@sema-agent/core 7.35.2 → 7.37.0

package/dist/core/runner/denial-limit-arms.js

@@ -5,7 +5,7 @@ import { attestClassifierDenyCause, attestClassifierRound } from "../tool-policy
 import { SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { askOriginOf, classifyAsk } from "../ask-origin.js";
+import { askClassMembersOf, askOriginOf, classifyAsk } from "../ask-origin.js";
 export function attachRebuiltDenialTrackers(entries, denialLimit) {
     if (entries === undefined)
         return undefined;
@@ -68,30 +68,34 @@ function fallbackCarry(fallback, liveApprover, tracker) {
 export function gateAskCarry(decision, liveApprover, tracker) {
     return {
         ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
+        ...(decision.askClass !== undefined && decision.classes !== undefined ? { askClass: decision.askClass, classes: decision.classes } : {}),
         ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
     };
 }
 export function inheritedAskCarry(judged, liveApprover, tracker) {
     return {
         origin: judged.origin,
+        ...askClassMembersOf(judged.classification),
         ...fallbackCarry(judged.fallback, liveApprover, tracker),
     };
 }
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, ask, req } = opts;
-    const origin = askOriginOf(ask, INHERITED_STATION_FACTS);
+    const facts = opts.facts ?? INHERITED_STATION_FACTS;
+    const origin = askOriginOf(ask, facts);
+    const classification = classifyAsk(ask, facts);
     const classifierStandsDown = () => {
         const live = opts.liveMode?.();
         return live === "dontAsk" || live === "bypassPermissions" || live === "plan" || (autoMode?.liveMode !== undefined && autoMode.liveMode.current !== "auto");
     };
-    if (autoMode === undefined || classifierStandsDown() || !classifyAsk(ask, INHERITED_STATION_FACTS).row.classifierEligible) {
-        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+    if (autoMode === undefined || classifierStandsDown() || !classification.row.classifierEligible) {
+        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification };
     }
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
     if (verdict.kind === "allow" && classifierStandsDown())
-        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification };
     const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
     if (verdict.kind === "allow") {
         autoMode.denialTracking?.recordAllow();
@@ -100,7 +104,7 @@ export async function judgeInheritedClassifier(opts) {
     if (verdict.kind === "unavailable") {
         const arm = classifierUnavailableArm({ ask, req, cause: verdict.cause, seat: opts.unavailableSeat, aborted: opts.signal.aborted });
         if (arm.kind === "asked")
-            return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+            return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification: classifyAsk(arm.ask, facts) };
         return { kind: "deny", result: attributed(arm.deny) };
     }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
@@ -116,7 +120,7 @@ export async function judgeInheritedClassifier(opts) {
     }
     const fallback = tracked.fallback;
     const minted = { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };
-    return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, INHERITED_STATION_FACTS) };
+    return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, facts), classification: classifyAsk(minted, facts) };
 }
 export function headlessDenyAtFold(r) {
     return r.settlement !== undefined && SETTLEMENT_NOBODY_JUDGED[r.settlement.kind];

package/dist/core/runner/inherited-ask-grants.d.ts

@@ -1,41 +1,42 @@
+import type { AskClass } from "../ask-origin.js";
 import type { HumanReviewGateRow } from "../task-result.js";
 import { type OnAsk, type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
-/** JSON.stringify throws on a cyclic value (a deployment
- *  policy's rewrite object carries no acyclicity guarantee) — `undefined` here means "no comparable
- *  shape", which every consumer treats as a mismatch (skip the record / skip the reuse ⇒ the child
- *  gate just re-asks — the safe direction, never a gate failure). */
-export declare function askGrantShapeOf(args: unknown): string | undefined;
-/**
- * Duplicate-frame collapse (single-Runner embedded shape), the CONSUME half: an inherited
- * layer already resolved THIS call as a clean allow at the SAME approver function, on EXACTLY the
- * byte-shape this caller-slot ask now presents. The human's consent covers this consultation
- * verbatim — asking again is the 2-frame UX debt, not a second authority. Guards, all mismatches
- * re-ask (⇒ `undefined`):
- *  · SOURCE: only a caller-slot POLICY ask may reuse — a safety tighten
- *    (egress/irreversible/shellGate stamp `decisionReason:"safety"`), a hook-promoted ask
- *    ("hook"), or a classifier ask carries a DIFFERENT authority/context and keeps its frame.
- *  · IDENTITY: the approver FUNCTION reference (never a name) — compared through
- *    `askApproverIdentity`, not by raw reference (ruled 2026-08-04): a delegated child's approver
- *    is the ancestor's own, wrapped with delegation provenance — a DIFFERENT function object, the
- *    SAME operator. Bare `===` therefore stopped collapsing the frame the moment the ask seam
- *    started forwarding approvers, and one tool call presented the same person the same card
- *    twice. The wrapper adds metadata and delegates every decision, so it grants no authority of
- *    its own; identity here only answers "same consultation".
- *  · SHAPE: byte-equality against the presented SNAPSHOT; reuse re-emits that snapshot
- *    as the executed shape via `presentedInput` — the same schema-revalidated binding
- *    as a main-gate approval (shown == executed, by construction).
- *  · LEDGER: the ONE real consultation (timed on the wrapper arm) is recorded here —
- *    one frame happened, one frame is booked.
- * The grant lives only within one gate evaluation (consumed on reuse, swept at the call site) — a
- * REOPENED checkpoint's re-adjudication never sees a stale grant.
- */
-export declare function consumeInheritedAskGrant(grants: Map<string, {
+/** One inherited ask grant: a person's clean allow at an ancestor's live approver, on ONE presented shape, to ONE question
+ *  (`classes`, the request's class set in `ASK_CLASSES` order) — it answers no stricter question. */
+export interface InheritedAskGrant {
     approver: unknown;
     argsJson: string;
     presented: unknown;
     waitMs: number;
     settled?: object;
-}>, onAsk: OnAsk | undefined, humanReviewRef: {
+    classes: readonly AskClass[];
+}
+/** Does a grant for `granted` cover a question the gate classified as `asked`? `ordinary` — the plain hesitation every other
+ *  class is a stricter form of — is covered by any card answered; every other class must have been on the card (the gate reads
+ *  facts the station cannot hold, and a class those add was asked of nobody). Unclassified, or a card with no class ⇒ never. */
+export declare function askGrantCovers(granted: readonly AskClass[], asked: readonly AskClass[] | undefined): boolean;
+/** JSON.stringify throws on a cyclic value (a rewrite object carries no acyclicity guarantee) — `undefined` means "no
+ *  comparable shape", which every consumer treats as a mismatch (skip the record / reuse ⇒ re-ask, the safe direction). */
+export declare function askGrantShapeOf(args: unknown): string | undefined;
+/**
+ * Duplicate-frame collapse, the CONSUME half: an inherited layer already resolved THIS call as a clean allow at the
+ * SAME approver function, on EXACTLY the byte-shape this caller-slot ask now presents, for a question that covers this
+ * one — asking again is the 2-frame UX debt, not a second authority. Guards, all mismatches re-ask (⇒ `undefined`):
+ *  · SOURCE: only a caller-slot POLICY ask may reuse — a safety tighten (`decisionReason:"safety"`), a hook-promoted
+ *    ask ("hook") or a classifier ask carries a DIFFERENT authority and keeps its frame.
+ *  · IDENTITY: the approver FUNCTION reference (never a name), compared through `askApproverIdentity`: a delegated
+ *    child's approver is the ancestor's own wrapped with provenance — a different function object, the same operator
+ *    (the wrapper grants no authority of its own); identity answers only "same consultation".
+ *  · SHAPE: byte-equality against the presented SNAPSHOT; reuse re-emits that snapshot as the executed shape via
+ *    `presentedInput` — the same binding as a main-gate approval (shown == executed, by construction).
+ *  · CLASS: the gate's stamped `classes` is covered by the set the person answered ({@link askGrantCovers}); a class
+ *    the gate's own judges add (a protected target, an out-of-root read) was not on the card. Not covered ⇒ the gate
+ *    asks its own question and the grant stays (it answers what it answered; the call-site sweep ends it).
+ *  · LEDGER: the ONE real consultation (timed on the wrapper arm) is booked here — one frame happened, one is booked.
+ * The grant lives within one gate evaluation (consumed on reuse, swept at the call site): a REOPENED checkpoint's
+ * re-adjudication never sees a stale grant.
+ */
+export declare function consumeInheritedAskGrant(grants: Map<string, InheritedAskGrant>, onAsk: OnAsk | undefined, humanReviewRef: {
     count: number;
     totalWaitMs: number;
     gates: HumanReviewGateRow[];

package/dist/core/runner/inherited-ask-grants.js

@@ -1,5 +1,8 @@
 import { primaryActivityArg } from "../arg-summary.js";
 import { askApproverIdentity, carryEngineAttestations } from "../tool-policy.js";
+export function askGrantCovers(granted, asked) {
+    return asked !== undefined && asked.length > 0 && granted.length > 0 && asked.every((c) => c === "ordinary" || granted.includes(c));
+}
 export function askGrantShapeOf(args) {
     try {
         return JSON.stringify(args ?? null);
@@ -14,6 +17,8 @@ export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision
     const grant = grants.get(req.toolCallId);
     if (grant === undefined || askApproverIdentity(grant.approver) !== askApproverIdentity(onAsk) || grant.argsJson !== askGrantShapeOf(req.args))
         return undefined;
+    if (!askGrantCovers(grant.classes, decision.action === "ask" ? decision.classes : undefined))
+        return undefined;
     grants.delete(req.toolCallId);
     humanReviewRef.count += 1;
     humanReviewRef.totalWaitMs += grant.waitMs;

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -241,6 +241,9 @@ export declare function createRuleOffersOf(cfg: {
     shellGatedTools: {
         has(name: string): boolean;
     };
+    toolMarkSources: {
+        get(name: string): ReadonlySet<string> | undefined;
+    };
     taskRoot: string | undefined;
     /** The live tracked-cwd ref (read per call — the relative-cd resolution base). */
     cwdRef: {

package/dist/core/runner/permission-rule-lanes.js

@@ -3,7 +3,8 @@ import {} from "../hooks.js";
 import { adjudicatePersistedPathRules, adjudicatePersistedRules, laneToolNamesOf, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
-import { anyNamed, declaredPathTargetOf, firstNamed, protectivePathTargetOf, ruleNamesOf } from "../tool-registry.js";
+import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
+import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
@@ -92,7 +93,7 @@ export function createPermissionRuleLanes(cfg) {
     const org = provider.partitions.org
         ? {
             adjudicate: async (req) => {
-                if (req.toolName === cfg.questionToolName && cfg.questionToolMounted)
+                if (wireOf("offer.orgQuestionExemption", req) === cfg.questionToolName && cfg.questionToolMounted)
                     return { status: "available" };
                 let resolution;
                 try {
@@ -158,16 +159,16 @@ export function createPermissionRuleLanes(cfg) {
 }
 export function createRuleOffersOf(cfg) {
     return (call, args, ask) => {
-        const toolName = call.toolName;
+        const toolName = wireOf("offer.laneTool", call);
         if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
             return {};
         if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
             return {};
-        const tierSeat = firstNamed(cfg.irreversibilityTier, ruleNamesOf(call));
+        const tierSeat = seatOf("offer.marks", cfg.irreversibilityTier, call);
         const closedDoor = ruleClearanceOf(ask, {
-            egress: anyNamed(cfg.egressTools, ruleNamesOf(call)),
+            egress: heldBy("offer.marks.egress", cfg.egressTools, call),
             irreversibility: tierSeat?.value,
-            shellGated: tierSeat !== undefined && cfg.shellGatedTools.has(tierSeat.name),
+            shellGated: tierSeat?.shellGated(cfg.shellGatedTools, cfg.toolMarkSources) === true,
         }).word;
         if (closedDoor !== undefined)
             return { ruleOffersAbsence: closedDoor };

package/dist/core/runner/prepare-context-lane.d.ts

@@ -24,6 +24,7 @@ import { type RunnerDeps } from "../types.js";
 import type { Prepared, PreparedMicroCompact } from "./contracts.js";
 import { type GitStatusLaneRef } from "./git-status-frame.js";
 import type { ReadFileState } from "../../tools/fs/safety.js";
+import { type ToolRosterDeltaSeat } from "../tool-roster.js";
 export interface PrepareContextLaneInput {
     /** borrowed-readonly — the task model: the budgets, the trigger-window geometry and `charsPerToken` are read off it. */
     model: Model;
@@ -39,6 +40,8 @@ export interface PrepareContextLaneInput {
     hostTaskId: string;
     /** borrowed-readonly — the run's offload store, or undefined (the caps' and the machine's persist seat). */
     offloadStore: ToolResultStore | undefined;
+    /** borrowed-readonly — the leg's live roster: a recorded tool name is judged as the wire name it resolves to. */
+    toolRosterDeltas: ToolRosterDeltaSeat;
     /** borrowed-readonly — the doors' RESOLVED microCompact knob (immutable values, never the deps bag). */
     microCompactKnob: {
         machine: MicroCompactMachine;
@@ -135,6 +138,7 @@ export interface GuardChainArgs {
     offloadStore: import("../tool-result-store.js").ToolResultStore | undefined;
     sessionId: string;
     taskId: string;
+    toolNameOf?: (recorded: string) => string;
     deps: RunnerDeps;
     trimPressureRef: {
         droppedMessages: boolean;

package/dist/core/runner/prepare-context-lane.js

@@ -8,8 +8,10 @@ import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../types.js";
 import { applyGitFrameGuard } from "./git-status-frame.js";
 import { applyContextShrinkToReadFileState } from "../../tools/fs/index.js";
+import { rosterToolName } from "../tool-roster.js";
 export function prepareContextLane(input) {
-    const { model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, readFileState } = input;
+    const { model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, readFileState } = input;
+    const toolNameOf = (recorded) => rosterToolName(toolRosterDeltas.current, recorded);
     const contextOverlay = input.contextOverlay ?? (() => undefined);
     const requestGeometry = () => {
         const current = harness.getModel();
@@ -27,7 +29,7 @@ export function prepareContextLane(input) {
             const replay = replayClearedProjection(healed, microCompact.ledger);
             const replayed = replay.messages;
             const capped = await capAggregateToolResults(replayed, {
-                store: offloadStore,
+                store: offloadStore, toolNameOf,
                 sessionId,
                 onCapped: (info) => pendingProjectionObservations.push(() => emitTrace(deps.tracer, () => ({
                     kind: "tool_result.capped",
@@ -49,7 +51,7 @@ export function prepareContextLane(input) {
             });
             let ccPass;
             const edited = microCompact.machine === "off" ? mediaCapped : clearStaleToolResults(mediaCapped, {
-                budgetTokens: editAt,
+                budgetTokens: editAt, toolNameOf,
                 clearSource: replayed,
                 onCleared: (pass) => { ccPass = pass; },
                 anchoredTotalTokens: estimateContextTokens(mediaCapped, cpt).tokens,
@@ -67,7 +69,7 @@ export function prepareContextLane(input) {
             }
             const chain = await runGuardChain({
                 edited, replayed, index: replay.index, microCompact, guardAt, charsPerToken: cpt, offloadStore,
-                sessionId, taskId: hostTaskId, deps, trimPressureRef, recheck, signal,
+                sessionId, taskId: hostTaskId, deps, trimPressureRef, recheck, signal, toolNameOf,
                 pendingProjectionObservations,
                 ...(readFileState !== undefined ? { readFileState } : {}),
             });
@@ -221,7 +223,7 @@ export async function runGuardChain(args) {
     if (microCompact.machine === "off" && anchoredWorking > guardAt) {
         let blockingPass;
         const blockingEdited = clearStaleToolResults(working, {
-            budgetTokens: guardAt,
+            budgetTokens: guardAt, toolNameOf: args.toolNameOf,
             clearSource: args.replayed,
             onCleared: (pass) => { blockingPass = pass; },
             anchoredTotalTokens: anchoredWorking,

package/dist/core/runner/prepare-gate-stations.js

@@ -9,8 +9,10 @@ import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
 import { askReachesPerson } from "../wiring-manifest.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-import { anyNamed, callAnswersTo, callFaceSeat, firstNamed, rosterToolName, ruleNamesOf, toolCallFaceOf } from "../tool-roster.js";
+import { callFaceSeat, rosterToolName, toolCallFaceOf } from "../tool-roster.js";
+import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 import { noteHostRewrite } from "../frame-settlement.js";
+const PEER_MESSAGE_NAMES = new Set([SEND_MESSAGE_TOOL_NAME]);
 function screenGateResult(result) {
     if (result.suspend !== undefined)
         return { defects: [] };
@@ -88,12 +90,12 @@ export function prepareGateStations(input) {
             harness.on("tool_call", async (called) => {
                 const e = { ...called, toolName: rosterToolName(toolRosterDeltas.current, called.toolName) };
                 const call = { toolName: e.toolName, ...callFaceSeat(toolCallFaceOf(toolRosterDeltas.current, called.toolName)) };
-                const names = ruleNamesOf(call);
-                const tierSeat = firstNamed(irreversibilityTier, names);
+                const tierSeat = seatOf("gate.shellSeat", irreversibilityTier, call);
+                const markSources = new Set(heldValues("gate.markSources", toolMarkSources, call).flatMap((s) => [...s]));
                 blockedToolCalls.delete(e.toolCallId);
                 inheritedAskGrants.delete(e.toolCallId);
                 {
-                    const complianceDeny = names.map((n) => complianceCallDenial(complianceDenies, n)).find((d) => d !== undefined);
+                    const complianceDeny = heldValues("gate.compliance", { get: (n) => complianceCallDenial(complianceDenies, n) }, call)[0];
                     if (complianceDeny !== undefined) {
                         if (blockedTracked)
                             blockedToolCalls.add(e.toolCallId);
@@ -122,19 +124,19 @@ export function prepareGateStations(input) {
                         resolveAsk: resolveAskBound,
                         suspendAsk,
                         resolveContentAsk,
-                        egress: anyNamed(egressTools, names),
-                        peerMessage: callAnswersTo(call, SEND_MESSAGE_TOOL_NAME),
+                        egress: heldBy("gate.egress", egressTools, call),
+                        peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                         ...(shellReadCheck !== undefined ? { shellReadCheck } : {}),
                         irreversibility: tierSeat?.value,
-                        reversibilityProbe: tierSeat !== undefined ? reversibilityProbes.get(tierSeat.name) : undefined,
+                        reversibilityProbe: tierSeat?.read(reversibilityProbes),
                         abortSignal: abortController.signal,
                         ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
                         onHookError: notifyHookError,
-                        shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
+                        shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
                         permissionMode: () => permissionMode.current,
-                        ...(() => { const s = firstNamed(toolMarkSources, names)?.value; return s !== undefined ? { toolMarkSources: s } : {}; })(),
+                        ...(markSources.size > 0 ? { toolMarkSources: markSources } : {}),
                         ...(a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
                         onModeReleased,
                         ancestorArbitrationOf: (toolCallId) => ancestorArbitrations.get(toolCallId),
@@ -243,6 +245,7 @@ export function prepareGateStations(input) {
             }
             let content = e.content;
             let changed = false;
+            const post = { toolName: rosterToolName(toolRosterDeltas.current, e.toolName) };
             if (e.isError) {
                 if (hooks?.postToolUseFailure) {
                     let clonedDetails = e.details;
@@ -251,7 +254,8 @@ export function prepareGateStations(input) {
                     }
                     catch {
                     }
-                    const failureSeat = await runHookSeat("postToolUseFailure", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUseFailure(e.toolName, e.input, {
+                    const failedName = wireOf("hook.postToolUseFailure", post);
+                    const failureSeat = await runHookSeat("postToolUseFailure", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUseFailure(failedName, e.input, {
                         error: e.content
                             .filter((c) => c.type === "text")
                             .map((c) => c.text)
@@ -259,7 +263,7 @@ export function prepareGateStations(input) {
                         isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
                         content: e.content.map((c) => ({ ...c })),
                         details: clonedDetails,
-                    }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                    }, { toolCallId: e.toolCallId, toolName: failedName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
                     if (failureSeat.expired) {
                         notifyOwnHookCrash(hookSeatExpiredError("postToolUseFailure", hookTimeoutMs, failureSeat.cause, "the observation was abandoned and its additionalContext dropped; the failure result itself is unchanged"));
                     }
@@ -271,7 +275,8 @@ export function prepareGateStations(input) {
                 }
             }
             else if (hooks?.postToolUse) {
-                const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                const ranName = wireOf("hook.postToolUse", post);
+                const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(ranName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: ranName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
                 if (successSeat.expired) {
                     notifyOwnHookCrash(hookSeatExpiredError("postToolUse", hookTimeoutMs, successSeat.cause, "the seat was abandoned; the tool result is delivered to the model UNMODIFIED (no updatedOutput, no additionalContext)"));
                 }

package/dist/core/runner/prepare-inherited-gate.js

@@ -36,7 +36,7 @@ export function prepareInheritedGate(input) {
     if (modeSeed.migrated !== undefined) {
         deliverEngineNotice(deps.onNotice, {
             code: "resume.legacy_mode_seed_migrated",
-            message: `the resumed checkpoint row carried pre-mode keys (${modeSeed.migrated.droppedKeys.join(", ")}); read once into ${modeSeed.migrated.permissionMode !== undefined ? `permissionMode: "${modeSeed.migrated.permissionMode}"` : "no mode of its own (the chain's ceiling stands)"}${modeSeed.shellGate !== undefined ? ' with the shell floor "always" kept' : ""} — the next suspend writes the one key; from 7.35.0 a row still carrying these keys is refused`,
+            message: `the resumed checkpoint row carried pre-mode keys (${modeSeed.migrated.droppedKeys.join(", ")}); read once into ${modeSeed.migrated.permissionMode !== undefined ? `permissionMode: "${modeSeed.migrated.permissionMode}"` : "no mode of its own (the chain's ceiling stands)"}${modeSeed.shellGate !== undefined ? ' with the shell floor "always" kept' : ""} — the next suspend writes the one key; this migration is kept through 7.37.x and removed in 7.38.0, which refuses a row still carrying these keys (resume or abandon such rows before upgrading)`,
             detail: { migrated: { ...(modeSeed.migrated.permissionMode !== undefined ? { permissionMode: modeSeed.migrated.permissionMode } : {}), droppedKeys: [...modeSeed.migrated.droppedKeys] }, sessionId, runId },
         });
     }

package/dist/core/runner/prepare-park-ask.d.ts

@@ -9,8 +9,8 @@
  * decomposition exists to make explicit.
  *
  * The thirteen-argument park closure is unchanged: twelve positional seats then the structural {@link AskCarry}, the
- * shape the gate's one invocation site (`parkWith`) holds. The ask's origin word and the denial-limit fallback ride the
- * carry onto the row exactly as before — this phase mints no origin, changes no word, adds no arm to the closed set.
+ * shape the gate's one invocation site (`parkWith`) holds. The ask's origin word, class pair and denial-limit fallback
+ * ride the carry onto the row — this phase mints no origin or class, changes no word, adds no arm to the closed set.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (both closures run per tool call), so the
  * phase adds no yield between the boundary parks before it and the gate station after it.
@@ -116,6 +116,8 @@ export interface PrepareParkAskInput {
     shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the per-tool tier, read only for the name the call's tier seat is read under (as at the gate). */
     irreversibilityTier: IrreversibilityTier;
+    /** borrowed-readonly — who marked each name's seat (the descriptor's `shellGated` reads it as the gate does). */
+    toolMarkSources: ReadonlyMap<string, ReadonlySet<import("../ask-origin.js").ToolMarkSource>>;
     /** borrowed-readonly — the operator's shell floor (`"always"`), persisted on a shell-gated descriptor; undefined = no floor. */
     effectiveShellGate: ShellGateDoctrine | undefined;
     /** borrowed-readonly — the EFFECTIVE durable-approval opt-in (the caller's, or the synthesized mandate scope): picks the

package/dist/core/runner/prepare-park-ask.js

@@ -15,7 +15,8 @@ import { checkpointScopeOf } from "./checkpoint-scope.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedTtlMs } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
-import { callFaceSeat, firstNamed, parkedToolIdentity, parkedToolFace, ruleNamesOf } from "../tool-roster.js";
+import { callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
+import { seatOf, wireOf } from "../tool-name-readings.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
         super(message, options);
@@ -26,7 +27,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -114,7 +115,7 @@ export function prepareParkAsk(input) {
     };
     const suspendAsk = parkLaneArmed && checkpointStore !== undefined
         ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, carry) => {
-            const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
+            const syncFirstEligible = wireOf("park.syncFirstRoute", req) === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
             if (syncFirstEligible &&
                 runtimeCaps?.forceDurableGate !== true &&
                 liveFaceUnavailable !== true &&
@@ -172,11 +173,7 @@ export function prepareParkAsk(input) {
                     if (reprojectedRaced.tag === "threw")
                         throw reprojectedRaced.error;
                     const reprojected = refuseOutOfContractDecision(reprojectedRaced.value);
-                    const demanded = reprojected.updatedInput !== undefined ? tryCloneArgs(reprojected.updatedInput) : undefined;
-                    const rewroteTheFiledValue = reprojected.updatedInput !== undefined &&
-                        !(demanded?.ok === true &&
-                            samePlainValue(demanded.value, parkedArgs) &&
-                            samePlainValue(reprojected.updatedInput, parkedArgs));
+                    const rewroteTheFiledValue = reprojected.updatedInput !== undefined && !samePlainValue(reprojected.updatedInput, parkedArgs);
                     if (reprojected.action === "deny" || rewroteTheFiledValue) {
                         throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and the deployment's tool policy does not accept the stored shape` +
                             `${reprojected.action === "deny" && reprojected.message ? `: ${reprojected.message}` : ""} — ` +
@@ -234,7 +231,7 @@ export function prepareParkAsk(input) {
                     remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
                 }
                 token = mintCheckpointToken();
-                const tierSeat = firstNamed(irreversibilityTier, ruleNamesOf(req));
+                const tierSeat = seatOf("park.riskDescriptor", irreversibilityTier, req);
                 const riskDescriptor = buildRiskDescriptor({
                     toolName: req.toolName,
                     args: parkedArgs,
@@ -242,7 +239,7 @@ export function prepareParkAsk(input) {
                     ...(shadowedRule !== undefined ? { shadowedRule } : {}),
                     ...(probeReason !== undefined ? { probeReason } : {}),
                     ...(probeCause !== undefined ? { probeCause } : {}),
-                    shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
+                    shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
                     ...(effectiveShellGate !== undefined ? { shellGateDoctrine: effectiveShellGate } : {}),
                 });
                 gate =
@@ -303,7 +300,7 @@ export function prepareParkAsk(input) {
                         kind: "tool_approval",
                         toolCallId: req.toolCallId,
                         toolName: req.toolName,
-                        ...parkedToolIdentity(toolRosterDeltas.current, req.toolName), ...parkedToolFace(toolRosterDeltas.current, req.toolName),
+                        ...parkedToolIdentity(toolRosterDeltas.current, req.toolName), ...parkedToolFace(toolRosterDeltas.current, req),
                         args: parkedArgs,
                         ...(() => {
                             const p = approvalPreviewOf(req.toolName, parkedArgs);

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -34,6 +34,7 @@ import { type ActiveSkillScope } from "./active-skill-scope.js";
 import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, StopForDenialLimit } from "./contracts.js";
 import { type Arbitration } from "../ask-origin.js";
 import { type ModeGateSeats, type PermissionModeController } from "../mode-policy.js";
+import { type InheritedAskGrant } from "./inherited-ask-grants.js";
 import { createRuleOffersOf, type PermissionRuleLanes } from "./permission-rule-lanes.js";
 import type { ToolCallLike } from "../tool-registry.js";
 export interface PreparePolicyChainInput {
@@ -45,7 +46,7 @@ export interface PreparePolicyChainInput {
      *  `permissionRuleStore` / `localOwnerRules` (the lanes and the offer factory), `onError` / `onNotice` (the advisories,
      *  the refusal disclosures, the late-ask observer), `tracer` (the admission and rule-store frames), `checkpointStore` (the park facility). Receiver preserved;
      *  the advisory dedupe is KEYED on this object's identity. */
-    deps: Pick<RunnerDeps, "sessionPolicyStore" | "hooks" | "permissionRuleStore" | "localOwnerRules" | "onError" | "onNotice" | "tracer" | "checkpointStore">;
+    deps: Pick<RunnerDeps, "sessionPolicyStore" | "hooks" | "permissionRuleStore" | "localOwnerRules" | "onError" | "onNotice" | "tracer" | "checkpointStore" | "a2a">;
     /** borrowed-readonly — the trusted spawn-side channel: `parentTaskId` (the from-subagent bit), `explicitAgentName` /
      *  `agentName` (the source agent name) — the ask source identity's local, trusted facts. */
     internals: Pick<RunInternals, "parentTaskId" | "explicitAgentName" | "agentName"> | undefined;
@@ -85,6 +86,8 @@ export interface PreparePolicyChainInput {
     envHandToolNames: ReadonlySet<string>;
     /** borrowed-readonly — the shell-seat provenance set (the offer factory's `shellGated` mandate term, read per call). */
     shellGatedTools: ReadonlySet<string>;
+    /** borrowed-readonly — who marked each name's seat (the offer factory's `shellGated` term reads it as the gate does). */
+    toolMarkSources: ReadonlyMap<string, ReadonlySet<import("../ask-origin.js").ToolMarkSource>>;
     /** borrowed-readonly — the tracked-cwd seat, read per call by the lanes and the offer factory (never written here). */
     handsCwdRef: CwdRef | undefined;
     /** borrowed-readonly — the compiled read-deny judge, or undefined (the offer factory's directory negative control). */
@@ -184,13 +187,7 @@ export interface PreparePolicyChainResult {
     }>>;
     /** borrowed-mutable — the grant record. Writers: the inherited arms here (record a clean allow at a live approver);
      *  the gate station (consume on reuse, sweep at settlement). */
-    inheritedAskGrants: Map<string, {
-        approver: unknown;
-        argsJson: string;
-        presented: unknown;
-        waitMs: number;
-        settled?: object;
-    }>;
+    inheritedAskGrants: Map<string, InheritedAskGrant>;
     /** owned — the SINGLE AskRequest source-identity factory every resolveAsk construction site spreads. */
     askSourceIdentity: () => {
         principal?: string;