@sema-agent/core 7.34.0 → 7.35.0

package/dist/core/ask-origin.js

@@ -192,26 +192,26 @@ export function isAskClass(v) {
     return ASK_CLASS_SET.has(v);
 }
 export const MODE_ARBITRATION = {
-    content_question: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    hook: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    ancestor: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    unverifiable_delete: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
-    transcript_write: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
-    org_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    governance_unavailable: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    rule_unreadable: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    ask_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    denial_limit_fallback: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    operator_forced: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
-    write_protection_unresolved: { bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false },
-    probe: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
-    write_protection: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
-    tool_marks_mcp: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
-    tool_marks_a2a: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
-    policy_rra: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
-    artifact_shared_read: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    mode: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true },
+    content_question: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    hook: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    ancestor: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    unverifiable_delete: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    transcript_write: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    org_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    governance_unavailable: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    rule_unreadable: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    ask_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    denial_limit_fallback: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    operator_forced: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
+    write_protection_unresolved: { bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true },
+    probe: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    write_protection: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true },
+    tool_marks_mcp: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
+    tool_marks_a2a: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
+    policy_rra: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    artifact_shared_read: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    mode: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true, hookAskFloor: false },
 };
 export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "ancestor", "artifact_shared_read"]);
 export const RELEASABLE_ASK_CLASSES = ASK_CLASSES.filter((c) => !MODE_ARBITRATION[c].bypassImmune);
@@ -248,15 +248,16 @@ export function decisionAskClassesOf(d) {
 export function foldArbitrationRow(classes) {
     if (classes.size === 0)
         return MODE_ARBITRATION.ordinary;
-    let bypassImmune = false, classifierEligible = true, sandboxAdmission = true, ruleMayClear = true;
+    let bypassImmune = false, classifierEligible = true, sandboxAdmission = true, ruleMayClear = true, hookAskFloor = false;
     for (const c of classes) {
         const row = MODE_ARBITRATION[c];
         bypassImmune ||= row.bypassImmune;
         classifierEligible &&= row.classifierEligible;
         sandboxAdmission &&= row.sandboxAdmission;
         ruleMayClear &&= row.ruleMayClear;
+        hookAskFloor ||= row.hookAskFloor;
     }
-    return { bypassImmune, classifierEligible, sandboxAdmission, ruleMayClear };
+    return { bypassImmune, classifierEligible, sandboxAdmission, ruleMayClear, hookAskFloor };
 }
 export function classifyAsk(d, facts) {
     const classes = decisionAskClassesOf({ ...d, foldedAskClasses: undefined });
@@ -332,7 +333,7 @@ export function arbitrateByMode(mode, c, disclosure, call) {
     const classes = ASK_CLASSES.filter((k) => c.classes.has(k));
     switch (mode) {
         case "dontAsk":
-            return has("hook") || has("org_rule") || has("operator_forced") || has("governance_unavailable") ? { kind: "ask" } : { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
+            return (has("hook") && !c.row.hookAskFloor) || has("org_rule") || has("operator_forced") || has("governance_unavailable") ? { kind: "ask" } : { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
         case "bypassPermissions":
             if (has("write_protection_unresolved"))
                 return { kind: "denied_by_mode", mode, askClass: c.askClass, classes };

package/dist/core/ask-question.js

@@ -5,6 +5,7 @@ import { defineTool, errorResult } from "./tools.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
 import { toolFace } from "./tool-catalog-entries.js";
 import { thrownText } from "./thrown-value.js";
+import { callAnswersTo } from "./tool-roster.js";
 export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
 export function classifyQuestionOutcome(outcome) {
     let unavailable;
@@ -134,7 +135,7 @@ export function validateAskQuestions(questions) {
 export function createDurableQuestionPolicy() {
     return {
         check(req) {
-            if (req.toolName !== ASK_USER_QUESTION_TOOL_NAME) {
+            if (!callAnswersTo(req, ASK_USER_QUESTION_TOOL_NAME)) {
                 return { action: "allow" };
             }
             return { action: "ask", message: "AskUserQuestion: awaiting a human answer (durable)" };

package/dist/core/checkpoint-store.d.ts

@@ -868,6 +868,10 @@ export type PendingAction = {
      */
     family?: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
+    /** The names a rule may spell the parked tool by (`ToolCallFace.names`: the wire name, then the aliases that resolve
+     *  to it) off the same roster row at the same mint — the pre-CAS recheck judges an edit against rules written on
+     *  either name, as the live gate judged the original. Absent on a row minted before it ⇒ the row's `toolName` alone. */
+    names?: readonly string[];
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
      * older reader ignores. Unlike that precedent seat — which resume DOES read, through its

package/dist/core/gate-fold.js

@@ -50,7 +50,7 @@ export async function runGateFold(pass) {
     }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && input.shellReadCheck !== undefined) {
         const station = input.shellReadCheck;
-        const judged = station.judge(toolName, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, input.trackedCwd?.(), pass.callSignal ?? input.abortSignal, { toolCallId });
+        const judged = station.judge(pass.req, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, input.trackedCwd?.(), pass.callSignal ?? input.abortSignal, { toolCallId });
         if (judged !== null) {
             let verdict;
             try {
@@ -61,7 +61,7 @@ export async function runGateFold(pass) {
                 if (kind !== "aborted" && input.abortSignal?.aborted !== true) {
                     traceHookCrash(input, new Error(`shell read station ${kind === "timeout" ? "timed out" : "threw"} for tool "${toolName}" (toolCallId ${toolCallId}) — where this call reads could not be established: ${thrownText(err)}`), notifier);
                 }
-                verdict = station.unanswered(toolName, kind === "timeout" ? "the read station timed out" : "the read station could not answer");
+                verdict = station.unanswered(pass.req, kind === "timeout" ? "the read station timed out" : "the read station could not answer");
             }
             applyShellReadVerdict(pass, verdict, toolName, input.shellGated === true);
         }

package/dist/core/gate-lanes.js

@@ -11,6 +11,7 @@ import { CD_GIT_COMPOUND_SENTENCE, changesDirectoryBeforeGit, readOnlyShellVerdi
 import { readShellCommand } from "./shell-lexer.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
 import { catalogRuleFaceOf } from "./tool-registry.js";
+import { callAnswersTo, callFaceSeat } from "./tool-roster.js";
 import { modeAcceptsFileCommand } from "./mode-policy.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 import { exitGate } from "./runner/gate-exit.js";
@@ -169,7 +170,7 @@ export async function runGateLanes(pass) {
         writeProtectionUnresolved: pass.writeProtectionUnresolved === true,
     });
     const askOriginFacts = (org, ruleCallUnreadable) => ({
-        contentQuestion: toolName === ASK_USER_QUESTION_TOOL_NAME,
+        contentQuestion: callAnswersTo(pass.req, ASK_USER_QUESTION_TOOL_NAME),
         markedUnresolvable: markedUnresolvable(),
         org,
         ...(ruleCallUnreadable ? { ruleCallUnreadable } : {}),
@@ -199,7 +200,7 @@ export async function runGateLanes(pass) {
         let decided = current;
         let pending;
         try {
-            pending = Promise.resolve(input.orgRules.adjudicate({ toolName, args, toolCallId }));
+            pending = Promise.resolve(input.orgRules.adjudicate({ toolName, args, toolCallId, ...callFaceSeat(pass.req.face) }));
         }
         catch (err) {
             pending = Promise.resolve({ status: "unavailable", disclosures: [`the org adjudication face threw before answering: ${describeThrown(err)}`] });
@@ -767,14 +768,14 @@ export async function runGateLanes(pass) {
                 }
                 if (editDenied === undefined && input.shellReadCheck !== undefined) {
                     const station = input.shellReadCheck;
-                    const judged = station.judge(toolName, editArgs, input.trackedCwd?.(), callSignal ?? input.abortSignal, { seat: "rejudge", toolCallId });
+                    const judged = station.judge(pass.req, editArgs, input.trackedCwd?.(), callSignal ?? input.abortSignal, { seat: "rejudge", toolCallId });
                     if (judged !== null) {
                         let verdict;
                         try {
                             verdict = await withGateTimeout(judged, boundedAwaitDeadlineMs(), callSignal ?? input.abortSignal, "shellReadStation");
                         }
                         catch {
-                            verdict = station.unanswered(toolName, "the read station could not answer");
+                            verdict = station.unanswered(pass.req, "the read station could not answer");
                         }
                         if (verdict.disposition !== "vouch") {
                             editDenied = {

package/dist/core/governance-codes.d.ts

@@ -12,7 +12,6 @@ export declare const GOVERNANCE_CODES: {
     readonly "config.compliance_required": "transient";
     readonly "config.compliance_denied": "terminal";
     readonly "config.locked_key": "terminal";
-    readonly "config.tool_mount_denied": "terminal";
     readonly "memory.capture_optout_denied": "terminal";
 };
 export type GovernanceCode = keyof typeof GOVERNANCE_CODES;
@@ -42,6 +41,23 @@ export declare const NON_GOVERNANCE_MEMORY_CODES: ReadonlySet<string>;
  * `undefined` (NOT governance — the caller falls through to its ordinary taxonomy).
  */
 export declare function governanceRetryClass(code: string): GovernanceRetryClass | undefined;
+/**
+ * The CLOSED set of codes the `spec.tools` DECLARATION door refuses a caller's tool entry with, at prepare,
+ * before anything mounts: the entry cannot be built from its own members (`config.tool_mount_denied`), a
+ * member over a roster row's wire bound (`config.tool_roster_bound` / `config.tool_name_too_long` /
+ * `config.tool_contract_too_long`), a schema over the row's key bounds (`config.tool_schema_bound`), a
+ * declared face or result card the schema / namespace cannot carry (`config.tool_face_invalid`), a name or
+ * alias in the engine's protocol namespace (`config.tool_name_invalid`), an egress tool declared other than
+ * `write` (`config.egress_requires_write_effect` — also minted, same meaning, for a protocol tool's resolved
+ * axes), a name the run reserves for a tool the engine injects (`config.reserved_tool_name` — structured output,
+ * the skill tool, tool search, the offload reader, an injected protocol tool; `runGoal`'s completion tool, which
+ * refuses before any run). Each ends the run `failed` with the code on `terminal.code`. A caller-shape refusal, not a policy
+ * verdict: none of these is a governance code ({@link GOVERNANCE_CODES}); re-issuing the same declaration
+ * changes nothing. Every mint site at the door types its code against this set.
+ */
+export declare const TOOL_DECLARATION_CODES: readonly ["config.tool_mount_denied", "config.tool_roster_bound", "config.tool_name_too_long", "config.tool_contract_too_long", "config.tool_schema_bound", "config.tool_face_invalid", "config.tool_name_invalid", "config.egress_requires_write_effect", "config.reserved_tool_name"];
+/** A code in {@link TOOL_DECLARATION_CODES}. */
+export type ToolDeclarationCode = (typeof TOOL_DECLARATION_CODES)[number];
 /**
  * The CLOSED registry of reasons a permission-rule sync round may refuse an inbound record or move a
  * local row into the quarantine area (design/182 §4.3/§5.2/§8.1). Same doctrine as

package/dist/core/governance-codes.js

@@ -5,7 +5,6 @@ export const GOVERNANCE_CODES = {
     "config.compliance_required": "transient",
     "config.compliance_denied": "terminal",
     "config.locked_key": "terminal",
-    "config.tool_mount_denied": "terminal",
     "memory.capture_optout_denied": "terminal",
 };
 export const NON_GOVERNANCE_MEMORY_CODES = new Set([
@@ -93,6 +92,17 @@ export function governanceRetryClass(code) {
         return "terminal";
     return undefined;
 }
+export const TOOL_DECLARATION_CODES = [
+    "config.tool_mount_denied",
+    "config.tool_roster_bound",
+    "config.tool_name_too_long",
+    "config.tool_contract_too_long",
+    "config.tool_schema_bound",
+    "config.tool_face_invalid",
+    "config.tool_name_invalid",
+    "config.egress_requires_write_effect",
+    "config.reserved_tool_name",
+];
 export const RULE_SYNC_DROP_CODES = {
     invalid_rule_text: "inbound-refused-or-local-quarantined",
     metadata_mismatch: "inbound-refused-or-local-quarantined",

package/dist/core/hooks.d.ts

@@ -1111,6 +1111,9 @@ export interface ToolGateInput {
      *  isolation scope (onHookError itself, the deny observer, the durable-park observer). The runner
      *  wires this to an `observer.notify_failed` trace event; absent = counted only (unchanged). */
     onNotifyError?: (failure: import("./safe-notify.js").SafeNotifyFailure) => void;
+    /** The call. `toolName` is the name every policy, hook and name-keyed table of this gate reads — the wire name of the
+     *  tool the call dispatches to: the Runner's station resolves a call made under an alias through the roster
+     *  (`rosterToolName`) before this gate runs; a host driving the gate resolves it the same way. */
     event: {
         toolCallId: string;
         toolName: string;

package/dist/core/message-utils.d.ts

@@ -10,7 +10,8 @@ export declare function messageRole(m: AgentMessage): string | undefined;
  * same terms rather than on four. The READ twin of `noteResponseModel` (`brain/stream-shared.ts`), which
  * states the same law on the write side; this side re-tests rather than trusting, because a HOST's own
  * Brain mints these messages too. `undefined` ⇒ the provider named the stamped id, named nothing, or
- * named something unreadable — ONE reading, never three.
+ * named something unreadable — ONE reading, never three. Readable = {@link isProviderEchoShape}, the write
+ * twin's own predicate.
  */
 export declare function providerReportedModel(m: {
     readonly model?: unknown;

package/dist/core/message-utils.js

@@ -1,9 +1,10 @@
+import { isProviderEchoShape } from "../brain/errors.js";
 export function messageRole(m) {
     return m.role;
 }
 export function providerReportedModel(m) {
     const reported = m.responseModel;
-    if (typeof reported !== "string" || reported === "")
+    if (typeof reported !== "string" || !isProviderEchoShape(reported))
         return undefined;
     return reported === m.model ? undefined : reported;
 }

package/dist/core/mode-policy.d.ts

@@ -172,6 +172,9 @@ export declare class PermissionModeController {
     get current(): PermissionMode;
     /** The three-member answer as it stands right now. */
     receipt(): PermissionModeReceipt;
+    /** The ceiling's source moved to another leg (the parent session's next leg); `before` is this leg's receipt under the
+     *  previous one. A ceiling fold the move produced — or changed — is announced, as the construction-time fold is. */
+    ceilingRebound(before: PermissionModeReceipt): void;
     /** Bind the deployment's arming facts (once, after the caps resolved); announces a fold-back if one results. */
     bindArming(arming: PermissionModeArming): PermissionModeReceipt;
     /** A steer: the requested word changes; the arming fold is re-judged; a leg that became `auto` arms its classifier.

package/dist/core/mode-policy.js

@@ -136,6 +136,11 @@ export class PermissionModeController {
             return { ...base, effective: declared, foldedBy: "inherited_ceiling" };
         return { ...base, effective: declared };
     }
+    ceilingRebound(before) {
+        const after = this.receipt();
+        if (after.foldedBy === "inherited_ceiling" && (before.foldedBy !== "inherited_ceiling" || before.effective !== after.effective))
+            this.onFold?.(after);
+    }
     bindArming(arming) {
         const before = this.receipt();
         this.arming = arming;

package/dist/core/permission-rule-model.d.ts

@@ -141,6 +141,10 @@ export declare const READ_RULE_TOOL = "Read";
  * catalog's declarations, exactly as the protective fences' covered set does.
  */
 export declare function ruleToolGrammarOf(toolName: string): "command" | "path" | undefined;
+/** The names the persisted grammar judges a call under: every one of the call's rule names (`ruleNamesOf` — the wire
+ *  name, then the aliases that resolve to it) the grammar speaks for, so a stored `Bash(…)` or `Edit(…)` row reaches a
+ *  tool that answers to that name under another wire name, as a policy's rule does. Empty ⇒ the grammar speaks for none. */
+export declare function laneToolNamesOf(req: Pick<import("./tool-policy.js").ToolCallRequest, "toolName" | "face">): readonly string[];
 /**
  * Match forms. Four members, two of them one predicate:
  *  · `exact` — admits the one string the rule spells.

package/dist/core/permission-rule-model.js

@@ -4,6 +4,7 @@ import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { pathTargetOf } from "./tool-registry.js";
+import { ruleNamesOf } from "./tool-roster.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
@@ -30,6 +31,9 @@ export function ruleToolGrammarOf(toolName) {
         return "command";
     return pathTargetOf(toolName) !== undefined ? "path" : undefined;
 }
+export function laneToolNamesOf(req) {
+    return ruleNamesOf(req).filter((n) => ruleToolGrammarOf(n) !== undefined);
+}
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([
     "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php", "osascript",

package/dist/core/permission-rules.js

@@ -6,6 +6,7 @@ import { pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "../tools/fs/sa
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
 import { ruleDenialSentence } from "./rule-denial-sentence.js";
+import { ruleNamesOf } from "./tool-roster.js";
 export { parsePermissionRule };
 export const BASH_GENERIC_PARAMS = new Set(catalogRuleFaceOf("Bash")?.params ?? []);
 const DEFAULT_CAPS = {
@@ -379,11 +380,30 @@ export function createPermissionRulePolicy(rules, opts) {
         ruleUnreadable: lane,
         requiresRealApproval: true,
     });
+    const entryFor = (req) => {
+        const entries = ruleNamesOf(req).flatMap((n) => {
+            const e = byTool.get(n);
+            return e !== undefined ? [e] : [];
+        });
+        if (entries.length <= 1)
+            return entries[0];
+        const bare = {};
+        for (const b of ["deny", "ask", "allow"]) {
+            const hit = entries.find((e) => e.bare[b] !== undefined)?.bare[b];
+            if (hit !== undefined)
+                bare[b] = hit;
+        }
+        return {
+            bare,
+            param: { deny: entries.flatMap((e) => e.param.deny), ask: entries.flatMap((e) => e.param.ask) },
+            content: { deny: entries.flatMap((e) => e.content.deny), ask: entries.flatMap((e) => e.content.ask) },
+        };
+    };
     return {
         nameSets: [nameSets],
         ...(pathDenyRules.length > 0 ? { pathDenyRules } : {}),
         check(req) {
-            const entry = byTool.get(req.toolName);
+            const entry = entryFor(req);
             const covering = hasCovering && protocolOf(req.toolName) !== undefined;
             if (entry?.bare.deny) {
                 return { action: "deny", message: ruleDenial(req, entry.bare.deny.ruleText, entry.bare.deny.source) };

package/dist/core/persisted-rule-arms.d.ts

@@ -12,7 +12,7 @@
  * (mandates, the org latch, the marked-call seat) rather than a function of the answer alone.
  */
 import type { PermissionResult } from "./tool-policy.js";
-import type { PersistedRuleHit, PersistedRuleHitRule } from "./hooks.js";
+import type { PersistedRuleAnswer, PersistedRuleHit, PersistedRuleHitRule } from "./hooks.js";
 /** The lane's one read, normalized: at most one of `hit` / `unreadable` / `coverage` (the gate's reader
  *  produces it; the arms below read it). */
 export interface PersistedRuleRead {
@@ -23,6 +23,9 @@ export interface PersistedRuleRead {
     /** The lexer's reason when the CALL could not be read against the person's deny/ask rows. */
     readonly reason?: string;
 }
+/** The answers of one store read judged under each of a call's names, folded as one table folds its rows (deny >
+ *  unreadable > ask > allow > coverage > nothing); among equals the first (the wire name's) stands. */
+export declare function strongestAnswer(answers: readonly PersistedRuleAnswer[]): PersistedRuleAnswer;
 /** Display form of a rule set (design/375 §5.1): every rule text is a DISPLAY value on a human trust
  *  boundary, and the set must stay readable however large a lane makes it — each member rides
  *  `inlineUntrusted` (200 cap, the same cap the durable leg's `RiskDescriptor.shadowedRule` carries),

package/dist/core/persisted-rule-arms.js

@@ -1,5 +1,9 @@
 import { decisionAskClassesOf } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+export function strongestAnswer(answers) {
+    const rank = (a) => (a === undefined ? 0 : "unreadable" in a ? 4 : "behavior" in a ? { deny: 5, ask: 3, allow: 2 }[a.behavior] : 1);
+    return answers.reduce((best, a) => (rank(a) > rank(best) ? a : best), undefined);
+}
 export function disclosedRuleSet(rules) {
     const shown = rules.slice(0, 5).map((r) => inlineUntrusted(r.rule, 200));
     const rest = rules.length - shown.length;

package/dist/core/retired-keys.js

@@ -15,5 +15,5 @@ export function assertNoRetiredKeys(bag, table, owner) {
 }
 export const RETIRED_TASK_SPEC_KEYS = Object.freeze({
     autoModeRequested: 'the permission mode is one key now — write `permissionMode: "auto"`',
-    approverPosture: 'the permission mode is one key now — write `permissionMode: "bypassPermissions"` (the engine renders the posture from the effective mode)',
+    approverPosture: 'a posture never authorized anything; drop the key (the engine renders the posture from the effective mode). Releasing asks is a separate decision: `permissionMode: "bypassPermissions"`',
 });

package/dist/core/runner/active-skill-scope.js

@@ -3,6 +3,7 @@ import { pathTargetValue } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
 import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
 import { parseSkillToolEntry, skillSpecifierRejection } from "../skill-tool-specifier.js";
+import { ruleNamesOf } from "../tool-roster.js";
 export class ActiveSkillScope {
     frames = [];
     push(frame) {
@@ -22,7 +23,7 @@ export function createActiveSkillScopePolicy(opts) {
     const { scope, env, rootPath, toolEffects } = opts;
     return {
         async check(req, signal) {
-            const toolName = req.toolName;
+            const names = ruleNamesOf(req);
             const frames = scope.active();
             if (frames.length === 0)
                 return { action: "allow" };
@@ -47,7 +48,7 @@ export function createActiveSkillScopePolicy(opts) {
                 }
                 return { manifest: m, byName };
             });
-            if (perFrame.length === 0 || perFrame.some((f) => !f.byName.has(toolName))) {
+            if (perFrame.length === 0 || perFrame.some((f) => !names.some((n) => f.byName.has(n)))) {
                 const ids = manifests.map((m) => m.lineageId).join(", ");
                 return {
                     action: "deny",
@@ -56,7 +57,7 @@ export function createActiveSkillScopePolicy(opts) {
                 };
             }
             for (const frame of perFrame) {
-                const alternatives = frame.byName.get(toolName) ?? [];
+                const alternatives = names.flatMap((n) => frame.byName.get(n) ?? []);
                 const rejections = [];
                 let admitted = false;
                 for (const entry of alternatives) {
@@ -79,7 +80,7 @@ export function createActiveSkillScopePolicy(opts) {
             const declaredTarget = req.face?.pathTarget;
             const skillScopeEligible = declaredTarget !== undefined && declaredTarget.skillScopeEligible === true;
             if (pathConstrainingActive && !skillScopeEligible) {
-                const eff = toolEffects?.get(toolName) ?? "write";
+                const eff = toolEffects?.get(req.toolName) ?? "write";
                 if (eff !== "read") {
                     const ids = manifests.filter((m) => m.allowPaths?.length).map((m) => m.lineageId).join(", ");
                     return {

package/dist/core/runner/assemble-result.js

@@ -1,5 +1,5 @@
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
-import { extractErrorCode, stripErrorCodePrefix } from "../../brain/errors.js";
+import { extractErrorCode, isProviderEchoShape, stripErrorCodePrefix } from "../../brain/errors.js";
 import { terminalProjection } from "./terminal-projection.js";
 import { haltConsumed } from "./halt-attribution.js";
 import { providerReportedModel } from "../message-utils.js";
@@ -127,7 +127,7 @@ export function terminalCauseOf(final, stats, flags) {
         if (final.isApiErrorMessage === true) {
             apiFailure = {
                 ...(final.apiErrorStatus !== undefined ? { status: final.apiErrorStatus } : {}),
-                ...(final.requestId !== undefined ? { requestId: final.requestId } : {}),
+                ...(typeof final.requestId === "string" && isProviderEchoShape(final.requestId) ? { requestId: final.requestId } : {}),
             };
         }
         const lifted = extractErrorCode(message);

package/dist/core/runner/contracts.d.ts

@@ -59,6 +59,7 @@ import type { ActiveSkillFrame } from "./active-skill-scope.js";
 import type { BudgetAxis } from "./assemble-result.js";
 import type { GitStatusLaneRef } from "./git-status-frame.js";
 import type { SessionReadFileStates } from "./session-read-file-states.js";
+import type { LegModeCeiling, SessionModeSeats } from "./session-mode-seats.js";
 import type { BlockedRef, OutputRef, SkillListingEntry } from "./synthetic-tools.js";
 import type { createAttachmentState, WriteFamily } from "./turn-attachments.js";
 import type { cacheFamilyOf } from "./usage-accounting.js";
@@ -443,6 +444,8 @@ export interface Prepared {
     };
     /** Removes the `spec.signal` abort listener on task end (else a long-lived signal leaks listeners). */
     releaseSignal: () => void;
+    /** The leg has stopped: its children's mode ceiling moves to the session's current leg (called once its loop settled). */
+    endModeCeiling: () => void;
     /**
      * End-of-leg sweep for questions this leg's gate routed to a person. Called once by the
      * run loop at task end, on every exit path. A binding that is still present means a person ANSWERED and
@@ -1362,13 +1365,17 @@ export interface InheritedGate {
      */
     permissionMode?: PermissionMode;
     /**
-     * The parent's LIVE mode seat (opaque half; never serialized): the child's effective mode is DERIVED from it on
-     * every read, so a parent's steer reaches a running child on the child's next arbitration without a forwarding
-     * frame. `sessionId` is the parent's, the address of the user notice a folded child declaration is announced on.
+     * The parent's live mode ceiling (opaque half; never serialized): the parent leg's mode while that leg runs, its
+     * SESSION's current leg after it — the child's effective mode is DERIVED from it on every read, so a parent's steer
+     * reaches a running child on the child's next arbitration without a forwarding frame, and the session's next leg
+     * reaches a child that outlived the leg that spawned it (a session-scoped background child). `sessionId` is the
+     * parent's, the address of the user notice a folded child declaration is announced on. `hold` (the engine's own
+     * ceiling): the child is re-judged at each move of the ceiling, and a fold that produces is announced as at prepare.
      */
     permissionModeCeiling?: {
         readonly current: PermissionMode;
         readonly sessionId: string;
+        readonly hold?: LegModeCeiling["hold"];
     };
     /**
      * Org-memory admission freeze (ruled 2026-08-05): the spawning chain's FROZEN admitted org-scope
@@ -1459,6 +1466,14 @@ export interface InheritedGate {
              * the one every gate consults, here and on every descendant.
              */
             arming?: AutoModeArmingRecipe;
+            /**
+             * The ancestor's live mode ceiling (opaque, never serialized; the chain's `permissionModeCeiling`): the classifier
+             * answers the ancestor's asks only while this reads `auto` — else they go to the frozen approver. Absent (a
+             * re-supplied entry) ⇒ the classifier answers as recorded.
+             */
+            liveMode?: {
+                readonly current: PermissionMode;
+            };
         };
         /**
          * Set ONLY on an entry whose `policy` is the folded form of an ancestor's PreToolUse screening face
@@ -1993,6 +2008,13 @@ export interface RunInternals {
      * channel, same posture as every other field here.
      */
     sessionReadStates?: SessionReadFileStates;
+    /**
+     * The Runner's per-session permission-mode seats ({@link SessionModeSeats}): the chain a leg hands its children
+     * carries its SESSION's seat as the children's ceiling, and each leg binds itself to that seat once its prepare
+     * commits — so a session-scoped background child follows the session's current leg. Always set by the Runner's own
+     * prepare call (overriding any caller value); absent on a standalone prepareTask, which mints a seat of its own.
+     */
+    sessionModeSeats?: SessionModeSeats;
     /** Trusted system-injection sink (`Runner.runLocked` wires it to the live TaskStream queue plus the
      *  current harness lanes; never a public TaskSpec field), ADDRESSED TO THE SESSION rather than to this
      *  run: a producer wired here (a background shell, a watch, a delegation settle) keeps the closure long

package/dist/core/runner/denial-limit-arms.d.ts

@@ -27,6 +27,10 @@ export interface InheritedAutoMode {
     decider: AutoModeDecider;
     denialTracking?: AutoModeDenialTracker;
     arming?: AutoModeArmingRecipe;
+    /** The ancestor's live mode seat: the decider answers only while it reads `auto` (absent ⇒ as recorded). */
+    liveMode?: {
+        readonly current: import("../ask-origin.js").PermissionMode;
+    };
 }
 /**
  * A re-supplied chain entry (a cross-process redemption rebuilt its ancestor's classifier from the
@@ -179,7 +183,8 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
 export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     autoMode: InheritedAutoMode | undefined;
     /** The leg's live permission mode (the gate's seat): under `dontAsk` / `bypassPermissions` / `plan` the decider is not
-     *  dispatched (the mode's arbitration decides first). Absent ⇒ a decider on the chain is dispatched. */
+     *  dispatched (the mode's arbitration decides first). Absent ⇒ a decider on the chain is dispatched (subject to the
+     *  entry's own `autoMode.liveMode`). */
     liveMode?: () => import("../ask-origin.js").PermissionMode;
     ask: A;
     req: ToolCallRequest;

package/dist/core/runner/denial-limit-arms.js

@@ -80,17 +80,17 @@ export function inheritedAskCarry(judged, liveApprover, tracker) {
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, ask, req } = opts;
     const origin = askOriginOf(ask, INHERITED_STATION_FACTS);
-    const modeDecidesFirst = () => {
+    const classifierStandsDown = () => {
         const live = opts.liveMode?.();
-        return live === "dontAsk" || live === "bypassPermissions" || live === "plan";
+        return live === "dontAsk" || live === "bypassPermissions" || live === "plan" || (autoMode?.liveMode !== undefined && autoMode.liveMode.current !== "auto");
     };
-    if (autoMode === undefined || modeDecidesFirst() || !classifyAsk(ask, INHERITED_STATION_FACTS).row.classifierEligible) {
+    if (autoMode === undefined || classifierStandsDown() || !classifyAsk(ask, INHERITED_STATION_FACTS).row.classifierEligible) {
         return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
     }
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
-    if (verdict.kind === "allow" && modeDecidesFirst())
+    if (verdict.kind === "allow" && classifierStandsDown())
         return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
     const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
     if (verdict.kind === "allow") {

package/dist/core/runner/file-history-request.d.ts

@@ -0,0 +1,26 @@
+/** The file-history REQUEST door and its bad-value doors — the pre-acquire half of the file-history phase (`prepare-file-history.ts`). */
+import type { FileHistoryStore } from "../file-history-store.js";
+import type { RunnerDeps, TaskSpec } from "../types.js";
+/**
+ * The file-history REQUEST door: every refusal the request (`TaskSpec`) and the deployment's own seats decide
+ * without the session, the env or the store's contents — the three bad-value doors (`RunnerDeps.onTrackFailure`,
+ * `RunnerDeps.fileHistoryStore` / `fileHistoryCapture`, `TaskSpec.fileHistory`), the retired `rewindFiles` restore
+ * sense, the restoreFiles / resumeAt / rewindFilesTo contradictions, and a restore asked of a run that holds no
+ * history (`rewind.capture_disabled` / `rewind.store_unconfigured`). SYNCHRONOUS and side-effect free; the driver
+ * calls it BEFORE the session is acquired, so a request refused here leaves the session — its leaf included —
+ * exactly as it was. What it resolves rides into the file-history phase (`prepareFileHistory`) unchanged.
+ */
+export declare function resolveFileHistoryRequest(spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "fileHistory">, deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "fileHistoryCapture">): FileHistoryRequest;
+/** What {@link resolveFileHistoryRequest} resolved: the validated seats and words, the run's store (after every off
+ *  switch) and its capture store, and the restore target (`undefined` = no restore asked). */
+export interface FileHistoryRequest {
+    onTrackFailure: "refuse" | "proceed-unprotected";
+    wiredSeat: FileHistoryStore | "disabled" | undefined;
+    runDeclaredOff: boolean;
+    captureOff: boolean;
+    declaredOff: boolean;
+    fileHistoryStore: FileHistoryStore | undefined;
+    captureStore: FileHistoryStore | undefined;
+    rewindTarget: string | undefined;
+    rewindBefore: boolean;
+}