@sema-agent/core 7.35.2 → 7.36.0

package/dist/core/tool-name-readings.d.ts

@@ -0,0 +1,366 @@
+/**
+ * The ONE table of how every per-call site keyed on an engine tool name reads a call's names, and the read ports a
+ * site must go through. A call answers to several names once a caller tool declares aliases (the model's spelling,
+ * the wire name the gate resolves it to, the other aliases that resolve to the same row); which of them a site reads
+ * is a property of the SITE, declared here once:
+ *
+ *  · `any`      — a TIGHTEN keyed on an engine name set, or a rule name a user wrote: the call is held under EVERY name it
+ *                 answers to ({@link heldBy}); a set-valued table is read as the union of its entries ({@link heldValues}).
+ *  · `seat`     — a multi-key seat keyed on engine names: ONE name is chosen ({@link seatOf}) and every key of the seat is
+ *                 read under it. `tier` = the name whose irreversibility tier is strictest (`never < maybe < always`, an
+ *                 absent tier lowest, ties to the earlier name of the call); `member` = the first name the table holds.
+ *  · `wire`     — a GRANT or a ROUTING keyed on an engine name: the call's wire name only ({@link wireOf}).
+ *  · `spelling` — a record of what the model said (stream frames, transcripts, counters): the harness event's own name;
+ *                 no port — listed so the table is complete.
+ *
+ * A site passes its {@link SiteId}; the port's parameter type admits only the ids of its kind, so moving a row to another
+ * kind fails to compile at the site. `gate:name-readings` holds the rest: a name-keyed table read outside a port, a call's
+ * name compared with an engine name outside {@link wireOf}, and a site id spelled at more than one place.
+ *
+ * Layer-0 vocabulary: depends on nothing but the tool declaration's tier type and, type-only, the mark-source word
+ * (`ToolMarkSource`); nothing here runs at import time.
+ */
+import type { ToolSpec } from "./tool-spec.js";
+export type NameReading = {
+    readonly kind: "any";
+    readonly file: string;
+} | {
+    readonly kind: "wire";
+    readonly file: string;
+} | {
+    readonly kind: "spelling";
+    readonly file: string;
+} | {
+    readonly kind: "seat";
+    readonly rank: "tier" | "member";
+    readonly file: string;
+};
+export declare const NAME_READINGS: {
+    readonly "gate.compliance": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "gate.egress": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "gate.peerMessage": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "gate.markSources": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "gate.shellSeat": {
+        readonly kind: "seat";
+        readonly rank: "tier";
+        readonly file: string;
+    };
+    readonly "gate.sandboxBoundary.egress": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "gate.sandboxBoundary.hand": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "gate.preToolUse": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "fold.readStation": {
+        readonly kind: "seat";
+        readonly rank: "member";
+        readonly file: string;
+    };
+    readonly "lanes.contentQuestionClass": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "lanes.readOnlyShellAllow": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "lanes.modeFileCommand": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "lanes.contentAskRoute": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "lanes.orgContentAskExemption": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "lanes.persistedEditSkip": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "lanes.persistedLaneSkip": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "lanes.allowLayerQuestionSkip": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "lanes.sandboxQuestionSkip": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "policy.nameLists": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "policy.shellToolsList": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "policy.projectionReplay": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "policy.sessionRules": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "policy.sessionRules.effect": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "policy.skillScope": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "policy.skillScope.effect": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "policy.permissionRules": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "policy.persistedGrammar": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "policy.durableQuestion": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "policy.sensitivePathGuardedByName": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "floor.protectivePathTarget": {
+        readonly kind: "seat";
+        readonly rank: "member";
+        readonly file: string;
+    };
+    readonly "mode.planRosterRow": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "offer.laneTool": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "offer.orgQuestionExemption": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "offer.marks": {
+        readonly kind: "seat";
+        readonly rank: "tier";
+        readonly file: string;
+    };
+    readonly "offer.marks.egress": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "park.riskDescriptor": {
+        readonly kind: "seat";
+        readonly rank: "tier";
+        readonly file: string;
+    };
+    readonly "park.syncFirstRoute": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "report.riskAxes": {
+        readonly kind: "seat";
+        readonly rank: "tier";
+        readonly file: string;
+    };
+    readonly "report.riskAxes.egress": {
+        readonly kind: "any";
+        readonly file: string;
+    };
+    readonly "report.riskAxes.negatives": {
+        readonly kind: "seat";
+        readonly rank: "member";
+        readonly file: string;
+    };
+    readonly "verify.wroteThisRun": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "verify.wroteThisRunSeed": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "event.toolStartEnd": {
+        readonly kind: "spelling";
+        readonly file: string;
+    };
+    readonly "hook.postToolUse": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "hook.postToolUseFailure": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "hook.postToolBatch": {
+        readonly kind: "spelling";
+        readonly file: string;
+    };
+    readonly "stats.subagentToolCounter": {
+        readonly kind: "spelling";
+        readonly file: string;
+    };
+    readonly "activity.sink": {
+        readonly kind: "spelling";
+        readonly file: string;
+    };
+    readonly "reconcile.orphanEffect": {
+        readonly kind: "spelling";
+        readonly file: string;
+    };
+    readonly "inherited.questionFloat": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "park.contentKindProjection": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "resume.contentAskRow": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "resume.editRecheckQuestionSkip": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "resume.questionArgsShown": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "budget.exemptResult": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+    readonly "compaction.compactableResult": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
+};
+type Readings = typeof NAME_READINGS;
+export type SiteId = keyof Readings;
+export type AnySite = {
+    [K in SiteId]: Readings[K]["kind"] extends "any" ? K : never;
+}[SiteId];
+export type WireSite = {
+    [K in SiteId]: Readings[K]["kind"] extends "wire" ? K : never;
+}[SiteId];
+export type SpellingSite = {
+    [K in SiteId]: Readings[K]["kind"] extends "spelling" ? K : never;
+}[SiteId];
+export type TierSeatSite = {
+    [K in SiteId]: Readings[K] extends {
+        kind: "seat";
+        rank: "tier";
+    } ? K : never;
+}[SiteId];
+export type MemberSeatSite = {
+    [K in SiteId]: Readings[K] extends {
+        kind: "seat";
+        rank: "member";
+    } ? K : never;
+}[SiteId];
+export type SeatSite = TierSeatSite | MemberSeatSite;
+/** A call as a site reads it: the wire name and, on a gated request, the face whose `names` lists every name it answers to. */
+export interface NamedCall {
+    readonly toolName: string;
+    readonly face?: {
+        readonly names?: readonly string[];
+    } | undefined;
+}
+/**
+ * Every name the call answers to — the face's `names` when they include the call's name, else the call's name alone (a
+ * bare request, or a face minted for another name). A tool-name rule a host matches reaches the call iff its name is on
+ * this list; inside the engine only the ports below read it.
+ */
+export declare function ruleNamesOf(call: NamedCall): readonly string[];
+/** An `any` site's membership read: does `set` hold any of the call's names? */
+export declare function heldBy(site: AnySite, set: {
+    has(name: string): boolean;
+}, call: NamedCall): boolean;
+/** An `any` site's value read: every entry `map` holds under any of the call's names, in the call's name order. */
+export declare function heldValues<V>(site: AnySite, map: {
+    get(name: string): V | undefined;
+}, call: NamedCall): V[];
+/** A `wire` site's read: the call's wire name. */
+export declare function wireOf(site: WireSite, call: {
+    readonly toolName: string;
+}): string;
+/** A tool's irreversibility tier, the one vocabulary `ToolSpec.irreversibility` declares. */
+type IrreversibilityTierWord = NonNullable<ToolSpec["irreversibility"]>;
+/** One seat, read under ONE name: the name the port chose, the value it holds there, and the seat's other keys under that name. */
+export interface Seat<V> {
+    readonly name: string;
+    readonly value: V;
+    /** Another key of this seat, read under the seat's name. */
+    read<W>(table: {
+        get(name: string): W | undefined;
+    }): W | undefined;
+    /** Another key of this seat, a membership, read under the seat's name. */
+    holds(set: {
+        has(name: string): boolean;
+    }): boolean;
+}
+/** A tier seat: the risk seat of the engine's irreversibility tables. */
+export interface TierSeat extends Seat<IrreversibilityTierWord> {
+    /**
+     * The seat's shell-seat provenance: the seat's name is in `shellGated` (the engine's shell seat is the sole positive
+     * source of its tier) AND no name the call answers to carries a deployment mark in `markSources` — a mark on any of the
+     * call's names outranks the shell seat's attribution.
+     */
+    shellGated(shellGated: {
+        has(name: string): boolean;
+    }, markSources: {
+        get(name: string): ReadonlySet<string> | undefined;
+    }): boolean;
+}
+/**
+ * A `seat` site's read. A `tier` seat takes the irreversibility tier table and picks the name whose tier is strictest;
+ * a `member` seat takes a table (a map, or a set whose value reads `true`) and picks the first name it holds.
+ */
+export declare function seatOf(site: TierSeatSite, tiers: {
+    get(name: string): IrreversibilityTierWord | undefined;
+}, call: NamedCall): TierSeat | undefined;
+export declare function seatOf<V>(site: MemberSeatSite, table: {
+    get(name: string): V | undefined;
+}, call: NamedCall): Seat<V> | undefined;
+export declare function seatOf(site: MemberSeatSite, table: {
+    has(name: string): boolean;
+}, call: NamedCall): Seat<true> | undefined;
+export declare function seatOf<V>(site: MemberSeatSite, table: {
+    get(name: string): V | undefined;
+} | {
+    has(name: string): boolean;
+}, call: NamedCall): Seat<V | true> | undefined;
+export {};

package/dist/core/tool-name-readings.js

@@ -0,0 +1,136 @@
+const GATE = "src/core/runner/prepare-gate-stations.ts";
+const CHAIN = "src/core/runner/prepare-policy-chain.ts";
+const LANES = "src/core/gate-lanes.ts";
+const POLICY = "src/core/tool-policy.ts";
+const OFFER = "src/core/runner/permission-rule-lanes.ts";
+const PARK = "src/core/runner/prepare-park-ask.ts";
+const HANDLERS = "src/core/runner/run-harness-handlers.ts";
+const any = (file) => ({ kind: "any", file });
+const wire = (file) => ({ kind: "wire", file });
+const spelling = (file) => ({ kind: "spelling", file });
+const seat = (rank, file) => ({ kind: "seat", rank, file });
+export const NAME_READINGS = {
+    "gate.compliance": any(GATE),
+    "gate.egress": any(GATE),
+    "gate.peerMessage": any(GATE),
+    "gate.markSources": any(GATE),
+    "gate.shellSeat": seat("tier", GATE),
+    "gate.sandboxBoundary.egress": any(CHAIN),
+    "gate.sandboxBoundary.hand": wire(CHAIN),
+    "gate.preToolUse": wire("src/core/hooks.ts"),
+    "fold.readStation": seat("member", "src/tools/fs/shell-read-check.ts"),
+    "lanes.contentQuestionClass": any(LANES),
+    "lanes.readOnlyShellAllow": wire(LANES),
+    "lanes.modeFileCommand": wire(LANES),
+    "lanes.contentAskRoute": wire(LANES),
+    "lanes.orgContentAskExemption": wire(LANES),
+    "lanes.persistedEditSkip": wire(LANES),
+    "lanes.persistedLaneSkip": wire(LANES),
+    "lanes.allowLayerQuestionSkip": wire(LANES),
+    "lanes.sandboxQuestionSkip": wire(LANES),
+    "policy.nameLists": any(POLICY),
+    "policy.shellToolsList": any(POLICY),
+    "policy.projectionReplay": any(POLICY),
+    "policy.sessionRules": any("src/core/runner/session-rule-policy.ts"),
+    "policy.sessionRules.effect": wire("src/core/runner/session-rule-policy.ts"),
+    "policy.skillScope": any("src/core/runner/active-skill-scope.ts"),
+    "policy.skillScope.effect": wire("src/core/runner/active-skill-scope.ts"),
+    "policy.permissionRules": any("src/core/permission-rules.ts"),
+    "policy.persistedGrammar": any("src/core/permission-rule-model.ts"),
+    "policy.durableQuestion": any("src/core/ask-question.ts"),
+    "policy.sensitivePathGuardedByName": any("src/core/sensitive-path-policy.ts"),
+    "floor.protectivePathTarget": seat("member", "src/core/tool-registry.ts"),
+    "mode.planRosterRow": wire("src/core/mode-policy.ts"),
+    "offer.laneTool": wire(OFFER),
+    "offer.orgQuestionExemption": wire(OFFER),
+    "offer.marks": seat("tier", OFFER),
+    "offer.marks.egress": any(OFFER),
+    "park.riskDescriptor": seat("tier", PARK),
+    "park.syncFirstRoute": wire(PARK),
+    "report.riskAxes": seat("tier", CHAIN),
+    "report.riskAxes.egress": any(CHAIN),
+    "report.riskAxes.negatives": seat("member", CHAIN),
+    "verify.wroteThisRun": wire(HANDLERS),
+    "verify.wroteThisRunSeed": wire("src/core/runner/run-attachment-seats.ts"),
+    "event.toolStartEnd": spelling(HANDLERS),
+    "hook.postToolUse": wire(GATE),
+    "hook.postToolUseFailure": wire(GATE),
+    "hook.postToolBatch": spelling(HANDLERS),
+    "stats.subagentToolCounter": spelling("src/agents/subagent.ts"),
+    "activity.sink": spelling(HANDLERS),
+    "reconcile.orphanEffect": spelling("src/core/session-reconcile.ts"),
+    "inherited.questionFloat": wire(CHAIN),
+    "park.contentKindProjection": wire("src/core/checkpoint-store.ts"),
+    "resume.contentAskRow": wire("src/core/runner/decide-continuation.ts"),
+    "resume.editRecheckQuestionSkip": wire("src/core/runner/resume-apply.ts"),
+    "resume.questionArgsShown": wire("src/core/runner/run-leg.ts"),
+    "budget.exemptResult": wire("src/core/tool-result-budget.ts"),
+    "compaction.compactableResult": wire("src/core/context-edit.ts"),
+};
+export function ruleNamesOf(call) {
+    const names = call.face?.names;
+    return names !== undefined && names.includes(call.toolName) ? names : [call.toolName];
+}
+function readingOf(site, kind) {
+    const r = NAME_READINGS[site];
+    if (r.kind !== kind)
+        throw new Error(`tool-name reading: site ${JSON.stringify(site)} is a ${r.kind} site, read through the ${kind} port`);
+    return r;
+}
+export function heldBy(site, set, call) {
+    readingOf(site, "any");
+    return ruleNamesOf(call).some((n) => set.has(n));
+}
+export function heldValues(site, map, call) {
+    readingOf(site, "any");
+    const out = [];
+    for (const n of ruleNamesOf(call)) {
+        const v = map.get(n);
+        if (v !== undefined)
+            out.push(v);
+    }
+    return out;
+}
+export function wireOf(site, call) {
+    readingOf(site, "wire");
+    return call.toolName;
+}
+const DEPLOYMENT_MARK = "deployment";
+const TIER_RANK = { never: 1, maybe: 2, always: 3 };
+function seatAt(name, value) {
+    return {
+        name,
+        value,
+        read: (table) => table.get(name),
+        holds: (set) => set.has(name),
+    };
+}
+export function seatOf(site, table, call) {
+    const r = readingOf(site, "seat");
+    const names = ruleNamesOf(call);
+    const valueAt = (n) => (typeof table.get === "function" ? table.get(n) : table.has(n) ? true : undefined);
+    if (r.kind === "seat" && r.rank === "tier") {
+        let best;
+        for (const n of names) {
+            const v = valueAt(n);
+            if (v === undefined)
+                continue;
+            if (best === undefined || TIER_RANK[v] > TIER_RANK[best.value])
+                best = { name: n, value: v };
+        }
+        if (best === undefined)
+            return undefined;
+        const chosen = seatAt(best.name, best.value);
+        const tierSeat = {
+            ...chosen,
+            shellGated: (shellGated, markSources) => shellGated.has(chosen.name) && !names.some((n) => markSources.get(n)?.has(DEPLOYMENT_MARK) === true),
+        };
+        return tierSeat;
+    }
+    for (const n of names) {
+        const v = valueAt(n);
+        if (v !== undefined)
+            return seatAt(n, v);
+    }
+    return undefined;
+}

package/dist/core/tool-policy.d.ts

@@ -4,10 +4,10 @@ import { type Settlement } from "./gate-outcome.js";
 /** A tool call presented to a policy before it executes. */
 /** design/388 B6 — the per-call face (see {@link ToolCallRequest.face}). */
 export interface ToolCallFace {
-    /** Every name a tool-name rule may spell this tool by: the tool's wire name first, then each alias that resolves to
-     *  it on the leg's roster (`rosterToolName`). A rule reaches the call iff its tool name is on this list — read it
-     *  through {@link ruleNamesOf}, never off `toolName` alone. Absent on a face rebuilt from a park row that predates it
-     *  (the call's own name is then the list). */
+    /** Every name a tool-name rule may spell this tool by: the name the call was made under first (the model's spelling),
+     *  then the tool's wire name and each other alias that resolves to it on the leg's roster (`rosterToolName`). A rule
+     *  reaches the call iff its tool name is on this list — read it through `ruleNamesOf`, never off `toolName` alone.
+     *  Absent on a face rebuilt from a park row that predates it (the call's own name is then the list). */
     names?: readonly string[];
     family: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
@@ -18,7 +18,7 @@ export interface ToolCallFace {
 }
 export interface ToolCallRequest {
     /** The tool's wire name — the Runner's gate resolves a call made under an alias to the wire name of the tool it
-     *  dispatches to before any policy runs (`rosterToolName`); the names a rule may use for it are {@link ruleNamesOf}. */
+     *  dispatches to before any policy runs (`rosterToolName`); the names a rule may use for it are `ruleNamesOf`. */
     toolName: string;
     args: unknown;
     toolCallId: string;

package/dist/core/tool-policy.js

@@ -8,7 +8,7 @@ import { sanitizeAutoModeArmingRecipe } from "./auto-mode-arming.js";
 import { join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
-import { ruleNamesOf, toolNameSetHas } from "./tool-roster.js";
+import { heldBy } from "./tool-name-readings.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
@@ -17,6 +17,8 @@ import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermission
 import { protocolOf } from "./protocol-table.js";
 import { isAbsoluteForFamily, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { ASSIGNMENT_PREFIX, writtenAssignmentPrefix } from "../tools/fs/bash-program-position.js";
+const nameListHolds = (set, req) => heldBy("policy.nameLists", set, req);
+const shellToolsListHolds = (set, req) => heldBy("policy.shellToolsList", set, req);
 export function advertisedWritableRootsSeat(seat) {
     return seat === undefined ? {} : { advertisedWritableRoots: Object.freeze([...seat.roots]) };
 }
@@ -165,21 +167,21 @@ export function namespacedCoveringHit(covering, toolName) {
     return covering.length > 0 && covering.some((e) => namespacedRuleNameCovers(e, toolName));
 }
 export function checkToolPolicyProjection(projection, req) {
-    const names = ruleNamesOf(req);
+    const listed = (list) => heldBy("policy.projectionReplay", { has: (n) => list.includes(n) }, req);
     for (const c of projection.components) {
         if (c.kind === "tool_deny") {
-            if (names.some((n) => c.names.includes(n)) || namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
+            if (listed(c.names) || namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by a frozen inherited policy projection` };
             }
             continue;
         }
         if (c.kind === "tool_allowlist") {
-            if (!names.some((n) => c.names.includes(n)) && !namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
+            if (!listed(c.names) && !namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in a frozen inherited policy projection's allowlist` };
             }
             continue;
         }
-        if (!names.some((n) => c.tools.includes(n)))
+        if (!listed(c.tools))
             continue;
         const command = req.args?.command;
         if (typeof command !== "string") {
@@ -388,10 +390,10 @@ export function createAllowDenyPolicy(opts) {
         nameSets: [{ ...(opts.allow ? { allow: [...opts.allow] } : {}), ...(opts.deny ? { deny: [...opts.deny] } : {}) }],
         check(req) {
             const toolName = req.toolName;
-            if (toolNameSetHas(deny, req) || namespacedCoveringHit(denyCovering, toolName)) {
+            if (nameListHolds(deny, req) || namespacedCoveringHit(denyCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (allow && !toolNameSetHas(allow, req) && !namespacedCoveringHit(allowCovering, toolName)) {
+            if (allow && !nameListHolds(allow, req) && !namespacedCoveringHit(allowCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
             return ALLOW;
@@ -428,10 +430,10 @@ export function createApprovalPolicy(opts) {
         ],
         async check(req, signal) {
             const toolName = req.toolName;
-            if (toolNameSetHas(deny, req) || namespacedCoveringHit(denyCovering, toolName)) {
+            if (nameListHolds(deny, req) || namespacedCoveringHit(denyCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (toolNameSetHas(need, req) || namespacedCoveringHit(needCovering, toolName)) {
+            if (nameListHolds(need, req) || namespacedCoveringHit(needCovering, toolName)) {
                 const attest = (d, settlement) => attestEngineSettlement(d, { settlement, origin: "policy" }, req);
                 if (signal?.aborted) {
                     return attest({ action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)` }, settledByNobody("task_aborted"));
@@ -481,7 +483,7 @@ export function createApprovalPolicy(opts) {
                 }
                 return attest({ action: "deny", message: `approval denied for "${req.toolName}"` }, settledByPerson("human_refused", undefined));
             }
-            if (opts.denyByDefault && !toolNameSetHas(auto, req) && !namespacedCoveringHit(autoCovering, toolName)) {
+            if (opts.denyByDefault && !nameListHolds(auto, req) && !namespacedCoveringHit(autoCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
             }
             return ALLOW;
@@ -621,7 +623,7 @@ export function createCoarseCommandNamePolicy(opts) {
     return brandPolicyAskClass({
         projection,
         check(req) {
-            if (!toolNameSetHas(shellTools, req))
+            if (!shellToolsListHolds(shellTools, req))
                 return ALLOW;
             const command = req.args?.command;
             if (typeof command !== "string") {
@@ -875,7 +877,7 @@ export function createUnverifiableDeletePolicy(opts) {
     const shellTools = canonicalToolNameSet(opts?.tools);
     return brandPolicyAskClass({
         check(req) {
-            if (!toolNameSetHas(shellTools, req))
+            if (!shellToolsListHolds(shellTools, req))
                 return ALLOW;
             const command = req.args?.command;
             if (typeof command !== "string")
@@ -972,7 +974,7 @@ export function createTranscriptIntegrityPolicy(opts) {
     });
     return brandPolicyAskClass({
         check(req) {
-            if (toolNameSetHas(shellTools, req)) {
+            if (shellToolsListHolds(shellTools, req)) {
                 const command = req.args?.command;
                 if (typeof command !== "string")
                     return ALLOW;

package/dist/core/tool-registry.d.ts

@@ -52,36 +52,6 @@ export interface ToolCallLike {
     } | undefined;
 }
 type CallPathTarget = ToolCallPathTarget;
-/**
- * The names a tool-name rule may spell this call's tool by — the face's `names` when they include the call's name,
- * else the call's name alone (a bare request, or a face minted for another name). Every name-keyed matcher and the
- * protective path floor read a rule's tool name against THIS list, which is the roster's one canonicalization seen
- * from the call's side: a rule written against an alias and one written against the wire name reach the same calls.
- */
-export declare function ruleNamesOf(req: Pick<ToolCallLike, "toolName" | "face">): readonly string[];
-/** Does the call answer to `name` — is it one of the call's names ({@link ruleNamesOf})? The engine's TIGHTENS keyed on
- *  one of its own tool names read this, so a tool that wears the name under any of its names is tightened (the
- *  fail-safe direction); a grant or a routing keyed on an engine tool name reads the wire name. */
-export declare function callAnswersTo(req: Pick<ToolCallLike, "toolName" | "face">, name: string): boolean;
-/** Does a set of rule tool names name this call's tool ({@link ruleNamesOf})? */
-export declare function toolNameSetHas(set: {
-    has(name: string): boolean;
-}, req: Pick<ToolCallLike, "toolName" | "face">): boolean;
-/** Does `set` hold any of the call's names ({@link ruleNamesOf})? The read of a MEMBERSHIP tighten keyed on the engine's
- *  own tool names (the egress set, a read station's tools, the compliance veto): a tool is held under every name it
- *  answers to. A grant or a routing keyed on an engine tool name reads the wire name instead. */
-export declare function anyNamed(set: {
-    has(name: string): boolean;
-}, names: readonly string[]): boolean;
-/** The first of the call's names ({@link ruleNamesOf}, the spelling first) that `map` holds an entry for, with the entry.
- *  The read of a SEAT keyed on the engine's own tool names (a tier, a mark's sources): every key of one seat is read under
- *  the ONE name this returns — a seat is never assembled from two names' entries. */
-export declare function firstNamed<V>(map: {
-    get(name: string): V | undefined;
-}, names: readonly string[]): {
-    readonly name: string;
-    readonly value: V;
-} | undefined;
 /**
  * design/388 B6/B17 — the path target a PROTECTIVE fence reads (a deny-list judging a write's target: sensitive paths,
  * frozen paths, write protection, the transcript gate; edit tracking): the object face's own declaration first, the
@@ -89,7 +59,7 @@ export declare function firstNamed<V>(map: {
  * face that declares none. Reading the catalog for an undeclared same-name tool can only TIGHTEN a deny-list (it adds
  * a slot to judge — the pre-388 posture, never wider), which is exactly why this floor is wrong for a grant.
  *
- * The floor reads EVERY name the call answers to (`ruleNamesOf`: the face's `names`, else the call's name alone) in
+ * The floor is a `member` seat over every name the call answers to (the face's `names`, else the call's name alone) in
  * the face's order — the name the call was made under first, then the wire name, then the other aliases — and the
  * first name the catalog declares a target for wins: a call made under a catalog name and resolved to a tool that
  * declares none keeps THAT name's slot, also when the tool answers to a second catalog name with another slot.