@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/runner/prepare-policy-chain.js

@@ -1,25 +1,38 @@
 import { policyAskClassOf } from "../ask-class.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
+import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
 import { assertHookSeatsCallable } from "../hook-seats.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, attestAskUnresolvableCause } from "../tool-policy.js";
+import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, wrapToolPolicy, attestAskUnresolvableCause } from "../tool-policy.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
 import { createActiveSkillScopePolicy } from "./active-skill-scope.js";
-import { askMandateMember, probeMandatedAsk } from "../ask-origin.js";
+import { arbitrateByMode, askMandateMember, classifyAsk } from "../ask-origin.js";
+import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
-import { headlessDenyAtFold, headlessDenyAtRecheck, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
+import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
 import { settleReadRootGrant } from "./read-root-grant.js";
 import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
 import { thrownText } from "../thrown-value.js";
+import { anyNamed, firstNamed, ruleNamesOf } from "../tool-roster.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const ancestorArbitrations = new Map();
+    const arbitrateInherited = (ask, toolCallId) => {
+        const verdict = arbitrateByMode(permissionMode.current, classifyAsk(ask, INHERITED_STATION_FACTS), { ...(ask.origin !== undefined ? { origin: ask.origin } : {}), ...(ask.mandate !== undefined ? { mandate: ask.mandate } : {}) });
+        if (verdict.kind === "ask" || verdict.kind === "accepted")
+            return undefined;
+        ancestorArbitrations.set(toolCallId, verdict);
+        if (verdict.kind === "released")
+            return { action: "allow", message: `released by the ${verdict.mode} permission mode at an inherited ancestor layer (the ${verdict.askClass} ask was not put to anyone)`, decisionReason: "mode", ...(ask.updatedInput !== undefined ? { updatedInput: ask.updatedInput } : {}) };
+        return { action: "deny", message: `refused by the ${verdict.mode} permission mode at an inherited ancestor layer (${verdict.askClass})`, decisionReason: "mode" };
+    };
     const policy = lockedPreflight.toolPolicy;
     const auditPolicyNames = (auditee) => {
         const nameGroups = toolPolicyNameSets(auditee);
@@ -220,7 +233,7 @@ export async function preparePolicyChain(input) {
         list.push({ cls, layer });
         foldAskClasses.set(toolCallId, list);
     };
-    const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || !envHandToolNames.has(toolName);
+    const sandboxBoundaryCapable = (call) => anyNamed(egressTools, ruleNamesOf(call)) || !envHandToolNames.has(call.toolName);
     const emitSandboxAdmitted = (info) => {
         emitTrace(deps.tracer, () => ({
             kind: "permission.sandbox_admitted",
@@ -244,18 +257,16 @@ export async function preparePolicyChain(input) {
         void toolName;
     };
     const callerPolicyLayer = policy !== undefined && sameInstanceAncestorCount > 0
-        ? {
-            check: async (creq, csignal) => {
-                const decision = await policy.check(creq, csignal ?? abortController.signal);
-                sharedFirstDecision.set(creq.toolCallId, decision);
-                if (sharedFirstDecision.size > SHARED_FIRST_DECISION_CAP) {
-                    const oldest = sharedFirstDecision.keys().next().value;
-                    if (oldest !== undefined)
-                        sharedFirstDecision.delete(oldest);
-                }
-                return decision;
-            },
-        }
+        ? wrapToolPolicy(policy, async (creq, csignal) => {
+            const decision = await policy.check(creq, csignal ?? abortController.signal);
+            sharedFirstDecision.set(creq.toolCallId, decision);
+            if (sharedFirstDecision.size > SHARED_FIRST_DECISION_CAP) {
+                const oldest = sharedFirstDecision.keys().next().value;
+                if (oldest !== undefined)
+                    sharedFirstDecision.delete(oldest);
+            }
+            return decision;
+        })
         : policy;
     const askSourceIdentity = () => ({
         principal: spec.principal,
@@ -266,11 +277,12 @@ export async function preparePolicyChain(input) {
             : {}),
         ...(delegation.isDelegatedChild ? { isDelegatedChild: true } : {}),
     });
-    const riskAxesOf = (toolName) => {
-        const tier = irreversibilityTier.get(toolName);
-        const negatives = axisExplicitNegatives.get(toolName);
+    const riskAxesOf = (call) => {
+        const names = ruleNamesOf(call);
+        const tier = firstNamed(irreversibilityTier, names)?.value;
+        const negatives = firstNamed(axisExplicitNegatives, names)?.value;
         const irreversible = tier === "always" || tier === "maybe" ? true : tier === "never" ? false : negatives?.irreversible;
-        const egress = egressTools.has(toolName) ? true : negatives?.egress;
+        const egress = anyNamed(egressTools, names) ? true : negatives?.egress;
         if (irreversible === undefined && egress === undefined)
             return {};
         return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
@@ -288,6 +300,8 @@ export async function preparePolicyChain(input) {
         questionToolName: ASK_USER_QUESTION_TOOL_NAME,
         onRevisionDefect: (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }),
         onDisclosure: (message) => emitTrace(deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: hostTaskId, message, ts: Date.now() })),
+        onStoreUnreadable: announceRuleStoreSkipped,
+        signal: abortController.signal,
     });
     const ruleOffersOf = createRuleOffersOf({
         laneArmed: permissionRuleLane !== undefined,
@@ -300,7 +314,9 @@ export async function preparePolicyChain(input) {
         cwdRef: handsCwdRef,
         deniesDirectoryRead: readDenyMatcher !== undefined ? (d) => readDenyMatcher.matchPath(d) !== null : undefined,
     });
-    const recheckApprovedEdit = async (pol, onAskOf, creq, edit, approved, csignal, ancestorDecider, ancestorTracker) => {
+    const recheckApprovedEdit = async (pol, onAskOf, creq, edit, approved, csignal, ancestorAutoMode) => {
+        const ancestorDecider = ancestorAutoMode?.decider;
+        const ancestorTracker = ancestorAutoMode?.denialTracking;
         let editArgs = edit;
         let settledBy = approved;
         const vetoed = (d) => {
@@ -336,7 +352,7 @@ export async function preparePolicyChain(input) {
             }
             if (re.updatedInput !== undefined)
                 editArgs = re.updatedInput;
-            const judged = await judgeInheritedClassifier({ autoMode: ancestorDecider !== undefined ? { decider: ancestorDecider, denialTracking: ancestorTracker } : undefined, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs });
+            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
                 const cleared = { ...judged.result };
                 carryEngineAttestations(judged.result, cleared);
@@ -347,14 +363,20 @@ export async function preparePolicyChain(input) {
                 return vetoed(judged.result);
             const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
             re = editAsk;
+            const editArbitrated = arbitrateInherited(re, creq.toolCallId);
+            if (editArbitrated !== undefined) {
+                const out = editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs } : editArbitrated;
+                carryPrecedingSettlement(settledBy, out);
+                return out;
+            }
             const rr = await resolveAsk({
                 toolName: creq.toolName,
                 toolCallId: creq.toolCallId,
                 args: editArgs,
-                ...ruleOffersOf(creq.toolName, editArgs, ancestorFacts(re)),
+                ...ruleOffersOf(creq, editArgs, ancestorFacts(re)),
                 message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                 ...askSourceIdentity(),
-                ...riskAxesOf(creq.toolName),
+                ...riskAxesOf(creq),
                 ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 ...askMandateMember(ancestorFacts(re)),
                 ...(re.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: re.persistedRuleShadowed } : {}),
@@ -381,7 +403,7 @@ export async function preparePolicyChain(input) {
         pc.contentMandate !== true &&
         askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
         pc.hookEnv === hookEnvSource &&
-        pc.autoMode?.decider === autoModeDecider
+        pc.autoMode?.decider === autoModeDecider()
         ? { check: () => ({ action: "allow" }) }
         : policy !== undefined && pc.policy === policy
             ? {
@@ -412,26 +434,29 @@ export async function preparePolicyChain(input) {
                             return first;
                         return mandateUnreconstructibleDeny(creq);
                     }
-                    const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call" });
+                    const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call", unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
                     if (judged.kind === "allow")
                         return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName) && !probeMandatedAsk(inheritedAsk)) {
+                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && classifyAsk(inheritedAsk, INHERITED_STATION_FACTS).row.sandboxAdmission) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return { action: "allow" };
                     }
+                    const arbitrated = arbitrateInherited(inheritedAsk, creq.toolCallId);
+                    if (arbitrated !== undefined)
+                        return arbitrated;
                     const presentedArgs = creq.args;
                     const askT0 = now();
                     const resolved = await resolveAsk({
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
-                        ...ruleOffersOf(creq.toolName, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
+                        ...ruleOffersOf(creq, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
                         message: inheritedAsk.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
-                        ...riskAxesOf(creq.toolName),
+                        ...riskAxesOf(creq),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                         ...askMandateMember(ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
@@ -449,89 +474,90 @@ export async function preparePolicyChain(input) {
                     if (resolved.action !== "allow")
                         return resolved;
                     if (resolved.updatedInput !== undefined) {
-                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode?.decider, pc.autoMode?.denialTracking);
+                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                     }
                     recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved);
                     return { action: "allow" };
                 },
             }
-            : {
-                check: async (creq, csignal) => {
-                    let decision;
-                    try {
-                        decision = await pc.policy.check(creq, csignal ?? abortController.signal);
-                    }
-                    catch (err) {
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy errored for "${creq.toolName}": ${thrownText(err)}`,
-                        };
-                    }
-                    if (decision.action !== "ask")
+            : wrapToolPolicy(pc.policy, async (creq, csignal) => {
+                let decision;
+                try {
+                    decision = await pc.policy.check(creq, csignal ?? abortController.signal);
+                }
+                catch (err) {
+                    return {
+                        action: "deny",
+                        message: `inherited parent policy errored for "${creq.toolName}": ${thrownText(err)}`,
+                    };
+                }
+                if (decision.action !== "ask")
+                    return decision;
+                if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+                    if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
                         return decision;
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
-                        if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
-                            return decision;
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
-                                `denied fail-closed (tighten-only)`,
-                        };
-                    }
-                    if (pc.durableMandate === true) {
-                        if (mandatedCallFloats(creq.toolCallId))
-                            return decision;
-                        return mandateUnreconstructibleDeny(creq);
-                    }
-                    const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                    const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput });
-                    if (judged.kind === "allow")
-                        return judged.result;
-                    if (judged.kind === "deny")
-                        return judged.result;
-                    const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName) && !probeMandatedAsk(inheritedAsk)) {
-                        recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
-                        return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
-                    }
-                    const askT0 = now();
-                    const resolved = await resolveAsk({
-                        toolName: creq.toolName,
-                        toolCallId: creq.toolCallId,
-                        args: presentedArgs,
-                        ...ruleOffersOf(creq.toolName, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                        message: inheritedAsk.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
-                        ...askSourceIdentity(),
-                        ...riskAxesOf(creq.toolName),
-                        ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                        ...askMandateMember(ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                        ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
-                        ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
-                        ruleEvidence: inheritedAskEvidence,
-                    }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
-                    void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
-                    const askWaitMs = Math.max(0, now() - askT0);
-                    if (resolved.action === "deny" && resolved.approverUnavailable === true) {
-                        if (markInheritedUnavailable(creq.toolCallId))
-                            return inheritedAsk;
-                        return markerChannelFullDeny(creq);
-                    }
-                    settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
-                    if (resolved.action !== "allow")
-                        return resolved;
-                    if (resolved.updatedInput !== undefined) {
-                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode?.decider, pc.autoMode?.denialTracking);
-                    }
-                    if (pc.preToolUse === undefined) {
-                        recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved);
-                    }
-                    if (decision.updatedInput === undefined)
-                        return resolved;
-                    const approvedWithRewrite = { ...resolved, updatedInput: decision.updatedInput };
-                    carryEngineAttestations(resolved, approvedWithRewrite);
-                    return approvedWithRewrite;
-                },
-            });
+                    return {
+                        action: "deny",
+                        message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
+                            `denied fail-closed (tighten-only)`,
+                    };
+                }
+                if (pc.durableMandate === true) {
+                    if (mandatedCallFloats(creq.toolCallId))
+                        return decision;
+                    return mandateUnreconstructibleDeny(creq);
+                }
+                const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+                const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
+                if (judged.kind === "allow")
+                    return judged.result;
+                if (judged.kind === "deny")
+                    return judged.result;
+                const { ask: inheritedAsk, fallback, mintedHere } = judged;
+                if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && classifyAsk(inheritedAsk, INHERITED_STATION_FACTS).row.sandboxAdmission) {
+                    recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
+                    return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
+                }
+                const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId);
+                if (arbitrated !== undefined)
+                    return arbitrated;
+                const askT0 = now();
+                const resolved = await resolveAsk({
+                    toolName: creq.toolName,
+                    toolCallId: creq.toolCallId,
+                    args: presentedArgs,
+                    ...ruleOffersOf(creq, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
+                    message: inheritedAsk.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                    ...askSourceIdentity(),
+                    ...riskAxesOf(creq),
+                    ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                    ...askMandateMember(ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
+                    ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
+                    ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+                    ruleEvidence: inheritedAskEvidence,
+                }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
+                void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
+                const askWaitMs = Math.max(0, now() - askT0);
+                if (resolved.action === "deny" && resolved.approverUnavailable === true) {
+                    if (markInheritedUnavailable(creq.toolCallId))
+                        return inheritedAsk;
+                    return markerChannelFullDeny(creq);
+                }
+                settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+                if (resolved.action !== "allow")
+                    return resolved;
+                if (resolved.updatedInput !== undefined) {
+                    return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
+                }
+                if (pc.preToolUse === undefined) {
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved);
+                }
+                if (decision.updatedInput === undefined)
+                    return resolved;
+                const approvedWithRewrite = { ...resolved, updatedInput: decision.updatedInput };
+                carryEngineAttestations(resolved, approvedWithRewrite);
+                return approvedWithRewrite;
+            }));
     const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
     const rewriteEmitterIndex = new Map();
     const rewriteCapableChain = [
@@ -544,17 +570,16 @@ export async function preparePolicyChain(input) {
         if (policy !== undefined && pc.policy === policy)
             sameInstanceAdapterIndices.add(j + callerSlotOffset);
     });
-    const instrumentedChain = rewriteCapableChain.map((layer, idx) => ({
-        check: async (creq, csignal) => {
-            const d = await layer.check(creq, csignal);
-            if (d.updatedInput !== undefined)
-                rewriteEmitterIndex.set(creq.toolCallId, idx);
-            if (d.action === "ask") {
-                recordFoldAskClass(creq.toolCallId, idx < callerSlotOffset ? policyAskClassOf(policy) : "mandate", idx < callerSlotOffset ? "caller_policy" : "ancestor_constraint");
-            }
-            return d;
-        },
+    const instrumentedChain = rewriteCapableChain.map((layer, idx) => wrapToolPolicy(layer, async (creq, csignal) => {
+        const d = await layer.check(creq, csignal);
+        if (d.updatedInput !== undefined)
+            rewriteEmitterIndex.set(creq.toolCallId, idx);
+        if (d.action === "ask") {
+            recordFoldAskClass(creq.toolCallId, idx < callerSlotOffset ? policyAskClassOf(policy) : "mandate", idx < callerSlotOffset ? "caller_policy" : "ancestor_constraint");
+        }
+        return d;
     }));
+    const modeGateLayer = createModeGatePolicy(permissionMode, { env: executionEnv, rootPath: taskRootFinal, acceptDirs: [taskRootFinal, ...additionalRootsCanonical], roster: toolRosterDeltas, readOnlyDeclared: (name) => mountedToolDeclaresReadOnly(tools, name), ...(scratchpadDir !== undefined ? { exemptDirs: [scratchpadDir] } : {}) });
     const policyLayers = [
         ...narrowingLayers,
         ...instrumentedChain,
@@ -562,76 +587,74 @@ export async function preparePolicyChain(input) {
     ];
     const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy()];
     const guardedPolicyLayers = rewriteCapableLayers
-        ? [...integrityGuardLayers, ...policyLayers, ...integrityGuardLayers]
-        : [...integrityGuardLayers, ...policyLayers];
+        ? [...integrityGuardLayers, ...policyLayers, modeGateLayer, ...integrityGuardLayers]
+        : [...integrityGuardLayers, ...policyLayers, modeGateLayer];
     const foldedPolicy = guardedPolicyLayers.length === 1 ? guardedPolicyLayers[0] : combinePolicies(...guardedPolicyLayers);
     const effectivePolicy = foldedPolicy !== undefined && rewriteCapableLayers
-        ? {
-            check: async (req, signal) => {
-                let decision;
-                try {
-                    decision = await foldedPolicy.check(req, signal);
-                }
-                catch (err) {
-                    rewriteEmitterIndex.delete(req.toolCallId);
-                    throw err;
-                }
-                const emitterIdx = rewriteEmitterIndex.get(req.toolCallId);
+        ? wrapToolPolicy(foldedPolicy, async (req, signal) => {
+            let decision;
+            try {
+                decision = await foldedPolicy.check(req, signal);
+            }
+            catch (err) {
                 rewriteEmitterIndex.delete(req.toolCallId);
-                if (decision.action === "deny" || decision.updatedInput === undefined)
-                    return decision;
-                const recheckPrefix = rewriteCapableChain.slice(0, emitterIdx ?? rewriteCapableChain.length);
-                const postEmitterSameInstanceAdapters = [];
-                if (emitterIdx !== undefined && emitterIdx > 0) {
-                    for (let i = emitterIdx + 1; i < rewriteCapableChain.length; i++) {
-                        if (sameInstanceAdapterIndices.has(i))
-                            postEmitterSameInstanceAdapters.push(rewriteCapableChain[i]);
-                    }
+                throw err;
+            }
+            const emitterIdx = rewriteEmitterIndex.get(req.toolCallId);
+            rewriteEmitterIndex.delete(req.toolCallId);
+            if (decision.action === "deny" || decision.updatedInput === undefined)
+                return decision;
+            const recheckPrefix = rewriteCapableChain.slice(0, emitterIdx ?? rewriteCapableChain.length);
+            const postEmitterSameInstanceAdapters = [];
+            if (emitterIdx !== undefined && emitterIdx > 0) {
+                for (let i = emitterIdx + 1; i < rewriteCapableChain.length; i++) {
+                    if (sameInstanceAdapterIndices.has(i))
+                        postEmitterSameInstanceAdapters.push(rewriteCapableChain[i]);
                 }
-                const recheckLayers = [...recheckPrefix, ...postEmitterSameInstanceAdapters];
-                const finalReq = { ...req, args: decision.updatedInput };
-                let asked;
-                const revalidated = {};
-                try {
-                    for (const layer of recheckLayers) {
-                        const d = await layer.check(finalReq, signal);
-                        if (d.action === "deny") {
-                            const carried = { ...d, updatedInput: decision.updatedInput };
-                            carryEngineAttestations(d, carried);
-                            carryPrecedingSettlement(decision, carried);
-                            return carried;
-                        }
-                        if (d.updatedInput !== undefined) {
-                            return {
-                                action: "deny",
-                                message: "policy required a rewrite during final-form re-check — the arguments that would execute were not accepted as-is (fail-closed; rewrite chains are not iterated to a fixpoint)",
-                                updatedInput: decision.updatedInput,
-                            };
-                        }
-                        if (d.action === "ask" && asked === undefined)
-                            asked = d;
-                        carryEngineAttestations(d, revalidated);
+            }
+            const recheckLayers = [...recheckPrefix, ...postEmitterSameInstanceAdapters];
+            const finalReq = { ...req, args: decision.updatedInput };
+            let asked;
+            const revalidated = {};
+            try {
+                for (const layer of recheckLayers) {
+                    const d = await layer.check(finalReq, signal);
+                    if (d.action === "deny") {
+                        const carried = { ...d, updatedInput: decision.updatedInput };
+                        carryEngineAttestations(d, carried);
+                        carryPrecedingSettlement(decision, carried);
+                        return carried;
                     }
+                    if (d.updatedInput !== undefined) {
+                        return {
+                            action: "deny",
+                            message: "policy required a rewrite during final-form re-check — the arguments that would execute were not accepted as-is (fail-closed; rewrite chains are not iterated to a fixpoint)",
+                            updatedInput: decision.updatedInput,
+                        };
+                    }
+                    if (d.action === "ask" && asked === undefined)
+                        asked = d;
+                    carryEngineAttestations(d, revalidated);
                 }
-                finally {
-                    rewriteEmitterIndex.delete(req.toolCallId);
-                }
-                if (asked !== undefined && decision.action === "allow") {
-                    const surfaced = { ...asked, updatedInput: decision.updatedInput };
-                    carryEngineAttestations(asked, surfaced);
-                    return surfaced;
-                }
-                if (decision.action === "allow") {
-                    const owned = { ...decision };
-                    carryEngineAttestations(decision, owned);
-                    carryEngineAttestations(revalidated, owned);
-                    return owned;
-                }
-                return decision;
-            },
-        }
+            }
+            finally {
+                rewriteEmitterIndex.delete(req.toolCallId);
+            }
+            if (asked !== undefined && decision.action === "allow") {
+                const surfaced = { ...asked, updatedInput: decision.updatedInput };
+                carryEngineAttestations(asked, surfaced);
+                return surfaced;
+            }
+            if (decision.action === "allow") {
+                const owned = { ...decision };
+                carryEngineAttestations(decision, owned);
+                carryEngineAttestations(revalidated, owned);
+                return owned;
+            }
+            return decision;
+        })
         : foldedPolicy;
-    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions };
+    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
 }
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -1,3 +1,28 @@
+/**
+ * PrepareTask's PROTOCOL-TOOLS phase, verbatim from the driver: the MCP materialization
+ * with its operator face (fail-open warnings once per session, the intake drops, the announce-lane prune), the
+ * reserved-name refusal, the roster push through the large-result wrapper, the RefreshMcpTools seam with its
+ * refresh closure, the two run-time seats the rebuild closures reach (`rebuildHarnessToolsRef`,
+ * `contentOriginWrapRef`) and the gate-armed honesty flag, the protocol-SHARED axis fold, and the A2A twin
+ * (materialize, warnings straight to the sink, its own reserved-name refusal, the same fold). The interface
+ * is the dependency list the segment had implicitly.
+ *
+ * ASYNC PHASE: the segment awaits the two materializers, exactly where the driver awaited them; the phase adds
+ * no yield BEFORE the first of those awaits. Read-stability of the host handles for the call:
+ * {@link RunInternals} (`@contract prepare.deps-read-stable`).
+ *
+ * The handles and the rollback stack. This phase is the first that acquires a handle INSIDE
+ * its body: the driver used to see `mcp` / `a2a` only because they were hoisted `let`s at function scope, so
+ * its catch could dispose a half-acquired pair. Those hoists are gone. The moment a materializer returns a
+ * real handle the phase pushes its `dispose` onto the driver-owned `rollback`; a prepare that throws AFTER
+ * this phase reaches the driver's catch, whose `unwindAll` disposes the peers, then the clients — the reverse
+ * acquisition order the hoisted legs kept, each bounded and reported. The two reserved-name arms only THROW:
+ * the release of what they refused is the rollback entry, called exactly once by that unwind (they used to
+ * dispose inline as well — a hoist-era leftover that leaned on dispose being idempotent; the transcript pins
+ * the single call). On the success path the stack is committed and the handles belong to `Prepared` (the
+ * Runner's finish releases them).
+ */
+import type { ToolMarkSource } from "../ask-origin.js";
 import type { AgentTool } from "../../internal/harness.js";
 import { type MaterializedMcp, type McpDroppedTool, type McpReconnectResult } from "../mcp.js";
 import { type MaterializedA2a } from "../a2a.js";
@@ -59,6 +84,9 @@ export interface PrepareProtocolToolsInput {
     irreversibleTools: Set<string>;
     /** borrowed-mutable — the egress set, added to by the fold (tighten-only; the effect:"write" invariant). */
     egressTools: Set<string>;
+    /** borrowed-mutable — WHO marked each tool (the safety scan's map); the protocol fold adds its own source word per
+     *  axis it tightens (`mcp_annotation` for a server's self-report, `a2a_default` for a peer skill's egress default). */
+    toolMarkSources: Map<string, Set<ToolMarkSource>>;
     /** borrowed-readonly — the run's abort controller; its `signal` rides into the A2A materialization. */
     abortController: Pick<AbortController, "signal">;
     /** borrowed-mutable — the driver-owned prepare-failure stack; this phase pushes one entry per REAL handle

package/dist/core/runner/prepare-protocol-tools.js

@@ -11,7 +11,14 @@ import { mintNamespacePrefix } from "../protocol-naming.js";
 import { applyMcpToolFaces } from "./tool-face-overlay.js";
 import { thrownText } from "../thrown-value.js";
 export async function prepareProtocolTools(input) {
-    const { lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, abortController, rollback } = input;
+    const { lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, toolMarkSources, abortController, rollback } = input;
+    const markedBy = (name, source) => {
+        const set = toolMarkSources.get(name);
+        if (set !== undefined)
+            set.add(source);
+        else
+            toolMarkSources.set(name, new Set([source]));
+    };
     const overPeer = (lockedPreflight.mcp ?? []).find((s) => s.name.length > TOOL_WIRE_NAME_MAX_CHARS);
     if (overPeer !== undefined) {
         throw Object.assign(new Error(`MCP server name ${JSON.stringify(overPeer.name.slice(0, 40) + "…")} is ${overPeer.name.length} characters; a peer rides every roster row of its tools and the roster's bound on a name is ${TOOL_WIRE_NAME_MAX_CHARS}.`), { code: "config.tool_name_too_long" });
@@ -123,10 +130,12 @@ export async function prepareProtocolTools(input) {
         }, { source: "builtin", mountedBy: "optional" });
     }
     const foldProtocolAxes = (axes, protocolLabel) => {
+        const source = protocolLabel === "A2A" ? "a2a_default" : "mcp_annotation";
         for (const axis of axes) {
             if (axis.irreversibility === "always") {
                 irreversibilityTier.set(axis.name, "always");
                 irreversibleTools.add(axis.name);
+                markedBy(axis.name, source);
             }
             if (axis.irreversibility === "never") {
                 axisExplicitNegatives.set(axis.name, { ...axisExplicitNegatives.get(axis.name), irreversible: false });
@@ -141,9 +150,10 @@ export async function prepareProtocolTools(input) {
                     throw e;
                 }
                 egressTools.add(axis.name);
+                markedBy(axis.name, source);
             }
-            if (!toolEffects.has(axis.name))
-                toolEffects.set(axis.name, axis.effect ?? "write");
+            if (axis.effect !== undefined && !toolEffects.has(axis.name))
+                toolEffects.set(axis.name, axis.effect);
         }
     };
     foldProtocolAxes(mcp.toolAxes, "MCP");