@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/ask-origin.d.ts

@@ -1,7 +1,7 @@
 /**
  * The ORIGIN of a surviving `ask` — WHICH AUTHORITY raised it, or took it over — as one word from a
- * closed set, and the per-lane tables that say what an automatic decider may do with an ask of that
- * origin.
+ * closed set; and, below it, the ask's CLASS SET, the mode × class arbitration table and the one predicate a
+ * permission mode is read through.
  *
  * Why an axis of its own. The tool gate has several automatic ask-resolution lanes (the auto-mode
  * classifier today; the persisted-rule lane and the sandbox-admission leg are the same shape), and each
@@ -12,11 +12,11 @@
  * one was a silent loosening (the new ask fell into whichever lane nobody had excluded it from).
  *
  * The replacement: the gate derives the origin ONCE from the facts its layers established
- * ({@link askOriginOf}), stamps it on the surviving ask, and each lane asks one question — "may this
- * lane answer an ask of this origin?" — against a table that MUST name every member of the set
- * ({@link AssertAllKeysHandled}). Adding a kind of ask is then: one member here, one arm in the
- * derivation, one row per table — and the compiler refuses the build until the row exists, so the
- * default for an unconsidered origin is a red build, never a silent allow.
+ * ({@link askOriginOf}) and stamps it on the surviving ask as the DISCLOSED word; the lanes read the ask's
+ * class SET ({@link classifyAsk}) folded onto one row of a table that MUST name every class
+ * ({@link MODE_ARBITRATION}, fenced by {@link AssertAllKeysHandled}). Adding a kind of ask is then: one
+ * class here, one arm in the derivation, one row in the table — and the compiler refuses the build until
+ * the row exists, so the default for an unconsidered class is a red build, never a silent allow.
  *
  * What is and is not an origin. An origin is WHO raised the question. Two facts that ride beside it
  * are deliberately not origins: `requiresRealApproval` says what may CLEAR the question (a governance
@@ -42,14 +42,13 @@ import type { PermissionResult } from "./tool-policy.js";
  *    lane may answer it).
  *  - `org_rule` — an organization policy rule asked (or stamped an existing ask): "no configuration
  *    clears this, a person nods".
- *  - `rule_store_unavailable` — the deployment wired a persisted-rule store and could not READ it for
- *    this call (a read failure, a timeout), OR could not read the CALL against the person's standing
- *    deny/ask rows (the tightening lexer's `unreadable` word: an expansion where a rule reads a word, an
- *    unterminated quote, a syntax error — the answer's `reason`): the person's own deny/ask rows cannot
- *    be enforced for this call, so it fails closed the way an unreadable org snapshot does — an allow
- *    tightens to an ask a person must clear, and no automatic lane may answer ("does one of my rules
- *    forbid this?" is unanswered). One word for both, deliberately: the AUTHORITY semantics (who may
- *    answer, what clears it, what the evidence records) are identical, and only the mechanism differs.
+ *  - `rule_store_unavailable` — the person's rule store WAS read, but the CALL could not be read against
+ *    their standing deny/ask rows (the tightening lexer's `unreadable` word: an expansion where a rule
+ *    reads a word, an unterminated quote, a syntax error — the answer's `reason`): whether one of those
+ *    rows forbids this call is unknown, so an allow tightens to an ask a person must clear and no automatic
+ *    lane may answer. A store that could not be READ is not this word: its rows take no part in the
+ *    decision (the call is judged as if the person had no persisted rows) and the run carries one
+ *    `permission.rule_store_unavailable` notice instead.
  *  - `hook` — a deployment's PreToolUse screening face raised or co-raised the ask; the word is
  *    engine-stamped at the fold and is the deployment's own per-call adjudication.
  *  - `ask_rule` — an EXPLICIT `ask` permission rule matched: a person's standing "ask me each time",
@@ -57,7 +56,7 @@ import type { PermissionResult } from "./tool-policy.js";
  *  - `denial_limit_fallback` — the auto-mode classifier reached its denial bound and handed the call
  *    to a person; the classifier stands BEFORE this ask, never after it.
  *  - `shell_gate_tighten` — the gate's own irreversibility tighten raised the ask over a tier the COARSE
- *    `shellGate` doctrine installed (a shell command under `shellGate: "classify"`/`"always"`), not an
+ *    shell seat installed (the shape tier on every full shell, or the `shellGate: "always"` floor), not an
  *    explicit per-tool mark. The gate records that its own tighten spoke; a policy stamping
  *    `decisionReason: "safety"` on its own ask does not become one.
  *  - `safety_tighten` — the gate's own post-fold tightens over an EXPLICIT fact of the call: the tool's
@@ -84,23 +83,6 @@ export declare function isAskOrigin(v: unknown): v is AskOrigin;
  * other direction (a row for a word that is not in the set).
  */
 export type AssertAllKeysHandled<T extends never> = T;
-/**
- * WHICH mechanism left the persisted-rule lane unable to enforce the person's deny/ask rows for a call —
- * the two-word set behind the one origin word `rule_store_unavailable` (the AUTHORITY semantics are
- * identical; the mechanism differs, and a consumer that renders "the store is down" for a call the lexer
- * could not read is telling the person to fix the wrong thing):
- *  - `store` — the wired store could not be READ for this call (a read failure, a timeout, a thrown adapter);
- *  - `call` — the store was read, but the CALL could not be read against the person's rows (the
- *    tightening lexer's `unreadable` word: an expansion where a rule reads a word, an unterminated quote,
- *    a syntax error — the ask's message carries the lexer's own sentence).
- * The gate reads the lane's answer ONCE into {@link AskOriginFacts.ruleStore}, derives the origin from it and
- * stamps the word onto the surviving ask (`ruleStoreUnreadable`), which the approval request and the durable
- * row carry beside `origin`.
- */
-export declare const RULE_STORE_UNREADABLE_KINDS: readonly ["store", "call"];
-export type RuleStoreUnreadable = (typeof RULE_STORE_UNREADABLE_KINDS)[number];
-/** Membership test for {@link RuleStoreUnreadable} — the screen a row reader applies to a stored word. */
-export declare function isRuleStoreUnreadable(v: unknown): v is RuleStoreUnreadable;
 /** The facts about one call that only the gate holds — the derivation's inputs beyond the decision
  *  itself. Every member is a plain boolean/word read ONCE by the gate, so the derivation is a pure
  *  function that a test can drive arm by arm. */
@@ -113,10 +95,11 @@ export interface AskOriginFacts {
      *  read-back off the decision (a policy can put `decisionReason: "org_rule"` on its own ask; the
      *  gate's cell cannot be written by a policy). */
     readonly org: "rule" | "unavailable" | undefined;
-    /** The gate's own record of its persisted-rule lane's READ: which {@link RuleStoreUnreadable} mechanism
-     *  left the lane's deny/ask rows unenforceable for this call, or undefined (the lane read the store and
-     *  the call). Written only by the gate. */
-    readonly ruleStore?: RuleStoreUnreadable | undefined;
+    /** The gate's own record of its persisted-rule lane's READ: the store was read, but THIS CALL could not be read
+     *  against the person's deny/ask rows (the lane's answer carried the lexer's reason) — the origin
+     *  `rule_store_unavailable`. Absent: the lane read the call, or its store could not be read and its rows took no
+     *  part. Written only by the gate. */
+    readonly ruleCallUnreadable?: boolean;
     /** Which of the gate's OWN post-fold tightens minted the standing ask, if one did — again the gate's
      *  record of its own layer (a tighten replaces an `allow` wholesale, so at most one fires per pass),
      *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. */
@@ -144,7 +127,7 @@ export declare function askOriginOf(decision: Extract<PermissionResult, {
  * Stamp the ask's origin word — and withdraw the disclosures that speak for the TIGHTEN alone when some
  * layer above it is the reason this call is being asked about. Today that is one member: the read
  * boundary's directory offer, whose claim holds only while the tighten is the whole reason. Every higher
- * rung is a layer with a reason of its own — a standing `ask` row, an unreadable rule store, an org
+ * rung is a layer with a reason of its own — a standing `ask` row, a call unreadable against the rows, an org
  * verdict, a hook, the denial-limit fallback — which no directory grant answers, so the ask would stand
  * after the grant and the offer would have promised a clearing it cannot deliver (measured: `cat
  * <out-of-root>` under a standing `Bash(cat:*)` ask rule offered the directory and kept asking after it).
@@ -222,6 +205,8 @@ export interface RuleClearanceFacts {
     /** An EXPLICIT `ask` permission rule matched this call (DSL, stamped at the rule policy's three
      *  matched-ask exits — bare, covering and param). */
     matchedAskRule?: string;
+    /** The ask was minted by the deployment's own governance layer (see {@link import("./tool-policy.js").PermissionResult}). */
+    authoredBy?: "deployment";
     /** The engine-stamped probe mandate (the reversibility probe declared this call's demotion
      *  structural — for the built-in shell probe, a read outside the session's allowed directories). */
     probeMandated?: boolean;
@@ -230,6 +215,9 @@ export interface RuleClearanceFacts {
     /** The ask is being resolved at an ANCESTOR's frozen approver (the three inherited-lane mint sites
      *  pass it literally) — this task's rule lane never adjudicates it. */
     ancestorResolved?: boolean;
+    /** The classes of the contributors the policy fold carried under this ask (see {@link import("./tool-policy.js").PermissionResult});
+     *  a member whose row no rule may clear keeps the question a person's. */
+    foldedAskClasses?: readonly AskClass[];
 }
 /** The ask FACE's mandate members — the bit and its table word, spread at the four mint stations and the
  *  park row. The stations hand it the SAME facts object they hand the rule-offer factory, so the card's word
@@ -239,6 +227,7 @@ export interface RuleClearanceFacts {
 export declare function askMandateMember(ask: RuleClearanceFacts | undefined): {
     mandated?: true;
     mandate?: PersistedRuleMandate;
+    authoredBy?: "deployment";
 };
 /** The clearance facts of an ask the engine did not construct (a policy's verdict), each member read ONCE into
  *  an engine-owned value — for a station that keeps the answer past its own side effects, where the verdict's
@@ -280,64 +269,13 @@ export declare const ORIGIN_IMPLIES_REAL_APPROVAL: {
 };
 /** The fence over the consistency table: `never` while every origin has a row. */
 export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<AskOrigin, keyof typeof ORIGIN_IMPLIES_REAL_APPROVAL>>;
-/**
- * The auto-mode CLASSIFIER's table: may a live classifier verdict resolve an ask of this origin?
- *
- * The classifier is the deployment's delegate for CLASSIFY-doctrine hesitation — the `policy` family,
- * and ONLY it. Every other origin is a question the classifier is structurally the wrong party to
- * answer, each for its own reason (kept beside its row so the reason travels with the fact):
- *  - `content_question`: a permission decider's verdict is neither an answer nor a park — letting it
- *    speak would skip the durable mandate, the park and the content route in one step.
- *  - `ancestor_marked`: a marked call must reach the park with no synchronous decision-maker between.
- *  - `org_unavailable` / `org_rule`: judgment may clear a `requiresRealApproval` bit a POLICY minted,
- *    but not the org's — while adjudication is unavailable the org's answer is unknown, and an org
- *    ask carries the org's own "a person nods" semantic.
- *  - `rule_store_unavailable`: the person's own deny/ask rows are unreadable — whether one forbids this
- *    call is unknown, and a classifier verdict would answer that question in the person's stead.
- *  - `hook`: the deployment's own per-call adjudication; the classifier is its delegate for
- *    hesitation, not an override for its screening face.
- *  - `ask_rule`: a person's standing "ask me each time" — the classifier answering it would decide
- *    whether the person is asked at all, which is the rule's whole content.
- *  - `denial_limit_fallback`: the classifier already spoke (its bound is what minted this ask); an
- *    allow here would un-say the fallback, a block would count it twice.
- *  - `shell_gate_tighten` / `safety_tighten`: YES — the engine's own tightens are hesitation the
- *    deployment armed the classifier to resolve (the classify doctrine's whole point for the shell
- *    tier; the safety marks make the ask NON-BUDGETABLE at the durable park, a different axis from who
- *    may answer it live).
- *    A PROBE mandate riding the same `shell_gate_tighten` word (a read-boundary / out-of-root /
- *    recursive-read probe verdict, or a probe that did not answer) is NOT this table's to admit: the
- *    gate's mandate table excludes it at both classifier stations, the way the allow layer
- *    excludes it from a standing rule. This table says which QUESTIONS are the classifier's; the probe
- *    words say which asks are nobody's but a person's.
- *  - `policy`: YES — including a safety policy's `requiresRealApproval` ask (a live verdict is
- *    judgment, and arming auto mode is the deployment's explicit choice to let the classifier be the
- *    explicit ask-resolution for those classes).
- * Exclusion is skip-not-deny: the ask flows the original chain (park / approver / headless deny) —
- * narrower autonomy, never a lost ask.
- */
-declare const CLASSIFIER_MAY_ANSWER: {
-    readonly content_question: false;
-    readonly ancestor_marked: false;
-    readonly org_unavailable: false;
-    readonly org_rule: false;
-    readonly rule_store_unavailable: false;
-    readonly hook: false;
-    readonly ask_rule: false;
-    readonly denial_limit_fallback: false;
-    readonly shell_gate_tighten: true;
-    readonly safety_tighten: true;
-    readonly policy: true;
-};
-/** The fence over the classifier table: `never` while every origin has a row (pinned by a type test). */
-export type ClassifierTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<AskOrigin, keyof typeof CLASSIFIER_MAY_ANSWER>>;
-/** Whether the auto-mode classifier may resolve an ask of this origin (see the table's contract). */
-export declare function classifierMayAnswer(origin: AskOrigin): boolean;
 /**
  * The MANDATE family — the closed set of words for "this ask stands by STRUCTURE, so a standing allow
- * rule may not retire it". TWO AXES, not one word each: EVERY member binds the persisted-rule lane
- * (membership IS that answer), and the table below says, per word, whether a LIVE decider may answer.
+ * rule may not retire it". A DISCLOSURE vocabulary: the word rides the approval card and the park row
+ * ({@link persistedRuleMandateOf} picks one), while what a live lane may do with the ask is decided by
+ * the ask's CLASS SET ({@link classifyAsk}, {@link MODE_ARBITRATION}) — never by this one word.
  *
- *  - `operator_always` — the coarse doctrine's per-call confirmation for shell commands.
+ *  - `operator_always` — the operator's `always` floor: per-call confirmation for shell commands.
  *  - `tool_marks` — the tool's own egress / irreversibility declaration.
  *  - `probe_mandate` — this call's reversibility probe declared the demotion STRUCTURAL.
  *  - `probe_unanswered` — the probe was consulted and did not answer: the boundary is UNKNOWN.
@@ -350,53 +288,6 @@ export declare const PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool
 export type PersistedRuleMandate = (typeof PERSISTED_RULE_MANDATES)[number];
 /** Membership test for {@link PersistedRuleMandate} — the screen a row reader applies to a stored word. */
 export declare function isPersistedRuleMandate(v: unknown): v is PersistedRuleMandate;
-/**
- * May a LIVE automatic lane answer an ask carrying this word? (The persisted-rule lane is not among
- * them — every word binds it.) TWO COLUMNS, because the two lanes are not asking one question: the
- * sandbox-admission leg asks whether CONTAINMENT already holds what this call would do, while the
- * classifier asks whether the question itself is one a model verdict may settle. Five of the six words
- * happen to answer both the same way today; that is a coincidence of those words, not an invariant, and
- * the columns exist so the sixth does not have to lie in one of them. Each row's reason:
- *  - `write_protection`: yes — upstream parity (that judge runs BEFORE the general allow rules and marks
- *    its ask classifier-approvable); what is refused is a standing rule answering "may this agent rewrite
- *    its own configuration?" once, for good.
- *  - `write_protection_unresolved`: CLASSIFIER no — the table's answer for this call is unknown, and a
- *    verdict clearing it would answer a question the engine could not put. SANDBOX yes — containment
- *    holds the effect whether or not the target is on the table, which is the leg's whole doctrine, and
- *    an isolated environment that cannot resolve a path is the ordinary reason this word appears.
- */
-declare const MANDATE_LANE_ANSWERS: {
-    readonly operator_always: {
-        readonly classifier: true;
-        readonly sandboxAdmission: true;
-    };
-    readonly tool_marks: {
-        readonly classifier: true;
-        readonly sandboxAdmission: true;
-    };
-    readonly probe_mandate: {
-        readonly classifier: false;
-        readonly sandboxAdmission: false;
-    };
-    readonly probe_unanswered: {
-        readonly classifier: false;
-        readonly sandboxAdmission: false;
-    };
-    readonly write_protection: {
-        readonly classifier: true;
-        readonly sandboxAdmission: true;
-    };
-    readonly write_protection_unresolved: {
-        readonly classifier: false;
-        readonly sandboxAdmission: true;
-    };
-};
-/** The fence over the mandate table: `never` while every word has a row. */
-export type MandateTableCoversEveryMandate = AssertAllKeysHandled<Exclude<PersistedRuleMandate, keyof typeof MANDATE_LANE_ANSWERS>>;
-/** Whether the auto-mode CLASSIFIER may answer an ask carrying this word; `undefined` (no mandate) admits it. */
-export declare function classifierMayAnswerMandate(mandate: PersistedRuleMandate | undefined): boolean;
-/** Whether the SANDBOX-ADMISSION leg may admit an ask carrying this word — the other column. */
-export declare function sandboxMayAdmitMandate(mandate: PersistedRuleMandate | undefined): boolean;
 /** WHY a matching persisted allow rule did not clear the ask, in the sentence a PERSON reads — one row per
  *  word (the ladder this replaces ended in a catch-all arm). Display prose; nothing reads it back to decide. */
 declare const MANDATE_DISCLOSURE: {
@@ -423,11 +314,11 @@ export declare function mandateDisclosureOf(mandate: PersistedRuleMandate | unde
  *    are properties of the TOOL and are true of every call on the seat, so a mandate that is true of
  *    this one call must not be shadowed by the tier that happens to carry it (#502: the built-in
  *    shell probe raises it for a listed reader naming a path outside the session's roots — a boundary
- *    the deployment declared, which is exactly what the classify tier alone cannot say);
+ *    the deployment declared, which is exactly what the shape tier alone cannot say);
  *  · `egress` — the tool's own external-write mark, judged next: it is the tool's declaration even
- *    when the coarse doctrine also installed a shell tier on the same seat;
- *  · `shellGated` + tier `"always"` — the operator's per-call confirmation doctrine
- *    (`"operator_always"`); the shell seat installs `"maybe"` under the off and classify doctrines,
+ *    when the shell seat also installed a tier on the same name;
+ *  · `shellGated` + tier `"always"` — the operator's `always` floor, a per-call confirmation
+ *    (`"operator_always"`); without the floor the shell seat installs the shape tier's `"maybe"`,
  *    and THOSE asks stay the rule lane's home turf (`undefined`) — that is the don't-ask-again main case, and the per-call member
  *    above is deliberately the ONLY thing that carves a mandate out of it;
  *  · a tool's OWN `"always"`/`"maybe"` irreversibility tier without the doctrine (`"tool_marks"`).
@@ -455,8 +346,9 @@ export interface MandateMarks {
      *  {@link import("./types.js").ReversibilityVerdict.mandated}. */
     probeMandated?: boolean;
     /** The gate's own record that the write-protection judge covered this call and its table MATCHED
-     *  (`GatePass.writeProtected`, written at the fourth post-fold tighten and there alone). A GATE fact
-     *  like the org words: it rides the pass, not the decision, so no layer outside the engine declares it. */
+     *  (`GatePass.writeProtected`, written at the fourth post-fold tighten for a write tool's target and by the read station
+     *  for a shell command's written targets). A GATE fact like the org words: it rides the pass, not the decision, so no
+     *  layer outside the engine declares it. */
     writeProtected?: boolean;
     /** The same record for the judge's other non-clear verdict — consulted, could not RESOLVE the target.
      *  The pair is the write face's twin of `probeMandated` / `probeUnanswered`, mutually exclusive. */
@@ -478,7 +370,7 @@ export interface MandateMarks {
  * probe judged THIS command not reversible). A policy ask on a shell-gated tool that the doctrine's probe
  * did not tighten and did not mandate is a plain ask: the tier was the probe's instrument, not a risk
  * label, and the park stays the budgetable kind. Before this derivation the static tier alone set the bit,
- * so every policy ask on Bash under `shellGate:"classify"` parked non-budgetable.
+ * so every policy ask on the full shell face parked non-budgetable.
  *
  * Deliberately NOT the rule-lane predicate verbatim: a shell tighten's ask is rule-clearable (a person's
  * past yes to this command shape stands) yet non-budgetable (a budget's mechanical yes is not a person's).
@@ -491,11 +383,344 @@ export declare function safetyAxisOf(marks: MandateMarks & {
     irreversible: boolean;
     shell?: boolean;
 } | undefined;
-/** An ASK that carries its probe's mandate — the per-call member the gate stamped (`probeMandated`), read
- *  through the same family word and lane table, so its three consumers (the inherited classifier station,
- *  the two ancestor sandbox-admission arms) are one predicate. A word the table ADMITS reads here exactly
- *  as no mandate does, which is the answer those lanes already gave it. */
-export declare function probeMandatedAsk(ask: {
-    probeMandated?: boolean;
-}): boolean;
+/**
+ * The permission-mode closed set — the ONE key a caller sets (`TaskSpec.permissionMode`), spelled as the wire and
+ * the reference implementation spell it. A root task's absent key reads `default`; a child's absent key inherits
+ * its parent's effective mode ({@link clampPermissionMode}).
+ */
+export declare const PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "auto", "bypassPermissions", "dontAsk"];
+export type PermissionMode = (typeof PERMISSION_MODES)[number];
+/** Membership test for {@link PermissionMode} — the word crosses process boundaries (a request body, a checkpoint row). */
+export declare function isPermissionMode(v: unknown): v is PermissionMode;
+/**
+ * The reference implementation's mode RANK, used for one thing only: a child's declared mode may not outrank
+ * the ceiling its parent hands down (a declaration is adopted iff `rank[declared] <= rank[ceiling]`, and
+ * `acceptEdits` / `auto` are incomparable). It is a clamping relation, not a per-class strictness order —
+ * `default` and `dontAsk` share a rank, and whether a mode releases a given ask is {@link MODE_ARBITRATION}'s.
+ */
+export declare const PERMISSION_MODE_RANK: {
+    readonly plan: 0;
+    readonly default: 1;
+    readonly dontAsk: 1;
+    readonly acceptEdits: 2;
+    readonly auto: 3;
+    readonly bypassPermissions: 4;
+};
+/** The fence over the rank table: `never` while every mode has a rank. */
+export type RankTableCoversEveryMode = AssertAllKeysHandled<Exclude<PermissionMode, keyof typeof PERMISSION_MODE_RANK>>;
+/**
+ * Clamp a child's DECLARED mode under its parent's ceiling. An absent declaration inherits the ceiling; a
+ * declaration the rank table does not admit under the ceiling is folded back to the ceiling (`clamped: true`
+ * — the caller discloses it, never silently). `bypassPermissions` is adopted only under a `bypassPermissions`
+ * parent, and the incomparable pair (`acceptEdits` ↔ `auto`) is never adopted across.
+ */
+export declare function clampPermissionMode(declared: PermissionMode | undefined, ceiling: PermissionMode): {
+    effective: PermissionMode;
+    clamped: boolean;
+};
+/** WHO put a tool's egress / irreversibility mark on the seat — the deployment's own declaration (`spec.tools`),
+ *  a protocol server's self-report (MCP annotations), or the A2A default (every peer skill is an external write). */
+export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
+/**
+ * The ask CLASS set — WHY a surviving ask exists, as the set of authorities that stand behind it. One ask can
+ * belong to several classes at once (a hook door and an org verdict on one call); a class is derived from the
+ * FACTS the gate's layers established ({@link classifyAsk}), never from the disclosed `origin` / `mandate`
+ * words, which are single-winner projections and hide the members behind them. The array ORDER decides one
+ * thing only: which member is the DISCLOSED word (`askClass`) when several hold — the door-before-word,
+ * most-immune-first order; every lane reads the folded row ({@link foldArbitrationRow}), never the word.
+ */
+export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "operator_forced", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "ordinary"];
+export type AskClass = (typeof ASK_CLASSES)[number];
+/** Membership test for {@link AskClass} — the word crosses the wire on `tool_end.gate.disposition`. */
+export declare function isAskClass(v: unknown): v is AskClass;
+/** The four switches a class carries, one row per class ({@link MODE_ARBITRATION}). */
+export interface ModeArbitrationRow {
+    /** The ask still reaches a person under `bypassPermissions` (the reference implementation's `bypassImmune`). */
+    readonly bypassImmune: boolean;
+    /** The auto-mode classifier may answer it. */
+    readonly classifierEligible: boolean;
+    /** The sandbox-admission leg may admit it (containment holds the effect). */
+    readonly sandboxAdmission: boolean;
+    /** A persisted allow rule may clear it. */
+    readonly ruleMayClear: boolean;
+    /** The reference implementation's rule / safety check answers `ask` for it, so a hook's ask beside it is not the hook's
+     *  forced decision: the call runs the full permission pipeline (the reference's `hookAskFloor`) — under `dontAsk`, a
+     *  refusal rather than a person's question. */
+    readonly hookAskFloor: boolean;
+}
+/**
+ * The mode × class table. `bypassImmune` is the one new column (nothing said it before); the classifier and
+ * sandbox columns are the fold of the two former per-word lane tables (only `probe` moved: the classifier may
+ * now answer it — the read boundary's unestablishable spelling is fed to it as a deny-table row instead), and
+ * `ruleMayClear` restates {@link ruleClearanceOf}'s conclusion per class (a real-approval bit is never rule-clearable).
+ * `mode` is the permission mode's OWN question (`plan`'s two sentences, `decisionReason: "mode"`): the reference
+ * implementation puts it to a person past every allow rule and never to an automatic lane, and its bypass conversion
+ * releases it like any other non-immune ask. `hookAskFloor` marks the classes the reference's rule / safety check answers
+ * `ask` for — an ask rule, a question the tool needs a person for, a dangerous removal, a protected or unresolvable write
+ * target, the session transcript, another's shared artifact.
+ */
+export declare const MODE_ARBITRATION: {
+    readonly content_question: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
+    readonly hook: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly ancestor: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly unverifiable_delete: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: true;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
+    readonly transcript_write: {
+        readonly bypassImmune: false;
+        readonly classifierEligible: true;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
+    readonly org_rule: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly governance_unavailable: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly rule_unreadable: {
+        readonly bypassImmune: false;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly ask_rule: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
+    readonly denial_limit_fallback: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly operator_forced: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: true;
+        readonly sandboxAdmission: true;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly write_protection_unresolved: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: true;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
+    readonly probe: {
+        readonly bypassImmune: false;
+        readonly classifierEligible: true;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly write_protection: {
+        readonly bypassImmune: false;
+        readonly classifierEligible: true;
+        readonly sandboxAdmission: true;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
+    readonly tool_marks_mcp: {
+        readonly bypassImmune: false;
+        readonly classifierEligible: true;
+        readonly sandboxAdmission: true;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly tool_marks_a2a: {
+        readonly bypassImmune: false;
+        readonly classifierEligible: true;
+        readonly sandboxAdmission: true;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly policy_rra: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: true;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly artifact_shared_read: {
+        readonly bypassImmune: false;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
+    readonly mode: {
+        readonly bypassImmune: false;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
+    readonly ordinary: {
+        readonly bypassImmune: false;
+        readonly classifierEligible: true;
+        readonly sandboxAdmission: true;
+        readonly ruleMayClear: true;
+        readonly hookAskFloor: false;
+    };
+};
+/** The fence over the arbitration table: `never` while every class has a row. */
+export type ArbitrationTableCoversEveryClass = AssertAllKeysHandled<Exclude<AskClass, keyof typeof MODE_ARBITRATION>>;
+/** The classes whose own mint puts the `requiresRealApproval` bit on the ask — a bit one of them explains is not
+ *  the bare bit `policy_rra` names. The mark classes (probe / write protection / tool marks / operator forced)
+ *  mint no bit and explain none. */
+export declare const RRA_EXPLAINERS: ReadonlySet<AskClass>;
+/** The classes a permission mode can RELEASE (the `bypassImmune: false` rows) — the only words that can appear on
+ *  `GateDisposition.released.askClass`; every other class reaches a person under every mode. */
+export declare const RELEASABLE_ASK_CLASSES: readonly AskClass[];
+/**
+ * The facts the class derivation reads beside the decision: the origin facts the gate holds, plus the tool
+ * seat's mark PROVENANCE ({@link ToolMarkSource}; a mark with no source reads as the deployment's, fail-closed),
+ * the A2A isolation switch (a set switch turns the A2A default into an operator's mandate), and — at an
+ * ancestor station — the classes the ancestor's own ask carries.
+ */
+export interface AskClassFacts extends AskOriginFacts {
+    readonly toolMarkSources?: ReadonlySet<ToolMarkSource>;
+    readonly a2aIsolatePeers?: boolean;
+    readonly ancestorClasses?: ReadonlySet<AskClass>;
+}
+/** The classification the arbitration reads: the whole set, the disclosed word (the set's first member in
+ *  {@link ASK_CLASSES} order) and the row folded across the set. */
+export interface AskClassification {
+    readonly classes: ReadonlySet<AskClass>;
+    readonly askClass: AskClass;
+    readonly row: ModeArbitrationRow;
+}
+/**
+ * The DECISION half of the class derivation — what ONE ask says about itself through its own members, read
+ * per contributing ask at the policy fold so a member the fold does not copy (a guard mark, the unreadable-rule
+ * fact) is not lost behind the ask that won the slot. The bare-bit rules are applied over THIS ask's own set:
+ * `requiresRealApproval` with no explaining class is `policy_rra`; a self-declared `mandated` with no other
+ * class is `operator_forced` (a deployment probe's own mandate, read conservatively). Returns the specific
+ * classes only — an empty set is "nothing but hesitation", which the caller reads as `ordinary`.
+ */
+export declare function decisionAskClassesOf(d: Extract<PermissionResult, {
+    action: "ask";
+}>): Set<AskClass>;
+/** Fold a class set onto one row: `bypassImmune` and `hookAskFloor` by OR (any immune member keeps the ask; any floored
+ *  member floors a hook's ask), the three permissive switches by AND (one refusing member withholds the lane). An empty
+ *  set is `ordinary`. */
+export declare function foldArbitrationRow(classes: ReadonlySet<AskClass>): ModeArbitrationRow;
+/**
+ * The ONE class derivation: the decision half ({@link decisionAskClassesOf}) joined with the gate's own facts —
+ * the question tool, an ancestor's mark, the org layer's two arms, the persisted lane's unreadable call, the tool
+ * seat's marks with their provenance, the read probe and the write-protection judge's records — then the bare
+ * real-approval rule re-read over the WHOLE set (an org verdict explains a bit the policy did not mint). The
+ * derivation reads facts and members, never the `origin` / `mandate` words.
+ */
+export declare function classifyAsk(d: Extract<PermissionResult, {
+    action: "ask";
+}>, facts: AskClassFacts): AskClassification;
+/** The refusal the model reads when an ask reaches a run with no approver: the reference implementation's sentence
+ *  (2.1.280) — the call did NOT run because this session has no approval surface — with the run's own fact beside it
+ *  and the ask's prompt as what was requested. The gate appends the caller-side remedy. */
+export declare function headlessDenialMessage(toolName: string, askMessage: string): string;
+/**
+ * The ONE sentence a headless auto-deny (an ask that reached its final deny because no approver is wired) adds
+ * after its refusal: the caller-side change that would have let this call run. Read off the effective mode, the
+ * ask's folded class row and whether the call is a covered write (the mode write gate's own question):
+ *  · a class no permission mode releases (`bypassImmune`) — only a person can answer it: wire an approver;
+ *  · the plan mode's own question (`mode`) — leave plan (steer the mode, or approve the plan) or wire an approver;
+ *  · the write gate's own ask under `default` / `auto` — `acceptEdits` lets writes inside the working
+ *    directories through without asking;
+ *  · the same ask under `acceptEdits` — the target lies outside the working directories: add its directory to
+ *    `additionalDirectories`;
+ *  · any other releasable ask — `bypassPermissions` releases it (disclosed on the call).
+ * Every arm also names the approver seat. The refusal's tool text and the `delegation.ask_unresolvable` notice
+ * both carry this sentence — they call this function, neither spells it.
+ */
+export declare function headlessApprovalRemedy(input: {
+    readonly mode: PermissionMode | undefined;
+    readonly classification: AskClassification | undefined;
+    readonly coveredWrite: boolean;
+    readonly unplacedOptions?: {
+        readonly program: "cp" | "mv";
+    };
+}): string;
+/** The reference implementation's sentence (2.1.280) for a `cp` / `mv` the mode will not answer because it carries option
+ *  words — the approval card's message under `acceptEdits` and the head of the headless remedy. */
+export declare function fileCommandOptionsSentence(program: "cp" | "mv"): string;
+/** What the mode arbitration decided for one surviving ask. `ask` hands it on unchanged (park / approver); `accepted` is
+ *  the mode answering an ordinary question itself (`acceptEdits` on one of its file commands — an allow of the mode's own
+ *  policy, like its in-root write gate, and no release: nothing is disclosed as released);
+ *  `released` is an allow the mode granted (disclosed on `tool_end.gate.disposition.released`); `denied_by_mode`
+ *  is a refusal the mode made (`deniedBy: "mode"`). */
+export type Arbitration = {
+    kind: "ask";
+} | {
+    kind: "accepted";
+    mode: "acceptEdits";
+} | {
+    kind: "released";
+    mode: PermissionMode;
+    askClass: AskClass;
+    classes: readonly AskClass[];
+    origin?: AskOrigin;
+    mandate?: PersistedRuleMandate;
+    reason?: "rule_unreadable";
+} | {
+    kind: "denied_by_mode";
+    mode: "bypassPermissions" | "dontAsk";
+    askClass: AskClass;
+    classes: readonly AskClass[];
+};
+/**
+ * The ONE mode read point. `dontAsk` refuses every ask but an operator authority's (an org rule, an operator's forced
+ * confirmation, unreadable governance — a mode stance may not settle an operator-mandated gate) and a hook's that no
+ * member of the set floors (`hookAskFloor`: a hook's ask beside a rule's or a safety check's ask is refused, as the
+ * reference's full pipeline refuses it); `bypassPermissions` refuses a write whose protection could not be judged (a person cannot be asked, and
+ * releasing would be looser than the allow the judge already refuses), keeps every immune class and releases the
+ * rest; `acceptEdits` answers an ORDINARY ask itself on a call the caller vouches is one of the mode's file commands
+ * (`call.fileCommand`, `accepted`); `plan`, `default` and `auto` hand every ask on (plan's own questions were raised by
+ * its write gate; the reference implementation refuses nothing at this point under plan — auto's classifier reads the
+ * row at its own station). Reads the class SET and the folded row — never the disclosed word.
+ */
+export declare function arbitrateByMode(mode: PermissionMode, c: AskClassification, disclosure?: {
+    origin?: AskOrigin;
+    mandate?: PersistedRuleMandate;
+}, call?: {
+    readonly fileCommand?: boolean;
+}): Arbitration;
 export {};