@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/tool-policy.d.ts

@@ -1,9 +1,14 @@
-import type { AskOrigin } from "./ask-origin.js";
+import { type AskOrigin, type AssertAllKeysHandled } from "./ask-origin.js";
 import { type ReadRootGrantScreen } from "./read-root-grant-screen.js";
 import { type Settlement } from "./gate-outcome.js";
 /** A tool call presented to a policy before it executes. */
 /** design/388 B6 — the per-call face (see {@link ToolCallRequest.face}). */
 export interface ToolCallFace {
+    /** Every name a tool-name rule may spell this tool by: the tool's wire name first, then each alias that resolves to
+     *  it on the leg's roster (`rosterToolName`). A rule reaches the call iff its tool name is on this list — read it
+     *  through {@link ruleNamesOf}, never off `toolName` alone. Absent on a face rebuilt from a park row that predates it
+     *  (the call's own name is then the list). */
+    names?: readonly string[];
     family: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
     capabilityId: string;
@@ -12,6 +17,8 @@ export interface ToolCallFace {
     implementationRevision: string;
 }
 export interface ToolCallRequest {
+    /** The tool's wire name — the Runner's gate resolves a call made under an alias to the wire name of the tool it
+     *  dispatches to before any policy runs (`rosterToolName`); the names a rule may use for it are {@link ruleNamesOf}. */
     toolName: string;
     args: unknown;
     toolCallId: string;
@@ -325,9 +332,8 @@ export type PermissionResult = {
     /** This ask is MANDATED — no persisted allow rule and no STANDING ANSWER (a release remembered from an
      *  earlier call, at any scope, a session included) may retire it; only an answer produced for THIS call
      *  clears it — a person, a hook, a deployment's blanket `onAsk: "allow"` seat, or the live deciders the
-     *  mandate tables admit ({@link import("./ask-origin.js").classifierMayAnswerMandate} /
-     *  `sandboxMayAdmitMandate`); {@link requiresRealApproval} is the stronger demand that also refuses the
-     *  blanket seat. ENGINE-STAMPED at the gate's single origin stamp from the ONE derivation
+     *  ask's class row admits ({@link import("./ask-origin.js").MODE_ARBITRATION}); {@link requiresRealApproval}
+     *  is the stronger demand that also refuses the blanket seat. ENGINE-STAMPED at the gate's single origin stamp from the ONE derivation
      *  the approval card's rule-offer word also reads ({@link import("./ask-origin.js").ruleClearanceOf},
      *  which lists the doors). TIGHTENING-ONLY: a layer below the mint may not clear one a layer above
      *  set, and a policy self-declaring it only opts its own ask OUT of automatic answering. Carried
@@ -376,19 +382,34 @@ export type PermissionResult = {
      *  fallback / the reserved question tool / a marked call / plain policy). ENGINE-STAMPED inside the
      *  gate at the same single stamp point as `ruleEvidence`, derived from what the gate's own layers
      *  did ({@link import("./ask-origin.js").askOriginOf}) — a policy that self-declares it is overwritten
-     *  there, so the member is never a channel a policy can loosen through. Consumers: the gate's
-     *  auto-mode classifier step admits an ask by ONE table lookup on this word
-     *  ({@link import("./ask-origin.js").classifierMayAnswer}) instead of a chain of per-kind
-     *  exclusions; an approval surface may render the card by it. Optional on the TYPE only because a
-     *  decision is caller-composable; every ask the gate hands to its resolver carries it. */
+     *  there, so the member is never a channel a policy can loosen through. A DISCLOSURE word: the lanes
+     *  read the ask's class set ({@link import("./ask-origin.js").classifyAsk}), an approval surface may
+     *  render the card by it. Optional on the TYPE only because a decision is caller-composable; every ask
+     *  the gate hands to its resolver carries it. */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** #688 C3 (additive): WHICH mechanism stands behind an `origin: "rule_store_unavailable"` — one word from
-     *  {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS} (`store`: the wired store could not be read;
-     *  `call`: the call could not be read against the person's rows — the lexer's sentence is in `message`).
-     *  ENGINE-STAMPED at the same single stamp point as `origin`, from the gate's own lane read; a policy's
-     *  self-declared value is overwritten or removed there. Present ⇔ the origin is `rule_store_unavailable`.
-     *  Carried onto the approval request and the durable row beside the origin word. */
-    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
+    /** WHICH integrity guard minted this ask — the unverifiable recursive delete or the session-transcript
+     *  write. ENGINE-STAMPED by the two guard policies; a fold-internal fact the class derivation reads
+     *  ({@link import("./ask-origin.js").classifyAsk}) so the two guards, which mint the same
+     *  `requiresRealApproval` ask, are told apart by a fact and not by their prose. Never copied onto the
+     *  approval request or the park row. */
+    guard?: "unverifiable_delete" | "transcript_write" | "artifact_shared_read";
+    /** The call could not be READ against a rule that may reach it — a content-form deny row, a content-form
+     *  ask row, or a persisted-rule row (the lexer's word). ENGINE-STAMPED at the three unreadable mint sites;
+     *  the class derivation reads it as `rule_unreadable` (a mode may release it, a person may clear it, no
+     *  automatic lane may). It replaces the former practice of stamping `matchedAskRule` on an unreadable
+     *  read: a rule that COULD NOT be matched is not a rule that matched. Fold-internal; not on the request. */
+    ruleUnreadable?: "content_deny" | "content_ask" | "persisted_call";
+    /** The ask was authored by the DEPLOYMENT's own governance (an operator's must-ask list, a managed command
+     *  policy's default ask) — a fact a host's policy states on its own ask so the class derivation reads it
+     *  as `operator_forced`: a permission mode releases nothing an operator mandated, and `dontAsk` does not
+     *  settle it. Public: a host composing such a policy sets it; {@link combinePolicies} carries it onto the
+     *  surviving ask (tighten-only). Not on the approval request — the card shows `origin` / `mandate`. */
+    authoredBy?: "deployment";
+    /** The classes of the OTHER asks a policy fold collapsed into this one
+     *  ({@link import("./ask-origin.js").decisionAskClassesOf} per contributing ask, unioned), so a member the
+     *  fold does not copy — a guard mark, an unreadable-rule fact, a bare real-approval bit — is not lost behind
+     *  the ask that won the slot. ENGINE-WRITTEN by {@link combinePolicies}; fold-internal, never on the request. */
+    foldedAskClasses?: readonly import("./ask-origin.js").AskClass[];
 } | {
     action: "deny";
     updatedInput?: unknown;
@@ -495,7 +516,44 @@ export interface ToolPolicy {
      * describes the policy must read that bit, not the field's presence.
      */
     readonly projection?: ToolPolicyProjection;
+    /** The policy's path DENY rules that speak for a face of the engine's deny table (a `Read(<pattern>)` / `Edit(<pattern>)`
+     *  deny compiled by `createPermissionRulePolicy`), as rows the prepared leg joins to its read and write tables — so the
+     *  shell's reads and writes and the traversals meet the rule, not only the tool it names. Carried through
+     *  {@link combinePolicies}; read with {@link toolPolicyPathDenyRules}. Deny-only: a row can only refuse more. */
+    readonly pathDenyRules?: readonly import("../tools/fs/read-deny.js").PathRuleDenyRow[];
+    /** Does this policy guard a write to this ABSOLUTE target — would it refuse the write if a write tool made it? The
+     *  policy's answer for a writer it cannot see as a call (the shell's file commands), read by the shell station's
+     *  `writesPlaced` fact alone: a guarded target is not placed, so no permission mode answers the command and its ask
+     *  reaches a person — it is not refused. A PURE judgment: no side effect, no audit record, no hook, no approver; `true`
+     *  on a target it cannot judge. Carried through {@link combinePolicies} (any member's `true` is the answer). */
+    readonly writeTargetGuard?: (target: string, signal?: AbortSignal) => Promise<boolean>;
+    /** The raw tool-name lists a name-keyed policy was built from — the prepare-time policy-name audit's feed (a retired
+     *  name refuses the run, an unmounted one is advised). Carried through {@link combinePolicies} (the union of the
+     *  members' groups); read with {@link toolPolicyNameSets}. */
+    readonly nameSets?: readonly ToolPolicyNameSets[];
 }
+/**
+ * The members a policy carries beside `check` — one table for every seat that carries them: {@link wrapToolPolicy} reads
+ * each by name off the wrapped policy, {@link combinePolicies} folds each. The fence makes a new {@link ToolPolicy} member
+ * a compile error until the table names it.
+ */
+declare const TOOL_POLICY_CARRIED_MEMBERS: readonly ["projection", "pathDenyRules", "writeTargetGuard", "nameSets"];
+type ToolPolicyCarriedMember = (typeof TOOL_POLICY_CARRIED_MEMBERS)[number];
+export type ToolPolicyCarriesEveryMember = AssertAllKeysHandled<Exclude<Exclude<keyof ToolPolicy, "check">, ToolPolicyCarriedMember>>;
+/**
+ * The ONE way to wrap a policy: the wrapper decides through `check`; every member {@link ToolPolicy} declares beside it
+ * (projection, name sets, path deny rows, write-target guard — the carried-member table) rides as `inner` holds it, read
+ * by name, so a class instance's accessor or a non-enumerable member rides too — a `{ check }` literal drops them, and
+ * engine stations the wrapper never sees read each one. The carried members describe what `inner` refuses, so the wrapper
+ * must refuse at least that (an observer, a tightener); one that releases what `inner` refuses is a policy of its own.
+ * The ask-class brand is not carried: it attests the replaced `check`.
+ */
+export declare function wrapToolPolicy<P extends ToolPolicy>(inner: P, check: ToolPolicy["check"]): Pick<P, ToolPolicyCarriedMember> & ToolPolicy;
+/** Every path deny row the given policies carry (combined policies included), in order — the deny tables' rule rows. */
+export declare function toolPolicyPathDenyRules(policies: readonly (ToolPolicy | undefined)[]): readonly import("../tools/fs/read-deny.js").PathRuleDenyRow[];
+/** The one write-target guard the given policies carry together (combined policies included): `true` when any member
+ *  guards the target, a member that throws counting as guarding it. `undefined` when none carries one. */
+export declare function toolPolicyWriteTargetGuard(policies: readonly (ToolPolicy | undefined)[]): ToolPolicy["writeTargetGuard"];
 /**
  * One deterministic DENY component of a {@link ToolPolicyProjection} (F-012 L1). All fields are plain
  * serializable data — a component round-trips JSON/`structuredClone` unchanged, which is what lets a
@@ -574,10 +632,7 @@ export declare function namespacedCoveringHit(covering: readonly string[], toolN
  * trusting a re-supplied policy's execution half for the frozen deny data: the projection persisted
  * at suspend is the authority for what the chain refused, whatever a re-supplied closure claims.
  */
-export declare function checkToolPolicyProjection(projection: Pick<ToolPolicyProjection, "components">, req: {
-    toolName: string;
-    args: unknown;
-}): Extract<PermissionResult, {
+export declare function checkToolPolicyProjection(projection: Pick<ToolPolicyProjection, "components">, req: Pick<ToolCallRequest, "toolName" | "args" | "face">): Extract<PermissionResult, {
     action: "deny";
 }> | undefined;
 /**
@@ -751,7 +806,7 @@ export interface ToolPolicyNameSets {
      *  here silently WIDENS (the tool runs without ever asking), so it is audited too. */
     readonly ask?: readonly string[];
 }
-/** A policy that exposes its name lists for the host-side pool audit. Composition-transparent:
+/** A policy that states its name lists ({@link ToolPolicy.nameSets} set). Composition-transparent:
  *  {@link combinePolicies} (and therefore {@link tightenTaskSpec}) unions children's groups onto the
  *  combined policy, so metadata survives the deployment's tighten/compose path. */
 export type NamedToolPolicy = ToolPolicy & {
@@ -910,10 +965,10 @@ export declare const COARSE_SHELL_TOOLS: string[];
  * you MUST compose explicitly: `combinePolicies(deploymentBaseline, createCoarseCommandNamePolicy(…))`
  * (deny-wins — both policies' denies still fire). {@link tightenTaskSpec} does this for you.
  *
- * Under `TaskSpec.shellGate: "classify"` a plain `ask` from this policy stays a plain ask: the shell seat's
- * `"maybe"` tier is the doctrine's probe instrument, not a risk label, so the park is the budgetable kind
+ * On the full shell face a plain `ask` from this policy stays a plain ask: the shell seat's
+ * `"maybe"` tier is the shape probe's instrument, not a risk label, so the park is the budgetable kind
  * (`human` under `durableApproval`) unless the probe mandated the call (an out-of-root read) or could not
- * answer. A command the doctrine's OWN tighten refuses (`rm -rf …` with no policy asking first) still parks
+ * answer. A command the shape tier's OWN tighten refuses (`rm -rf …` with no policy asking first) still parks
  * non-budgetable — the safety axis is judged per call by `safetyAxisOf`.
  */
 export declare function createCoarseCommandNamePolicy(opts: {
@@ -1299,6 +1354,11 @@ export interface AskRequest {
      * gate, never caller/worker-settable; tightening-only.
      */
     readonly mandated?: true;
+    /** The ask was minted by the deployment's own governance layer (the {@link PermissionResult} ask arm's member of the same
+     *  name, carried through every request mint and onto the park row): a person's question under every mode — no persisted
+     *  rule, standing answer or mode release retires it. A host approval seat that settles asks from a session grant reads
+     *  it to keep its hands off. Filled by the gate, never caller/worker-settable. */
+    readonly authoredBy?: "deployment";
     /** WHICH word of the closed {@link import("./ask-origin.js").PERSISTED_RULE_MANDATES} set {@link mandated} stands
      *  on — present ⇔ that table word is the bit's WHOLE reason (`probe_mandate` = a read outside the session's
      *  directories). ABSENT beside `mandated: true` = another door holds too (governance, a hook, an ancestor's
@@ -1317,12 +1377,6 @@ export interface AskRequest {
      *  that forwards a decision's member here does not compile, which is the point: the window is the
      *  route's fact, and forwarding it silently is how a configured window becomes a wait with none. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
-    /** #688 C3 (additive) — the wire twin of the {@link PermissionResult} ask-arm member of the same name: which
-     *  mechanism stands behind an `origin: "rule_store_unavailable"` (`store` / `call`,
-     *  {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS}). Present ⇔ that origin; a consumer that
-     *  renders "the rule store is unreachable" vs "this command could not be read against your rules" branches
-     *  here, never on the message text. Filled by the gate's own carry station from the engine-stamped decision. */
-    readonly ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /** (additive) WHICH AUTHORITY raised this ask — the wire twin of the {@link PermissionResult} ask-arm
      *  member of the same name, one word from the closed {@link import("./ask-origin.js").AskOrigin} set.
      *  The gate's own mint station copies the engine-stamped word; the three inherited-lane stations

package/dist/core/tool-policy.js

@@ -1,12 +1,14 @@
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { brandPolicyAskClass } from "./ask-class.js";
+import { decisionAskClassesOf, headlessDenialMessage } from "./ask-origin.js";
 import { ownReadRootCandidate, readRootGrantSeat } from "./read-root-grant-screen.js";
 import { decidersNote, settledByPerson } from "./gate-outcome.js";
 import { sanitizeAutoModeArmingRecipe } from "./auto-mode-arming.js";
 import { join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
+import { ruleNamesOf, toolNameSetHas } from "./tool-roster.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
@@ -121,6 +123,41 @@ export const ASK_EVIDENCE_ABSENCE_VALUES = ["not_wired", "not_adjudicated", "una
 export function decisionText(d) {
     return d.message;
 }
+const TOOL_POLICY_CARRIED_MEMBERS = ["projection", "pathDenyRules", "writeTargetGuard", "nameSets"];
+function carriedMembersOf(p) {
+    const out = {};
+    const carry = (k) => {
+        const v = p[k];
+        if (v !== undefined)
+            out[k] = v;
+    };
+    for (const k of TOOL_POLICY_CARRIED_MEMBERS)
+        carry(k);
+    return out;
+}
+export function wrapToolPolicy(inner, check) {
+    return { ...carriedMembersOf(inner), check };
+}
+export function toolPolicyPathDenyRules(policies) {
+    return policies.flatMap((p) => (Array.isArray(p?.pathDenyRules) ? p.pathDenyRules : []));
+}
+export function toolPolicyWriteTargetGuard(policies) {
+    const guards = policies.flatMap((p) => (typeof p?.writeTargetGuard === "function" ? [p.writeTargetGuard] : []));
+    if (guards.length === 0)
+        return undefined;
+    return async (target, signal) => {
+        for (const guard of guards) {
+            try {
+                if ((await guard(target, signal)) !== false)
+                    return true;
+            }
+            catch {
+                return true;
+            }
+        }
+        return false;
+    };
+}
 export function namespacedCoveringEntries(entries) {
     return (entries ?? []).filter(isNamespacedCoveringRuleName);
 }
@@ -128,20 +165,21 @@ export function namespacedCoveringHit(covering, toolName) {
     return covering.length > 0 && covering.some((e) => namespacedRuleNameCovers(e, toolName));
 }
 export function checkToolPolicyProjection(projection, req) {
+    const names = ruleNamesOf(req);
     for (const c of projection.components) {
         if (c.kind === "tool_deny") {
-            if (c.names.includes(req.toolName) || namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
+            if (names.some((n) => c.names.includes(n)) || namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by a frozen inherited policy projection` };
             }
             continue;
         }
         if (c.kind === "tool_allowlist") {
-            if (!c.names.includes(req.toolName) && !namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
+            if (!names.some((n) => c.names.includes(n)) && !namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in a frozen inherited policy projection's allowlist` };
             }
             continue;
         }
-        if (!c.tools.includes(req.toolName))
+        if (!names.some((n) => c.tools.includes(n)))
             continue;
         const command = req.args?.command;
         if (typeof command !== "string") {
@@ -350,10 +388,10 @@ export function createAllowDenyPolicy(opts) {
         nameSets: [{ ...(opts.allow ? { allow: [...opts.allow] } : {}), ...(opts.deny ? { deny: [...opts.deny] } : {}) }],
         check(req) {
             const toolName = req.toolName;
-            if (deny.has(toolName) || namespacedCoveringHit(denyCovering, toolName)) {
+            if (toolNameSetHas(deny, req) || namespacedCoveringHit(denyCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (allow && !allow.has(toolName) && !namespacedCoveringHit(allowCovering, toolName)) {
+            if (allow && !toolNameSetHas(allow, req) && !namespacedCoveringHit(allowCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
             return ALLOW;
@@ -390,10 +428,10 @@ export function createApprovalPolicy(opts) {
         ],
         async check(req, signal) {
             const toolName = req.toolName;
-            if (deny.has(toolName) || namespacedCoveringHit(denyCovering, toolName)) {
+            if (toolNameSetHas(deny, req) || namespacedCoveringHit(denyCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (need.has(toolName) || namespacedCoveringHit(needCovering, toolName)) {
+            if (toolNameSetHas(need, req) || namespacedCoveringHit(needCovering, toolName)) {
                 const attest = (d, settlement) => attestEngineSettlement(d, { settlement, origin: "policy" }, req);
                 if (signal?.aborted) {
                     return attest({ action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)` }, settledByNobody("task_aborted"));
@@ -443,7 +481,7 @@ export function createApprovalPolicy(opts) {
                 }
                 return attest({ action: "deny", message: `approval denied for "${req.toolName}"` }, settledByPerson("human_refused", undefined));
             }
-            if (opts.denyByDefault && !auto.has(toolName) && !namespacedCoveringHit(autoCovering, toolName)) {
+            if (opts.denyByDefault && !toolNameSetHas(auto, req) && !namespacedCoveringHit(autoCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
             }
             return ALLOW;
@@ -452,6 +490,8 @@ export function createApprovalPolicy(opts) {
 }
 export function combinePolicies(...policies) {
     const nameSets = policies.flatMap(toolPolicyNameSets);
+    const pathDenyRules = toolPolicyPathDenyRules(policies);
+    const writeTargetGuard = toolPolicyWriteTargetGuard(policies);
     const childProjections = policies.map((p) => p.projection);
     const projectedComponents = [];
     let combinedRemainder = false;
@@ -469,9 +509,14 @@ export function combinePolicies(...policies) {
     const combinedProjection = childProjections.some((p) => p !== undefined)
         ? { components: projectedComponents, requiresLiveRemainder: combinedRemainder }
         : undefined;
+    const folded = {
+        projection: combinedProjection,
+        nameSets: nameSets.length > 0 ? nameSets : undefined,
+        pathDenyRules: pathDenyRules.length > 0 ? pathDenyRules : undefined,
+        writeTargetGuard,
+    };
     return {
-        ...(combinedProjection !== undefined ? { projection: combinedProjection } : {}),
-        ...(nameSets.length > 0 ? { nameSets } : {}),
+        ...carriedMembersOf(folded),
         async check(req, signal) {
             let asked;
             let current = req;
@@ -482,6 +527,8 @@ export function combinePolicies(...policies) {
             let probeMandateSeen = false;
             let mandateSeen = false;
             let fallbackSeen;
+            let authoredBySeen = false;
+            const contributors = [];
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
@@ -516,6 +563,10 @@ export function combinePolicies(...policies) {
                     mandateSeen = true;
                 if (d.action === "ask" && d.denialLimitFallback !== undefined && fallbackSeen === undefined)
                     fallbackSeen = d.denialLimitFallback;
+                if (d.action === "ask" && d.authoredBy === "deployment")
+                    authoredBySeen = true;
+                if (d.action === "ask")
+                    contributors.push(d);
             }
             if (asked) {
                 const merged = rewrite?.updatedInput;
@@ -523,7 +574,14 @@ export function combinePolicies(...policies) {
                 const withMark = probeMandateSeen && withRuleAsk.probeMandated !== true ? { ...withRuleAsk, probeMandated: true } : withRuleAsk;
                 const withMandate = mandateSeen && withMark.mandated !== true ? { ...withMark, mandated: true } : withMark;
                 const withFallback = fallbackSeen !== undefined && withMandate.denialLimitFallback === undefined ? { ...withMandate, denialLimitFallback: fallbackSeen, requiresRealApproval: true } : withMandate;
-                return merged !== undefined ? { ...withFallback, updatedInput: merged } : withFallback;
+                const withAuthor = authoredBySeen && withFallback.authoredBy === undefined ? { ...withFallback, authoredBy: "deployment" } : withFallback;
+                const folded = new Set(withAuthor.foldedAskClasses ?? []);
+                for (const c of contributors)
+                    if (c !== asked)
+                        for (const k of decisionAskClassesOf(c))
+                            folded.add(k);
+                const withClasses = folded.size > 0 ? { ...withAuthor, foldedAskClasses: [...folded] } : withAuthor;
+                return merged !== undefined ? { ...withClasses, updatedInput: merged } : withClasses;
             }
             const allowed = rewrite ?? ALLOW;
             if (!anyRecord)
@@ -563,7 +621,7 @@ export function createCoarseCommandNamePolicy(opts) {
     return brandPolicyAskClass({
         projection,
         check(req) {
-            if (!shellTools.has(req.toolName))
+            if (!toolNameSetHas(shellTools, req))
                 return ALLOW;
             const command = req.args?.command;
             if (typeof command !== "string") {
@@ -817,7 +875,7 @@ export function createUnverifiableDeletePolicy(opts) {
     const shellTools = canonicalToolNameSet(opts?.tools);
     return brandPolicyAskClass({
         check(req) {
-            if (!shellTools.has(req.toolName))
+            if (!toolNameSetHas(shellTools, req))
                 return ALLOW;
             const command = req.args?.command;
             if (typeof command !== "string")
@@ -829,6 +887,7 @@ export function createUnverifiableDeletePolicy(opts) {
                 action: "ask",
                 decisionReason: "safety",
                 requiresRealApproval: true,
+                guard: "unverifiable_delete",
                 message: `Unverifiable recursive delete (fail-closed unless cleared): ${finding}. ` +
                     `Re-run the delete with the resolved literal path written into the command itself ` +
                     `(or assign the variable in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`,
@@ -905,6 +964,7 @@ export function createTranscriptIntegrityPolicy(opts) {
         action: "ask",
         decisionReason: "safety",
         requiresRealApproval: true,
+        guard: "transcript_write",
         message: `Session-transcript write (fail-closed unless cleared): ${what}. Session transcripts (the .jsonl files ` +
             `under the agent data dir's sessions/ directory) are harness-written session state, not agent working ` +
             `files — modifying or deleting them tampers with the run's own audit trail. Reading them (ls/cat/grep ` +
@@ -912,8 +972,7 @@ export function createTranscriptIntegrityPolicy(opts) {
     });
     return brandPolicyAskClass({
         check(req) {
-            const toolName = req.toolName;
-            if (shellTools.has(toolName)) {
+            if (toolNameSetHas(shellTools, req)) {
                 const command = req.args?.command;
                 if (typeof command !== "string")
                     return ALLOW;
@@ -956,6 +1015,7 @@ export function isLiveApproverSeat(onAsk) {
     return typeof onAsk === "function";
 }
 export const DURABLE_MANDATE_SOURCES = ["force_durable_gate", "durable_approval"];
+Object.freeze(DURABLE_MANDATE_SOURCES);
 export function durableMandateSourceOf(args) {
     if (args.forceDurableGate)
         return "force_durable_gate";
@@ -1250,7 +1310,7 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
     if (onAsk === undefined || onAsk === "deny") {
         return {
             action: "deny",
-            message: `approval required for "${req.toolName}" but no approver is wired (headless auto-deny): ${req.message}`,
+            message: headlessDenialMessage(req.toolName, req.message),
             decisionReason: "mode",
             settlement: settledByNobody("no_approver"),
         };

package/dist/core/tool-registry.d.ts

@@ -28,6 +28,8 @@ export declare function pathConfinableWriteToolNames(): ReadonlySet<string>;
 export declare function skillScopeWriteToolNames(): ReadonlySet<string>;
 /** A-8 — every definition that names a path target at all (read or write): the file-tool glob lane. */
 export declare function pathTargetingToolNames(): ReadonlySet<string>;
+/** The tools whose declared path target is a READ (a file read, a search root): the file read station's membership. */
+export declare function readTargetToolNames(): ReadonlySet<string>;
 /** A-10 — the micro-compaction whitelist (`compactable: true`). */
 export declare function compactableToolNames(): ReadonlySet<string>;
 /** A-5 — the aggregate-budget exemptions (`budgetExempt: true`). */
@@ -46,9 +48,40 @@ export interface ToolCallLike {
     args: unknown;
     face?: {
         pathTarget?: ToolCallPathTarget;
+        names?: readonly string[];
     } | undefined;
 }
 type CallPathTarget = ToolCallPathTarget;
+/**
+ * The names a tool-name rule may spell this call's tool by — the face's `names` when they include the call's name,
+ * else the call's name alone (a bare request, or a face minted for another name). Every name-keyed matcher and the
+ * protective path floor read a rule's tool name against THIS list, which is the roster's one canonicalization seen
+ * from the call's side: a rule written against an alias and one written against the wire name reach the same calls.
+ */
+export declare function ruleNamesOf(req: Pick<ToolCallLike, "toolName" | "face">): readonly string[];
+/** Does the call answer to `name` — is it one of the call's names ({@link ruleNamesOf})? The engine's TIGHTENS keyed on
+ *  one of its own tool names read this, so a tool that wears the name under any of its names is tightened (the
+ *  fail-safe direction); a grant or a routing keyed on an engine tool name reads the wire name. */
+export declare function callAnswersTo(req: Pick<ToolCallLike, "toolName" | "face">, name: string): boolean;
+/** Does a set of rule tool names name this call's tool ({@link ruleNamesOf})? */
+export declare function toolNameSetHas(set: {
+    has(name: string): boolean;
+}, req: Pick<ToolCallLike, "toolName" | "face">): boolean;
+/** Does `set` hold any of the call's names ({@link ruleNamesOf})? The read of a MEMBERSHIP tighten keyed on the engine's
+ *  own tool names (the egress set, a read station's tools, the compliance veto): a tool is held under every name it
+ *  answers to. A grant or a routing keyed on an engine tool name reads the wire name instead. */
+export declare function anyNamed(set: {
+    has(name: string): boolean;
+}, names: readonly string[]): boolean;
+/** The first of the call's names ({@link ruleNamesOf}, the spelling first) that `map` holds an entry for, with the entry.
+ *  The read of a SEAT keyed on the engine's own tool names (a tier, a mark's sources): every key of one seat is read under
+ *  the ONE name this returns — a seat is never assembled from two names' entries. */
+export declare function firstNamed<V>(map: {
+    get(name: string): V | undefined;
+}, names: readonly string[]): {
+    readonly name: string;
+    readonly value: V;
+} | undefined;
 /**
  * design/388 B6/B17 — the path target a PROTECTIVE fence reads (a deny-list judging a write's target: sensitive paths,
  * frozen paths, write protection, the transcript gate; edit tracking): the object face's own declaration first, the
@@ -56,6 +89,11 @@ type CallPathTarget = ToolCallPathTarget;
  * face that declares none. Reading the catalog for an undeclared same-name tool can only TIGHTEN a deny-list (it adds
  * a slot to judge — the pre-388 posture, never wider), which is exactly why this floor is wrong for a grant.
  *
+ * The floor reads EVERY name the call answers to (`ruleNamesOf`: the face's `names`, else the call's name alone) in
+ * the face's order — the name the call was made under first, then the wire name, then the other aliases — and the
+ * first name the catalog declares a target for wins: a call made under a catalog name and resolved to a tool that
+ * declares none keeps THAT name's slot, also when the tool answers to a second catalog name with another slot.
+ *
  * #635: "can only tighten" is true of the SLOT and false of the RESOLUTION, so the floor hands over the first and
  * defaults the second (`pathTargetSlotOnly`). Telling a fence that a FOREIGN tool of the same name resolves its slot
  * against the project root is a claim about someone else's implementation: get it wrong and the judged path moves to

package/dist/core/tool-registry.js

@@ -31,6 +31,9 @@ export function skillScopeWriteToolNames() {
 export function pathTargetingToolNames() {
     return names((e) => e.face.pathTarget !== undefined);
 }
+export function readTargetToolNames() {
+    return names((e) => e.face.pathTarget?.access === "read");
+}
 export function compactableToolNames() {
     return names((e) => e.face.compactable === true);
 }
@@ -48,10 +51,31 @@ export function pathTargetValue(args, pt) {
     }
     return undefined;
 }
+export function ruleNamesOf(req) {
+    const names = req.face?.names;
+    return names !== undefined && names.includes(req.toolName) ? names : [req.toolName];
+}
+export function callAnswersTo(req, name) {
+    return ruleNamesOf(req).includes(name);
+}
+export function toolNameSetHas(set, req) {
+    return anyNamed(set, ruleNamesOf(req));
+}
+export function anyNamed(set, names) {
+    return names.some((n) => set.has(n));
+}
+export function firstNamed(map, names) {
+    for (const name of names) {
+        const value = map.get(name);
+        if (value !== undefined)
+            return { name, value };
+    }
+    return undefined;
+}
 export function protectivePathTargetOf(call) {
     if (call.face?.pathTarget !== undefined)
         return call.face.pathTarget;
-    const floor = pathTargetOf(call.toolName);
+    const floor = ruleNamesOf(call).map((n) => pathTargetOf(n)).find((pt) => pt !== undefined);
     return floor === undefined || call.face === undefined ? floor : pathTargetSlotOnly(floor);
 }
 export const BARE_REQUEST_CODE = "policy.bare_request";

package/dist/core/tool-roster.d.ts

@@ -249,7 +249,19 @@ export type ToolRosterDelta = Static<typeof ToolRosterDelta>;
 /** The ONE name→row resolution every per-call reader shares (the call face, the park identity): the wire name first,
  *  then an alias — the same order the dispatcher resolves a model's call. */
 export declare function rosterEntryNamed(roster: ToolRoster, toolName: string): ToolRosterEntry | undefined;
-/** design/388 B6 — the per-call face a gated request carries, read off a roster snapshot by name (aliases resolve). */
+/**
+ * The ONE tool-name canonicalization: the wire name of the row `name` resolves to on the roster ({@link rosterEntryNamed}
+ * — the wire name first, then an alias, the dispatcher's order), or `name` itself when no row answers to it. The gate
+ * reads a call's name through it before any policy runs, and a rule's tool name reaches a call exactly when it
+ * canonicalizes to the same wire name (`ToolCallFace.names` is that set, minted here) — so a rule written against
+ * an alias and one written against the wire name are one rule.
+ */
+export declare function rosterToolName(roster: ToolRoster | undefined, name: string): string;
+export { anyNamed, callAnswersTo, firstNamed, ruleNamesOf, toolNameSetHas } from "./tool-registry.js";
+/** design/388 B6 — the per-call face a gated request carries, read off a roster snapshot by name (aliases resolve).
+ *  `names` leads with the name the face was minted under (the model's spelling at the gate), then the wire name and the
+ *  other aliases: a reader that must pick ONE of the call's names (the protective path floor) picks the spelling first,
+ *  as the same call was judged before name resolution. */
 export declare function toolCallFaceOf(roster: ToolRoster | undefined, toolName: string): import("./tool-policy.js").ToolCallFace | undefined;
 /** design/388 B18 — the identity members a park row carries, read off a roster snapshot by name; an empty object when
  *  the name is not on the snapshot (the row then reads pre-identity and the resume takes the name-only path). */
@@ -268,6 +280,7 @@ export declare function parkedToolIdentity(roster: ToolRoster | undefined, toolN
 export declare function parkedToolFace(roster: ToolRoster | undefined, toolName: string): {
     family?: ToolFamily;
     pathTarget?: ToolRosterEntry["pathTarget"];
+    names?: readonly string[];
 };
 /** The call face a park row carries — present iff the row was minted with BOTH its face members and its four
  *  identity members (one mint writes all of them; a row missing any is pre-388 and yields undefined, never a
@@ -275,6 +288,7 @@ export declare function parkedToolFace(roster: ToolRoster | undefined, toolName:
 export declare function parkedCallFaceOf(pending: {
     family?: ToolFamily;
     pathTarget?: ToolRosterPathTarget;
+    names?: readonly string[];
     capabilityId?: string;
     contractId?: string;
     shapeDigest?: string;
@@ -321,7 +335,8 @@ export interface RosterBoundMembers {
     cardId?: string;
 }
 /** The typed refusal a member over its bound mints — the door's two codes, and the mint's own for the members no
- *  declaration door names (`modelGate`, the derived `cardId`). */
+ *  declaration door names (`modelGate`, the derived `cardId`). Spelled out as literals (a consumer's tooling reads
+ *  the words); each is a member of {@link ToolDeclarationCode}, which every mint below satisfies. */
 export type RosterBoundCode = "config.tool_name_too_long" | "config.tool_contract_too_long" | "config.tool_roster_bound";
 /**
  * design/388 B20 / #626 ① — the ONE bound judge over a row's identity members: a problem `{ code, message }`, or

package/dist/core/tool-roster.js

@@ -74,13 +74,22 @@ export const ToolRosterDelta = Type.Object({
 export function rosterEntryNamed(roster, toolName) {
     return roster.entries.find((r) => r.name === toolName) ?? roster.entries.find((r) => r.aliases.includes(toolName));
 }
+export function rosterToolName(roster, name) {
+    return (roster === undefined ? undefined : rosterEntryNamed(roster, name)?.name) ?? name;
+}
+function namesResolvingTo(roster, e) {
+    return [e.name, ...e.aliases.filter((a) => a !== e.name && rosterToolName(roster, a) === e.name)];
+}
+export { anyNamed, callAnswersTo, firstNamed, ruleNamesOf, toolNameSetHas } from "./tool-registry.js";
 export function toolCallFaceOf(roster, toolName) {
     if (roster === undefined)
         return undefined;
     const e = rosterEntryNamed(roster, toolName);
     if (e === undefined)
         return undefined;
+    const resolving = namesResolvingTo(roster, e);
     return {
+        names: resolving.includes(toolName) ? [toolName, ...resolving.filter((n) => n !== toolName)] : resolving,
         family: e.family,
         ...(e.pathTarget !== undefined ? { pathTarget: e.pathTarget } : {}),
         capabilityId: e.capabilityId,
@@ -103,12 +112,13 @@ export function parkedToolFace(roster, toolName) {
     const e = rosterEntryNamed(roster, toolName);
     if (e === undefined)
         return {};
-    return { family: e.family, ...(e.pathTarget !== undefined ? { pathTarget: e.pathTarget } : {}) };
+    return { family: e.family, ...(e.pathTarget !== undefined ? { pathTarget: e.pathTarget } : {}), names: namesResolvingTo(roster, e) };
 }
 export function parkedCallFaceOf(pending) {
     if (pending.family === undefined || pending.capabilityId === undefined || pending.contractId === undefined || pending.shapeDigest === undefined || pending.implementationRevision === undefined)
         return undefined;
     return {
+        ...(pending.names !== undefined ? { names: pending.names } : {}),
         family: pending.family,
         ...(pending.pathTarget !== undefined ? { pathTarget: pending.pathTarget } : {}),
         capabilityId: pending.capabilityId,