@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -1,8 +1,8 @@
 /**
  * PrepareTask's INHERITED-GATE phase, verbatim from the driver: the live/seed fold of the
- * chain this run inherits (ancestor rules rev-monotonic per (session, principal), shellGate by max rank, the
- * re-supplied parent constraints with their rebuilt denial trackers, the auto-mode intent, the org-admission
- * freeze with its tighten-only intersection and the monotonic governed bit), the effective shellGate against the
+ * chain this run inherits (ancestor rules rev-monotonic per (session, principal), the shell floor, the
+ * re-supplied parent constraints with their rebuilt denial trackers, the permission mode's live seat, the org-admission
+ * freeze with its tighten-only intersection and the monotonic governed bit), the effective shell floor against the
  * spec, the three cells later phases fill for the children's chain (own session rules, own admitted org scopes,
  * own org verdict), the checkpoint-section closures the suspend serializer reads (face / org / F-012 stamps), the
  * FROZEN ask and question seats (spec over deps), the parent SPEC seat the children inherit, the two delegation refs the memory phase binds late, the ONE
@@ -44,9 +44,10 @@ import type { DelegationContentSafety } from "../memory-engine/delegation-proven
 import { type SessionPermissionRules } from "../session-policy-store.js";
 import type { SessionStore } from "../session.js";
 import { type OnAsk } from "../tool-policy.js";
-import type { ApproverPosture, RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskEvent, TaskSpec, ToolExecuteContext, ToolSpec } from "../types.js";
+import type { PermissionMode, RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskEvent, TaskSpec, ToolExecuteContext, ToolSpec } from "../types.js";
+import { PermissionModeController } from "../mode-policy.js";
 import type { ActiveSkillScope } from "./active-skill-scope.js";
-import type { InheritedGate, Prepared, PrepareResume, RunInternals, StopForDenialLimit, ToolFaceSnapshot } from "./contracts.js";
+import type { InheritedGate, Prepared, PrepareResume, RunInternals, StopForDenialLimit, ToolFaceSnapshot, WriteFaceSeat } from "./contracts.js";
 export interface PrepareInheritedGateInput {
     /** borrowed-readonly — the REBOUND spec. Read: `shellGate` (the own doctrine the chain fold tightens), `durableApproval`
      *  (the mandate tests + the children's copy), `onAsk`/`onQuestion` (the frozen seats), `handsReadOnly` / `interactiveTools`
@@ -65,10 +66,10 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — the trusted spawn-side channel: `inheritedGate` (the LIVE half of the chain fold), `ownOrgAdmissionRef`
      *  (the same-session continuation's freeze), `delegationProvenance` (the F-012 stamp), and the identity / peer / notification
      *  seats the ctx enrichment forwards. Never mutated. */
-    internals: Pick<RunInternals, "inheritedGate" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork" | "questionFaceStripped"> | undefined;
+    internals: Pick<RunInternals, "inheritedGate" | "sessionModeSeats" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork" | "questionFaceStripped"> | undefined;
     /** borrowed-readonly — the resume leg, or undefined on a fresh one: `seed.inheritedGate` is the CHECKPOINT half of the chain
      *  fold (the trust floor the live half may only tighten), `seed.readFace` the hands-less re-park's carried section. */
-    resume: Pick<PrepareResume, "seed"> | undefined;
+    resume: Pick<PrepareResume, "seed" | "outcome"> | undefined;
     /** borrowed-readonly — the session store's fork face: `fork` / `release` are bound into the ctx's `hostSessionFork` (present
      *  only when the store can fork). */
     sessions: Pick<SessionStore, "fork" | "release">;
@@ -95,10 +96,9 @@ export interface PrepareInheritedGateInput {
     promptProfile: ToolExecuteContext["promptProfile"];
     /** borrowed-readonly — the resolved interaction posture (ctx seat; absent ⇒ no key). */
     resolvedInteractionPosture: ToolExecuteContext["interactionPosture"];
-    /** borrowed-readonly — the task's own auto-mode intent seat, screened and snapshotted before the first await. */
-    autoModeSeat: boolean;
-    /** borrowed-readonly — the task's own approver-posture seat, screened and snapshotted before the first await. */
-    approverPostureSeat: ApproverPosture | undefined;
+    /** borrowed-readonly — the task's own permission-mode key, screened and snapshotted before the first await (undefined =
+     *  declared nothing: a root runs `default`, a child inherits). */
+    permissionModeSeat: PermissionMode | undefined;
     /** borrowed-readonly — whether an execution env is wired at all (the full-shell predicate's first term). */
     handsEnabled: boolean;
     /** borrowed-readonly — the nested-usage sink the ctx forwards. */
@@ -121,8 +121,8 @@ export interface PrepareInheritedGateInput {
     }) => void;
     /** borrowed-readonly — see `requestReview`. */
     requestStopAfterTurn: () => void;
-    /** borrowed-readonly — see `requestReview`. */
-    enterPlanMode: () => void;
+    /** borrowed-readonly — see `requestReview`; a steer of the leg's mode seat into `plan`. */
+    enterPlanMode: () => Promise<void>;
     /** borrowed-readonly — the leg's reminder mark (ctx seat). */
     reminderMark: string;
     /** borrowed-readonly — the leg's disclosure counters (ctx seat; the outlets that bump them are not in this phase). */
@@ -163,8 +163,8 @@ export interface PrepareInheritedGateInput {
     observersActive: () => boolean;
     /** borrowed-readonly — LATE-BOUND: the hands mount's resolved read face (undefined until/unless hands mount). */
     resolvedReadFace: () => ContainmentFace | undefined;
-    /** borrowed-readonly — LATE-BOUND: the hands mount's resolved WRITE face (the read seat's twin). */
-    resolvedWriteFace: () => ContainmentFace | undefined;
+    /** borrowed-readonly — LATE-BOUND: the hands mount's WRITE face seat (the read seat's twin; read per call, and whether its fence is declared). */
+    resolvedWriteFace: () => WriteFaceSeat | undefined;
     /** borrowed-readonly — LATE-BOUND: the normalized deny additions in force (empty until the hands mount resolves them). */
     readDenyAdditionsNormalized: () => ReadonlyArray<{
         pattern: string;
@@ -173,7 +173,7 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — LATE-BOUND: the hands-less legs' resolved face (the carrier's second source). */
     handsLessResolvedFace: () => ContainmentFace | undefined;
     /** borrowed-readonly — LATE-BOUND: the hands-less legs' resolved WRITE face (same second source, write seat). */
-    handsLessResolvedWriteFace: () => ContainmentFace | undefined;
+    handsLessResolvedWriteFace: () => WriteFaceSeat | undefined;
     /** borrowed-readonly — LATE-BOUND: the adopted center artifact (ctx `centerArtifactDigest` / `centerSourceRevision`). */
     centerAdoption: () => {
         artifact: PromptEpochArtifact;
@@ -189,22 +189,29 @@ export interface PrepareInheritedGateResult {
     seedInheritedGate: PrepareResume["seed"]["inheritedGate"];
     /** owned — the rev-monotonic fold of the two halves' ancestor rules (live replaces per (session, principal) only at ≥ rev). */
     inheritedAncestorRules: InheritedGate["ancestorRules"];
-    /** owned — the max-rank fold of the two halves' shellGate doctrines (before the spec's own is applied). */
+    /** owned — the chain's shell floor (live or seed; the seed's migrated word), before the spec's own is applied. */
     inheritedShellGate: InheritedGate["shellGate"];
     /** owned — the live parent constraints with a fresh denial tracker attached per rebuilt decider. */
     inheritedParentConstraints: NonNullable<InheritedGate["parentConstraints"]>[number][] | undefined;
-    /** owned — the auto-mode INTENT (own seat ∨ live chain ∨ checkpoint bit); the arming site judges the other two arms. */
-    autoModeIntent: boolean;
-    /** owned — the resolved approver POSTURE (own seat, else the live chain's, else the checkpoint's); rendered, never enforced. */
-    approverPosture: ApproverPosture | undefined;
+    /** owned — the leg's live permission-mode seat: the spec's request clamped under the chain's ceiling (a parent's live
+     *  seat, or the checkpoint's recorded word), folded against the arming facts the caps phase binds later. Every mode
+     *  consumer reads `current` at its own call; the steer verb writes it. */
+    permissionMode: PermissionModeController;
+    /** owned — the leg's commit of its mode seats, called by the driver once prepare succeeded (never on a failed one):
+     *  makes this leg its SESSION's current leg and holds the leg's own engine ceiling until `legSignal` aborts, so each
+     *  move of that ceiling re-judges this leg. */
+    commitModeSeats: (legSignal: AbortSignal) => void;
+    /** owned — the leg has STOPPED (the run leg's teardown, after its loop settled): from here its children read the
+     *  session's current leg. Idempotent; a leg that never reaches it keeps answering its children itself. */
+    endModeCeiling: () => void;
     /** owned — the seed ∩ live admitted org scopes (one side absent ⇒ the other; both absent ⇒ undefined). */
     inheritedAdmittedOrgScopes: readonly string[] | undefined;
     /** owned — the prior own org verdict: checkpoint ∩ same-session ref (either alone stands; neither ⇒ undefined). */
     priorOwnOrgVerdict: OwnOrgAdmissionVerdict | undefined;
     /** owned — the monotonic governed-provenance bit for this leg. */
     orgGovernedProvenance: boolean;
-    /** owned — the spec's own shellGate tightened by the inherited doctrine. */
-    effectiveShellGate: ShellGateDoctrine;
+    /** owned — the operator's shell floor in force (the spec's, or the chain's); undefined = no floor. */
+    effectiveShellGate: ShellGateDoctrine | undefined;
     /** borrowed-mutable — THIS task's own session-rule snapshot for its children's chain. Writers (R-3): the policy-chain
      *  station's session-policy read, once per leg, when a store is wired and the task carries its own sessionId. Read by
      *  `inheritedGateForChildren` at spawn time. */

package/dist/core/runner/prepare-inherited-gate.js

@@ -5,10 +5,14 @@ import { createPreToolUseConstraintPolicy } from "../hooks.js";
 import { continuesLineage } from "../session-policy-store.js";
 import { StubExecutionEnv } from "../stub-env.js";
 import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
+import { deliverEngineNotice } from "../types.js";
+import { PermissionModeController, modeRequestAfterResume } from "../mode-policy.js";
+import { SessionModeSeats } from "./session-mode-seats.js";
+import { migrateLegacyModeSeed } from "../checkpoint-store.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { asThrownError } from "../thrown-value.js";
 export function prepareInheritedGate(input) {
-    const { spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, autoModeSeat, approverPostureSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
+    const { spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
     const seedInheritedGate = resume?.seed.inheritedGate;
     const inheritedAncestorRules = (() => {
@@ -28,19 +32,36 @@ export function prepareInheritedGate(input) {
         const extras = liveRules.filter((l) => !seedRules.some((s) => s.sessionId === l.sessionId && s.principal === l.principal));
         return [...merged, ...extras];
     })();
-    const shellGateRank = { off: 0, classify: 1, always: 2 };
-    const liveShellGate = liveInheritedGate?.shellGate;
-    const seedShellGate = seedInheritedGate?.shellGate;
-    const inheritedShellGate = liveShellGate === undefined
-        ? seedShellGate
-        : seedShellGate === undefined
-            ? liveShellGate
-            : shellGateRank[liveShellGate] >= shellGateRank[seedShellGate]
-                ? liveShellGate
-                : seedShellGate;
+    const modeSeed = migrateLegacyModeSeed(seedInheritedGate);
+    if (modeSeed.migrated !== undefined) {
+        deliverEngineNotice(deps.onNotice, {
+            code: "resume.legacy_mode_seed_migrated",
+            message: `the resumed checkpoint row carried pre-mode keys (${modeSeed.migrated.droppedKeys.join(", ")}); read once into ${modeSeed.migrated.permissionMode !== undefined ? `permissionMode: "${modeSeed.migrated.permissionMode}"` : "no mode of its own (the chain's ceiling stands)"}${modeSeed.shellGate !== undefined ? ' with the shell floor "always" kept' : ""} — the next suspend writes the one key; from 7.35.0 a row still carrying these keys is refused`,
+            detail: { migrated: { ...(modeSeed.migrated.permissionMode !== undefined ? { permissionMode: modeSeed.migrated.permissionMode } : {}), droppedKeys: [...modeSeed.migrated.droppedKeys] }, sessionId, runId },
+        });
+    }
+    const inheritedShellGate = liveInheritedGate?.shellGate ?? modeSeed.shellGate;
     const inheritedParentConstraints = attachRebuiltDenialTrackers(liveInheritedGate?.parentConstraints, deps.autoMode?.denialLimit);
-    const autoModeIntent = autoModeSeat || liveInheritedGate?.autoModeRequested === true || seedInheritedGate?.autoModeRequested === true;
-    const approverPosture = [approverPostureSeat, liveInheritedGate?.approverPosture, seedInheritedGate?.approverPosture].find((w) => w !== undefined);
+    const parentSeat = liveInheritedGate?.permissionModeCeiling;
+    const ceiling = parentSeat ?? liveInheritedGate?.permissionMode;
+    const announceModeFold = (receipt) => {
+        if (receipt.foldedBy === undefined)
+            return;
+        const requested = receipt.requested ?? "default";
+        const because = receipt.foldedBy === "operator_deny" ? "the deployment denies it for this principal" : receipt.foldedBy === "face_absent" ? "no auto-mode classifier face is wired on this deployment" : `the parent leg's mode is the ceiling a child's declaration is clamped under`;
+        const message = `permission mode "${requested}" is not available on this leg (${because}) — it runs under "${receipt.effective}"`;
+        deliverEngineNotice(deps.onNotice, { code: "config.permission_mode_unavailable", message, detail: { requested, effective: receipt.effective, by: receipt.foldedBy, sessionId, runId } });
+        if (receipt.foldedBy === "inherited_ceiling" && parentSeat !== undefined) {
+            deliverEngineNotice(deps.onNotice, { code: "config.permission_mode_unavailable", message: `${message} (a child leg, ${sessionId})`, detail: { requested, effective: receipt.effective, by: receipt.foldedBy, sessionId: parentSeat.sessionId, childSessionId: sessionId, runId } });
+        }
+    };
+    const permissionMode = new PermissionModeController(modeRequestAfterResume(permissionModeSeat, modeSeed, resume?.outcome), ceiling, { onFold: announceModeFold, ...(modeSeed.prePlanMode !== undefined ? { prePlanMode: modeSeed.prePlanMode } : {}) });
+    announceModeFold(permissionMode.receipt());
+    const { ceiling: legModeCeiling, commit: commitLegModeCeiling, end: endModeCeiling } = (internals?.sessionModeSeats ?? new SessionModeSeats()).legCeiling(sessionId, permissionMode);
+    const commitModeSeats = (legSignal) => {
+        commitLegModeCeiling();
+        parentSeat?.hold?.(permissionMode, legSignal);
+    };
     const liveAdmittedOrg = liveInheritedGate?.admittedOrgScopes;
     const seedAdmittedOrg = seedInheritedGate?.admittedOrgScopes;
     const inheritedAdmittedOrgScopes = liveAdmittedOrg === undefined ? seedAdmittedOrg : seedAdmittedOrg === undefined ? liveAdmittedOrg : liveAdmittedOrg.filter((s) => seedAdmittedOrg.includes(s));
@@ -64,8 +85,7 @@ export function prepareInheritedGate(input) {
         deps.compliancePostureResolver !== undefined ||
         inheritedOrgGoverned ||
         priorOwnOrgVerdict !== undefined;
-    const specShellGate = spec.shellGate ?? "off";
-    const effectiveShellGate = inheritedShellGate !== undefined && shellGateRank[inheritedShellGate] > shellGateRank[specShellGate] ? inheritedShellGate : specShellGate;
+    const effectiveShellGate = spec.shellGate ?? inheritedShellGate;
     const ownSessionRulesRef = {};
     const ancestorSessionRulesRef = { current: new Map() };
     const ancestorRulesNow = () => inheritedAncestorRules === undefined ? undefined : inheritedAncestorRules.map((a, i) => ancestorSessionRulesRef.current.get(i) ?? a);
@@ -92,8 +112,8 @@ export function prepareInheritedGate(input) {
     };
     const faceCheckpointState = () => faceCheckpointSection() !== undefined;
     const writeFaceCheckpointSection = () => {
-        const face = input.resolvedWriteFace() ?? input.handsLessResolvedWriteFace();
-        return face === "open" ? { face } : undefined;
+        const seat = input.resolvedWriteFace() ?? input.handsLessResolvedWriteFace();
+        return seat === undefined ? undefined : seat.inForce() === "open" ? { face: "open" } : seat.fenced ? { face: "roots" } : undefined;
     };
     const f012CheckpointState = () => (inheritedParentConstraints?.length ?? 0) > 0 ||
         seedInheritedGate?.constraintChain !== undefined ||
@@ -114,7 +134,7 @@ export function prepareInheritedGate(input) {
     const delegationSettlementRef = {};
     const delegationSettlementForChildren = () => delegationSettlementRef.current;
     const inheritedGateForChildren = () => {
-        const autoModeDecider = input.autoModeDecider();
+        const autoModeDecider = permissionMode.current === "auto" ? input.autoModeDecider() : undefined;
         const autoModeDenialTracking = input.autoModeDenialTracking();
         const autoModeArming = input.autoModeArming();
         const ancestorRules = [
@@ -142,7 +162,7 @@ export function prepareInheritedGate(input) {
                     ...(durableMandate ? { durableMandate: true } : {}),
                     ...(contentMandate ? { contentMandate: true } : {}),
                     ...(autoModeDecider !== undefined
-                        ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
+                        ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}), liveMode: legModeCeiling } }
                         : {}),
                 },
             ]
@@ -158,7 +178,7 @@ export function prepareInheritedGate(input) {
                         ...(durableMandate ? { durableMandate: true } : {}),
                         ...(contentMandate ? { contentMandate: true } : {}),
                         ...(autoModeDecider !== undefined
-                            ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
+                            ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}), liveMode: legModeCeiling } }
                             : {}),
                     },
                 ]
@@ -166,16 +186,16 @@ export function prepareInheritedGate(input) {
         ];
         return {
             ...(ancestorRules.length > 0 ? { ancestorRules } : {}),
-            ...(effectiveShellGate !== "off" ? { shellGate: effectiveShellGate } : {}),
-            ...(autoModeIntent ? { autoModeRequested: true } : {}),
-            ...(approverPosture !== undefined ? { approverPosture } : {}),
+            ...(effectiveShellGate !== undefined ? { shellGate: effectiveShellGate } : {}),
+            permissionMode: permissionMode.current,
+            permissionModeCeiling: legModeCeiling,
             ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
             admittedOrgScopes: memoryAdmittedOrgScopesRef.current,
             ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
         };
     };
     const carrierReadFace = () => input.resolvedReadFace() ?? input.handsLessResolvedFace();
-    const carrierWriteFace = () => input.resolvedWriteFace() ?? input.handsLessResolvedWriteFace();
+    const carrierWriteFace = () => (input.resolvedWriteFace() ?? input.handsLessResolvedWriteFace())?.inForce();
     const fullShellReachable = handsEnabled &&
         !(executionEnv instanceof StubExecutionEnv) &&
         spec.handsReadOnly !== true &&
@@ -281,5 +301,5 @@ export function prepareInheritedGate(input) {
             ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
         };
     };
-    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, approverPosture, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
+    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
 }

package/dist/core/runner/prepare-park-ask.d.ts

@@ -29,7 +29,7 @@ import type { RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskSpec } from "../ty
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import { type ContentAskBinding } from "./content-ask-bindings.js";
-import type { AskLane, ParkAsk, Prepared, SuspendSaga } from "./contracts.js";
+import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, SuspendSaga } from "./contracts.js";
 import type { createRuleOffersOf } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
 export interface PrepareParkAskInput {
@@ -112,10 +112,12 @@ export interface PrepareParkAskInput {
     /** borrowed-mutable — the run-scoped remote-lifecycle failure log. Writer here: a refused `suspendVM` (`push`). */
     remoteEnvFailures: Prepared["remoteEnvFailures"];
     /** borrowed-readonly — the shell-seat provenance set: the shell-running tools whose tier is the engine's shell seat's, not a
-     *  deployment mark (the risk descriptor's `shellGated` is the gated tool's membership). */
+     *  deployment mark (the risk descriptor's `shellGated` is the membership of the name the call's tier is read under). */
     shellGatedTools: ReadonlySet<string>;
-    /** borrowed-readonly — the effective shell-gate doctrine persisted on the descriptor. */
-    effectiveShellGate: ShellGateDoctrine;
+    /** borrowed-readonly — the per-tool tier, read only for the name the call's tier seat is read under (as at the gate). */
+    irreversibilityTier: IrreversibilityTier;
+    /** borrowed-readonly — the operator's shell floor (`"always"`), persisted on a shell-gated descriptor; undefined = no floor. */
+    effectiveShellGate: ShellGateDoctrine | undefined;
     /** borrowed-readonly — the EFFECTIVE durable-approval opt-in (the caller's, or the synthesized mandate scope): picks the
      *  gate kind, the scope and the ttl. */
     durableApproval: TaskSpec["durableApproval"];

package/dist/core/runner/prepare-park-ask.js

@@ -15,7 +15,7 @@ import { checkpointScopeOf } from "./checkpoint-scope.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedTtlMs } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
-import { callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
+import { callFaceSeat, firstNamed, parkedToolIdentity, parkedToolFace, ruleNamesOf } from "../tool-roster.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
         super(message, options);
@@ -26,7 +26,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -234,6 +234,7 @@ export function prepareParkAsk(input) {
                     remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
                 }
                 token = mintCheckpointToken();
+                const tierSeat = firstNamed(irreversibilityTier, ruleNamesOf(req));
                 const riskDescriptor = buildRiskDescriptor({
                     toolName: req.toolName,
                     args: parkedArgs,
@@ -241,8 +242,8 @@ export function prepareParkAsk(input) {
                     ...(shadowedRule !== undefined ? { shadowedRule } : {}),
                     ...(probeReason !== undefined ? { probeReason } : {}),
                     ...(probeCause !== undefined ? { probeCause } : {}),
-                    shellGated: shellGatedTools.has(req.toolName),
-                    shellGateDoctrine: effectiveShellGate,
+                    shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
+                    ...(effectiveShellGate !== undefined ? { shellGateDoctrine: effectiveShellGate } : {}),
                 });
                 gate =
                     safety !== undefined || rowRealApproval !== undefined
@@ -281,6 +282,7 @@ export function prepareParkAsk(input) {
                 const clearanceFacts = {
                     ...(carry?.mandated === true || storedShapeMandated ? { mandated: true } : {}),
                     ...(carry?.mandate !== undefined && !storedShapeMandated ? { mandate: carry.mandate } : {}),
+                    ...(carry?.authoredBy === "deployment" ? { authoredBy: "deployment" } : {}),
                     ...(rowRealApproval !== undefined ? { requiresRealApproval: true } : {}),
                     ...(shadowedRule !== undefined ? { persistedRuleShadowed: shadowedRule } : {}),
                     ...(askDecisionReason !== undefined ? { decisionReason: askDecisionReason } : {}),
@@ -315,7 +317,7 @@ export function prepareParkAsk(input) {
                         ...(rowRealApproval !== undefined ? { requiresRealApproval: true } : {}),
                         ...askMandateMember(clearanceFacts),
                         ...askCarryRowMembers(carry),
-                        ...ruleOffersOf(req.toolName, parkedArgs, clearanceFacts),
+                        ...ruleOffersOf(req, parkedArgs, clearanceFacts),
                         boundInputHash: boundInputHashOf(parkedArgs),
                         batchToolCallIds,
                         completedCallIds,

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -32,7 +32,10 @@ import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { ReadDenyMatcher } from "../../tools/fs/read-deny.js";
 import { type ActiveSkillScope } from "./active-skill-scope.js";
 import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, StopForDenialLimit } from "./contracts.js";
+import { type Arbitration } from "../ask-origin.js";
+import { type ModeGateSeats, type PermissionModeController } from "../mode-policy.js";
 import { createRuleOffersOf, type PermissionRuleLanes } from "./permission-rule-lanes.js";
+import type { ToolCallLike } from "../tool-registry.js";
 export interface PreparePolicyChainInput {
     /** borrowed-readonly — the REBOUND spec. Read: `sessionId` / `principal` (the session-rule read and the lanes' identity),
      *  `hooks` (spec over deps), `durableApproval` / `checkpointStore` (the mandate-park facility test and the sandbox arming's park prerequisites), `taskId` (the late-ask observer's detail).
@@ -54,6 +57,9 @@ export interface PreparePolicyChainInput {
     hostTaskId: string;
     /** borrowed-readonly — the FINAL task root (path rules resolve against it; the lanes' and the offers' root). */
     taskRootFinal: string;
+    /** borrowed-readonly — the leg's canonical write roots beyond the task root (`additionalDirectories` + advertised writable
+     *  dirs): the `acceptEdits` mode gate allows writes inside the root and these, and asks outside them all. */
+    additionalRootsCanonical: readonly string[];
     /** borrowed-readonly — the run's resolved env (path rules resolve in it; the sandbox declaration is read off it). */
     executionEnv: ExecutionEnv;
     /** borrowed-readonly — the frozen preflight: `toolPolicy` (the caller slot) and `basePolicyForResumeEdit` (the lock-aware
@@ -83,6 +89,8 @@ export interface PreparePolicyChainInput {
     handsCwdRef: CwdRef | undefined;
     /** borrowed-readonly — the compiled read-deny judge, or undefined (the offer factory's directory negative control). */
     readDenyMatcher: ReadDenyMatcher | undefined;
+    /** borrowed-readonly — the run's one notice for a person's rule store that could not be read (`ruleStoreUnreadableNotice`). */
+    announceRuleStoreSkipped: (at: "prepare" | "call") => void;
     /** borrowed-readonly — whether the question tool mounted (the lanes' question-tool exclusion). */
     questionToolMounted: boolean;
     /** borrowed-readonly — the resolved per-principal entitlements; only `forceDurableGate` (the mandate-park facility and
@@ -117,8 +125,15 @@ export interface PreparePolicyChainInput {
     hookEnvSource: unknown;
     /** borrowed-readonly — the own-hook crash reporter (the timeout seat's bad-value disclosure). */
     notifyOwnHookCrash: (err: unknown) => void;
-    /** borrowed-readonly — this task's own classifier instance, or undefined (the pass-through test's decider term). */
-    autoModeDecider: AutoModeDecider | undefined;
+    /** borrowed-readonly — LATE-BOUND: this task's own classifier instance (the pass-through test's decider term), read at chain
+     *  assembly (the arming runs after this phase, and again on a steer into `auto`). */
+    autoModeDecider: () => AutoModeDecider | undefined;
+    /** borrowed-readonly — the leg's live permission-mode seat: the mode gate policy layer and the inherited stations' arbitration
+     *  read `current` per call. */
+    permissionMode: PermissionModeController;
+    /** borrowed-readonly — the task's scratchpad directory (the mode write gate's one exemption), or undefined. */
+    scratchpadDir: string | undefined;
+    /** borrowed-readonly — the leg's live roster seat; the mode write gate reads `current` per call. */ toolRosterDeltas: NonNullable<ModeGateSeats["roster"]>;
     /** borrowed-readonly — the run's ONE typed stop for a denial-limit bound (the fallback settlements call it). */
     stopForDenialLimit: StopForDenialLimit;
     /** borrowed-readonly — the effective delegation facts; only `isDelegatedChild` (the ask source identity). */
@@ -161,6 +176,12 @@ export interface PreparePolicyChainResult {
     /** borrowed-mutable — the inherited-unavailable marker channel. Writers: the inherited arms here (mark); the gate station
      *  (the lifecycle-end sweep) and the park lane's consumers (delete on consumption). */
     inheritedUnavailableAsks: Set<string>;
+    /** owned — the inherited stations' MODE ARBITRATIONS by tool call (a release or a refusal made inside the fold,
+     *  where an ancestor's ask is arbitrated before its frozen approver). Writers: the three inherited stations here; the gate's
+     *  exit reads it onto the disposition and the gate station deletes it at the call's end. */
+    ancestorArbitrations: Map<string, Exclude<Arbitration, {
+        kind: "ask";
+    }>>;
     /** borrowed-mutable — the grant record. Writers: the inherited arms here (record a clean allow at a live approver);
      *  the gate station (consume on reuse, sweep at settlement). */
     inheritedAskGrants: Map<string, {
@@ -179,7 +200,7 @@ export interface PreparePolicyChainResult {
         isDelegatedChild?: true;
     };
     /** owned — the engine-judged risk axes for an ask, from the same resolved sources the safety tightens use. */
-    riskAxesOf: (toolName: string) => {
+    riskAxesOf: (call: Pick<ToolCallLike, "toolName" | "face">) => {
         riskAxes?: {
             irreversible?: boolean;
             egress?: boolean;
@@ -194,7 +215,7 @@ export interface PreparePolicyChainResult {
     /** owned — whether the sandbox-admission mode armed (declared isolation with its park prerequisites). */
     sandboxAdmissionArmed: boolean;
     /** owned — the NOT-CONTAINED classification: a call the declared sandbox does not contain. */
-    sandboxBoundaryCapable: (toolName: string) => boolean;
+    sandboxBoundaryCapable: (call: Pick<ToolCallLike, "toolName" | "face">) => boolean;
     /** owned — the admission disclosure's trace emitter (the gate station emits it once the fold settles). */
     emitSandboxAdmitted: (info: {
         toolCallId: string;