@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -24,18 +24,22 @@
  */
 import type { AgentHarness, AgentTool } from "../../internal/harness.js";
 import type { AskClass } from "../ask-class.js";
+import type { Arbitration, ToolMarkSource } from "../ask-origin.js";
+import type { PermissionModeController } from "../mode-policy.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type ComplianceCapability } from "../compliance.js";
 import { type HookEnvCapabilities, type HookInvocationIdentity, type Hooks } from "../hooks.js";
 import type { ToolPolicy } from "../tool-policy.js";
 import { type GateOutcome } from "../gate-outcome.js";
 import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
+import { type WiringManifest } from "../wiring-manifest.js";
 import type { WriteProtectionCheck } from "../write-protect.js";
 import type { ShellReadCheck } from "../../tools/fs/shell-read-check.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, ReversibilityProbes, StopForDenialLimit } from "./contracts.js";
 import type { PermissionRuleLanes } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
+import type { ToolCallLike } from "../tool-registry.js";
 import { type FrameSettlement } from "../frame-settlement.js";
 /**
  * The parent-thread human-rejection boundary — judged ONCE here, from the pass's own record (CC parity:
@@ -134,8 +138,6 @@ export interface PrepareGateStationsInput {
     hookIdentity: HookInvocationIdentity;
     /** borrowed-readonly — the leg's reminder provenance mark (every model-facing deny reason and hook context carries it). */
     reminderMark: string;
-    /** borrowed-readonly — the plan-mode latch (`Prepared.planModeRef`); `active` is read per call. Not written here. */
-    planModeRef: Prepared["planModeRef"];
     /** borrowed-readonly — the per-task identity (the trace rows' taskId). */
     hostTaskId: string;
     /** borrowed-readonly — the acquired session id (the settlement defects' error tag). */
@@ -147,6 +149,12 @@ export interface PrepareGateStationsInput {
     /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read per screening / per post seat. Not
      *  written here. */
     handsCwdRef: CwdRef | undefined;
+    /** borrowed-readonly — the leg's read-deny table in force, read at a release: the active built-in tiers and the rows
+     *  beside them (the deployment's and the task's patterns, the read-face rule rows). Empty ⇒ no table. */
+    readDenyInForce: () => {
+        readonly tiers: readonly string[];
+        readonly rows: readonly string[];
+    };
     /** borrowed-readonly — the read-only env capability face every hook context carries, or undefined. */
     hookEnvFace: HookEnvCapabilities | undefined;
     /** borrowed-readonly — the leg's write-protection gate input, compiled ONCE by the wiring-manifest phase
@@ -167,12 +175,32 @@ export interface PrepareGateStationsInput {
         readonly signal: AbortSignal;
     };
     /** borrowed-readonly — the shell-seat provenance set: the shell-running tools whose tier is the engine's shell seat's, not a
-     *  deployment mark (the gate's `shellGated` attribution is the gated tool's membership). */
+     *  deployment mark (the gate's `shellGated` attribution is the membership of the name the call's tier was read under). */
     shellGatedTools: ReadonlySet<string>;
-    /** borrowed-readonly — the auto-mode decider, or undefined (the classifier lane the gate routes a surviving ask through). */
-    autoModeDecider: AutoModeDecider | undefined;
-    /** borrowed-readonly — the auto-mode denial tracker, or undefined (handed to the gate beside the decider). */
-    autoModeDenialTracking: AutoModeDenialTracker | undefined;
+    /** borrowed-readonly — the armed classifier's live seat (read per call: a leg steered into `auto` arms after prepare). */
+    autoModeDecider: {
+        readonly current: AutoModeDecider | undefined;
+    };
+    /** borrowed-readonly — the denial tracker's live seat beside the decider's. */
+    autoModeDenialTracking: {
+        readonly current: AutoModeDenialTracker | undefined;
+    };
+    /** borrowed-readonly — the leg's ONE ask derivation (`wiring_manifest.ask`: form + effective), read for the classifier's seat. */
+    askRoute: WiringManifest["ask"];
+    /** borrowed-readonly — the leg's live permission-mode seat: the gate's arbitration point reads `current` per call. */
+    permissionMode: PermissionModeController;
+    /** borrowed-readonly — WHO marked each tool's seat (the safety scan's map, the protocol fold's rows); read per call into
+     *  the gate's class derivation. */
+    toolMarkSources: ReadonlyMap<string, ReadonlySet<ToolMarkSource>>;
+    /** borrowed-readonly — the deployment's A2A isolation switch (`RunnerDeps.a2a.isolatePeers`), when set. */
+    a2aIsolatePeers?: true;
+    /** borrowed-readonly — the run's invocation id (the released-ask account's detail). */
+    runId: string;
+    /** borrowed-mutable — the inherited stations' mode arbitrations, keyed by tool call (the policy-chain phase writes; the
+     *  gate's exit reads and this station deletes at the call's end, the fold-record lifecycle). */
+    ancestorArbitrations: Map<string, Exclude<Arbitration, {
+        kind: "ask";
+    }>>;
     /** borrowed-readonly — the headless denial-limit stop seat (wired unconditionally). */
     stopForDenialLimit: StopForDenialLimit;
     /** borrowed-readonly — the persisted allow-rule lane, or undefined (absent entirely with no store). */
@@ -184,8 +212,8 @@ export interface PrepareGateStationsInput {
     questionToolMounted: boolean;
     /** borrowed-readonly — whether sandbox admission is armed (isolated env + park prerequisites). */
     sandboxAdmissionArmed: boolean;
-    /** borrowed-readonly — the per-tool boundary-capability fact the sandbox admission reads. */
-    sandboxBoundaryCapable: (toolName: string) => boolean;
+    /** borrowed-readonly — the per-call boundary-capability fact the sandbox admission reads (the call's wire name and names). */
+    sandboxBoundaryCapable: (call: Pick<ToolCallLike, "toolName" | "face">) => boolean;
     /** borrowed-readonly — the sandbox-admission trace sink (the deferred ancestor disclosure and the gate's own). */
     emitSandboxAdmitted: (info: {
         toolCallId: string;

package/dist/core/runner/prepare-gate-stations.js

@@ -1,14 +1,15 @@
 import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { complianceCallDenial } from "../compliance.js";
 import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, runHookSeat, runToolGate } from "../hooks.js";
-import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
 import { screenGateOutcome } from "../gate-outcome.js";
 import { directDeny } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
+import { askReachesPerson } from "../wiring-manifest.js";
+import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-import { toolCallFaceOf } from "../tool-roster.js";
+import { anyNamed, callAnswersTo, callFaceSeat, firstNamed, rosterToolName, ruleNamesOf, toolCallFaceOf } from "../tool-roster.js";
 import { noteHostRewrite } from "../frame-settlement.js";
 function screenGateResult(result) {
     if (result.suspend !== undefined)
@@ -42,7 +43,29 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement } = input;
+    const releasesAnnounced = new Map();
+    const onModeReleased = (info) => {
+        const table = info.readUnestablished === true ? input.readDenyInForce() : undefined;
+        if (table !== undefined && table.tiers.length + table.rows.length > 0) {
+            const named = [...(table.tiers.length > 0 ? [`built-in tiers ${table.tiers.join(", ")}`] : []), ...table.rows.slice(0, 8), ...(table.rows.length > 8 ? [`${table.rows.length - 8} more`] : [])].join("; ");
+            deliverEngineNotice(deps.onNotice, {
+                code: "permission.read_deny_unapplied",
+                message: `the ${info.release.mode} permission mode released "${info.toolName}" although a read-deny table is in force (${named}): the read boundary could not establish what this command reads, so no row of the table was applied to it`,
+                detail: { mode: info.release.mode, toolCallId: info.toolCallId, tiers: [...table.tiers], rows: table.rows.slice(0, 8), rowCount: table.rows.length, sessionId, runId },
+            });
+        }
+        const key = `${info.release.mode}\u0000${info.release.askClass}`;
+        const count = (releasesAnnounced.get(key) ?? 0) + 1;
+        releasesAnnounced.set(key, count);
+        if (count !== 1)
+            return;
+        deliverEngineNotice(deps.onNotice, {
+            code: "permission.ask_released_by_mode",
+            message: `the ${info.release.mode} permission mode released a ${info.release.askClass} ask on "${info.toolName}" without putting it to anyone (further releases of this pair in this run ride each call's tool_end.gate.disposition.released)`,
+            detail: { mode: info.release.mode, askClass: info.release.askClass, ...(info.release.origin !== undefined ? { origin: info.release.origin } : {}), ...(info.release.mandate !== undefined ? { mandate: info.release.mandate } : {}), count, firstToolCallId: info.toolCallId, sessionId, runId },
+        });
+    };
     if (askLane !== undefined && parkAsk !== undefined) {
         const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
         const { resolveContentAsk, suspendAsk } = parkAsk;
@@ -62,11 +85,15 @@ export function prepareGateStations(input) {
                 writeProtectionArmed ||
                 shellReadCheck !== undefined;
         if (toolCallGateArmedRef.armed) {
-            harness.on("tool_call", async (e) => {
+            harness.on("tool_call", async (called) => {
+                const e = { ...called, toolName: rosterToolName(toolRosterDeltas.current, called.toolName) };
+                const call = { toolName: e.toolName, ...callFaceSeat(toolCallFaceOf(toolRosterDeltas.current, called.toolName)) };
+                const names = ruleNamesOf(call);
+                const tierSeat = firstNamed(irreversibilityTier, names);
                 blockedToolCalls.delete(e.toolCallId);
                 inheritedAskGrants.delete(e.toolCallId);
                 {
-                    const complianceDeny = complianceCallDenial(complianceDenies, e.toolName);
+                    const complianceDeny = names.map((n) => complianceCallDenial(complianceDenies, n)).find((d) => d !== undefined);
                     if (complianceDeny !== undefined) {
                         if (blockedTracked)
                             blockedToolCalls.add(e.toolCallId);
@@ -78,22 +105,6 @@ export function prepareGateStations(input) {
                         return { block: true, reason: formatHookFeedback(complianceDeny, reminderMark), preToolContext: [] };
                     }
                 }
-                if (planModeRef.active && (toolEffects.get(e.toolName) ?? "write") !== "read") {
-                    if (blockedTracked)
-                        blockedToolCalls.add(e.toolCallId);
-                    const planDenyReason = `Plan mode is active — "${e.toolName}" is a write/mutating tool and is read-only-blocked. ` +
-                        `Research with read-only tools, then call ${PRESENT_PLAN_TOOL_NAME} with your plan to get it approved before acting.`;
-                    const gate = directDeny("plan_mode");
-                    gateOutcomes.set(e.toolCallId, gate);
-                    if (notifyPermissionDenied) {
-                        await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: planDenyReason, gate, identity: hookIdentity });
-                    }
-                    return {
-                        block: true,
-                        reason: formatHookFeedback(planDenyReason, reminderMark),
-                        preToolContext: [],
-                    };
-                }
                 let result;
                 try {
                     result = await runToolGate({
@@ -106,22 +117,27 @@ export function prepareGateStations(input) {
                         hookTimeoutMs,
                         ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
                         ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
-                        toolFaceOf: (name) => toolCallFaceOf(toolRosterDeltas.current, name),
+                        toolFaceOf: (name) => toolCallFaceOf(toolRosterDeltas.current, name === e.toolName ? called.toolName : name),
                         adjudicate,
                         resolveAsk: resolveAskBound,
                         suspendAsk,
                         resolveContentAsk,
-                        egress: egressTools.has(e.toolName),
-                        peerMessage: e.toolName === SEND_MESSAGE_TOOL_NAME,
+                        egress: anyNamed(egressTools, names),
+                        peerMessage: callAnswersTo(call, SEND_MESSAGE_TOOL_NAME),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                         ...(shellReadCheck !== undefined ? { shellReadCheck } : {}),
-                        irreversibility: irreversibilityTier.get(e.toolName),
-                        reversibilityProbe: reversibilityProbes.get(e.toolName),
+                        irreversibility: tierSeat?.value,
+                        reversibilityProbe: tierSeat !== undefined ? reversibilityProbes.get(tierSeat.name) : undefined,
                         abortSignal: abortController.signal,
                         ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
                         onHookError: notifyHookError,
-                        shellGated: shellGatedTools.has(e.toolName),
-                        ...(autoModeDecider ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}) } } : {}),
+                        shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
+                        ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
+                        permissionMode: () => permissionMode.current,
+                        ...(() => { const s = firstNamed(toolMarkSources, names)?.value; return s !== undefined ? { toolMarkSources: s } : {}; })(),
+                        ...(a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
+                        onModeReleased,
+                        ancestorArbitrationOf: (toolCallId) => ancestorArbitrations.get(toolCallId),
                         onHeadlessDenialLimit: stopForDenialLimit,
                         onAskUnresolvable: (info) => deliverEngineNotice(deps.onNotice, askUnresolvableNotice({ sessionId, ...info })),
                         ...(permissionRuleLane
@@ -171,7 +187,7 @@ export function prepareGateStations(input) {
                             ? {
                                 sandboxAdmission: {
                                     askClassesOf: (toolCallId) => foldAskClasses.get(toolCallId),
-                                    boundaryCapable: sandboxBoundaryCapable(e.toolName),
+                                    boundaryCapable: sandboxBoundaryCapable(call),
                                     onAdmitted: emitSandboxAdmitted,
                                 },
                             }
@@ -182,6 +198,7 @@ export function prepareGateStations(input) {
                     inheritedUnavailableAsks.delete(e.toolCallId);
                     inheritedAskGrants.delete(e.toolCallId);
                     foldAskClasses.delete(e.toolCallId);
+                    ancestorArbitrations.delete(e.toolCallId);
                 }
                 const ancestorAdmitted = ancestorSandboxAdmissions.get(e.toolCallId);
                 ancestorSandboxAdmissions.delete(e.toolCallId);

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -1,14 +1,16 @@
-import { type BeforeWriteHook, type CwdRef, type ReadDenyMatcher, type ContainmentFace } from "../../tools/fs/index.js";
+import { type BeforeWriteHook, type CwdRef, type ReadDenyMatcher, type PathRuleDenyRow, type ContainmentFace } from "../../tools/fs/index.js";
 import { type ReadFileState } from "../../tools/fs/safety.js";
 import { type ShellReadAdmission, type ShellReadCheck } from "../../tools/fs/shell-read-check.js";
+import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
 import type { RunnerDeps, ShellGateDoctrine, TaskSpec } from "../types.js";
 import type { Model } from "../../internal/llm.js";
 import type { AgentHarness, AgentTool, ExecutionEnv, WorkspaceState } from "../../internal/harness.js";
 import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import { type ArtifactStoreRef, type GrantReadRoot } from "./read-root-grant.js";
 import type { StoredSession } from "../session.js";
-import type { IrreversibilityTier, PrepareResume, ReversibilityProbes, RunInternals, ToolFaceSnapshot, ToolProgressLane } from "./contracts.js";
+import type { IrreversibilityTier, PrepareResume, ReversibilityProbes, RunInternals, ToolFaceSnapshot, ToolProgressLane, WriteFaceSeat } from "./contracts.js";
 import { RosterBuilder } from "../tool-roster.js";
+import type { PermissionMode } from "../ask-origin.js";
 /** Test seam (mirrors `__resetMalformedNoticeSeatAnnouncement`): never called by production code.
  *  Deliberately asymmetric — it resets only the console latch: the WeakSet arm needs no seam
  *  because a test resets it by minting a fresh sink function (identity IS the ledger key), while
@@ -51,13 +53,31 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-readonly — the registry scope (`internals?.registryScope ?? spec.principal ??
      *  "default"`, computed in the driver); the band's task-registry scope. */
     taskScope: string;
+    /** borrowed-readonly — the deny tables' permission-rule rows: the path deny rules of the leg's caller policy and of every
+     *  ancestor's (`toolPolicyPathDenyRules`); joined to the read face's matcher and to the shell station's write face. */
+    pathDenyRules: readonly PathRuleDenyRow[];
+    /** borrowed-readonly — the two judges a shell command's write targets meet for the mode's file-command placement: the
+     *  leg's write-protection judge (read per judgment — it is compiled at the manifest phase, before any gate is mounted)
+     *  and the chain's write-target guard (`toolPolicyWriteTargetGuard`). Absent ⇒ neither (a standalone phase drive). */
+    writeGuards?: {
+        readonly protection: () => ShellReadBoundary["writeProtectionJudge"];
+        readonly target: ShellReadBoundary["writeTargetGuard"];
+    };
+    /** borrowed-readonly — the directories of the person's persisted `Read(//dir/**)` allow rows: read directories of this
+     *  run, canonicalized and admitted exactly as `additionalReadDirectories` entries are. */
+    persistedReadDirectories?: readonly string[];
+    /** borrowed-readonly — the leg's mode seat, read LIVE by the write face ({@link writeFaceReader}): its mode's face
+     *  is the resolver's row 3′ on every write. */
+    permissionMode: {
+        readonly current: PermissionMode;
+    };
     /** borrowed-readonly — the D-6 spec-time full-shell reachability precomputation; an input to the
      *  face resolver on BOTH arms (the driver's post-exclusion roster assertion pins it to the
      *  mounted truth — that assertion is driver-side, after this phase). */
     fullShellReachable: boolean;
-    /** borrowed-readonly — the MAX-RANK fold of spec.shellGate with the inherited chain's doctrine
-     *  (computed in the driver's inherited-gate block); the shellGate fold's doctrine value. */
-    effectiveShellGate: ShellGateDoctrine;
+    /** borrowed-readonly — the operator's shell FLOOR (`"always"`: the spec's, or the chain's), or undefined (no floor:
+     *  the shape tier installs on its own and the permission mode arbitrates its asks). */
+    effectiveShellGate: ShellGateDoctrine | undefined;
     /** borrowed-readonly — B-1's frozen task-start face snapshot; only `.exclude` is read here (the
      *  Monitor-mount honesty bit for the gh rate-limit hint). */
     toolFaceSnapshot: ToolFaceSnapshot;
@@ -123,8 +143,8 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-mutable — the shellGate fold `.add`s Bash/Monitor here. Same-object contract as
      *  above. */
     irreversibleTools: Set<string>;
-    /** borrowed-mutable — the classify doctrine's probe installs (`.set`, only where the doctrine
-     *  owns the seat). Same-object contract as above. */
+    /** borrowed-mutable — the shape tier's probe installs (`.set`, only where the shell seat
+     *  owns the tier). Same-object contract as above. */
     reversibilityProbes: ReversibilityProbes;
     /** borrowed-readonly — the run's reminder provenance mark (minted/adopted
      *  by the driver's adoption ladder); threaded into the hands band so the fs-side engine mints
@@ -184,9 +204,12 @@ export interface PrepareHandsReadFaceResult {
     /** owned — real shell + write hands + background-capable env: gates the driver's TaskOutput/
      *  TaskStop/Monitor/SendMessage mounts (P11) and the Monitor arm of the shellGate fold here. */
     backgroundTaskToolsActive: boolean;
-    /** owned — this run's shell READ STATION, the gate input (`ToolGateInput.shellReadCheck`): ONE judgment of
-     *  where a shell command reads, for every shell face this leg mounts, under every doctrine. ⇔ a real shell. */
+    /** owned — this run's READ STATIONS as the one gate input (`ToolGateInput.shellReadCheck`): the shell's (ONE judgment of
+     *  where a shell command reads, for every shell face this leg mounts, under every mode and floor) and the file tools'
+     *  (an out-of-root Read / Grep / Glob target is a question). ⇔ hands with a real shell, or hands with an approval face. */
     shellReadCheck: ShellReadCheck | undefined;
+    /** owned — the shell read station is mounted (⇔ a real shell): the wiring manifest's cell. */
+    shellReadStationArmed: boolean;
     /** owned — the same station's pre-spawn ADMISSION, published for the P11 face that spawns a shell command
      *  and mounts LATER than the band (`Monitor`): the SAME function the band's shell faces got. ⇔ a real shell. */
     shellReadAdmission: ShellReadAdmission | undefined;
@@ -194,13 +217,13 @@ export interface PrepareHandsReadFaceResult {
      *  (the hands-less value lives in `handsLessResolvedFace`). The driver assigns this onto its
      *  outer `let` for the call-time closures (ctx enrichment / checkpoint mint / envFacts). */
     resolvedReadFace: ContainmentFace | undefined;
-    /** write-back — the run's RESOLVED WRITE face where hands mount; undefined ⇔ no hands (the
-     *  hands-less value lives in `handsLessResolvedWriteFace`). The read seat's twin, resolved by the
-     *  SAME order on its OWN seats — the two never read each other. */
-    resolvedWriteFace: ContainmentFace | undefined;
-    /** write-back — the hands-LESS legs' resolved WRITE face (the posture is a property of the RUN,
-     *  not the mount): the delegation carriers and the checkpoint mint need it on every leg. */
-    handsLessResolvedWriteFace: ContainmentFace | undefined;
+    /** write-back — the run's WRITE face in force where hands mount, read per call ({@link writeFaceReader}); undefined ⇔
+     *  no hands (the hands-less reader is `handsLessResolvedWriteFace`). The read seat's twin, resolved by the SAME order on
+     *  its OWN seats — the two never read each other. */
+    resolvedWriteFace: WriteFaceSeat | undefined;
+    /** write-back — the hands-LESS legs' write face in force (the posture is a property of the RUN, not the mount): the
+     *  delegation carriers and the checkpoint mint read it on every leg. */
+    handsLessResolvedWriteFace: WriteFaceSeat | undefined;
     /** write-back (D-3 hold) — the NORMALIZED deny-set additions in force (deployment ∪ task ∪
      *  resume-seed; zero-builtin compile — the persisted/carrier form, never the judged union's
      *  post-dedup remainder). Driver assigns onto its outer `let`. */
@@ -234,7 +257,7 @@ export interface PrepareHandsReadFaceResult {
      *  task additions). Undefined ⇔ hands-less (its consumers only exist with hands). */
     readDenyMatcher: ReadDenyMatcher | undefined;
     /** owned — the shell-seat PROVENANCE set: the shell-running tools whose tier the engine's shell seat (read
-     *  boundary + shellGate doctrine) is the SOLE POSITIVE source of — no explicit deployment mark on that name.
+     *  boundary + shape tier + shellGate floor) is the SOLE POSITIVE source of — no explicit deployment mark on that name.
      *  The one seat every consumer reads (risk grading, the gate's tighten attribution, the persisted-rule mandate
      *  boundary): `shellGatedTools.has(toolName)`. Minted here, never grown afterwards; empty when the seat fold
      *  did not run (no real writable shell). */

package/dist/core/runner/prepare-hands-readface.js

@@ -1,19 +1,22 @@
 import { emitTrace } from "../trace.js";
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasBackgroundShell } from "../background-shell.js";
-import { boundaryIsTheSandbox } from "../remote-env.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { bashReversibilityProbe, activeReadDenyBuiltinTiers, compileReadDeny, readDenySeat, createHandsToolkit, deploymentFaceClampNotice, pdfModelCapabilitiesOf, inheritSessionReadFileState, resolveContainmentFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
+import { bashReversibilityProbe, activeReadDenyBuiltinTiers, readDenyBuiltinConfigOf, compileReadDeny, compileWriteDeny, withRuleRowsWhereTheyLead, readDenySeat, createHandsToolkit, deploymentFaceClampNotice, pdfModelCapabilitiesOf, inheritSessionReadFileState, backgroundOutputReadExemption, resolveContainmentFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
 import { resolveKey, sha256 } from "../../tools/fs/safety.js";
+import { placeReadDenyAtHome, whereItsAnsweredPrefixLeads } from "../../tools/fs/read-deny-home.js";
 import { createShellOverflowSpoolFence } from "../../tools/fs/fs-shared.js";
 import { createShellReadStation } from "../../tools/fs/shell-read-check.js";
+import { composeReadChecks, createFileReadStation } from "../../tools/fs/file-read-check.js";
+import { readTargetToolNames } from "../tool-registry.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
 import { deliverEngineNotice } from "../types.js";
-import { readRootGrantOver } from "./read-root-grant.js";
+import { readRootGrantOver, rootAdmittingArtifactStore } from "./read-root-grant.js";
 import { sessionSeatAnchorHolds } from "./session-read-file-states.js";
 import { rebaseWorkspacePath } from "./workspace-path.js";
 import { RosterBuilder } from "../tool-roster.js";
+import { modePolicyOf } from "../mode-policy.js";
 const faceClampAnnouncedSinks = { read: new WeakSet(), write: new WeakSet() };
 const faceClampConsoleAnnounced = { read: false, write: false };
 function announceDeploymentFaceClamp(kind, sink) {
@@ -52,6 +55,15 @@ function assertStringArraySeat(value, seat, entryLaw) {
         }
     }
 }
+function writeFaceReader(input, onDeploymentClamp) {
+    const { spec, deps, resume, fullShellReachable, permissionMode } = input;
+    const seats = { kind: "write", readOnlyMount: spec.handsReadOnly === true, orgGoverned: deps.permissionRuleStore?.partitions.org === true, fullShellReachable };
+    resolveContainmentFace({ ...seats, specFace: spec.writeFace, depsFace: deps.writeFace, ...(onDeploymentClamp !== undefined ? { onDeploymentClamp } : {}) });
+    const recorded = resume === undefined ? "live" : resume.seed.writeFace?.face;
+    const folded = (word) => (recorded === "roots" ? "roots" : word === "open" && recorded !== "open" && recorded !== "live" ? undefined : word);
+    const faceUnder = (modeFace) => resolveContainmentFace({ ...seats, specFace: folded(spec.writeFace), depsFace: folded(deps.writeFace), ...(modeFace !== undefined ? { modeFace } : {}) });
+    return { inForce: () => faceUnder(modePolicyOf(permissionMode.current).writeFace), fenced: faceUnder("open") === "roots" };
+}
 export function resolveHandsLessReadFace(input) {
     const { resume, fullShellReachable, spec, deps } = input;
     assertStringArraySeat(deps.readDenyPatterns, "RunnerDeps.readDenyPatterns", "compiler-owned");
@@ -71,21 +83,9 @@ export function resolveHandsLessReadFace(input) {
         });
         const seed = resume?.seed.readFace;
         handsLessResolvedFace = resume !== undefined && (seed === undefined || seed.face === "roots") ? "roots" : liveFace;
-        const liveWriteFace = resolveContainmentFace({
-            kind: "write",
-            specFace: spec.writeFace,
-            depsFace: deps.writeFace,
-            readOnlyMount: spec.handsReadOnly === true,
-            orgGoverned: deps.permissionRuleStore?.partitions.org === true,
-            fullShellReachable,
-        });
-        const seedWrite = resume?.seed.writeFace;
-        handsLessResolvedWriteFace = resume !== undefined && (seedWrite === undefined || seedWrite.face === "roots") ? "roots" : liveWriteFace;
+        handsLessResolvedWriteFace = writeFaceReader(input);
         const denyAdditions = [...(deps.readDenyPatterns ?? []), ...(spec.readDenyPatterns ?? []), ...(seed?.denyEntries ?? [])];
-        readDenyBuiltinTiersActive = activeReadDenyBuiltinTiers({
-            ...(deps.readDenyBuiltinTiers !== undefined ? { tiers: deps.readDenyBuiltinTiers } : {}),
-            ...(deps.readDenyBuiltinExclude !== undefined ? { exclude: deps.readDenyBuiltinExclude } : {}),
-        });
+        readDenyBuiltinTiersActive = activeReadDenyBuiltinTiers(readDenyBuiltinConfigOf({ tiers: deps.readDenyBuiltinTiers, exclude: deps.readDenyBuiltinExclude }));
         if (denyAdditions.length > 0) {
             readDenyAdditionsNormalized = compileReadDeny(denyAdditions, "readDenyPatterns", { tiers: [] }).entries;
         }
@@ -99,6 +99,7 @@ export function resolveHandsLessReadFace(input) {
         rebaseWsPath: (p) => p,
         backgroundTaskToolsActive: false,
         shellReadCheck: undefined,
+        shellReadStationArmed: false,
         shellReadAdmission: undefined,
         resolvedReadFace: undefined,
         resolvedWriteFace: undefined,
@@ -133,6 +134,8 @@ export async function prepareHandsMount(input) {
     let rebaseWsPath = (p) => p;
     let backgroundTaskToolsActive = false;
     let shellReadStation;
+    let shellReadTools = new Set();
+    let fileReadStation;
     let resolvedReadFace;
     let resolvedWriteFace;
     let readDenyAdditionsNormalized = [];
@@ -176,6 +179,10 @@ export async function prepareHandsMount(input) {
         };
         await canonicalizeExtraDirs(spec.additionalDirectories, "additionalDirectories", additionalRootsCanonical);
         await canonicalizeExtraDirs(spec.additionalReadDirectories, "additionalReadDirectories", additionalReadRootsCanonical);
+        const standingCanonical = [];
+        await canonicalizeExtraDirs(input.persistedReadDirectories, "persistedReadRule", standingCanonical);
+        artifactStoreRef.standing = { keys: standingCanonical.filter((k) => !additionalReadRootsCanonical.includes(k) && !additionalRootsCanonical.includes(k)), readRoots: additionalReadRootsCanonical };
+        additionalReadRootsCanonical.push(...standingCanonical);
         if (advertisedWritableDirs !== undefined) {
             if (spec.envFacts?.scratchpadDir)
                 await advertisedWritableDirs.admit({ path: spec.envFacts.scratchpadDir, advertiser: "scratchpad", materializeMarker: ".sema-scratchpad" });
@@ -212,11 +219,10 @@ export async function prepareHandsMount(input) {
         }
         const seedReadFaceSection = resume?.seed.readFace;
         const readDenyAdditions = [...(deps.readDenyPatterns ?? []), ...(spec.readDenyPatterns ?? []), ...(seedReadFaceSection?.denyEntries ?? [])];
-        const readDenyBuiltinCfg = {
-            ...(deps.readDenyBuiltinTiers !== undefined ? { tiers: [...deps.readDenyBuiltinTiers] } : {}),
-            ...(deps.readDenyBuiltinExclude !== undefined ? { exclude: [...deps.readDenyBuiltinExclude] } : {}),
-        };
-        readDenyMatcher = compileReadDeny(readDenyAdditions, "readDenyPatterns", readDenyBuiltinCfg);
+        const readDenyBuiltinCfg = readDenyBuiltinConfigOf({ tiers: deps.readDenyBuiltinTiers, exclude: deps.readDenyBuiltinExclude });
+        const pathDenyRules = await withRuleRowsWhereTheyLead(input.pathDenyRules, (head) => whereItsAnsweredPrefixLeads(executionEnv, head));
+        const readDenyPlacement = await placeReadDenyAtHome(executionEnv, (homes, linked) => compileReadDeny(readDenyAdditions, "readDenyPatterns", readDenyBuiltinCfg, pathDenyRules, homes, linked));
+        readDenyMatcher = readDenyPlacement.matcher;
         readDenyBuiltinTiersActive = activeReadDenyBuiltinTiers(readDenyBuiltinCfg);
         readDenyAdditionsNormalized = compileReadDeny(readDenyAdditions, "readDenyPatterns", { tiers: [] }).entries;
         let liveReadFace = resolveContainmentFace({
@@ -231,19 +237,7 @@ export async function prepareHandsMount(input) {
         if (resume !== undefined && (seedReadFaceSection === undefined || seedReadFaceSection.face === "roots"))
             liveReadFace = "roots";
         resolvedReadFace = liveReadFace;
-        let liveWriteFace = resolveContainmentFace({
-            kind: "write",
-            specFace: spec.writeFace,
-            depsFace: deps.writeFace,
-            readOnlyMount: handsReadOnly,
-            orgGoverned: deps.permissionRuleStore?.partitions.org === true,
-            fullShellReachable,
-            onDeploymentClamp: () => announceDeploymentFaceClamp("write", deps.onNotice),
-        });
-        const seedWriteFaceSection = resume?.seed.writeFace;
-        if (resume !== undefined && (seedWriteFaceSection === undefined || seedWriteFaceSection.face === "roots"))
-            liveWriteFace = "roots";
-        resolvedWriteFace = liveWriteFace;
+        resolvedWriteFace = writeFaceReader(input, () => announceDeploymentFaceClamp("write", deps.onNotice));
         const sessionSeats = input.internals?.sessionReadStates;
         let seatLeafId;
         try {
@@ -297,31 +291,55 @@ export async function prepareHandsMount(input) {
                 }
                 : undefined;
         const denySeat = readDenySeat(readDenyMatcher);
+        const writeDeny = compileWriteDeny(pathDenyRules);
+        const writeDenySeat = writeDeny.ruleRows.length > 0 ? { writeDenyMatch: (p) => writeDeny.matchPath(p)?.pattern ?? null } : {};
         const shellReadBoundary = () => ({
             roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical],
             ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}),
             ...(executionEnv.homeDir !== undefined ? { homeDir: executionEnv.homeDir } : {}),
             ...denySeat,
+            ...writeDenySeat,
+            writeRoots: [rootCanonical, ...additionalRootsCanonical],
+            ...((judge) => (judge !== undefined ? { writeProtectionJudge: judge } : {}))(input.writeGuards?.protection()),
+            ...(input.writeGuards?.target !== undefined ? { writeTargetGuard: input.writeGuards.target } : {}),
             ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}),
         });
         if (handsIncludeShell) {
             const spoolFence = handsReadOnly ? createShellOverflowSpoolFence(executionEnv) : undefined;
-            const readonlyBoundary = () => spoolFence !== undefined ? { roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical], cwd: rootCanonical, ...denySeat, alsoInside: spoolFence } : undefined;
+            const readonlyBoundary = () => spoolFence !== undefined ? { roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical], cwd: rootCanonical, ...denySeat, ...writeDenySeat, alsoInside: spoolFence } : undefined;
+            shellReadTools = new Set(handsReadOnly ? ["Bash"] : backgroundTaskToolsActive ? ["Bash", "Monitor"] : ["Bash"]);
             shellReadStation = createShellReadStation({
                 env: executionEnv,
-                tools: new Set(handsReadOnly ? ["Bash"] : backgroundTaskToolsActive ? ["Bash", "Monitor"] : ["Bash"]),
-                seatOf: () => (handsReadOnly ? "readonly" : effectiveShellGate === "classify" ? "bash_classify" : "bash_off"),
+                tools: shellReadTools,
+                seatOf: () => (handsReadOnly ? "readonly" : "full_shell"),
                 boundaryOf: () => readonlyBoundary() ?? shellReadBoundary(), rootsCanonical: true,
             });
         }
+        if (!handsReadOnly) {
+            const bgOutputExempt = backgroundOutputReadExemption(defaultTaskRegistry, { taskOwner: hostTaskId, taskScope, ...(sessionId !== undefined ? { sessionId } : {}) }, executionEnv);
+            fileReadStation = createFileReadStation({
+                env: executionEnv,
+                rootCanonical,
+                roots: () => [...additionalRootsCanonical, ...additionalReadRootsCanonical],
+                ...(readDenyMatcher !== undefined ? { readDeny: readDenyMatcher } : {}),
+                ...(liveReadFace !== undefined ? { readFace: liveReadFace } : {}),
+                ...("homeDir" in executionEnv && executionEnv.homeDir !== undefined ? { homeDir: executionEnv.homeDir } : {}),
+                tools: readTargetToolNames(),
+                excluded: (key) => artifactStoreRef.current !== undefined && rootAdmittingArtifactStore(artifactStoreRef.current, [key]) !== undefined,
+                exempt: (key) => bgOutputExempt?.(key) === true,
+            });
+        }
         const band = createHandsToolkit(executionEnv, readFileState, rootCanonical, {
             ...(additionalRootsCanonical.length > 0 ? { additionalRoots: additionalRootsCanonical } : {}),
             additionalReadRoots: additionalReadRootsCanonical,
             ...(readDenyAdditions.length > 0 ? { readDenyPatterns: readDenyAdditions } : {}),
+            ...(pathDenyRules.length > 0 ? { pathDenyRules } : {}),
+            readDenyHomes: readDenyPlacement.homes,
+            readDenyHomeLinks: readDenyPlacement.linked,
             ...(readDenyBuiltinCfg.tiers !== undefined ? { readDenyBuiltinTiers: readDenyBuiltinCfg.tiers } : {}),
             ...(readDenyBuiltinCfg.exclude !== undefined ? { readDenyBuiltinExclude: readDenyBuiltinCfg.exclude } : {}),
             readFace: liveReadFace,
-            writeFace: liveWriteFace,
+            writeFaceLive: resolvedWriteFace.inForce,
             reminderMark: input.reminderMark,
             reminderDisclosureCounts: input.reminderDisclosureCounts,
             ...(input.trackFileEdit !== undefined ? { trackFileEdit: input.trackFileEdit } : {}),
@@ -329,6 +347,7 @@ export async function prepareHandsMount(input) {
             includeShell: handsIncludeShell,
             readOnly: handsReadOnly,
             ...(shellReadStation !== undefined ? { shellReadAdmission: shellReadStation.admit } : {}),
+            ...(fileReadStation !== undefined ? { readAdmission: fileReadStation.admitted } : {}),
             ...(handsCwdRef ? { cwdRef: handsCwdRef } : {}),
             taskRegistry: defaultTaskRegistry,
             taskOwner: hostTaskId,
@@ -368,27 +387,18 @@ export async function prepareHandsMount(input) {
             }
         }
         roster.mountAll(band.map((t) => (envHandToolNames.add(t.name), firstPartyOffload(t))), { source: "builtin", mountedBy: "hands" });
-        const shellGate = effectiveShellGate;
+        const shellFloor = effectiveShellGate;
         if (!(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
-            if (shellGate === "off") {
-                deps.onError?.(new Error(`shell gate doctrine is "off" while a real writable shell (Bash) is mounted — the read boundary is ` +
-                    `still judged on every command (a deny-listed read is refused; an out-of-root read asks, and the ask is mandated${boundaryIsTheSandbox(executionEnv) ? "; under an isolated sandbox the paths are judged as written" : "; the paths are judged as the filesystem resolves them, symlinks and patterns included"}), but no ` +
-                    `residual shell-risk classifier is installed: writes, egress and unknown commands are adjudicated by ` +
-                    `the ordinary policy/hook chain only. Set spec.shellGate to "classify" or "always" if this deployment ` +
-                    `expects doctrine-gated shell behavior.`), { phase: "config", sessionId, classification: "shell-gate-off" });
-            }
             const installShellSeat = (name) => {
                 const tierBefore = irreversibilityTier.get(name);
                 const seatOwned = !egressTools.has(name) && tierBefore !== "always" && tierBefore !== "maybe";
-                if (seatOwned)
-                    shellGatedTools.add(name);
-                if (shellGate === "off" && tierBefore !== "always")
-                    return;
-                const tier = shellGate === "always" || tierBefore === "always" ? "always" : "maybe";
+                const tier = shellFloor === "always" || tierBefore === "always" ? "always" : "maybe";
                 irreversibilityTier.set(name, tier);
                 irreversibleTools.add(name);
                 if (seatOwned && tier === "maybe")
                     reversibilityProbes.set(name, bashReversibilityProbe(undefined, shellReadBoundary));
+                if (seatOwned)
+                    shellGatedTools.add(name);
             };
             installShellSeat("Bash");
             if (backgroundTaskToolsActive)
@@ -403,7 +413,8 @@ export async function prepareHandsMount(input) {
         wsSnapshot,
         rebaseWsPath,
         backgroundTaskToolsActive,
-        shellReadCheck: shellReadStation?.check,
+        shellReadCheck: composeReadChecks([...(shellReadStation !== undefined ? [{ check: shellReadStation.check, tools: shellReadTools }] : []), ...(fileReadStation !== undefined ? [fileReadStation] : [])]),
+        shellReadStationArmed: shellReadStation !== undefined,
         shellReadAdmission: shellReadStation?.admit,
         resolvedReadFace,
         resolvedWriteFace,