@sema-agent/core 7.34.0 → 7.35.1

package/dist/core/ask-origin.d.ts

@@ -443,6 +443,10 @@ export interface ModeArbitrationRow {
     readonly sandboxAdmission: boolean;
     /** A persisted allow rule may clear it. */
     readonly ruleMayClear: boolean;
+    /** The reference implementation's rule / safety check answers `ask` for it, so a hook's ask beside it is not the hook's
+     *  forced decision: the call runs the full permission pipeline (the reference's `hookAskFloor`) — under `dontAsk`, a
+     *  refusal rather than a person's question. */
+    readonly hookAskFloor: boolean;
 }
 /**
  * The mode × class table. `bypassImmune` is the one new column (nothing said it before); the classifier and
@@ -451,7 +455,9 @@ export interface ModeArbitrationRow {
  * `ruleMayClear` restates {@link ruleClearanceOf}'s conclusion per class (a real-approval bit is never rule-clearable).
  * `mode` is the permission mode's OWN question (`plan`'s two sentences, `decisionReason: "mode"`): the reference
  * implementation puts it to a person past every allow rule and never to an automatic lane, and its bypass conversion
- * releases it like any other non-immune ask.
+ * releases it like any other non-immune ask. `hookAskFloor` marks the classes the reference's rule / safety check answers
+ * `ask` for — an ask rule, a question the tool needs a person for, a dangerous removal, a protected or unresolvable write
+ * target, the session transcript, another's shared artifact.
  */
 export declare const MODE_ARBITRATION: {
     readonly content_question: {
@@ -459,120 +465,140 @@ export declare const MODE_ARBITRATION: {
         readonly classifierEligible: false;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
     };
     readonly hook: {
         readonly bypassImmune: true;
         readonly classifierEligible: false;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly ancestor: {
         readonly bypassImmune: true;
         readonly classifierEligible: false;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly unverifiable_delete: {
         readonly bypassImmune: true;
         readonly classifierEligible: true;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
     };
     readonly transcript_write: {
         readonly bypassImmune: false;
         readonly classifierEligible: true;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
     };
     readonly org_rule: {
         readonly bypassImmune: true;
         readonly classifierEligible: false;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly governance_unavailable: {
         readonly bypassImmune: true;
         readonly classifierEligible: false;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly rule_unreadable: {
         readonly bypassImmune: false;
         readonly classifierEligible: false;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly ask_rule: {
         readonly bypassImmune: true;
         readonly classifierEligible: false;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
     };
     readonly denial_limit_fallback: {
         readonly bypassImmune: true;
         readonly classifierEligible: false;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly operator_forced: {
         readonly bypassImmune: true;
         readonly classifierEligible: true;
         readonly sandboxAdmission: true;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly write_protection_unresolved: {
         readonly bypassImmune: true;
         readonly classifierEligible: false;
         readonly sandboxAdmission: true;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
     };
     readonly probe: {
         readonly bypassImmune: false;
         readonly classifierEligible: true;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly write_protection: {
         readonly bypassImmune: false;
         readonly classifierEligible: true;
         readonly sandboxAdmission: true;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
     };
     readonly tool_marks_mcp: {
         readonly bypassImmune: false;
         readonly classifierEligible: true;
         readonly sandboxAdmission: true;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly tool_marks_a2a: {
         readonly bypassImmune: false;
         readonly classifierEligible: true;
         readonly sandboxAdmission: true;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly policy_rra: {
         readonly bypassImmune: true;
         readonly classifierEligible: true;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly artifact_shared_read: {
         readonly bypassImmune: false;
         readonly classifierEligible: false;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
     };
     readonly mode: {
         readonly bypassImmune: false;
         readonly classifierEligible: false;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
     };
     readonly ordinary: {
         readonly bypassImmune: false;
         readonly classifierEligible: true;
         readonly sandboxAdmission: true;
         readonly ruleMayClear: true;
+        readonly hookAskFloor: false;
     };
 };
 /** The fence over the arbitration table: `never` while every class has a row. */
@@ -613,8 +639,9 @@ export interface AskClassification {
 export declare function decisionAskClassesOf(d: Extract<PermissionResult, {
     action: "ask";
 }>): Set<AskClass>;
-/** Fold a class set onto one row: `bypassImmune` by OR (any immune member keeps the ask), the three permissive
- *  switches by AND (one refusing member withholds the lane). An empty set is `ordinary`. */
+/** Fold a class set onto one row: `bypassImmune` and `hookAskFloor` by OR (any immune member keeps the ask; any floored
+ *  member floors a hook's ask), the three permissive switches by AND (one refusing member withholds the lane). An empty
+ *  set is `ordinary`. */
 export declare function foldArbitrationRow(classes: ReadonlySet<AskClass>): ModeArbitrationRow;
 /**
  * The ONE class derivation: the decision half ({@link decisionAskClassesOf}) joined with the gate's own facts —
@@ -680,9 +707,10 @@ export type Arbitration = {
     classes: readonly AskClass[];
 };
 /**
- * The ONE mode read point. `dontAsk` refuses every ask but a hook's and an operator authority's (an org rule, an
- * operator's forced confirmation, unreadable governance — a mode stance may not settle an operator-mandated
- * gate); `bypassPermissions` refuses a write whose protection could not be judged (a person cannot be asked, and
+ * The ONE mode read point. `dontAsk` refuses every ask but an operator authority's (an org rule, an operator's forced
+ * confirmation, unreadable governance — a mode stance may not settle an operator-mandated gate) and a hook's that no
+ * member of the set floors (`hookAskFloor`: a hook's ask beside a rule's or a safety check's ask is refused, as the
+ * reference's full pipeline refuses it); `bypassPermissions` refuses a write whose protection could not be judged (a person cannot be asked, and
  * releasing would be looser than the allow the judge already refuses), keeps every immune class and releases the
  * rest; `acceptEdits` answers an ORDINARY ask itself on a call the caller vouches is one of the mode's file commands
  * (`call.fileCommand`, `accepted`); `plan`, `default` and `auto` hand every ask on (plan's own questions were raised by

package/dist/core/ask-origin.js

@@ -192,26 +192,26 @@ export function isAskClass(v) {
     return ASK_CLASS_SET.has(v);
 }
 export const MODE_ARBITRATION = {
-    content_question: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    hook: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    ancestor: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    unverifiable_delete: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
-    transcript_write: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
-    org_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    governance_unavailable: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    rule_unreadable: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    ask_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    denial_limit_fallback: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    operator_forced: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
-    write_protection_unresolved: { bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false },
-    probe: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
-    write_protection: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
-    tool_marks_mcp: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
-    tool_marks_a2a: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false },
-    policy_rra: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false },
-    artifact_shared_read: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    mode: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false },
-    ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true },
+    content_question: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    hook: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    ancestor: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    unverifiable_delete: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    transcript_write: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    org_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    governance_unavailable: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    rule_unreadable: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    ask_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    denial_limit_fallback: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    operator_forced: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
+    write_protection_unresolved: { bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true },
+    probe: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    write_protection: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true },
+    tool_marks_mcp: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
+    tool_marks_a2a: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
+    policy_rra: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    artifact_shared_read: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    mode: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true, hookAskFloor: false },
 };
 export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "ancestor", "artifact_shared_read"]);
 export const RELEASABLE_ASK_CLASSES = ASK_CLASSES.filter((c) => !MODE_ARBITRATION[c].bypassImmune);
@@ -248,15 +248,16 @@ export function decisionAskClassesOf(d) {
 export function foldArbitrationRow(classes) {
     if (classes.size === 0)
         return MODE_ARBITRATION.ordinary;
-    let bypassImmune = false, classifierEligible = true, sandboxAdmission = true, ruleMayClear = true;
+    let bypassImmune = false, classifierEligible = true, sandboxAdmission = true, ruleMayClear = true, hookAskFloor = false;
     for (const c of classes) {
         const row = MODE_ARBITRATION[c];
         bypassImmune ||= row.bypassImmune;
         classifierEligible &&= row.classifierEligible;
         sandboxAdmission &&= row.sandboxAdmission;
         ruleMayClear &&= row.ruleMayClear;
+        hookAskFloor ||= row.hookAskFloor;
     }
-    return { bypassImmune, classifierEligible, sandboxAdmission, ruleMayClear };
+    return { bypassImmune, classifierEligible, sandboxAdmission, ruleMayClear, hookAskFloor };
 }
 export function classifyAsk(d, facts) {
     const classes = decisionAskClassesOf({ ...d, foldedAskClasses: undefined });
@@ -332,7 +333,7 @@ export function arbitrateByMode(mode, c, disclosure, call) {
     const classes = ASK_CLASSES.filter((k) => c.classes.has(k));
     switch (mode) {
         case "dontAsk":
-            return has("hook") || has("org_rule") || has("operator_forced") || has("governance_unavailable") ? { kind: "ask" } : { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
+            return (has("hook") && !c.row.hookAskFloor) || has("org_rule") || has("operator_forced") || has("governance_unavailable") ? { kind: "ask" } : { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
         case "bypassPermissions":
             if (has("write_protection_unresolved"))
                 return { kind: "denied_by_mode", mode, askClass: c.askClass, classes };

package/dist/core/ask-question.js

@@ -5,6 +5,7 @@ import { defineTool, errorResult } from "./tools.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
 import { toolFace } from "./tool-catalog-entries.js";
 import { thrownText } from "./thrown-value.js";
+import { callAnswersTo } from "./tool-roster.js";
 export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
 export function classifyQuestionOutcome(outcome) {
     let unavailable;
@@ -134,7 +135,7 @@ export function validateAskQuestions(questions) {
 export function createDurableQuestionPolicy() {
     return {
         check(req) {
-            if (req.toolName !== ASK_USER_QUESTION_TOOL_NAME) {
+            if (!callAnswersTo(req, ASK_USER_QUESTION_TOOL_NAME)) {
                 return { action: "allow" };
             }
             return { action: "ask", message: "AskUserQuestion: awaiting a human answer (durable)" };

package/dist/core/checkpoint-store.d.ts

@@ -868,6 +868,10 @@ export type PendingAction = {
      */
     family?: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
+    /** The names a rule may spell the parked tool by (`ToolCallFace.names`: the wire name, then the aliases that resolve
+     *  to it) off the same roster row at the same mint — the pre-CAS recheck judges an edit against rules written on
+     *  either name, as the live gate judged the original. Absent on a row minted before it ⇒ the row's `toolName` alone. */
+    names?: readonly string[];
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
      * older reader ignores. Unlike that precedent seat — which resume DOES read, through its

package/dist/core/gate-fold.js

@@ -50,7 +50,7 @@ export async function runGateFold(pass) {
     }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && input.shellReadCheck !== undefined) {
         const station = input.shellReadCheck;
-        const judged = station.judge(toolName, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, input.trackedCwd?.(), pass.callSignal ?? input.abortSignal, { toolCallId });
+        const judged = station.judge(pass.req, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, input.trackedCwd?.(), pass.callSignal ?? input.abortSignal, { toolCallId });
         if (judged !== null) {
             let verdict;
             try {
@@ -61,7 +61,7 @@ export async function runGateFold(pass) {
                 if (kind !== "aborted" && input.abortSignal?.aborted !== true) {
                     traceHookCrash(input, new Error(`shell read station ${kind === "timeout" ? "timed out" : "threw"} for tool "${toolName}" (toolCallId ${toolCallId}) — where this call reads could not be established: ${thrownText(err)}`), notifier);
                 }
-                verdict = station.unanswered(toolName, kind === "timeout" ? "the read station timed out" : "the read station could not answer");
+                verdict = station.unanswered(pass.req, kind === "timeout" ? "the read station timed out" : "the read station could not answer");
             }
             applyShellReadVerdict(pass, verdict, toolName, input.shellGated === true);
         }

package/dist/core/gate-lanes.js

@@ -11,6 +11,7 @@ import { CD_GIT_COMPOUND_SENTENCE, changesDirectoryBeforeGit, readOnlyShellVerdi
 import { readShellCommand } from "./shell-lexer.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
 import { catalogRuleFaceOf } from "./tool-registry.js";
+import { callAnswersTo, callFaceSeat } from "./tool-roster.js";
 import { modeAcceptsFileCommand } from "./mode-policy.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 import { exitGate } from "./runner/gate-exit.js";
@@ -169,7 +170,7 @@ export async function runGateLanes(pass) {
         writeProtectionUnresolved: pass.writeProtectionUnresolved === true,
     });
     const askOriginFacts = (org, ruleCallUnreadable) => ({
-        contentQuestion: toolName === ASK_USER_QUESTION_TOOL_NAME,
+        contentQuestion: callAnswersTo(pass.req, ASK_USER_QUESTION_TOOL_NAME),
         markedUnresolvable: markedUnresolvable(),
         org,
         ...(ruleCallUnreadable ? { ruleCallUnreadable } : {}),
@@ -199,7 +200,7 @@ export async function runGateLanes(pass) {
         let decided = current;
         let pending;
         try {
-            pending = Promise.resolve(input.orgRules.adjudicate({ toolName, args, toolCallId }));
+            pending = Promise.resolve(input.orgRules.adjudicate({ toolName, args, toolCallId, ...callFaceSeat(pass.req.face) }));
         }
         catch (err) {
             pending = Promise.resolve({ status: "unavailable", disclosures: [`the org adjudication face threw before answering: ${describeThrown(err)}`] });
@@ -767,14 +768,14 @@ export async function runGateLanes(pass) {
                 }
                 if (editDenied === undefined && input.shellReadCheck !== undefined) {
                     const station = input.shellReadCheck;
-                    const judged = station.judge(toolName, editArgs, input.trackedCwd?.(), callSignal ?? input.abortSignal, { seat: "rejudge", toolCallId });
+                    const judged = station.judge(pass.req, editArgs, input.trackedCwd?.(), callSignal ?? input.abortSignal, { seat: "rejudge", toolCallId });
                     if (judged !== null) {
                         let verdict;
                         try {
                             verdict = await withGateTimeout(judged, boundedAwaitDeadlineMs(), callSignal ?? input.abortSignal, "shellReadStation");
                         }
                         catch {
-                            verdict = station.unanswered(toolName, "the read station could not answer");
+                            verdict = station.unanswered(pass.req, "the read station could not answer");
                         }
                         if (verdict.disposition !== "vouch") {
                             editDenied = {

package/dist/core/governance-codes.d.ts

@@ -12,7 +12,6 @@ export declare const GOVERNANCE_CODES: {
     readonly "config.compliance_required": "transient";
     readonly "config.compliance_denied": "terminal";
     readonly "config.locked_key": "terminal";
-    readonly "config.tool_mount_denied": "terminal";
     readonly "memory.capture_optout_denied": "terminal";
 };
 export type GovernanceCode = keyof typeof GOVERNANCE_CODES;
@@ -42,6 +41,23 @@ export declare const NON_GOVERNANCE_MEMORY_CODES: ReadonlySet<string>;
  * `undefined` (NOT governance — the caller falls through to its ordinary taxonomy).
  */
 export declare function governanceRetryClass(code: string): GovernanceRetryClass | undefined;
+/**
+ * The CLOSED set of codes the `spec.tools` DECLARATION door refuses a caller's tool entry with, at prepare,
+ * before anything mounts: the entry cannot be built from its own members (`config.tool_mount_denied`), a
+ * member over a roster row's wire bound (`config.tool_roster_bound` / `config.tool_name_too_long` /
+ * `config.tool_contract_too_long`), a schema over the row's key bounds (`config.tool_schema_bound`), a
+ * declared face or result card the schema / namespace cannot carry (`config.tool_face_invalid`), a name or
+ * alias in the engine's protocol namespace (`config.tool_name_invalid`), an egress tool declared other than
+ * `write` (`config.egress_requires_write_effect` — also minted, same meaning, for a protocol tool's resolved
+ * axes), a name the run reserves for a tool the engine injects (`config.reserved_tool_name` — structured output,
+ * the skill tool, tool search, the offload reader, an injected protocol tool; `runGoal`'s completion tool, which
+ * refuses before any run). Each ends the run `failed` with the code on `terminal.code`. A caller-shape refusal, not a policy
+ * verdict: none of these is a governance code ({@link GOVERNANCE_CODES}); re-issuing the same declaration
+ * changes nothing. Every mint site at the door types its code against this set.
+ */
+export declare const TOOL_DECLARATION_CODES: readonly ["config.tool_mount_denied", "config.tool_roster_bound", "config.tool_name_too_long", "config.tool_contract_too_long", "config.tool_schema_bound", "config.tool_face_invalid", "config.tool_name_invalid", "config.egress_requires_write_effect", "config.reserved_tool_name"];
+/** A code in {@link TOOL_DECLARATION_CODES}. */
+export type ToolDeclarationCode = (typeof TOOL_DECLARATION_CODES)[number];
 /**
  * The CLOSED registry of reasons a permission-rule sync round may refuse an inbound record or move a
  * local row into the quarantine area (design/182 §4.3/§5.2/§8.1). Same doctrine as

package/dist/core/governance-codes.js

@@ -5,7 +5,6 @@ export const GOVERNANCE_CODES = {
     "config.compliance_required": "transient",
     "config.compliance_denied": "terminal",
     "config.locked_key": "terminal",
-    "config.tool_mount_denied": "terminal",
     "memory.capture_optout_denied": "terminal",
 };
 export const NON_GOVERNANCE_MEMORY_CODES = new Set([
@@ -93,6 +92,17 @@ export function governanceRetryClass(code) {
         return "terminal";
     return undefined;
 }
+export const TOOL_DECLARATION_CODES = [
+    "config.tool_mount_denied",
+    "config.tool_roster_bound",
+    "config.tool_name_too_long",
+    "config.tool_contract_too_long",
+    "config.tool_schema_bound",
+    "config.tool_face_invalid",
+    "config.tool_name_invalid",
+    "config.egress_requires_write_effect",
+    "config.reserved_tool_name",
+];
 export const RULE_SYNC_DROP_CODES = {
     invalid_rule_text: "inbound-refused-or-local-quarantined",
     metadata_mismatch: "inbound-refused-or-local-quarantined",

package/dist/core/hooks.d.ts

@@ -1111,6 +1111,9 @@ export interface ToolGateInput {
      *  isolation scope (onHookError itself, the deny observer, the durable-park observer). The runner
      *  wires this to an `observer.notify_failed` trace event; absent = counted only (unchanged). */
     onNotifyError?: (failure: import("./safe-notify.js").SafeNotifyFailure) => void;
+    /** The call. `toolName` is the name every policy, hook and name-keyed table of this gate reads — the wire name of the
+     *  tool the call dispatches to: the Runner's station resolves a call made under an alias through the roster
+     *  (`rosterToolName`) before this gate runs; a host driving the gate resolves it the same way. */
     event: {
         toolCallId: string;
         toolName: string;

package/dist/core/message-utils.d.ts

@@ -10,7 +10,8 @@ export declare function messageRole(m: AgentMessage): string | undefined;
  * same terms rather than on four. The READ twin of `noteResponseModel` (`brain/stream-shared.ts`), which
  * states the same law on the write side; this side re-tests rather than trusting, because a HOST's own
  * Brain mints these messages too. `undefined` ⇒ the provider named the stamped id, named nothing, or
- * named something unreadable — ONE reading, never three.
+ * named something unreadable — ONE reading, never three. Readable = {@link isProviderEchoShape}, the write
+ * twin's own predicate.
  */
 export declare function providerReportedModel(m: {
     readonly model?: unknown;

package/dist/core/message-utils.js

@@ -1,9 +1,10 @@
+import { isProviderEchoShape } from "../brain/errors.js";
 export function messageRole(m) {
     return m.role;
 }
 export function providerReportedModel(m) {
     const reported = m.responseModel;
-    if (typeof reported !== "string" || reported === "")
+    if (typeof reported !== "string" || !isProviderEchoShape(reported))
         return undefined;
     return reported === m.model ? undefined : reported;
 }

package/dist/core/mode-policy.d.ts

@@ -172,6 +172,9 @@ export declare class PermissionModeController {
     get current(): PermissionMode;
     /** The three-member answer as it stands right now. */
     receipt(): PermissionModeReceipt;
+    /** The ceiling's source moved to another leg (the parent session's next leg); `before` is this leg's receipt under the
+     *  previous one. A ceiling fold the move produced — or changed — is announced, as the construction-time fold is. */
+    ceilingRebound(before: PermissionModeReceipt): void;
     /** Bind the deployment's arming facts (once, after the caps resolved); announces a fold-back if one results. */
     bindArming(arming: PermissionModeArming): PermissionModeReceipt;
     /** A steer: the requested word changes; the arming fold is re-judged; a leg that became `auto` arms its classifier.

package/dist/core/mode-policy.js

@@ -136,6 +136,11 @@ export class PermissionModeController {
             return { ...base, effective: declared, foldedBy: "inherited_ceiling" };
         return { ...base, effective: declared };
     }
+    ceilingRebound(before) {
+        const after = this.receipt();
+        if (after.foldedBy === "inherited_ceiling" && (before.foldedBy !== "inherited_ceiling" || before.effective !== after.effective))
+            this.onFold?.(after);
+    }
     bindArming(arming) {
         const before = this.receipt();
         this.arming = arming;

package/dist/core/permission-rule-model.d.ts

@@ -141,6 +141,10 @@ export declare const READ_RULE_TOOL = "Read";
  * catalog's declarations, exactly as the protective fences' covered set does.
  */
 export declare function ruleToolGrammarOf(toolName: string): "command" | "path" | undefined;
+/** The names the persisted grammar judges a call under: every one of the call's rule names (`ruleNamesOf` — the wire
+ *  name, then the aliases that resolve to it) the grammar speaks for, so a stored `Bash(…)` or `Edit(…)` row reaches a
+ *  tool that answers to that name under another wire name, as a policy's rule does. Empty ⇒ the grammar speaks for none. */
+export declare function laneToolNamesOf(req: Pick<import("./tool-policy.js").ToolCallRequest, "toolName" | "face">): readonly string[];
 /**
  * Match forms. Four members, two of them one predicate:
  *  · `exact` — admits the one string the rule spells.

package/dist/core/permission-rule-model.js

@@ -4,6 +4,7 @@ import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { pathTargetOf } from "./tool-registry.js";
+import { ruleNamesOf } from "./tool-roster.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
@@ -30,6 +31,9 @@ export function ruleToolGrammarOf(toolName) {
         return "command";
     return pathTargetOf(toolName) !== undefined ? "path" : undefined;
 }
+export function laneToolNamesOf(req) {
+    return ruleNamesOf(req).filter((n) => ruleToolGrammarOf(n) !== undefined);
+}
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([
     "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php", "osascript",

package/dist/core/permission-rules.js

@@ -6,6 +6,7 @@ import { pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "../tools/fs/sa
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
 import { ruleDenialSentence } from "./rule-denial-sentence.js";
+import { ruleNamesOf } from "./tool-roster.js";
 export { parsePermissionRule };
 export const BASH_GENERIC_PARAMS = new Set(catalogRuleFaceOf("Bash")?.params ?? []);
 const DEFAULT_CAPS = {
@@ -379,11 +380,30 @@ export function createPermissionRulePolicy(rules, opts) {
         ruleUnreadable: lane,
         requiresRealApproval: true,
     });
+    const entryFor = (req) => {
+        const entries = ruleNamesOf(req).flatMap((n) => {
+            const e = byTool.get(n);
+            return e !== undefined ? [e] : [];
+        });
+        if (entries.length <= 1)
+            return entries[0];
+        const bare = {};
+        for (const b of ["deny", "ask", "allow"]) {
+            const hit = entries.find((e) => e.bare[b] !== undefined)?.bare[b];
+            if (hit !== undefined)
+                bare[b] = hit;
+        }
+        return {
+            bare,
+            param: { deny: entries.flatMap((e) => e.param.deny), ask: entries.flatMap((e) => e.param.ask) },
+            content: { deny: entries.flatMap((e) => e.content.deny), ask: entries.flatMap((e) => e.content.ask) },
+        };
+    };
     return {
         nameSets: [nameSets],
         ...(pathDenyRules.length > 0 ? { pathDenyRules } : {}),
         check(req) {
-            const entry = byTool.get(req.toolName);
+            const entry = entryFor(req);
             const covering = hasCovering && protocolOf(req.toolName) !== undefined;
             if (entry?.bare.deny) {
                 return { action: "deny", message: ruleDenial(req, entry.bare.deny.ruleText, entry.bare.deny.source) };

package/dist/core/persisted-rule-arms.d.ts

@@ -12,7 +12,7 @@
  * (mandates, the org latch, the marked-call seat) rather than a function of the answer alone.
  */
 import type { PermissionResult } from "./tool-policy.js";
-import type { PersistedRuleHit, PersistedRuleHitRule } from "./hooks.js";
+import type { PersistedRuleAnswer, PersistedRuleHit, PersistedRuleHitRule } from "./hooks.js";
 /** The lane's one read, normalized: at most one of `hit` / `unreadable` / `coverage` (the gate's reader
  *  produces it; the arms below read it). */
 export interface PersistedRuleRead {
@@ -23,6 +23,9 @@ export interface PersistedRuleRead {
     /** The lexer's reason when the CALL could not be read against the person's deny/ask rows. */
     readonly reason?: string;
 }
+/** The answers of one store read judged under each of a call's names, folded as one table folds its rows (deny >
+ *  unreadable > ask > allow > coverage > nothing); among equals the first (the wire name's) stands. */
+export declare function strongestAnswer(answers: readonly PersistedRuleAnswer[]): PersistedRuleAnswer;
 /** Display form of a rule set (design/375 §5.1): every rule text is a DISPLAY value on a human trust
  *  boundary, and the set must stay readable however large a lane makes it — each member rides
  *  `inlineUntrusted` (200 cap, the same cap the durable leg's `RiskDescriptor.shadowedRule` carries),

package/dist/core/persisted-rule-arms.js

@@ -1,5 +1,9 @@
 import { decisionAskClassesOf } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+export function strongestAnswer(answers) {
+    const rank = (a) => (a === undefined ? 0 : "unreadable" in a ? 4 : "behavior" in a ? { deny: 5, ask: 3, allow: 2 }[a.behavior] : 1);
+    return answers.reduce((best, a) => (rank(a) > rank(best) ? a : best), undefined);
+}
 export function disclosedRuleSet(rules) {
     const shown = rules.slice(0, 5).map((r) => inlineUntrusted(r.rule, 200));
     const rest = rules.length - shown.length;

package/dist/core/retired-keys.js

@@ -15,5 +15,5 @@ export function assertNoRetiredKeys(bag, table, owner) {
 }
 export const RETIRED_TASK_SPEC_KEYS = Object.freeze({
     autoModeRequested: 'the permission mode is one key now — write `permissionMode: "auto"`',
-    approverPosture: 'the permission mode is one key now — write `permissionMode: "bypassPermissions"` (the engine renders the posture from the effective mode)',
+    approverPosture: 'a posture never authorized anything; drop the key (the engine renders the posture from the effective mode). Releasing asks is a separate decision: `permissionMode: "bypassPermissions"`',
 });

package/dist/core/runner/active-skill-scope.js

@@ -3,6 +3,7 @@ import { pathTargetValue } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
 import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
 import { parseSkillToolEntry, skillSpecifierRejection } from "../skill-tool-specifier.js";
+import { ruleNamesOf } from "../tool-roster.js";
 export class ActiveSkillScope {
     frames = [];
     push(frame) {
@@ -22,7 +23,7 @@ export function createActiveSkillScopePolicy(opts) {
     const { scope, env, rootPath, toolEffects } = opts;
     return {
         async check(req, signal) {
-            const toolName = req.toolName;
+            const names = ruleNamesOf(req);
             const frames = scope.active();
             if (frames.length === 0)
                 return { action: "allow" };
@@ -47,7 +48,7 @@ export function createActiveSkillScopePolicy(opts) {
                 }
                 return { manifest: m, byName };
             });
-            if (perFrame.length === 0 || perFrame.some((f) => !f.byName.has(toolName))) {
+            if (perFrame.length === 0 || perFrame.some((f) => !names.some((n) => f.byName.has(n)))) {
                 const ids = manifests.map((m) => m.lineageId).join(", ");
                 return {
                     action: "deny",
@@ -56,7 +57,7 @@ export function createActiveSkillScopePolicy(opts) {
                 };
             }
             for (const frame of perFrame) {
-                const alternatives = frame.byName.get(toolName) ?? [];
+                const alternatives = names.flatMap((n) => frame.byName.get(n) ?? []);
                 const rejections = [];
                 let admitted = false;
                 for (const entry of alternatives) {
@@ -79,7 +80,7 @@ export function createActiveSkillScopePolicy(opts) {
             const declaredTarget = req.face?.pathTarget;
             const skillScopeEligible = declaredTarget !== undefined && declaredTarget.skillScopeEligible === true;
             if (pathConstrainingActive && !skillScopeEligible) {
-                const eff = toolEffects?.get(toolName) ?? "write";
+                const eff = toolEffects?.get(req.toolName) ?? "write";
                 if (eff !== "read") {
                     const ids = manifests.filter((m) => m.allowPaths?.length).map((m) => m.lineageId).join(", ");
                     return {