@sema-agent/core 7.35.2 → 7.37.0

package/dist/core/gate-lanes.js

@@ -1,4 +1,4 @@
-import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, describeThrown } from "./tool-policy.js";
+import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, describeThrown, refuseOutOfContractDecision } from "./tool-policy.js";
 import { arbitrateByMode, classifyAsk, fileCommandOptionsSentence, mandateDisclosureOf, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
 import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { classifierUnavailableArm } from "./classifier-unavailable-arm.js";
@@ -11,13 +11,15 @@ import { CD_GIT_COMPOUND_SENTENCE, changesDirectoryBeforeGit, readOnlyShellVerdi
 import { readShellCommand } from "./shell-lexer.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
 import { catalogRuleFaceOf } from "./tool-registry.js";
-import { callAnswersTo, callFaceSeat } from "./tool-roster.js";
+import { callFaceSeat } from "./tool-roster.js";
+import { heldBy, wireOf } from "./tool-name-readings.js";
 import { modeAcceptsFileCommand } from "./mode-policy.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 import { exitGate } from "./runner/gate-exit.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
+const QUESTION_TOOL_NAMES = new Set([ASK_USER_QUESTION_TOOL_NAME]);
 function isPlainOwnRecord(x) {
     try {
         if (x === null || typeof x !== "object" || Array.isArray(x))
@@ -170,7 +172,7 @@ export async function runGateLanes(pass) {
         writeProtectionUnresolved: pass.writeProtectionUnresolved === true,
     });
     const askOriginFacts = (org, ruleCallUnreadable) => ({
-        contentQuestion: callAnswersTo(pass.req, ASK_USER_QUESTION_TOOL_NAME),
+        contentQuestion: heldBy("lanes.contentQuestionClass", QUESTION_TOOL_NAMES, pass.req),
         markedUnresolvable: markedUnresolvable(),
         org,
         ...(ruleCallUnreadable ? { ruleCallUnreadable } : {}),
@@ -179,9 +181,7 @@ export async function runGateLanes(pass) {
         ...(input.toolMarkSources !== undefined ? { toolMarkSources: input.toolMarkSources } : {}),
         ...(input.a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
     });
-    const classifyStanding = (unstamped, facts) => {
-        pass.askClassification = classifyAsk(unstamped, facts);
-    };
+    const classifyStanding = (unstamped, facts) => (pass.askClassification = classifyAsk(unstamped, facts));
     let orgTightenCount = 0;
     let orgEvidence = (() => {
         const w = input.orgRules === undefined ? "not_wired" : "not_adjudicated";
@@ -195,7 +195,7 @@ export async function runGateLanes(pass) {
     const applyOrgLayer = async (current, args) => {
         if (input.orgRules === undefined)
             return { decision: current, org: undefined };
-        if (toolName === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
+        if (wireOf("lanes.orgContentAskExemption", pass.req) === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
             return { decision: current, org: undefined };
         let decided = current;
         let pending;
@@ -271,7 +271,7 @@ export async function runGateLanes(pass) {
         return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
     };
     const laneReq = { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) };
-    const laneAnswer = input.persistedRules !== undefined && pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
+    const laneAnswer = input.persistedRules !== undefined && wireOf("lanes.persistedLaneSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
     {
         const tightened = applyPersistedTightening(pass.decision, laneAnswer);
         pass.decision = tightened.decision;
@@ -299,7 +299,7 @@ export async function runGateLanes(pass) {
             pass.decision.action === "ask" &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
-            pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            wireOf("lanes.allowLayerQuestionSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME &&
             !markedUnresolvable();
         if (input.persistedRules && allowLayerMayClear()) {
             const answer = laneAnswer ?? {};
@@ -353,10 +353,9 @@ export async function runGateLanes(pass) {
         const originFacts = askOriginFacts(orgAnswer.org, ruleCallUnreadableOf(laneAnswer));
         if (pass.decision.action === "ask") {
             const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
-            classifyStanding(stamped, originFacts);
-            pass.decision = stampAskOrigin(stamped, originFacts);
+            pass.decision = stampAskOrigin(stamped, originFacts, classifyStanding(stamped, originFacts));
         }
-        if (allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() && pass.probeBoundaryDeclined !== true && pass.req.toolName === COMMAND_RULE_TOOL) {
+        if (allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() && pass.probeBoundaryDeclined !== true && wireOf("lanes.readOnlyShellAllow", pass.req) === COMMAND_RULE_TOOL) {
             const commandParam = catalogRuleFaceOf(COMMAND_RULE_TOOL)?.primaryParams[0] ?? "command";
             const args = pass.req.args;
             const command = typeof args === "object" && args !== null && !Array.isArray(args) ? args[commandParam] : undefined;
@@ -397,8 +396,7 @@ export async function runGateLanes(pass) {
             else if (verdict?.kind === "unavailable") {
                 const arm = classifierUnavailableArm({ ask: pass.decision, req: pass.req, cause: verdict.cause, attribution: verdict.classifier, seat: input.autoMode.unavailable, aborted: classifySignal?.aborted === true });
                 if (arm.kind === "asked") {
-                    classifyStanding(arm.ask, originFacts);
-                    pass.decision = stampAskOrigin(arm.ask, originFacts);
+                    pass.decision = stampAskOrigin(arm.ask, originFacts, classifyStanding(arm.ask, originFacts));
                     pass.classifierRound = undefined;
                 }
                 else
@@ -416,8 +414,7 @@ export async function runGateLanes(pass) {
                         requiresRealApproval: true,
                         denialLimitFallback: tracked.fallback,
                     };
-                    classifyStanding(fallbackAsk, originFacts);
-                    pass.decision = stampAskOrigin(fallbackAsk, originFacts);
+                    pass.decision = stampAskOrigin(fallbackAsk, originFacts, classifyStanding(fallbackAsk, originFacts));
                 }
                 else {
                     const denied = {
@@ -435,7 +432,7 @@ export async function runGateLanes(pass) {
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&
-            pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            wireOf("lanes.sandboxQuestionSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
@@ -463,7 +460,7 @@ export async function runGateLanes(pass) {
         if (pass.decision.action === "ask" && input.permissionMode !== undefined && pass.askClassification !== undefined) {
             const standing = pass.decision;
             const mode = input.permissionMode();
-            const fileCommandByWord = modeAcceptsFileCommand(mode, toolName, pass.policyRewrite ?? pass.currentInput);
+            const fileCommandByWord = modeAcceptsFileCommand(mode, wireOf("lanes.modeFileCommand", pass.req), pass.policyRewrite ?? pass.currentInput);
             const verdict = arbitrateByMode(mode, pass.askClassification, { ...(standing.origin !== undefined ? { origin: standing.origin } : {}), ...(standing.mandate !== undefined ? { mandate: standing.mandate } : {}) }, { fileCommand: pass.shellWritesPlaced === true && fileCommandByWord });
             if (verdict.kind === "ask" && fileCommandByWord && pass.shellWritesPlaced !== true && pass.shellUnplacedOptions !== undefined && pass.askClassification.classes.size === 1 && pass.askClassification.classes.has("ordinary")) {
                 pass.decision = { ...standing, message: fileCommandOptionsSentence(pass.shellUnplacedOptions.program) };
@@ -515,6 +512,7 @@ export async function runGateLanes(pass) {
             ...(callSignal !== undefined ? { signal: callSignal } : {}),
             ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
             ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
+            ...(d.action === "ask" && d.askClass !== undefined && d.classes !== undefined ? { askClass: d.askClass, classes: d.classes } : {}),
             ...(d.action === "ask" && d.mandated === true ? { mandated: true, ...(d.mandate !== undefined ? { mandate: d.mandate } : {}) } : {}),
             ...(d.action === "ask" && d.authoredBy === "deployment" ? { authoredBy: "deployment" } : {}),
         });
@@ -528,7 +526,7 @@ export async function runGateLanes(pass) {
                     return { suspend: suspended, preToolContext: pass.preToolContext };
             }
         }
-        if (pass.decision.action === "ask" && pass.req.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+        if (pass.decision.action === "ask" && wireOf("lanes.contentAskRoute", pass.req) === ASK_USER_QUESTION_TOOL_NAME) {
             const outcome = input.resolveContentAsk !== undefined ? await (callSignal !== undefined ? input.resolveContentAsk(pass.req, callSignal) : input.resolveContentAsk(pass.req)) : { kind: "unavailable", parkDeclined: false };
             if (outcome.kind === "answered") {
                 pass.decision = { action: "allow", updatedInput: outcome.presentedInput };
@@ -660,7 +658,7 @@ export async function runGateLanes(pass) {
                     if (adjudicate) {
                         try {
                             const editReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
-                            recheck = await (callSignal !== undefined ? adjudicate(editReq, callSignal) : adjudicate(editReq));
+                            recheck = refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(editReq, callSignal) : adjudicate(editReq)));
                         }
                         catch (err) {
                             recheck = {
@@ -692,7 +690,7 @@ export async function runGateLanes(pass) {
                         break;
                     }
                     let editRuleCallUnreadable = false;
-                    if (input.persistedRules !== undefined && toolName !== ASK_USER_QUESTION_TOOL_NAME) {
+                    if (input.persistedRules !== undefined && wireOf("lanes.persistedEditSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME) {
                         const editLane = await readPersistedRules({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
                         editRuleCallUnreadable = ruleCallUnreadableOf(editLane);
                         const editTightened = applyPersistedTightening(recheck, editLane);
@@ -718,8 +716,7 @@ export async function runGateLanes(pass) {
                     const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
                     markedThisRound = undefined;
                     const editFacts = askOriginFacts(editOrg.org, editRuleCallUnreadable);
-                    classifyStanding(editAskSnapshot, editFacts);
-                    const editAskDecision = stampAskOrigin(editAskSnapshot, editFacts);
+                    const editAskDecision = stampAskOrigin(editAskSnapshot, editFacts, classifyStanding(editAskSnapshot, editFacts));
                     if (input.permissionMode !== undefined && pass.askClassification !== undefined) {
                         const editVerdict = arbitrateByMode(input.permissionMode(), pass.askClassification, { ...(editAskDecision.origin !== undefined ? { origin: editAskDecision.origin } : {}), ...(editAskDecision.mandate !== undefined ? { mandate: editAskDecision.mandate } : {}) });
                         if (editVerdict.kind === "released") {

package/dist/core/gate-outcome.d.ts

@@ -7,7 +7,7 @@
  * policy composes: a policy says allow / ask / deny; this file says how the pass that consumed that
  * verdict ended.
  */
-import { type AskClass, type AskOrigin, type AssertAllKeysHandled, type PermissionMode, type PersistedRuleMandate } from "./ask-origin.js";
+import { type AskClass, type AskOrigin, type AssertAllKeysHandled, type ModeReleaseReason, type PermissionMode, type PersistedRuleMandate } from "./ask-origin.js";
 import { type AutoModeClassifierRound } from "./auto-mode.js";
 /**
  * How the wait an ask was in ENDED — the closed set. One word per way a wait can end; the `who` on the
@@ -303,7 +303,8 @@ export type GateDisposition = {
  * A permission MODE released a surviving ask — the allowed disposition's account of the question it did not put
  * to anyone: the mode, the disclosed class word (`askClass`, the first member of the folded set in `ASK_CLASSES`
  * order — one of {@link RELEASABLE_ASK_CLASSES}), the whole set, and the origin / mandate words the card would
- * have shown. `reason: "rule_unreadable"` marks a release over a rule the call could not be read against.
+ * have shown. `reason` is a member of {@link import("./ask-origin.js").MODE_RELEASE_REASONS} (`isModeReleaseReason`):
+ * `"rule_unreadable"` marks a release over a rule the call could not be read against; absent, the release names none.
  */
 export interface ModeRelease {
     mode: PermissionMode;
@@ -311,7 +312,7 @@ export interface ModeRelease {
     classes: readonly AskClass[];
     origin?: AskOrigin;
     mandate?: PersistedRuleMandate;
-    reason?: "rule_unreadable";
+    reason?: ModeReleaseReason;
 }
 /** The two modes that refuse on their own account (`deniedBy: "mode"`): `dontAsk` every non-authority ask,
  *  `bypassPermissions` a write whose protection could not be judged. `plan` refuses nothing here — its questions ask. */
@@ -341,8 +342,9 @@ export interface ModeRefusal {
  *      {@link import("./auto-mode.js").AUTO_MODE_FALLBACK_CAUSES} — a record whose `to` and `modelUsed`
  *      disagree would let a reader answer "which model decided this call?" two ways;
  *  I7  `disposition.released` present ⇒ `kind === "allowed"`, no settlement, `mode` is `bypassPermissions`,
- *      `askClass` is a releasable class and every member of `classes` is an ask class — a mode releases nothing
- *      a person answered and nothing the table calls immune;
+ *      `askClass` is a releasable class, every member of `classes` is an ask class, `origin` / `reason`, when
+ *      present, are members of their closed sets, and `reason` names a member of `classes` (the mint takes it from
+ *      that set) — a mode releases nothing a person answered and nothing the table calls immune;
  *  I8  `deniedBy === "mode"` ⇔ `mode` present (`bypassPermissions` | `dontAsk`) with `askClass` and `classes`.
  * Nothing here is read out of an ABSENCE: an ordinary allow with no ask is `{ disposition: { kind: "allowed" } }`,
  * a direct policy deny is `{ disposition: { kind: "denied", deniedBy: "policy" } }`, and neither carries a

package/dist/core/gate-outcome.js

@@ -1,4 +1,4 @@
-import { isAskClass, isAskOrigin, isPermissionMode, RELEASABLE_ASK_CLASSES } from "./ask-origin.js";
+import { isAskClass, isAskOrigin, isModeReleaseReason, isPermissionMode, RELEASABLE_ASK_CLASSES } from "./ask-origin.js";
 import { isAutoModeFallbackCause } from "./auto-mode.js";
 export const SETTLEMENT_KINDS = [
     "human_allowed",
@@ -128,6 +128,10 @@ export function screenGateOutcome(g) {
             defects.push("I7: released.classes must be a non-empty list of ask classes");
         if (r.origin !== undefined && !isAskOrigin(r.origin))
             defects.push(`I7: released.origin "${String(r.origin)}" is outside the closed set`);
+        if (r.reason !== undefined && !isModeReleaseReason(r.reason))
+            defects.push(`I7: released.reason "${String(r.reason)}" is outside the closed set`);
+        else if (r.reason !== undefined && Array.isArray(r.classes) && !r.classes.includes(r.reason))
+            defects.push(`I7: released.reason "${r.reason}" is not a member of released.classes`);
     }
     if (d.kind === "denied") {
         const modeRefusal = d.deniedBy === "mode";

package/dist/core/governance-codes.d.ts

@@ -135,7 +135,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "resume.legacy_mode_seed_migrated", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "resume.legacy_mode_seed_migrated", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -178,6 +178,7 @@ export const ENGINE_NOTICE_CODES = [
     "route.classifier_unroutable",
     "route.base_url_changed_key_unchanged",
     "route.response_model_mismatch",
+    "route.tool_call_id_folded",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
     "steering.parked_input_blocked",
@@ -269,6 +270,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "route.classifier_unroutable": "operator",
     "route.base_url_changed_key_unchanged": "operator",
     "route.response_model_mismatch": "operator",
+    "route.tool_call_id_folded": "operator",
     "skills.listing_truncated": "operator",
     "agents.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",

package/dist/core/hooks.d.ts

@@ -474,6 +474,9 @@ export interface PostToolUseFailureResult {
 /** One resolved call in a postToolBatch payload (CC PostToolBatchToolCall shape, thin projection —
  *  `response` is a bounded text digest of the result, never the full details object). */
 export interface PostToolBatchCall {
+    /** The name the model spelled on the tool_use block (an alias stays an alias) — the reference's PostToolBatch payload
+     *  names each block the same way, while the per-call post hooks receive the resolved tool's wire name. Correlate
+     *  the two faces by `toolCallId`. */
     toolName: string;
     input: unknown;
     toolCallId: string;
@@ -1734,6 +1737,12 @@ export interface AskCarry {
     /** The surviving ask's engine-stamped origin word ({@link import("./ask-origin.js").AskOrigin}), persisted
      *  on the row so a durable card is rendered by the same word the synchronous card is. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
+    /** The surviving ask's engine-stamped class ({@link import("./tool-policy.js").AskRequest.askClass}), persisted on the
+     *  row so a durable approval seat answers by the class the synchronous one reads. Present exactly when
+     *  {@link classes} is. */
+    readonly askClass?: import("./ask-origin.js").AskClass;
+    /** The whole class set beside it ({@link import("./tool-policy.js").AskRequest.classes}), in `ASK_CLASSES` order. */
+    readonly classes?: readonly import("./ask-origin.js").AskClass[];
     /** The stamped mandate ({@link import("./tool-policy.js").AskRequest.mandated}) — the park site's
      *  rule-offer facts read it, so a parked mandated ask offers no rule, like the live card. */
     readonly mandated?: true;
@@ -1744,11 +1753,14 @@ export interface AskCarry {
 }
 /** What a durable row persists of an {@link AskCarry}: the fallback member COPIED (the row never aliases
  *  the gate's object; its window is already `0` — the gate's carry mint is the one writer of that
- *  number) and the origin word only when it is a member of the closed set (the carry is typed, but the
- *  row is the boundary a host reads back through — the same screen the summary applies). */
+ *  number), the origin word only when it is a member of the closed set, and the class pair only when it is
+ *  well-formed, as a fresh copy (the carry is typed, but the row is the boundary a host reads back through —
+ *  the same screen the summary applies to the word). */
 export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
     origin?: import("./ask-origin.js").AskOrigin;
+    askClass?: import("./ask-origin.js").AskClass;
+    classes?: readonly import("./ask-origin.js").AskClass[];
 };
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant

package/dist/core/hooks.js

@@ -7,10 +7,11 @@ import { runGateLanes } from "./gate-lanes.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
-import { isAskOrigin } from "./ask-origin.js";
+import { isAskOrigin, screenAskClassMembers } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
+import { wireOf } from "./tool-name-readings.js";
 export const DEFAULT_HOOK_TIMEOUT_MS = 600_000;
 export const MAX_HOOK_TIMEOUT_MS = 2_147_483_647;
 const POST_ABORT_GRACE_MS = 1_000;
@@ -238,18 +239,21 @@ export function askCarryRowMembers(carry) {
     if (carry === undefined)
         return {};
     const origin = carry.origin;
+    const classed = screenAskClassMembers(carry.askClass, carry.classes);
     return {
         ...(carry.denialLimitFallback !== undefined ? { denialLimitFallback: { ...carry.denialLimitFallback } } : {}),
         ...(isAskOrigin(origin) ? { origin } : {}),
+        ...(classed !== undefined ? classed : {}),
     };
 }
 export async function runToolGate(input) {
     const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
     const { toolCallId, toolName } = event;
     const callSignal = input.callSignal;
+    const screenedName = wireOf("gate.preToolUse", event);
     const hookCtx = (seatSignal) => ({
         toolCallId,
-        toolName,
+        toolName: screenedName,
         ...(seatSignal !== undefined ? { signal: seatSignal } : {}),
         ...(() => {
             const c = input.trackedCwd?.();
@@ -284,7 +288,7 @@ export async function runToolGate(input) {
     };
     const screening = preToolUse !== undefined
         ? {
-            screen: (args) => runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(toolName, args, hookCtx(sig))),
+            screen: (args) => runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(screenedName, args, hookCtx(sig))),
             screened: screenPreToolUseResult,
             crashReason: preToolUseCrashReason,
             unansweredReason: preToolUseUnansweredBlock,

package/dist/core/mode-policy.js

@@ -1,6 +1,7 @@
 import { createFsWriteGatePolicy } from "./fs-write-gate-policy.js";
 import { isProtectedWrite } from "./tool-registry.js";
 import { rosterEntryNamed } from "./tool-roster.js";
+import { wireOf } from "./tool-name-readings.js";
 import { clampPermissionMode } from "./ask-origin.js";
 import { argvOf, lexShellText } from "../shell/lex.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
@@ -42,7 +43,7 @@ const ENGINE_ROSTER_SOURCES = new Set(["builtin", "synthetic"]);
 export function planRefusesWrite(req, roster, readOnlyDeclared) {
     if (isProtectedWrite(req))
         return true;
-    const row = roster === undefined ? undefined : rosterEntryNamed(roster, req.toolName);
+    const row = roster === undefined ? undefined : rosterEntryNamed(roster, wireOf("mode.planRosterRow", req));
     return row !== undefined && !ENGINE_ROSTER_SOURCES.has(row.source) && row.effect !== "read" && !(row.effectProvenance === "default" && readOnlyDeclared?.(row.name) === true);
 }
 const planAsk = (message) => ({ action: "ask", message, decisionReason: "mode" });

package/dist/core/park-selfcheck.js

@@ -77,6 +77,8 @@ function syntheticCheckpoint(scope) {
             mandated: true,
             denialLimitFallback: { consecutive: 3, total: 3, limit: "consecutive", autoDenyAfterMs: 0 },
             origin: "denial_limit_fallback",
+            askClass: "denial_limit_fallback",
+            classes: ["denial_limit_fallback"],
             batchToolCallIds: [`${scope}:call`],
             completedCallIds: [],
         },

package/dist/core/permission-rule-model.d.ts

@@ -141,8 +141,8 @@ export declare const READ_RULE_TOOL = "Read";
  * catalog's declarations, exactly as the protective fences' covered set does.
  */
 export declare function ruleToolGrammarOf(toolName: string): "command" | "path" | undefined;
-/** The names the persisted grammar judges a call under: every one of the call's rule names (`ruleNamesOf` — the wire
- *  name, then the aliases that resolve to it) the grammar speaks for, so a stored `Bash(…)` or `Edit(…)` row reaches a
+/** The names the persisted grammar judges a call under: every name the call answers to (the model's spelling, the wire
+ *  name, the other aliases that resolve to it) the grammar speaks for, so a stored `Bash(…)` or `Edit(…)` row reaches a
  *  tool that answers to that name under another wire name, as a policy's rule does. Empty ⇒ the grammar speaks for none. */
 export declare function laneToolNamesOf(req: Pick<import("./tool-policy.js").ToolCallRequest, "toolName" | "face">): readonly string[];
 /**

package/dist/core/permission-rule-model.js

@@ -4,7 +4,7 @@ import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { pathTargetOf } from "./tool-registry.js";
-import { ruleNamesOf } from "./tool-roster.js";
+import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
@@ -32,7 +32,7 @@ export function ruleToolGrammarOf(toolName) {
     return pathTargetOf(toolName) !== undefined ? "path" : undefined;
 }
 export function laneToolNamesOf(req) {
-    return ruleNamesOf(req).filter((n) => ruleToolGrammarOf(n) !== undefined);
+    return heldValues("policy.persistedGrammar", { get: (n) => (ruleToolGrammarOf(n) !== undefined ? n : undefined) }, req);
 }
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([

package/dist/core/permission-rules.js

@@ -6,7 +6,7 @@ import { pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "../tools/fs/sa
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
 import { ruleDenialSentence } from "./rule-denial-sentence.js";
-import { ruleNamesOf } from "./tool-roster.js";
+import { heldValues } from "./tool-name-readings.js";
 export { parsePermissionRule };
 export const BASH_GENERIC_PARAMS = new Set(catalogRuleFaceOf("Bash")?.params ?? []);
 const DEFAULT_CAPS = {
@@ -381,10 +381,7 @@ export function createPermissionRulePolicy(rules, opts) {
         requiresRealApproval: true,
     });
     const entryFor = (req) => {
-        const entries = ruleNamesOf(req).flatMap((n) => {
-            const e = byTool.get(n);
-            return e !== undefined ? [e] : [];
-        });
+        const entries = heldValues("policy.permissionRules", byTool, req);
         if (entries.length <= 1)
             return entries[0];
         const bare = {};

package/dist/core/runner/active-skill-scope.js

@@ -3,7 +3,7 @@ import { pathTargetValue } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
 import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
 import { parseSkillToolEntry, skillSpecifierRejection } from "../skill-tool-specifier.js";
-import { ruleNamesOf } from "../tool-roster.js";
+import { heldValues, wireOf } from "../tool-name-readings.js";
 export class ActiveSkillScope {
     frames = [];
     push(frame) {
@@ -23,7 +23,7 @@ export function createActiveSkillScopePolicy(opts) {
     const { scope, env, rootPath, toolEffects } = opts;
     return {
         async check(req, signal) {
-            const names = ruleNamesOf(req);
+            const entriesFor = (byName) => heldValues("policy.skillScope", byName, req).flat();
             const frames = scope.active();
             if (frames.length === 0)
                 return { action: "allow" };
@@ -48,7 +48,7 @@ export function createActiveSkillScopePolicy(opts) {
                 }
                 return { manifest: m, byName };
             });
-            if (perFrame.length === 0 || perFrame.some((f) => !names.some((n) => f.byName.has(n)))) {
+            if (perFrame.length === 0 || perFrame.some((f) => entriesFor(f.byName).length === 0)) {
                 const ids = manifests.map((m) => m.lineageId).join(", ");
                 return {
                     action: "deny",
@@ -57,7 +57,7 @@ export function createActiveSkillScopePolicy(opts) {
                 };
             }
             for (const frame of perFrame) {
-                const alternatives = names.flatMap((n) => frame.byName.get(n) ?? []);
+                const alternatives = entriesFor(frame.byName);
                 const rejections = [];
                 let admitted = false;
                 for (const entry of alternatives) {
@@ -80,7 +80,7 @@ export function createActiveSkillScopePolicy(opts) {
             const declaredTarget = req.face?.pathTarget;
             const skillScopeEligible = declaredTarget !== undefined && declaredTarget.skillScopeEligible === true;
             if (pathConstrainingActive && !skillScopeEligible) {
-                const eff = toolEffects?.get(req.toolName) ?? "write";
+                const eff = toolEffects?.get(wireOf("policy.skillScope.effect", req)) ?? "write";
                 if (eff !== "read") {
                     const ids = manifests.filter((m) => m.allowPaths?.length).map((m) => m.lineageId).join(", ");
                     return {

package/dist/core/runner/decide-continuation.js

@@ -3,6 +3,7 @@ import { boundInputHashOf } from "../canonical-json.js";
 import { CheckpointError } from "../checkpoint-store.js";
 import { formatHookFeedback } from "../hooks.js";
 import { delimitUntrusted, REVIEWER_NOTE_MAX_BODY } from "../untrusted-text.js";
+import { wireOf } from "../tool-name-readings.js";
 export function resumeDecisionWasNegative(resume) {
     const o = resume.outcome;
     return o.decision === "reject" || o.decision === "deny";
@@ -49,7 +50,7 @@ export function sameWinner(incoming, persisted) {
         (persisted.reason === undefined || incoming.reason === persisted.reason));
 }
 export function pendingContentAskCallId(cp) {
-    return cp.pendingAction.kind === "tool_approval" && cp.pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME
+    return cp.pendingAction.kind === "tool_approval" && wireOf("resume.contentAskRow", cp.pendingAction) === ASK_USER_QUESTION_TOOL_NAME
         ? cp.pendingAction.toolCallId
         : undefined;
 }

package/dist/core/runner/denial-limit-arms.d.ts

@@ -3,7 +3,7 @@ import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
-import { type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
+import { type AskClass, type AskClassFacts, type AskClassification, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import type { Prepared, StopForDenialLimit } from "./contracts.js";
 /**
  * The classifier DENIAL-LIMIT arms of the tool gate's inherited (delegation) lane, extracted
@@ -98,34 +98,38 @@ export type InheritedAsk = Extract<PermissionResult, {
  * classifier runs inside the policy fold, BEFORE the live gate's org layer has spoken and before its
  * question-tool and marked-call lanes run, so they read as absent here and those asks meet their
  * exclusions downstream, where the facts exist. Excluded asks fall through to the frozen approver
- * chain, the delegation lane's original chain. The word is derived inside {@link judgeInheritedClassifier}
- * — once off the incoming ask for the exclusion and the unchanged-ask branches, once off the re-spoken
- * ask this station mints at the bound — and threaded to the request mint, never re-read off the
- * caller-owned object there.
- * The MANDATE marks are empty for the same reason — no tool seat of this task, no tighten of its own;
- * what the ancestor's ask carries on ITSELF still answers, read off the decision by the one predicate.
+ * chain, the delegation lane's original chain. The word and the class set are derived inside
+ * {@link judgeInheritedClassifier} and threaded to every reader ({@link inheritedAskCarry}).
+ * The MANDATE marks here are empty (the base names no seat): the policy-chain phase builds each call's facts over this
+ * base with THIS task's tool seat — the seat the request's risk axes are read from — so a marked tool's ask is
+ * classified by the seat at the station as at the gate. What the ancestor's ask carries on ITSELF still answers.
  */
 export declare const INHERITED_STATION_FACTS: AskOriginFacts;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
- *  they spell themselves: the ask's origin word and its denial-limit fallback. */
+ *  they spell themselves: the ask's origin word, its class (the word and the set, carried together) and its
+ *  denial-limit fallback. */
 export interface AskRequestCarry {
     origin?: AskOrigin;
+    askClass?: AskClass;
+    classes?: readonly AskClass[];
     denialLimitFallback?: DenialLimitFallback;
 }
-/** The GATE's own mint station: both members are read off the surviving decision, which is the gate's
- *  OWN snapshot (its stamp point spreads the policy's object and stamps the word onto the copy), so the
- *  origin is the engine-derived one and the member is the one the gate's classifier step minted. */
+/** The GATE's own mint station: every member is read off the surviving decision, which is the gate's
+ *  OWN snapshot (its stamp point spreads the policy's object and stamps the word and the class onto the copy),
+ *  so the origin and the class are the engine-derived ones and the fallback member is the one the gate's
+ *  classifier step minted. */
 export declare function gateAskCarry(decision: InheritedAsk, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
 /** An INHERITED-lane mint station (the two wrapper arms and the approved-edit re-check): the ask is an
- *  ancestor policy's own decision, never engine-stamped, so BOTH members come from the judgment
- *  {@link judgeInheritedClassifier} handed back — the word it derived under the station facts and the
- *  fallback member it captured — each read ONCE there and threaded here, never re-read off the
+ *  ancestor policy's own decision, never engine-stamped, so EVERY member comes from the judgment
+ *  {@link judgeInheritedClassifier} handed back — the word and the classification it derived under the station
+ *  facts and the fallback member it captured — each read ONCE there and threaded here, never re-read off the
  *  caller-owned object (a stateful accessor could otherwise answer the card with one value and the
- *  settlement with another; a self-declared `origin` on the ancestor's decision is never read). */
+ *  settlement with another; a self-declared `origin` / `askClass` / `classes` on the ancestor's decision is never
+ *  read). */
 export declare function inheritedAskCarry(judged: Pick<Extract<InheritedClassifierJudgment<InheritedAsk>, {
     kind: "resolve";
-}>, "origin" | "fallback" | "ask">, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
+}>, "origin" | "classification" | "fallback" | "ask">, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
 /** What {@link judgeInheritedClassifier} hands back to the arm that called it. */
 export type InheritedClassifierJudgment<A extends InheritedAsk> = 
 /** The frozen classifier allowed. `result` is the allow the arm RETURNS — minted at the judging station so
@@ -146,8 +150,11 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  `origin` is the ask's word under the station facts, threaded to the request mint: on the two
  *  unchanged-ask branches it is the SAME read the exclusion judged by (a caller-owned decision with a
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
- *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
-/** `ask` is the incoming ask unchanged (the caller's own object), or — an UNAVAILABLE classification with a live frozen
+ *  bound branch it is derived from the re-spoken ask this station minted (its own object).
+ *  `classification` is the class set of the ask handed on, under the same station facts: on the two unchanged-ask
+ *  branches the one read the exclusion judged by, on the unavailable and bound branches a read of the object this
+ *  station minted (each adds a real-approval bit, which the set must reflect). */
+/** `ask` is the incoming ask unchanged (the arm's receipt snapshot of the ancestor's decision), or — an UNAVAILABLE classification with a live frozen
 *  approver — that ask with the classifier sentence appended; without one it is a `deny` whose attested cause reads `unavailable`. */
  | {
     kind: "resolve";
@@ -155,6 +162,7 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
     fallback: UnarmedDenialLimitFallback | undefined;
     mintedHere: boolean;
     origin: AskOrigin;
+    classification: AskClassification;
 };
 /**
  * The ancestor's frozen classifier, run BEFORE its frozen approver in the ancestor's own gate order,
@@ -195,6 +203,8 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     allowRewrite?: unknown;
     /** An `unavailable` verdict's fork facts (`classifierUnavailableArm`): is the frozen approver live; who hears it. */
     unavailableSeat?: ClassifierUnavailableSeat;
+    /** The station's facts for this call (the base with this task's tool seat); absent ⇒ {@link INHERITED_STATION_FACTS}. */
+    facts?: AskClassFacts;
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
 export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;