@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/sensitive-path-policy.d.ts

@@ -11,7 +11,9 @@ import type { ToolPolicy } from "./tool-policy.js";
  *
  * @contract sensitive_paths.agent_config_tier_is_shared — the write deny set's agent-configuration
  * block IS the read face's `agent-config` tier, row for row: one table, two judges, and the two faces
- * cannot drift into disagreeing about which files are an agent's own configuration. The CONFIGURATION
+ * cannot drift into disagreeing about which files are an agent's own configuration. The block carries each
+ * row's RUN: the read rows are home-anchored (a project's same-named file reads), while this write set judges
+ * each run anywhere, so a project's own configuration file stays a refused write here. The CONFIGURATION
  * DIRECTORIES (`.claude`, `.sema`) are on neither face's deny side — their write guard is ASK
  * severity, where an approver or a persisted allow rule can clear it. Their `hooks/` and `agents/`
  * sub-directories are the two exceptions and they are NOT part of this mirror: a hook script is an executable
@@ -30,7 +32,7 @@ export declare function agentConfigDenyPatterns(): readonly string[];
  * globs): each pattern is a `/`-separated run of path SEGMENTS; `*` matches any run of non-slash chars
  * within one segment and is the ONLY metacharacter (everything else, `?` included, is literal); the run
  * may match ANYWHERE in the canonical path (so `.ssh` covers `~/.ssh/…` and any other `.ssh` directory —
- * home-anchoring like `~/` is NOT part of the syntax, do not prefix it). A pattern that reduces to zero
+ * home-anchoring like `~/` is NOT part of the syntax: a pattern opening with it is refused at wiring). A pattern that reduces to zero
  * segments is a wiring ERROR (it would guard nothing) and throws rather than being dropped.
  * Remember this policy guards WRITES only; reads are out of scope by design.
  *

package/dist/core/sensitive-path-policy.js

@@ -1,12 +1,13 @@
 import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
 import { canonicalizeTarget, expandHomeTilde, isAbsoluteForFamily, isWinFormPath, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
-import { compileSegmentPattern, matchSegmentPatterns, READ_FACE_BUILTIN_DENY_TABLE } from "../tools/fs/read-deny.js";
+import { compileSegmentPattern, matchSegmentPatterns, READ_FACE_BUILTIN_DENY_TABLE, readDenyPatternRun } from "../tools/fs/read-deny.js";
 import { isProtectedWrite, protectivePathTargetOf } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
 import { symlinkChainHops } from "./path-identity.js";
+import { toolNameSetHas } from "./tool-roster.js";
 export function agentConfigDenyPatterns() {
-    return READ_FACE_BUILTIN_DENY_TABLE.filter((row) => row.tier === "agent-config").map((row) => row.pattern);
+    return READ_FACE_BUILTIN_DENY_TABLE.filter((row) => row.tier === "agent-config").map((row) => readDenyPatternRun(row.pattern).run);
 }
 export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".env",
@@ -95,6 +96,11 @@ export function relativeUnderRoot(targetKey, rootKey) {
 function compilePatterns(patterns) {
     const out = [];
     for (const raw of patterns) {
+        const { homeAnchored, run } = readDenyPatternRun(raw);
+        if (homeAnchored) {
+            throw new Error(`createSensitivePathPolicy: pattern ${JSON.stringify(raw)} opens with the home word "~", which this write list does not place — its patterns are judged anywhere in the real target. ` +
+                `Spell the segments without it (${JSON.stringify(run)}), which covers the home's file and every same-named one.`);
+        }
         const compiled = compileSegmentPattern(raw, CASE_INSENSITIVE_FS ? "unicode" : "none");
         if (compiled === null) {
             throw new Error(`createSensitivePathPolicy: pattern ${JSON.stringify(raw)} contains no path segments and would guard nothing. ` +
@@ -111,55 +117,59 @@ export function createSensitivePathPolicy(opts) {
     const compiled = compilePatterns(opts.patterns);
     const dataRootPaths = dataRootSpellings(opts.dataRoot);
     const guardedByName = opts.tools !== undefined ? new Set(opts.tools) : undefined;
+    const family = (cwd) => pathFamilyOf({ root: opts.rootPath, cwd: cwd ?? opts.env.cwd });
+    const judgeTarget = async (path, fam, base, signal) => {
+        const canon = await canonicalizeTarget(opts.env, path, signal, fam, base);
+        if (!canon.ok)
+            return { kind: "unresolved", unresolvedSymlink: canon.unresolvedSymlink === true, cause: canon.refused ?? canon.message };
+        let relative = null;
+        for (const rootKey of await canonicalDataRootKeys(opts.env, dataRootPaths, signal)) {
+            relative = relativeUnderRoot(canon.key, rootKey);
+            if (relative !== null)
+                break;
+        }
+        if (relative === "")
+            return { kind: "clear" };
+        const hit = matchSensitive(relative ?? canon.key, compiled, canon.aliasResolved === true);
+        if (hit)
+            return { kind: "hit", pattern: hit, via: "target" };
+        if (relative === null) {
+            for (const hop of await symlinkChainHops(opts.env, path, signal, fam, base)) {
+                const viaHop = matchSensitive(hop, compiled, false);
+                if (viaHop)
+                    return { kind: "hit", pattern: viaHop, via: "chain" };
+            }
+        }
+        return { kind: "clear" };
+    };
     return {
+        ...(compiled.length > 0 ? { writeTargetGuard: async (target, signal) => (await judgeTarget(target, family(undefined), undefined, signal)).kind !== "clear" } : {}),
         async check(req, signal) {
             if (compiled.length === 0)
                 return { action: "allow" };
-            if (guardedByName !== undefined ? !guardedByName.has(req.toolName) : !isProtectedWrite(req))
+            if (guardedByName !== undefined ? !toolNameSetHas(guardedByName, req) : !isProtectedWrite(req))
                 return { action: "allow" };
             const protective = protectivePathTargetOf(req);
             const path = writeTargetPath(req, protective);
             if (typeof path !== "string" || path.length === 0)
                 return { action: "allow" };
-            const canon = await canonicalizeTarget(opts.env, path, signal, pathFamilyOf({ root: opts.rootPath, cwd: req.cwd ?? opts.env.cwd }), pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }));
-            if (!canon.ok) {
+            const judged = await judgeTarget(path, family(req.cwd), pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }), signal);
+            if (judged.kind === "unresolved") {
                 return {
                     action: "deny",
-                    message: canon.unresolvedSymlink
+                    message: judged.unresolvedSymlink
                         ? `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`
-                        : `write to "${path}" is blocked: its target could not be resolved on this tree (${canon.refused ?? canon.message}), so the sensitive-path guard cannot judge it`,
+                        : `write to "${path}" is blocked: its target could not be resolved on this tree (${judged.cause}), so the sensitive-path guard cannot judge it`,
                     decisionReason: "safety",
                 };
             }
-            let relative = null;
-            for (const rootKey of await canonicalDataRootKeys(opts.env, dataRootPaths, signal)) {
-                relative = relativeUnderRoot(canon.key, rootKey);
-                if (relative !== null)
-                    break;
-            }
-            const judged = relative ?? canon.key;
-            if (relative === "")
-                return { action: "allow" };
-            const hit = matchSensitive(judged, compiled, canon.aliasResolved === true);
-            if (hit) {
+            if (judged.kind === "hit") {
                 return {
                     action: "deny",
-                    message: `write to "${path}" is blocked: its real target resolves onto the guarded sensitive path "${hit}"`,
+                    message: judged.via === "target" ? `write to "${path}" is blocked: its real target resolves onto the guarded sensitive path "${judged.pattern}"` : `write to "${path}" is blocked: its symlink chain passes through the guarded sensitive path "${judged.pattern}"`,
                     decisionReason: "safety",
                 };
             }
-            if (relative === null) {
-                for (const hop of await symlinkChainHops(opts.env, path, signal, pathFamilyOf({ root: opts.rootPath, cwd: req.cwd ?? opts.env.cwd }), pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }))) {
-                    const viaHop = matchSensitive(hop, compiled, false);
-                    if (viaHop) {
-                        return {
-                            action: "deny",
-                            message: `write to "${path}" is blocked: its symlink chain passes through the guarded sensitive path "${viaHop}"`,
-                            decisionReason: "safety",
-                        };
-                    }
-                }
-            }
             return { action: "allow" };
         },
     };

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -301,7 +301,7 @@ export async function checkpointStoreContract(make, runAssertion) {
         const stored = (await store.get(bitless.token)).pendingAction;
         assert.equal("hasBidiControls" in stored, false, "projection backfill must not write back to the row");
     });
-    run("design/388 B18 × B6 identity + face group: a row's seven optional members (capabilityId/contractId/shapeDigest/implementationRevision/rosterDigest + family/pathTarget) survive the round-trip verbatim; an absent group stays absent", async () => {
+    run("design/388 B18 × B6 identity + face group: a row's eight optional members (capabilityId/contractId/shapeDigest/implementationRevision/rosterDigest + family/pathTarget/names) survive the round-trip verbatim; an absent group stays absent", async () => {
         const store = make();
         const carried = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "id-carried" });
         const group = {
@@ -312,6 +312,7 @@ export async function checkpointStoreContract(make, runAssertion) {
             rosterDigest: "sha256:fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210",
             family: "file-write",
             pathTarget: { param: "destination", aliases: ["path"], access: "create", skillScopeEligible: true },
+            names: ["AcmeWrite", "acme_write"],
         };
         Object.assign(carried.pendingAction, group);
         const bare = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "id-bare" });

package/dist/core/task-event.d.ts

@@ -370,7 +370,7 @@ export type TaskEvent = ({
      * document/worktree/todo/task/task-list/task-output/task-stop/agent/fork/workflow-run/web-fetch/
      * web-search/cron-create/cron-delete/cron-list/tool-search/repo-map/monitor-start/
      * enter-plan-mode/exit-plan-mode/report-findings/schedule-wakeup/send-message/agent-transcript/
-     * a2a/path_not_in_root/readonly_out_of_root), surfaced on the live wire so a CC-faithful shell
+     * a2a/path_not_in_root/readonly_out_of_root/read_unestablished), surfaced on the live wire so a CC-faithful shell
      * renders rich cards (red/green diff, stdout panes, file cards) without re-parsing the
      * model-facing string. Absent when the tool carries no card shape or when the serialized card
      * exceeds the size bound (omitted whole; a consumer falls back to `output`).

package/dist/core/task-result.d.ts

@@ -622,7 +622,7 @@ export interface TaskResult {
      * posture rides every leg that continues this work, not just the delegation subtree.
      *
      * **In-presence condition:** present iff non-empty. Built-in entries are never listed — they are the
-     * DEPLOYMENT's own selection (off by default), re-compiled per leg and reported on its wiring
+     * DEPLOYMENT's own selection (the default tiers unless it says otherwise), re-compiled per leg and reported on its wiring
      * manifest ({@link import("./wiring-manifest.js").WiringManifest.readDeny}). Same terminal coverage as
      * {@link effectiveReadFace}: rides any terminal of a leg that ran; absent on prepare failures.
      *

package/dist/core/task-spec.d.ts

@@ -4,6 +4,7 @@
  * beside it in `task-limits.ts`; the terminal record it produces in `task-result.ts`. Layer 0
  * vocabulary; `types.ts` re-exports the three, so no consumer's import changes.
  */
+import type { PermissionMode } from "./ask-origin.js";
 import type { TSchema } from "typebox";
 import type { ThinkingLevel } from "../internal/harness.js";
 import type { ActorAssertion, Model, ResilienceOptions } from "../internal/llm.js";
@@ -31,15 +32,12 @@ export type ImageInput = {
     url: string;
 };
 /** A single self-contained task with its full configuration. */
-/** The shell-gate doctrine vocabulary — {@link TaskSpec.shellGate}'s value set, and the word the engine persists on a
- *  shell-gated ask (`RiskDescriptor.shellGateDoctrine`) and folds across a delegation chain (max-rank: `off` <
- *  `classify` < `always`). One closed set; every seat that names a doctrine spells it through this alias. */
-export type ShellGateDoctrine = "off" | "classify" | "always";
-/** The approval POSTURE a host declares for a task — {@link TaskSpec.approverPosture}'s value set: a
- *  statement about who answers this run's approval cards, never an instruction to the gate. One word
- *  today (`"bypass"` — the host answers every card itself, automatically). The engine only RENDERS it,
- *  so adding a word here changes what the model is told and nothing else. */
-export type ApproverPosture = "bypass";
+/** The shell-gate FLOOR vocabulary — {@link TaskSpec.shellGate}'s value set, the word the engine persists on a
+ *  shell-gated ask (`RiskDescriptor.shellGateDoctrine`) and carries down a delegation chain. One value: `"always"`
+ *  (every shell command is confirmed, under every permission mode — an operator's mandate). The shape tier itself
+ *  is installed on every full shell regardless; what a permission mode does with the resulting ask is the gate's
+ *  arbitration, never a doctrine word. */
+export type ShellGateDoctrine = "always";
 export interface TaskSpec {
     taskId?: string;
     /** The instruction / latest user message for this turn. */
@@ -791,8 +789,8 @@ export interface TaskSpec {
     /**
      * Interactive read-boundary whitelist (ruled 2026-08-05, both-arms ruling, arm A): extra directories
      * the READ faces may access — and nothing else. Joins the containment allowlist of the read-only
-     * tools (read_file / grep / glob / repo_map / `bash_readonly`) and the `shellGate:"classify"`
-     * read-boundary (so a provably read-only command like `head <dir>/settings.json` auto-allows instead
+     * tools (read_file / grep / glob / repo_map / `bash_readonly`) and the shell read station's
+     * boundary (so a provably read-only command like `head <dir>/settings.json` auto-allows instead
      * of asking on every call), but is NEVER admitted by the write faces (edit_file / write_file /
      * notebook_edit refuse these paths exactly as before). Use `additionalDirectories` when the task
      * should also write there. Same canonicalization and fail-closed skip rules as
@@ -805,7 +803,7 @@ export interface TaskSpec {
      * design/199 件B — TASK-layer ADDITIONS to the built-in sensitive-path READ deny set
      * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}). Judged by the
      * structured read faces (Read/Grep/Glob/RepoMap, their traversals, the compaction attachment reader) and
-     * by the shell READ STATION under every doctrine — the full shell (`Bash`, `Monitor`, whatever
+     * by the shell READ STATION under every mode — the full shell (`Bash`, `Monitor`, whatever
      * {@link shellGate} says) and the `bash_readonly` shell mounted by {@link handsReadOnly} alike: a
      * deny-listed shell read is REFUSED at the gate (`deniedBy: "read_boundary"`), never asked, with the same
      * sentence the structured faces refuse with — one deny judge for every read face — in BOTH containment
@@ -814,8 +812,8 @@ export interface TaskSpec {
      * {@link RunnerDeps.readDenyPatterns}; `[]` ≡ absent (union identity); NOTHING at the task layer
      * can remove a built-in — the one removal channel is the DEPLOYMENT's built-in configuration
      * ({@link RunnerDeps.readDenyBuiltinTiers} / {@link RunnerDeps.readDenyBuiltinExclude}, #245
-     * revision of D-4), which no TaskSpec key reaches — and that half is OFF by default, so on an
-     * unconfigured deployment the entries here are the WHOLE judged set. Bad entry shapes refuse loudly at prepare
+     * revision of D-4), which no TaskSpec key reaches (an unconfigured deployment judges the default tiers,
+     * {@link import("../tools/fs/read-deny.js").READ_DENY_DEFAULT_TIERS}). Bad entry shapes refuse loudly at prepare
      * (#123). The write faces are untouched.
      */
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
@@ -890,87 +888,41 @@ export interface TaskSpec {
      */
     enableFork?: boolean;
     /**
-     * design/80 D-2 (part-1): gate the injected `bash` hand tool, since a full shell can run egress (`curl`,
-     * `git push`) and irreversible (`rm`) commands that the per-tool egress/irreversibility marks otherwise miss.
-     * The §4-OQ4 doctrine: shell-in-presence ⇒ always-gate UNLESS a real parsed classifier is wired.
-     *  - `"off"` (default): `bash` is unmarked — the current behavior (subject only to the deployment's policy).
-     *  - `"always"`: every `bash` command tightens to an `irreversible_ask` durable suspend (fail-closed; the
-     *    correct default for an unattended/supervisor deployment with no classifier).
-     *  - `"classify"`: mark `bash` `irreversibility:"maybe"` with {@link import("../tools/fs/index.js").bashReversibilityProbe}
-     *    — the SHAPE classifier alone: a provably-benign single allowlisted read-only command (no operators)
-     *    auto-allows; everything else (writes, egress, pipes, unknown commands) tightens to ask. WHERE a command
-     *    reads is not this doctrine's question under any value: the gate's shell read station judges every
-     *    shell call's read candidates against the deny set and the containment roots (a deny-listed read is
-     *    refused, an out-of-root read is a mandated ask) whether `shellGate` is `"off"`, `"classify"` or
-     *    `"always"`. An egress command (e.g. `curl`) suspends under
-     *    the IRREVERSIBLE axis (the shell mark is irreversibility, not egress) — the kind is non-budgetable either
-     *    way, so the budget resolver still never auto-approves it; the axis label is informational.
-     *    NOT unconditional: a POSITIVE per-tool mark on the shell tool keeps its seat — an explicit
-     *    `irreversibility:"always"` is never downgraded (the tier combine is tighten-only) and an explicit
-     *    `"maybe"` keeps its own probe (a probe-less explicit `"maybe"` stays fail-closed ask; the doctrine's
-     *    generic probe installs only on doctrine-owned seats). An explicit `"never"` is NOT a mark — the
-     *    doctrine governs that seat as if unmarked.
-     * No effect under `handsReadOnly` (that mounts `bash_readonly`, already allowlisted) or with no execution env.
-     * **Re-supply on resume:** like `toolPolicy`/`tools`/`durableApproval`, `shellGate` is part of the resume
-     * task config — a resume that omits it leaves the resumed run's SUBSEQUENT `bash` calls ungated (the approved
-     * pending call itself runs once, having been adjudicated). Re-pass the same value the original task used.
+     * The OPERATOR's shell floor: `"always"` ⇒ every `bash` / `Monitor` command is a confirmed ask (an
+     * `operator_forced` ask — kept under `bypassPermissions`, not settled by `dontAsk`; a standing allow rule never
+     * clears it). Absent ⇒ no floor: the shape tier the engine installs on every full shell (a provably read-only
+     * single command runs, everything else asks) is arbitrated by the task's {@link permissionMode}. The retired
+     * values `"off"` / `"classify"` are refused at the door (`config.shell_gate_value_retired`): the tier is no longer a
+     * doctrine a caller chooses, and the read boundary is judged on every shell call under every mode. A positive
+     * per-tool mark keeps its seat (an explicit `irreversibility:"always"` is never downgraded). No effect under
+     * `handsReadOnly` or with no execution env. Re-supplied on resume like `toolPolicy` (a checkpoint carries the
+     * chain's floor). Delegation: the floor travels the inherited-gate lane; a child cannot lift it.
      */
     shellGate?: ShellGateDoctrine;
     /**
-     * The caller's AUTO-MODE INTENT for this task — the "user turned auto on" half of the classifier
-     * arming (CC 2.1.250 polarity: auto mode is something the USER enables at the permission-mode
-     * seat, and something an ORGANIZATION may only DENY; it is never something an organization grants
-     * on a user's behalf). The engine arms its per-run classifier only when ALL THREE hold:
-     *  - this seat is `true` (intent),
-     *  - {@link RunnerDeps.autoMode} is present (the deployment is classifier-capable — the trust gate;
-     *    classifier RULES still enter ONLY through that face, never through this seat), and
-     *  - {@link RuntimeCaps.autoMode} is not `false` (the per-principal DENY bit; ABSENT is NOT a denial).
+     * The task's PERMISSION MODE — the ONE key that says how the engine answers a surviving ask (six words,
+     * {@link import("./ask-origin.js").PERMISSION_MODES}; spelled as the wire spells it). ROOT task absent ⇒
+     * `"default"`; an engine-spawned CHILD absent ⇒ its parent's effective mode (a child's own declaration is
+     * adopted only where the reference implementation's rank table admits it under the parent's — a folded
+     * declaration is disclosed on `wiring_manifest.permissionMode.foldedBy: "inherited_ceiling"` and announced,
+     * never silent). A value outside the set is refused at the door (`config.permission_mode_invalid`).
      *
-     * **Ownership** — same split as {@link shellGate}: the service layer TRANSLATES the effective
-     * permission mode into this seat (at the same point it translates the mode into `shellGate`);
-     * core only CONSUMES it. Absent ⇒ not an auto-mode task (byte-identical to the pre-seat shape:
-     * asks flow the original chain). Only the literal `true` is a value here: any other present value
-     * (`false`, `"true"`, `1`) is refused at the door (`config.auto_mode_requested_invalid`) rather than
-     * read as either polarity — a marshalled string must never silently arm, or silently disarm, a
-     * classifier.
+     * What the mode DOES is one table and one predicate ({@link import("./ask-origin.js").MODE_ARBITRATION},
+     * {@link import("./ask-origin.js").arbitrateByMode}) read after every rule, tighten and classifier station:
+     * `bypassPermissions` releases every ask but the immune classes (an explicit ask rule, a hook's ask, the
+     * question tool, an unverifiable recursive delete, an org rule, an operator's forced confirmation, unreadable
+     * governance, the classifier's denial-limit fallback) and discloses each release; `dontAsk` refuses every ask
+     * but a hook's or an operator authority's; `auto` arms the classifier (`RunnerDeps.autoMode` present and
+     * `RuntimeCaps.autoMode` not `false`, else folded to `default` and announced); `plan` reads only and mounts the
+     * plan pair; `acceptEdits` writes inside the root without asking; `default` asks. The mode also installs its own
+     * seats ({@link import("./mode-policy.js").modePolicyOf}).
      *
-     * **Inheritance**: the intent is session-wide, like a permission mode — an engine-spawned child of
-     * an auto-mode task inherits it through the trusted constraint chain
-     * (`InheritedGate.autoModeRequested`), never through a model-authored argument; the child's own
-     * deny bit and deployment face are still evaluated for the child. **On resume:** the intent the
-     * suspend leg resolved (this seat, or the bit its chain carried) is recorded on the checkpoint's
-     * data half (`CheckpointState.inheritedGate.autoModeRequested`) and read back as one more intent
-     * source, so a redemption in another process arms as the suspend leg did without re-passing the
-     * seat; re-passing it is still honoured (the sources fold by OR). Intent only — the resuming
-     * deployment's face and the resuming principal's deny bit are judged afresh on every leg.
-     */
-    autoModeRequested?: true;
-    /**
-     * The host's declared APPROVER POSTURE for this task — a typed fact seat, the same ownership split
-     * as {@link shellGate} and {@link autoModeRequested}: the service layer declares it (it is the layer
-     * that knows who sits at the cards), core only CONSUMES it. `"bypass"` says the host answers every
-     * approval card itself, automatically.
-     *
-     * **The gate does not read it.** Cards are raised, routed and recorded byte-identically with and
-     * without this seat — no rule is relaxed, no ask is skipped, no decision is pre-empted. The seat's
-     * one effect is that the ENGINE tells the model which posture the run is under, in its own marked
-     * `<system-reminder>` on the first turn. That is the whole point of the seat: a posture is a fact of
-     * the run, and a host that instead splices the sentence into the objective hands the model
-     * reminder-shaped text with no engine mark, which the mark declaration tells it to treat as data and
-     * flag. One fact, one seat, one mint.
-     *
-     * Absent ⇒ no posture declared, zero bytes rendered (byte-identical to the pre-seat shape). Only the
-     * literal `"bypass"` is a value: any other present value is refused at the door
-     * (`config.approver_posture_invalid`) rather than folded back to absence — a marshalled typo must not
-     * silently un-declare a posture the host meant to declare.
-     *
-     * **Inheritance / resume:** session-wide, exactly like {@link autoModeRequested} — an engine-spawned
-     * child inherits it through the trusted constraint chain (`InheritedGate.approverPosture`), and the
-     * resolved value is recorded on the checkpoint's data half so a redemption in another process still
-     * knows the posture without the seat being re-passed. Re-passing it is honoured; the sources fold
-     * seat-first.
+     * `bypassPermissions` is a REQUEST: it takes effect only where the deployment does not deny it
+     * ({@link RuntimeCaps.bypassPermissions} not `false`); a denied request runs in `default`, announced
+     * (`config.permission_mode_unavailable`). A running leg changes mode through `TaskStream.setPermissionMode`.
+     * Persists on the checkpoint's data half (`CheckpointState.inheritedGate.permissionMode`), re-judged on every leg.
      */
-    approverPosture?: ApproverPosture;
+    permissionMode?: PermissionMode;
     /** Task-scoped MCP servers, materialized into tools then disposed. */
     mcp?: McpServerSpec[];
     /** Task-scoped A2A peers (remote agents), whose advertised skills mount as `a2a__<peer>__<skill>`

package/dist/core/task-stream.d.ts

@@ -275,6 +275,22 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
     }): Promise<{
         outcome: "created" | "existed";
     }>;
+    /**
+     * Change the running leg's PERMISSION MODE (`TaskSpec.permissionMode`'s live half — a shell's mode toggle, a serving
+     * layer's `permission_mode` control frame). The requested word is rewritten on the leg's mode seat; the deployment's
+     * fold is re-judged (`bypassPermissions` where `RuntimeCaps.bypassPermissions` is `false`, or `auto` with no
+     * classifier face / a `false` deny bit, runs `default` and is announced `config.permission_mode_unavailable`); a leg
+     * that became `auto` arms its classifier now — an arming that fails rolls the steer back (the word it replaced stands)
+     * and the verb rejects with the arming's code; the NEXT tool call reads the new mode at the gate's arbitration point
+     * (a tightening and a loosening both take effect one call later, on one seat), and a child leg derives its own
+     * effective mode from this seat on its next read. Resolves the same three-member receipt `wiring_manifest.permissionMode`
+     * carries — `{ requested, effective, foldedBy? }` — on EVERY call, moved or not, so a caller renders what the engine
+     * says and never what it sent. Typed refusals: `steering.invalid_content` (a word outside the closed set) and the
+     * steer-family `steering.not_running` once the task has finished. AUTHORITY (steer-lane law): holding this stream IS
+     * the capability handle; a service exposing the verb owns the principal check at its own face — and a deployment that
+     * must never let a caller reach `bypassPermissions` says so with the deny bit, which this verb honours.
+     */
+    setPermissionMode(mode: import("./ask-origin.js").PermissionMode): Promise<import("./mode-policy.js").PermissionModeReceipt>;
     /**
      * **RE-DIAL one MCP server** on the running task, the action `RefreshMcpTools` deliberately
      * is not (its contract is "never dials or re-dials"). Core holds no MCP connection across task

package/dist/core/terminal-cause.js

@@ -4,6 +4,7 @@ export const TERMINAL_CAUSE_IS_REPLAYABLE = {
     blocked: false,
     paused: false,
 };
+Object.freeze(TERMINAL_CAUSE_IS_REPLAYABLE);
 export function isTerminalCauseKind(kind) {
     return typeof kind === "string" && Object.hasOwn(TERMINAL_CAUSE_IS_REPLAYABLE, kind);
 }

package/dist/core/tighten-task-spec.d.ts

@@ -13,8 +13,8 @@ export declare class TaskSpecTightenError extends Error {
  *    would drop the base policy entirely.
  *  - **`handsReadOnly`** — `true` is stricter. `base:true` + `override:false` ⇒ **throw** (loosening). Otherwise
  *    the stricter (`true` if either is true) wins.
- *  - **`shellGate`** — `off < classify < always`. `override` may only equal-or-raise the rank; lowering it ⇒
- *    **throw**. The stricter of the two wins.
+ *  - **`shellGate`** — one value (`"always"`, the operator floor). Either side set ⇒ the floor stands; it cannot
+ *    be loosened because absence is the only other state and an override cannot unset a base value.
  *  - **`onAsk`** — no safe automatic merge (the approver and the policy must be coordinated). Both set to
  *    DIFFERENT values ⇒ **throw**; equal ⇒ keep; one set ⇒ that one.
  *  - **`hooks`** — no standard composition (stacking hook results is caller-specific). Both set ⇒ **throw**;

package/dist/core/tighten-task-spec.js

@@ -1,9 +1,5 @@
 import { combinePolicies } from "./tool-policy.js";
-const SHELL_GATE_RANK = {
-    off: 0,
-    classify: 1,
-    always: 2,
-};
+import { clampPermissionMode } from "./ask-origin.js";
 export class TaskSpecTightenError extends Error {
     constructor(message) {
         super(message);
@@ -51,16 +47,18 @@ export function tightenTaskSpec(base, overrides) {
     if (base.handsReadOnly !== undefined || overrides.handsReadOnly !== undefined) {
         merged.handsReadOnly = base.handsReadOnly === true || overrides.handsReadOnly === true;
     }
-    if (base.shellGate !== undefined || overrides.shellGate !== undefined) {
-        const baseGate = base.shellGate ?? "off";
-        const overrideGate = overrides.shellGate;
-        if (overrideGate !== undefined && SHELL_GATE_RANK[overrideGate] < SHELL_GATE_RANK[baseGate]) {
-            throw new TaskSpecTightenError(`tightenTaskSpec: cannot loosen shellGate from "${baseGate}" to "${overrideGate}" (override may only tighten)`);
+    if (base.permissionMode !== undefined && overrides.permissionMode !== undefined) {
+        const { effective, clamped } = clampPermissionMode(overrides.permissionMode, base.permissionMode);
+        if (clamped) {
+            throw new TaskSpecTightenError(`tightenTaskSpec: permissionMode override "${overrides.permissionMode}" would loosen the base "${base.permissionMode}" (the override may only tighten; a bypass override needs a bypass base, acceptEdits and auto never adopt each other)`);
         }
-        merged.shellGate =
-            overrideGate !== undefined && SHELL_GATE_RANK[overrideGate] > SHELL_GATE_RANK[baseGate]
-                ? overrideGate
-                : (base.shellGate ?? overrideGate);
+        merged.permissionMode = effective;
+    }
+    else if (base.permissionMode !== undefined || overrides.permissionMode !== undefined) {
+        merged.permissionMode = overrides.permissionMode ?? base.permissionMode;
+    }
+    if (base.shellGate !== undefined || overrides.shellGate !== undefined) {
+        merged.shellGate = base.shellGate ?? overrides.shellGate;
     }
     if (base.onAsk !== undefined && overrides.onAsk !== undefined && base.onAsk !== overrides.onAsk) {
         throw new TaskSpecTightenError("tightenTaskSpec: conflicting onAsk on base and overrides — onAsk cannot be merged automatically " +

package/dist/core/tool-catalog-entries.js

@@ -56,7 +56,7 @@ export const TOOL_CATALOG_ENTRIES = [
     },
     {
         id: "bash", name: "Bash", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"],
-        cards: ["bash", "readonly_out_of_root", "bash_invalid_timeout"],
+        cards: ["bash", "readonly_out_of_root", "read_unestablished", "bash_invalid_timeout"],
         face: {
             family: "shell", effect: "write", contentOrigin: "execution", contract: c(FULL_SHELL_CONTRACT_ID),
             ruleFace: SHELL_RULE_FACE,
@@ -66,7 +66,7 @@ export const TOOL_CATALOG_ENTRIES = [
     },
     {
         id: "bash-readonly", name: "Bash", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"],
-        cards: ["bash", "readonly_out_of_root", "bash_invalid_timeout"],
+        cards: ["bash", "readonly_out_of_root", "read_unestablished", "bash_invalid_timeout"],
         face: {
             family: "shell", effect: "read", contract: c(READONLY_SHELL_CONTRACT_ID),
             ruleFace: SHELL_RULE_FACE,
@@ -108,7 +108,7 @@ export const TOOL_CATALOG_ENTRIES = [
     { id: "task-stop-hands", name: "TaskStop", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", effect: "write", contract: TASK_STOP_CONTRACT } },
     { id: "task-output", name: "TaskOutput", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-output"], face: { family: "delegate", effect: "read", contract: TASK_OUTPUT_CONTRACT } },
     { id: "task-stop", name: "TaskStop", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-stop"], face: { family: "delegate", effect: "write", contract: TASK_STOP_CONTRACT } },
-    { id: "monitor", name: "Monitor", source: "builtin", definedIn: "src/tools/monitor.ts", mountedBy: ["backgroundTasks"], cards: ["monitor-start", "readonly_out_of_root"], face: { family: "other", effect: "write", contract: c("core.monitor@1"), offloadThresholdChars: 10_000 } },
+    { id: "monitor", name: "Monitor", source: "builtin", definedIn: "src/tools/monitor.ts", mountedBy: ["backgroundTasks"], cards: ["monitor-start", "readonly_out_of_root", "read_unestablished"], face: { family: "other", effect: "write", contract: c("core.monitor@1"), offloadThresholdChars: 10_000 } },
     { id: "send-message", name: "SendMessage", source: "builtin", definedIn: "src/agents/send-message-tool.ts", mountedBy: ["delegation", "hostInternals", "peerLane"], cards: ["send-message"], face: { family: "protocol", effect: "write", contract: c("core.send_message@1") } },
     { id: "agent-transcript", name: "AgentTranscript", source: "builtin", definedIn: "src/agents/agent-transcript-tool.ts", mountedBy: ["delegation"], cards: ["agent-transcript"], face: { family: "delegate", effect: "read", contract: c("core.agent_transcript@1") } },
     { id: "list-agents", name: "ListAgents", source: "builtin", definedIn: "src/agents/list-agents-tool.ts", mountedBy: ["delegation", "peerLane"], cards: ["list-agents"], face: { family: "protocol", effect: "read", aliases: ["ListPeers"], contract: c("core.list_agents@1") } },
@@ -156,6 +156,7 @@ export const ENGINE_CARDS = Object.freeze({
     path_not_in_root: "src/tools/fs/safety.ts",
     read_path_denied: "src/tools/fs/safety.ts",
     readonly_out_of_root: "src/tools/fs/shell-read-check.ts",
+    read_unestablished: "src/tools/fs/shell-read-check.ts",
 });
 const byId = new Map();
 for (const e of TOOL_CATALOG_ENTRIES) {