto the disposition). Writer: the lanes' arbitration point. */
+    arbitration?: Exclude<Arbitration, {
+        kind: "ask";
+    }>;
 }
 /**
  * The engine's fail-closed block of phase 1 — the PreToolUse face THREW or never ANSWERED, so the engine

package/dist/core/runner/gate-exit.js

@@ -1,4 +1,6 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
+import { headlessApprovalRemedy } from "../ask-origin.js";
+import { isProtectedWrite } from "../tool-registry.js";
 import { askUnresolvableCauseOf, classifierDenyCauseOf, classifierRoundOf, decisionText, engineSettlementOf } from "../tool-policy.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
@@ -7,8 +9,14 @@ export function mintGateOutcome(facts) {
     const attribution = facts.classifier !== undefined ? Object.freeze({ ...facts.classifier, ...(facts.classifier.fallback !== undefined ? { fallback: Object.freeze({ ...facts.classifier.fallback }) } : {}) }) : undefined;
     const outcome = Object.freeze({
         disposition: Object.freeze(facts.deniedBy !== undefined
-            ? { kind: "denied", deniedBy: facts.deniedBy, ...(facts.cause !== undefined ? { cause: facts.cause } : {}), ...(attribution !== undefined ? { classifier: attribution } : {}) }
-            : { kind: "allowed", ...(attribution !== undefined ? { classifier: attribution } : {}) }),
+            ? {
+                kind: "denied",
+                deniedBy: facts.deniedBy,
+                ...(facts.cause !== undefined ? { cause: facts.cause } : {}),
+                ...(attribution !== undefined ? { classifier: attribution } : {}),
+                ...(facts.modeRefusal !== undefined ? { mode: facts.modeRefusal.mode, askClass: facts.modeRefusal.askClass, classes: Object.freeze([...facts.modeRefusal.classes]) } : {}),
+            }
+            : { kind: "allowed", ...(attribution !== undefined ? { classifier: attribution } : {}), ...(facts.released !== undefined ? { released: Object.freeze({ ...facts.released, classes: Object.freeze([...facts.released.classes]) }) } : {}) }),
         ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
     });
     const defects = screenGateOutcome(outcome);
@@ -16,6 +24,10 @@ export function mintGateOutcome(facts) {
         throw new Error(`the tool gate composed an outcome that violates its own record: ${defects.join("; ")}`);
     return outcome;
 }
+function releaseRecordOf(a) {
+    const { kind: _kind, ...record } = a;
+    return record;
+}
 export function directDeny(deniedBy) {
     return mintGateOutcome({ deniedBy });
 }
@@ -111,17 +123,24 @@ function unresolvableCauseOfSettlement(gate) {
 export async function exitGate(pass) {
     const { input, event, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
     if (pass.decision.action === "deny") {
-        const denyReason = withParkFailureCause(decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`, pass.parkFailed);
         if (pass.decision.updatedInput !== undefined) {
             pass.currentInput = pass.decision.updatedInput;
         }
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
-        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}) });
+        const ancestorArbitration = pass.arbitration === undefined && pass.deniedBy === "policy" ? input.ancestorArbitrationOf?.(toolCallId) : undefined;
+        const modeRefusal = pass.arbitration?.kind === "denied_by_mode" ? pass.arbitration : ancestorArbitration?.kind === "denied_by_mode" ? ancestorArbitration : undefined;
+        if (modeRefusal !== undefined) {
+            pass.deniedBy = "mode";
+            ledger.supersede();
+        }
+        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(modeRefusal !== undefined ? { modeRefusal: { mode: modeRefusal.mode, askClass: modeRefusal.askClass, classes: modeRefusal.classes } } : {}) });
         const unresolvable = askUnresolvableCauseOf(pass.decision, { toolCallId, toolName }) ?? unresolvableCauseOfSettlement(gate);
+        const remedy = unresolvable === "no_approver_wired" ? headlessApprovalRemedy({ mode: input.permissionMode?.(), classification: pass.askClassification, coveredWrite: isProtectedWrite(pass.req), ...(pass.shellUnplacedOptions !== undefined ? { unplacedOptions: pass.shellUnplacedOptions } : {}) }) : undefined;
+        const denyReason = withParkFailureCause(`${decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`}${remedy !== undefined ? ` — ${remedy}` : ""}`, pass.parkFailed);
         if (unresolvable !== undefined) {
             const cause = unresolvable;
-            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined }), "toolGate.onAskUnresolvable");
+            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined, ...(remedy !== undefined ? { remedy } : {}) }), "toolGate.onAskUnresolvable");
         }
         await notifyPermissionDenied({
             toolName,
@@ -136,7 +155,7 @@ export async function exitGate(pass) {
             reason: formatHookFeedback(denyReason, input.reminderMark),
             gate,
             ...(() => {
-                const details = pass.denyDetails ?? pass.shellReadDetails;
+                const details = pass.denyDetails ?? (modeRefusal !== undefined ? undefined : pass.shellReadDetails);
                 return details !== undefined ? { details } : {};
             })(),
             preToolContext: pass.preToolContext,
@@ -147,9 +166,11 @@ export async function exitGate(pass) {
         if (rw !== undefined)
             pass.currentInput = rw;
     }
+    const release = pass.arbitration?.kind === "released" ? pass.arbitration : (() => { if (ledger.settled !== undefined)
+        return undefined; const a = pass.arbitration === undefined ? input.ancestorArbitrationOf?.(toolCallId) : undefined; return a?.kind === "released" ? a : undefined; })();
     return {
         updatedInput: pass.currentInput === event.input ? undefined : pass.currentInput,
-        gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}) }),
+        gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(release !== undefined ? { released: releaseRecordOf(release) } : {}) }),
         preToolContext: pass.preToolContext,
     };
 }

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -29,8 +29,9 @@ import type { AskRuleEvidence, ToolCallRequest } from "../tool-policy.js";
 import { persistedRuleMandateOf, type RuleClearanceFacts } from "../ask-origin.js";
 import { type OrgGateVerdict, type PersistedRuleAnswer, type PersistedRuleHit, type PersistedRuleUnreadable } from "../hooks.js";
 import type { PersistedRule, PersistedRuleVerdict, RuleOffer, SegmentCoverage } from "../permission-rule-model.js";
+import { type ToolCallLike } from "../tool-registry.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
-import type { PermissionRuleStoreProvider } from "../permission-rule-provider.js";
+import { type EffectivePermissionRules, type PermissionRuleStoreProvider } from "../permission-rule-provider.js";
 /** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for
  *  it alone). The PATH grammar's tools are derived from the catalog (`ruleToolGrammarOf`). */
 export declare const PERSISTED_RULE_TOOL = "Bash";
@@ -81,10 +82,9 @@ export declare function orgRevisionEvidenceOf(resolution: OrgRuleResolution, onD
  */
 export declare function persistedRuleHitOf(verdict: PersistedRuleVerdict | undefined): PersistedRuleHit | undefined;
 /** The COMMAND arm's projection of a verdict: a call the lexer could not read against a standing deny/ask
- *  row is the lane's UNREADABLE answer — the same fail-closed shape an unreadable store takes (a
- *  real-approval ask no automatic lane clears), with the lexer's reason in place of the store's — never a
- *  matched ask rule, which would let a blanket `onAsk: "allow"` clear a question nobody can answer. Every
- *  other verdict is {@link persistedRuleHitOf}'s hit. */
+ *  row is the lane's UNREADABLE answer carrying the lexer's reason — it fails closed (a real-approval ask no
+ *  automatic lane clears) — never a matched ask rule, which would let a blanket `onAsk: "allow"` clear a
+ *  question nobody can answer. Every other verdict is {@link persistedRuleHitOf}'s hit. */
 export declare function persistedRuleAnswerOf(verdict: PersistedRuleVerdict | undefined): PersistedRuleHit | PersistedRuleUnreadable | undefined;
 /**
  * Widened to every path-targeting tool — the persisted-rule lane's PATH arm: the call's
@@ -152,6 +152,11 @@ export declare function createPermissionRuleLanes(cfg: {
      *  that were dropped) and for a durable read failure — each read's lines are delivered once, whichever
      *  lane took the read. */
     onDisclosure: (message: string) => void;
+    /** The person is told their store (or the named sources of it) was skipped for a call (the run's one notice,
+     *  `ruleStoreUnreadableNotice`). */
+    onStoreUnreadable: (at: "call", sources?: EffectivePermissionRules["unreadableSources"]) => void;
+    /** The run's cut: a read it interrupts is abandoned quietly — a cancelled wait is no fact about the store. */
+    signal?: AbortSignal;
 }): PermissionRuleLanes;
 /** The closed reason set for the rule-offer factory's empty answer — the same three
  *  spellings the `AskRequest` and durable-row seats declare, kept at the one factory that fills both.
@@ -242,7 +247,7 @@ export declare function createRuleOffersOf(cfg: {
         current: string;
     } | undefined;
     deniesDirectoryRead: ((directory: string) => boolean) | undefined;
-}): (toolName: string, args: unknown, ask: RuleOffersAskFacts | undefined) => {
+}): (call: Pick<ToolCallLike, "toolName" | "face">, args: unknown, ask: RuleOffersAskFacts | undefined) => {
     ruleOffers?: readonly RuleOffer[];
     ruleOffersAbsence?: RuleOffersAbsence;
     execCwd?: string;

package/dist/core/runner/permission-rule-lanes.js

@@ -1,11 +1,15 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedPathRules, adjudicatePersistedRules, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedPathRules, adjudicatePersistedRules, laneToolNamesOf, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
-import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
+import { anyNamed, declaredPathTargetOf, firstNamed, protectivePathTargetOf, ruleNamesOf } from "../tool-registry.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
+import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
+import { strongestAnswer } from "../persisted-rule-arms.js";
+import { gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
+import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
 export const PERSISTED_RULE_TOOL = "Bash";
 const HANDOFF_BOUND = 256;
 export function inheritedAskRuleEvidence(provider) {
@@ -59,10 +63,7 @@ export function createPermissionRuleLanes(cfg) {
     if (provider === undefined)
         return { personal: undefined, org: undefined };
     const anonymous = cfg.principal === undefined || cfg.principal === "";
-    const store = anonymous && cfg.localOwnerDeclared
-        ?
-            provider.forLocalOwner()
-        : provider.forPrincipal(anonymous ? undefined : cfg.principal);
+    const store = ownerStoreOf(provider, cfg.principal, cfg.localOwnerDeclared);
     const handed = new Map();
     const read = () => store.effective({ sessionId: cfg.sessionId }).then((view) => {
         for (const line of view.disclosures)
@@ -105,62 +106,68 @@ export function createPermissionRuleLanes(cfg) {
                 }
                 const revisionCell = orgRevisionEvidenceOf(resolution, cfg.onRevisionDefect);
                 const command = req.args?.command;
-                if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
+                if (!laneToolNamesOf(req).includes(PERSISTED_RULE_TOOL) || typeof command !== "string")
                     return { status: "available", ...revisionCell };
-                const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
+                const verdict = orgRuleVerdictFor(resolution.rules, { tool: PERSISTED_RULE_TOOL, command });
                 return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
             },
         }
         : undefined;
-    const personal = provider.partitions.durable
-        ? {
-            adjudicate: async (req) => {
-                if (anonymous && !cfg.localOwnerDeclared)
-                    return undefined;
-                const grammar = ruleToolGrammarOf(req.toolName);
-                if (grammar === undefined)
-                    return undefined;
-                let view;
-                try {
-                    view = await claim(req.toolCallId);
-                }
-                catch (err) {
-                    cfg.onDisclosure(thrownText(err));
-                    return { unreadable: true };
-                }
-                if (view.unreadable !== undefined) {
-                    cfg.onDisclosure(view.unreadable);
-                    return { unreadable: true };
-                }
-                const table = view.rules;
-                const liveCwd = cfg.liveCwd();
-                if (grammar === "path") {
-                    return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, liveCwd, home: cfg.home });
-                }
-                const command = req.args?.command;
-                if (typeof command !== "string")
-                    return undefined;
-                const execCwd = liveCwd !== undefined ? { execCwd: liveCwd } : {};
-                const verdict = adjudicatePersistedRules(table, { tool: req.toolName, command, cwd: cfg.root, sessionId: cfg.sessionId, ...execCwd });
-                if (verdict !== undefined)
-                    return persistedRuleAnswerOf(verdict);
-                const coverage = segmentCoverageOf(command, { persisted: table }, { tool: req.toolName, cwd: cfg.root, sessionId: cfg.sessionId, ...execCwd });
-                return coverage !== undefined ? { segmentCoverage: coverage } : undefined;
-            },
+    const personalAdjudicate = async (req) => {
+        if (anonymous && !cfg.localOwnerDeclared)
+            return undefined;
+        const laneNames = laneToolNamesOf(req);
+        if (laneNames.length === 0)
+            return undefined;
+        let view;
+        try {
+            view = await withGateTimeout(claim(req.toolCallId), ORG_ADJUDICATION_TIMEOUT_MS, cfg.signal, "persistedRules");
         }
-        : undefined;
+        catch (err) {
+            return gateWaitFailureOf(err) === "aborted" ? { unreadable: true } : skipped(thrownText(err));
+        }
+        if (view.unreadable !== undefined)
+            skipped(view.unreadable, view.unreadableSources);
+        try {
+            const answer = strongestAnswer(laneNames.map((n) => judgeAgainst(view.rules, { ...req, toolName: n }, ruleToolGrammarOf(n))));
+            return view.unreadable !== undefined && (answer === undefined || "segmentCoverage" in answer) ? { unreadable: true } : answer;
+        }
+        catch (err) {
+            const why = `judging this call against the rows threw: ${thrownText(err)}`;
+            cfg.onDisclosure(`the persisted rule lane could not judge a ${req.toolName} call against the rows it read — ${why}`);
+            return { unreadable: true, reason: why };
+        }
+    };
+    const judgeAgainst = (table, req, grammar) => {
+        const liveCwd = cfg.liveCwd();
+        if (grammar === "path")
+            return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, liveCwd, home: cfg.home });
+        const command = req.args?.command;
+        if (typeof command !== "string")
+            return undefined;
+        const execCwd = liveCwd !== undefined ? { execCwd: liveCwd } : {};
+        const verdict = adjudicatePersistedRules(table, { tool: req.toolName, command, cwd: cfg.root, sessionId: cfg.sessionId, ...execCwd });
+        if (verdict !== undefined)
+            return persistedRuleAnswerOf(verdict);
+        const coverage = segmentCoverageOf(command, { persisted: table }, { tool: req.toolName, cwd: cfg.root, sessionId: cfg.sessionId, ...execCwd });
+        return coverage !== undefined ? { segmentCoverage: coverage } : undefined;
+    };
+    const skipped = (why, sources) => (cfg.onDisclosure(why), cfg.onStoreUnreadable("call", sources), { unreadable: true });
+    const personal = provider.partitions.durable ? { adjudicate: personalAdjudicate } : undefined;
     return { personal, org };
 }
 export function createRuleOffersOf(cfg) {
-    return (toolName, args, ask) => {
+    return (call, args, ask) => {
+        const toolName = call.toolName;
         if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
             return {};
         if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
             return {};
+        const tierSeat = firstNamed(cfg.irreversibilityTier, ruleNamesOf(call));
         const closedDoor = ruleClearanceOf(ask, {
-            egress: cfg.egressTools.has(toolName),
-            irreversibility: cfg.irreversibilityTier.get(toolName),
-            shellGated: cfg.shellGatedTools.has(toolName),
+            egress: anyNamed(cfg.egressTools, ruleNamesOf(call)),
+            irreversibility: tierSeat?.value,
+            shellGated: tierSeat !== undefined && cfg.shellGatedTools.has(tierSeat.name),
         }).word;
         if (closedDoor !== undefined)
             return { ruleOffersAbsence: closedDoor };

package/dist/core/runner/persisted-path-rows.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The person's persisted PATH rows as a leg's read face takes them at prepare (the gate's rule lanes read the same store
+ * per call).
+ */
+import { type EffectivePermissionRules, type PermissionRuleStoreProvider } from "../permission-rule-provider.js";
+import type { PathRuleDenyRow } from "../../tools/fs/read-deny.js";
+import type { RunnerDeps } from "../runner-deps.js";
+/** The person's persisted PATH rows a leg's read face takes at prepare ({@link persistedPathRowsOf}). */
+export interface PersistedPathRows {
+    /** Every live `Read(//dir/**)` allow row's directory (lexical, absolute): a standing yes to reads under it. */
+    readonly readDirectories: readonly string[];
+    /** Every live face-keyed path DENY row (`Read(...)`, `Edit(...)`), as a deny-table row resolved at the task's bases. */
+    readonly denyRows: readonly PathRuleDenyRow[];
+}
+/**
+ * The person's persisted PATH rows, read ONCE at prepare from the same store query the gate's lanes read per call: a
+ * `Read(//dir/**)` allow row is a READ DIRECTORY of the run (the Bash read station, Read / Grep / Glob — one set), and a
+ * `Read(...)` / `Edit(...)` deny row joins the run's read / write deny tables (every read face, the shell's file commands
+ * and traversals). One read, two directions, so a person's allow row never reaches further than their deny rows: a
+ * directory it admits still refuses the paths a deny row names. A row the store gains mid-run applies from the next
+ * prepare; the in-flight grant (`readRootGrant`) is the mid-run door. The store not armed, or the anonymous floor ⇒ no
+ * rows. A read that failed (or did not answer in time) ⇒ no rows, and a partition the read could not read ⇒ none of ITS
+ * rows (the partition that was read contributes its own): what could not be read is skipped for this run's tables — its
+ * directories widen nothing and its deny rows judge nothing here — disclosed on the trace and announced to the person
+ * (`onUnread`); the next prepare reads again, as it would for a row the store gained mid-run. A deny row whose
+ * pattern needs a base the task cannot supply (`~/` with no declared home) is left to the per-call lane and disclosed.
+ */
+export declare function persistedPathRowsOf(cfg: {
+    provider: PermissionRuleStoreProvider | undefined;
+    localOwnerDeclared: boolean;
+    principal: string | undefined;
+    sessionId: string;
+    root: string;
+    home: string | undefined;
+    onDisclosure: (message: string) => void;
+    /** The person is told the store (or the named sources of it) was skipped ({@link ruleStoreUnreadableNotice}). */
+    onUnread: (at: "prepare", sources?: EffectivePermissionRules["unreadableSources"]) => void;
+    /** The run's cut: a read that has not answered by then (or by the gate's await bound) reads as unreadable. */
+    signal?: AbortSignal;
+}): Promise<PersistedPathRows>;
+/**
+ * The run's ONE `permission.rule_store_unavailable` notice (audience user): the person's rules — the whole store, or the
+ * sources of it whose partition could not be read — were skipped; minted by whichever read found it first (the prepare
+ * read of the path rows, or a call's own read on the rule lane), once per run however many reads fail after it (the
+ * prepare sentence says a later call may be judged without them too). The trace keeps every read's line.
+ */
+export declare function ruleStoreUnreadableNotice(onNotice: RunnerDeps["onNotice"], ids: {
+    readonly sessionId: string;
+    readonly runId: string;
+}): (at: "prepare" | "call", sources?: EffectivePermissionRules["unreadableSources"]) => void;
+/** {@link persistedPathRowsOf} for one task's prepare: only where a read face mounts (hands), disclosed on the run's trace,
+ *  cut by the run's own signals. `undefined` = nothing to read, returned synchronously: a run with no person's store (or
+ *  no hands) gains no suspension point on its prepare. */
+export declare function persistedPathRowsOfTask(t: {
+    deps: Pick<RunnerDeps, "permissionRuleStore" | "localOwnerRules" | "tracer">;
+    principal: string | undefined;
+    sessionId: string;
+    root: string;
+    home: string | undefined;
+    taskId: string;
+    handsEnabled: boolean;
+    signals: readonly AbortSignal[];
+    onUnread: (at: "prepare", sources?: EffectivePermissionRules["unreadableSources"]) => void;
+}): Promise<PersistedPathRows> | undefined;