@sema-agent/core 7.35.2 → 7.37.0

package/dist/core/runner/prepare-policy-chain.js

@@ -6,12 +6,12 @@ import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
 import { assertHookSeatsCallable } from "../hook-seats.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, wrapToolPolicy, attestAskUnresolvableCause } from "../tool-policy.js";
+import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, wrapToolPolicy, attestAskUnresolvableCause } from "../tool-policy.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
 import { createActiveSkillScopePolicy } from "./active-skill-scope.js";
-import { arbitrateByMode, askMandateMember, classifyAsk } from "../ask-origin.js";
+import { arbitrateByMode, askClassMembersOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
 import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
@@ -20,12 +20,12 @@ import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
 import { thrownText } from "../thrown-value.js";
-import { anyNamed, firstNamed, ruleNamesOf } from "../tool-roster.js";
+import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
-    const arbitrateInherited = (ask, toolCallId) => {
-        const verdict = arbitrateByMode(permissionMode.current, classifyAsk(ask, INHERITED_STATION_FACTS), { ...(ask.origin !== undefined ? { origin: ask.origin } : {}), ...(ask.mandate !== undefined ? { mandate: ask.mandate } : {}) });
+    const arbitrateInherited = (ask, toolCallId, classification) => {
+        const verdict = arbitrateByMode(permissionMode.current, classification, { ...(ask.origin !== undefined ? { origin: ask.origin } : {}), ...(ask.mandate !== undefined ? { mandate: ask.mandate } : {}) });
         if (verdict.kind === "ask" || verdict.kind === "accepted")
             return undefined;
         ancestorArbitrations.set(toolCallId, verdict);
@@ -188,7 +188,7 @@ export async function preparePolicyChain(input) {
     }, "mandate_unreconstructible", creq);
     const markerChannelFullDeny = (creq) => attestAskUnresolvableCause({ action: "deny", message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed` }, "approver_unavailable", creq);
     const inheritedAskGrants = new Map();
-    const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs, settled) => {
+    const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs, settled, classes) => {
         if (typeof approver !== "function")
             return;
         if (presented === undefined)
@@ -198,7 +198,7 @@ export async function preparePolicyChain(input) {
         const argsJson = askGrantShapeOf(presented);
         if (argsJson === undefined)
             return;
-        inheritedAskGrants.set(toolCallId, { approver, argsJson, presented, waitMs, settled });
+        inheritedAskGrants.set(toolCallId, { approver, argsJson, presented, waitMs, settled, classes });
     };
     const sandboxDeclared = isIsolated(executionEnv);
     const sandboxAdmissionArmed = (() => {
@@ -233,7 +233,8 @@ export async function preparePolicyChain(input) {
         list.push({ cls, layer });
         foldAskClasses.set(toolCallId, list);
     };
-    const sandboxBoundaryCapable = (call) => anyNamed(egressTools, ruleNamesOf(call)) || !envHandToolNames.has(call.toolName);
+    const isDelegatedQuestion = (creq) => wireOf("inherited.questionFloat", creq) === ASK_USER_QUESTION_TOOL_NAME;
+    const sandboxBoundaryCapable = (call) => heldBy("gate.sandboxBoundary.egress", egressTools, call) || !envHandToolNames.has(wireOf("gate.sandboxBoundary.hand", call));
     const emitSandboxAdmitted = (info) => {
         emitTrace(deps.tracer, () => ({
             kind: "permission.sandbox_admitted",
@@ -258,7 +259,7 @@ export async function preparePolicyChain(input) {
     };
     const callerPolicyLayer = policy !== undefined && sameInstanceAncestorCount > 0
         ? wrapToolPolicy(policy, async (creq, csignal) => {
-            const decision = await policy.check(creq, csignal ?? abortController.signal);
+            const decision = refuseOutOfContractDecision(await policy.check(creq, csignal ?? abortController.signal));
             sharedFirstDecision.set(creq.toolCallId, decision);
             if (sharedFirstDecision.size > SHARED_FIRST_DECISION_CAP) {
                 const oldest = sharedFirstDecision.keys().next().value;
@@ -277,16 +278,33 @@ export async function preparePolicyChain(input) {
             : {}),
         ...(delegation.isDelegatedChild ? { isDelegatedChild: true } : {}),
     });
+    const seatMarksOf = (call) => {
+        const tierSeat = seatOf("report.riskAxes", irreversibilityTier, call);
+        return {
+            tier: tierSeat?.value,
+            egress: heldBy("report.riskAxes.egress", egressTools, call),
+            shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
+            sources: new Set(heldValues("report.markSources", toolMarkSources, call).flatMap((s) => [...s])),
+        };
+    };
     const riskAxesOf = (call) => {
-        const names = ruleNamesOf(call);
-        const tier = firstNamed(irreversibilityTier, names)?.value;
-        const negatives = firstNamed(axisExplicitNegatives, names)?.value;
-        const irreversible = tier === "always" || tier === "maybe" ? true : tier === "never" ? false : negatives?.irreversible;
-        const egress = anyNamed(egressTools, names) ? true : negatives?.egress;
+        const seat = seatMarksOf(call);
+        const negatives = seatOf("report.riskAxes.negatives", axisExplicitNegatives, call)?.value;
+        const irreversible = seat.tier === "always" || seat.tier === "maybe" ? true : seat.tier === "never" ? false : negatives?.irreversible;
+        const egress = seat.egress ? true : negatives?.egress;
         if (irreversible === undefined && egress === undefined)
             return {};
         return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
     };
+    const inheritedStationFacts = (call) => {
+        const seat = seatMarksOf(call);
+        return {
+            ...INHERITED_STATION_FACTS,
+            mandateMarks: { egress: seat.egress, shellGated: seat.shellGated, ...(seat.tier !== undefined ? { irreversibility: seat.tier } : {}) },
+            ...(seat.sources.size > 0 ? { toolMarkSources: seat.sources } : {}),
+            ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}),
+        };
+    };
     const inheritedAskEvidence = inheritedAskRuleEvidence(deps.permissionRuleStore);
     const { personal: permissionRuleLane, org: permissionRuleOrgLane } = createPermissionRuleLanes({
         provider: deps.permissionRuleStore,
@@ -310,6 +328,7 @@ export async function preparePolicyChain(input) {
         egressTools,
         irreversibilityTier,
         shellGatedTools,
+        toolMarkSources,
         taskRoot: taskRootFinal,
         cwdRef: handsCwdRef,
         deniesDirectoryRead: readDenyMatcher !== undefined ? (d) => readDenyMatcher.matchPath(d) !== null : undefined,
@@ -334,7 +353,7 @@ export async function preparePolicyChain(input) {
             }
             let re;
             try {
-                re = await pol.check({ ...creq, args: editArgs }, csignal ?? abortController.signal);
+                re = refuseOutOfContractDecision(await pol.check({ ...creq, args: editArgs }, csignal ?? abortController.signal));
             }
             catch (err) {
                 return vetoed({
@@ -352,7 +371,7 @@ export async function preparePolicyChain(input) {
             }
             if (re.updatedInput !== undefined)
                 editArgs = re.updatedInput;
-            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
+            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
                 const cleared = { ...judged.result };
                 carryEngineAttestations(judged.result, cleared);
@@ -363,7 +382,7 @@ export async function preparePolicyChain(input) {
                 return vetoed(judged.result);
             const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
             re = editAsk;
-            const editArbitrated = arbitrateInherited(re, creq.toolCallId);
+            const editArbitrated = arbitrateInherited(re, creq.toolCallId, judged.classification);
             if (editArbitrated !== undefined) {
                 const out = editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs } : editArbitrated;
                 carryPrecedingSettlement(settledBy, out);
@@ -420,7 +439,7 @@ export async function preparePolicyChain(input) {
                         return first;
                     if (first.action === "allow")
                         return { action: "allow" };
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+                    if (isDelegatedQuestion(creq)) {
                         if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
                             return first;
                         return {
@@ -434,17 +453,17 @@ export async function preparePolicyChain(input) {
                             return first;
                         return mandateUnreconstructibleDeny(creq);
                     }
-                    const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call", unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
+                    const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call", facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
                     if (judged.kind === "allow")
                         return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && classifyAsk(inheritedAsk, INHERITED_STATION_FACTS).row.sandboxAdmission) {
+                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return { action: "allow" };
                     }
-                    const arbitrated = arbitrateInherited(inheritedAsk, creq.toolCallId);
+                    const arbitrated = arbitrateInherited(inheritedAsk, creq.toolCallId, judged.classification);
                     if (arbitrated !== undefined)
                         return arbitrated;
                     const presentedArgs = creq.args;
@@ -476,14 +495,14 @@ export async function preparePolicyChain(input) {
                     if (resolved.updatedInput !== undefined) {
                         return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                     }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved);
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(judged.classification).classes);
                     return { action: "allow" };
                 },
             }
             : wrapToolPolicy(pc.policy, async (creq, csignal) => {
                 let decision;
                 try {
-                    decision = await pc.policy.check(creq, csignal ?? abortController.signal);
+                    decision = refuseOutOfContractDecision(await pc.policy.check(creq, csignal ?? abortController.signal));
                 }
                 catch (err) {
                     return {
@@ -493,7 +512,7 @@ export async function preparePolicyChain(input) {
                 }
                 if (decision.action !== "ask")
                     return decision;
-                if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+                if (isDelegatedQuestion(creq)) {
                     if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
                         return decision;
                     return {
@@ -508,17 +527,17 @@ export async function preparePolicyChain(input) {
                     return mandateUnreconstructibleDeny(creq);
                 }
                 const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
+                const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
                 if (judged.kind === "allow")
                     return judged.result;
                 if (judged.kind === "deny")
                     return judged.result;
                 const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && classifyAsk(inheritedAsk, INHERITED_STATION_FACTS).row.sandboxAdmission) {
+                if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                     recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                     return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
                 }
-                const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId);
+                const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId, judged.classification);
                 if (arbitrated !== undefined)
                     return arbitrated;
                 const askT0 = now();
@@ -550,7 +569,7 @@ export async function preparePolicyChain(input) {
                     return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                 }
                 if (pc.preToolUse === undefined) {
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved);
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(judged.classification).classes);
                 }
                 if (decision.updatedInput === undefined)
                     return resolved;
@@ -571,7 +590,7 @@ export async function preparePolicyChain(input) {
             sameInstanceAdapterIndices.add(j + callerSlotOffset);
     });
     const instrumentedChain = rewriteCapableChain.map((layer, idx) => wrapToolPolicy(layer, async (creq, csignal) => {
-        const d = await layer.check(creq, csignal);
+        const d = refuseOutOfContractDecision(await layer.check(creq, csignal));
         if (d.updatedInput !== undefined)
             rewriteEmitterIndex.set(creq.toolCallId, idx);
         if (d.action === "ask") {
@@ -618,7 +637,7 @@ export async function preparePolicyChain(input) {
             const revalidated = {};
             try {
                 for (const layer of recheckLayers) {
-                    const d = await layer.check(finalReq, signal);
+                    const d = refuseOutOfContractDecision(await layer.check(finalReq, signal));
                     if (d.action === "deny") {
                         const carried = { ...d, updatedInput: decision.updatedInput };
                         carryEngineAttestations(d, carried);

package/dist/core/runner/prepare-safety-scan.js

@@ -4,6 +4,8 @@ import { callerCardIdOf, offendingResultCard, rosterMemberBoundProblem, schemaKe
 import { toolFaceProblem } from "./tool-face-overlay.js";
 import { OFFLOAD_TOOL_NAME } from "../tool-result-store.js";
 import { PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
+const REPEAT_RISK = { read: 0, idempotent: 1, write: 2 };
+const leastRepeatSafe = (a, b) => (REPEAT_RISK[a] >= REPEAT_RISK[b] ? a : b);
 export function prepareSafetyScan(input) {
     const { spec, deps } = input;
     const toolEffects = new Map();
@@ -120,11 +122,16 @@ export function prepareSafetyScan(input) {
         }
     }
     toolEffects.set(OFFLOAD_TOOL_NAME, "read");
+    const claimerEffects = new Map([...claimedAliases].map((a) => [a, toolEffects.get(a) ?? "write"]));
+    const recordHandEffect = (name, effect) => {
+        const claimed = claimerEffects.get(name);
+        toolEffects.set(name, claimed === undefined ? effect : leastRepeatSafe(claimed, effect));
+    };
     if (deps.executionEnvFactory || deps.executionEnv) {
         for (const [name, effect] of handBandEffects())
-            toolEffects.set(name, effect);
+            recordHandEffect(name, effect);
         if (spec.handsReadOnly === true)
-            toolEffects.set("Bash", "read");
+            recordHandEffect("Bash", "read");
     }
     if (spec.enablePlanMode === true) {
         toolEffects.set(PRESENT_PLAN_TOOL_NAME, "read");

package/dist/core/runner/prepare-task.js

@@ -740,7 +740,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
         const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox });
         const writeProtectionCheck = writeProtection?.check;
         writeProtectionJudgeRef.current = writeProtection?.judgeTarget;
@@ -753,10 +753,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
-        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
+        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
         prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.pathDenyRules.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: wiringManifest.ask, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
         const postureFrameRef = {};
-        const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, contextOverlay: legContextOverlay, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
+        const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas: rosterSeat, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, contextOverlay: legContextOverlay, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);

package/dist/core/runner/resume-apply.js

@@ -10,6 +10,7 @@ import { inlineUntrusted } from "../untrusted-text.js";
 import { deepJsonEqual, describeSuppliedValue } from "./decide-continuation.js";
 import { mintGateOutcome } from "./gate-exit.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
+import { wireOf } from "../tool-name-readings.js";
 export async function resumeApply(input) {
     const { cp, config, internals, outcomeGate, wakeMessage, resumeSignal, recheckGovernanceWindow, plainReviewOutcome, plainParkOutcome, runner, effectiveDelegationFacts } = input;
     let plainPolicyOutcome = input.plainPolicyOutcome;
@@ -78,7 +79,7 @@ export async function resumeApply(input) {
         plainPolicyOutcome.decision === "allow" &&
         plainPolicyOutcome.updatedInput !== undefined &&
         cp.pendingAction.kind === "tool_approval" &&
-        cp.pendingAction.toolName !== ASK_USER_QUESTION_TOOL_NAME) {
+        wireOf("resume.editRecheckQuestionSkip", cp.pendingAction) !== ASK_USER_QUESTION_TOOL_NAME) {
         const editedArgs = plainPolicyOutcome.updatedInput;
         const editBudget = {
             resourceRemainingMicroUsd: remainingBudgetMicroUsd(cp.resourceLedger),

package/dist/core/runner/run-attachment-seats.js

@@ -2,6 +2,8 @@ import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
 import { stripGitStatusUnits } from "./git-status-frame.js";
 import { SKILLS_LISTING_PROBE_HEADER } from "./synthetic-tools.js";
 import { AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, agentListingDeltaHeader, agentListingInitialHeader, createAttachmentState, replayAnnouncedListing, replayAnnouncedModels } from "./turn-attachments.js";
+import { wireOf } from "../tool-name-readings.js";
+import { rosterToolName } from "../tool-roster.js";
 export async function runAttachmentSeats(input) {
     const { spec, prepared, resume, rs, runner, next } = input;
     rs.counters.wroteThisRun = false;
@@ -174,7 +176,7 @@ export async function runAttachmentSeats(input) {
                     if ((fvMarked || text.includes("<system-reminder>[final verification]")) && rs.counters.finalVerifyInjections < 2)
                         rs.counters.finalVerifyInjections += 1;
                 }
-                else if (m.role === "toolResult" && !rs.counters.wroteThisRun && (prepared.toolEffects.get(m.toolName) ?? "write") !== "read") {
+                else if (m.role === "toolResult" && !rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRunSeed", { toolName: rosterToolName(prepared.toolRosterDeltas.current, m.toolName) })) ?? "write") !== "read") {
                     rs.counters.wroteThisRun = true;
                 }
             }

package/dist/core/runner/run-harness-handlers.js

@@ -11,9 +11,13 @@ import { gatedCallIdOf } from "./park-commit.js";
 import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { batchResponseDigest, toolEndBodyFrom } from "./tool-end-body.js";
 import { createResponseModelSeat } from "./response-model-seat.js";
+import { createToolCallIdFoldSeat } from "./tool-call-id-fold-seat.js";
+import { wireOf } from "../tool-name-readings.js";
+import { rosterToolName } from "../tool-roster.js";
 export function createHarnessHandlers(input) {
     const { prepared, stats, rs, deps } = input;
     const responseModelSeat = createResponseModelSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
+    const toolCallIdFoldSeat = createToolCallIdFoldSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const { spec, queue, internals, ident, parentToolCallId, subagentName, pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf, toolLabels, postToolBatchHook, batchArgs, internalsNotifier } = deps;
     let lastWorkspaceCwd = prepared.cwdRef?.current;
     const announceWorkspaceMove = () => {
@@ -147,6 +151,7 @@ export function createHarnessHandlers(input) {
         }
         if (m.role === "assistant") {
             rs.turn.turnResponseModel = responseModelSeat.observe(m);
+            toolCallIdFoldSeat.observe(m);
         }
         if (m.role === "assistant") {
             const rep = m.repetition;
@@ -219,7 +224,7 @@ export function createHarnessHandlers(input) {
         toolStartAt.delete(event.toolCallId);
         toolProgress.noteEnd(event.toolCallId);
         const toolNow = Date.now();
-        if (!rs.counters.wroteThisRun && (prepared.toolEffects.get(event.toolName) ?? "write") !== "read") {
+        if (!rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRun", { toolName: rosterToolName(prepared.toolRosterDeltas.current, event.toolName) })) ?? "write") !== "read") {
             rs.counters.wroteThisRun = true;
         }
         if (rs.attach.attachState !== undefined && !event.isError) {

package/dist/core/runner/run-leg.js

@@ -13,7 +13,7 @@ import { composeApprovalPostureDirective } from "../auto-mode-directive.js";
 import { mintSystemReminder, statedReminderBodiesOf } from "../reminder-mint.js";
 import { hasDestroy } from "../remote-env.js";
 import { advertisedWritableRootsSeat, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
-import { callFaceSeat, judgeParkedToolIdentity, rosterEntryNamed, toolCallFaceOf } from "../tool-roster.js";
+import { callFaceSeat, judgeParkedToolIdentity, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
 import { deliverEngineNotice } from "../types.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
 import { errorCodeOf } from "./assemble-result.js";
@@ -34,6 +34,7 @@ import { attachmentEnvelopeTags, collectDateChange, commitAgentListing, commitSk
 import { flushOwedAnnouncedSnapshot } from "./announce-once-ledger.js";
 import { asThrownError, thrownMarksOf, thrownText } from "../thrown-value.js";
 import { ruleSourcePhrase } from "../rule-denial-sentence.js";
+import { wireOf } from "../tool-name-readings.js";
 export async function runLeg(input) {
     const { spec, queue, prepared, resume, rs, isDelegatedChild, entryActor, effectiveTimeoutMs, timeout, pushContent, ident, emitCommitted, writeFamilyOf, startedToolCallIds, announceWorkspaceMove, withBrainSinks, flushGitMirror, loopLatch, notificationLane, unsubscribeTaskNotifications, unsubGitRetry, unsubBoundary, unsub, runner, next } = input;
     let final;
@@ -563,12 +564,13 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     if (decidedGate === undefined) {
         throw new CheckpointError("checkpoint.invalid_outcome", "pending action reached the resolver with no settlement record on its decision (gateOutcome) — refusing to execute or settle a decision that carries no record");
     }
-    const resolvedArgs = pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME ? pendingAction.args : (outcome.updatedInput !== undefined ? outcome.updatedInput : pendingAction.args);
+    const resolvedArgs = wireOf("resume.questionArgsShown", pendingAction) === ASK_USER_QUESTION_TOOL_NAME ? pendingAction.args : (outcome.updatedInput !== undefined ? outcome.updatedInput : pendingAction.args);
     const pendingLabel = (() => { const l = prepared.tools.find((t) => t.name === pendingAction.toolName)?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
-    emit({ type: "tool_start", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, args: resolvedArgs });
+    const spelledName = pendingAction.names?.[0] ?? pendingAction.toolName;
+    emit({ type: "tool_start", toolCallId: pendingAction.toolCallId, toolName: spelledName, ...pendingLabel, args: resolvedArgs });
     const settleEnd = async (isError, result, gate = decidedGate) => {
         prepared.toolProgressRef.current?.noteEnd(pendingAction.toolCallId);
-        emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError, prepared.structuredProjector, gate) });
+        emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: spelledName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError, prepared.structuredProjector, gate) });
         const word = await resume.recordExecutionOutcome(gate);
         settleExecutionRecord(runner.deps.onNotice, word, { toolName: pendingAction.toolName, gate, sessionId: prepared.sessionId, runId: prepared.runId, scope: resume.cp.scope, ...(resume.cp.checkpointId !== undefined ? { checkpointId: resume.cp.checkpointId } : {}) });
     };
@@ -611,7 +613,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             budget: beltBudget,
             ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
             ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs),
-            ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)),
+            ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)),
         }, prepared.abortController.signal));
         const beltUnsafe = rechecked.action === "deny" ||
             (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, resolvedArgs));
@@ -634,7 +636,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     if (prepared.permissionRuleOrg !== undefined) {
         const orgVerdict = prepared.permissionRuleOrg
-            .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)) })
+            .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)) })
             .catch(() => ({ status: "unavailable", disclosures: ["the org adjudication face threw on resume"] }));
         let orgWaitCancelled = false;
         const org = await settleOrgVerdictWithin(orgVerdict, { status: "unavailable", disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`] }, {
@@ -669,7 +671,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             toolName: pendingAction.toolName,
             args: resolvedArgs,
             toolCallId: pendingAction.toolCallId,
-            ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)),
+            ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)),
             budget: beltBudget,
             ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
             ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs),
@@ -691,7 +693,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
                 toolName: pendingAction.toolName,
                 args: resolvedArgs,
                 toolCallId: pendingAction.toolCallId,
-                ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)),
+                ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)),
                 budget: beltBudget,
                 ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
                 ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs),
@@ -717,7 +719,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     if (prepared.shellReadCheck !== undefined) {
         const edited = outcome.updatedInput !== undefined && !deepJsonEqual(outcome.updatedInput, pendingAction.args);
-        const readCall = { toolName: pendingAction.toolName, ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)) };
+        const readCall = { toolName: pendingAction.toolName, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)) };
         const judged = prepared.shellReadCheck.judge(readCall, resolvedArgs, prepared.cwdRef?.current, prepared.abortController.signal, {
             toolCallId: pendingAction.toolCallId,
             ...(edited ? { seat: "rejudge" } : {}),

package/dist/core/runner/run-recovery-lanes.js

@@ -1,5 +1,6 @@
 import { compactionKindOf } from "../task-notification.js";
 import { planRejectionClears } from "../context-edit.js";
+import { rosterToolName } from "../tool-roster.js";
 import { landStaleResultClears } from "./prepare-context-lane.js";
 import { DEFAULT_COMPACTION_INSTRUCTIONS, maybeCompact, mintCompactedEvent } from "../auto-compaction.js";
 import { emitTrace } from "../trace.js";
@@ -122,6 +123,7 @@ export function runRecoveryLanes(input) {
                         ? { declined: "no_candidates" }
                         : planRejectionClears(proj.messages, {
                             keyOf: proj.keyOf,
+                            toolNameOf: (recorded) => rosterToolName(prepared.toolRosterDeltas.current, recorded),
                             ...(prepared.microCompact.offloadPersist ? { offload: { persist: prepared.microCompact.offloadPersist } } : {}),
                         });
                     if ("declined" in plan) {

package/dist/core/runner/session-rule-policy.js

@@ -2,7 +2,7 @@ import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from
 import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
 import { continuesLineage } from "../session-policy-store.js";
 import { thrownText } from "../thrown-value.js";
-import { toolNameSetHas } from "../tool-roster.js";
+import { heldBy, wireOf } from "../tool-name-readings.js";
 import { ruleDenialSentence } from "../rule-denial-sentence.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames, skillScopeWriteToolNames } from "../tool-registry.js";
@@ -137,9 +137,10 @@ export function createSessionRulePolicy(rules, opts) {
         async check(req, signal) {
             const { toolDeny, toolAllow, toolDenyCovering, toolAllowCovering, cmdPolicy, allowDirs } = compile(await readRules(req.toolCallId, signal));
             const toolName = req.toolName;
-            if (toolNameSetHas(toolDeny, req) || namespacedCoveringHit(toolDenyCovering, toolName))
+            const listed = (set) => heldBy("policy.sessionRules", set, req);
+            if (listed(toolDeny) || namespacedCoveringHit(toolDenyCovering, toolName))
                 return deny(req.toolName);
-            if (toolAllow && !toolNameSetHas(toolAllow, req) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
+            if (toolAllow && !listed(toolAllow) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
                 return deny(req.toolName, "it is not in the session-rule allowlist");
             }
             if (cmdPolicy) {
@@ -151,7 +152,7 @@ export function createSessionRulePolicy(rules, opts) {
             }
             if (allowDirs) {
                 if (!isProtectedWrite(req)) {
-                    const eff = toolEffects?.get(toolName) ?? "write";
+                    const eff = toolEffects?.get(wireOf("policy.sessionRules.effect", req)) ?? "write";
                     if (eff !== "read") {
                         return deny(req.toolName, "it is write-capable and cannot be path-confined, while the rule confines writes to allowDirs");
                     }

package/dist/core/runner/tool-call-id-fold-seat.d.ts

@@ -0,0 +1,13 @@
+import type { EngineNotice } from "../engine-notice.js";
+export interface ToolCallIdFoldSeat {
+    /** Observe one assistant message; announces the run's first folded call. */
+    observe(message: {
+        readonly content?: unknown;
+    }): void;
+}
+/** The notice's attribution ids — the same pair, for the same reason, as {@link ResponseModelSeatIds}. */
+export interface ToolCallIdFoldSeatIds {
+    sessionId: string;
+    runId: string;
+}
+export declare function createToolCallIdFoldSeat(onNotice: ((notice: EngineNotice) => void) | undefined, ids: ToolCallIdFoldSeatIds): ToolCallIdFoldSeat;

package/dist/core/runner/tool-call-id-fold-seat.js

@@ -0,0 +1,31 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+import { providerToolCallId, toolCallIdFoldReason } from "../../brain/tool-call-id.js";
+function isCall(block) {
+    return typeof block === "object" && block !== null && block.type === "toolCall" && typeof block.id === "string";
+}
+export function createToolCallIdFoldSeat(onNotice, ids) {
+    let announced = false;
+    return {
+        observe(message) {
+            if (announced || !Array.isArray(message.content))
+                return;
+            for (const call of message.content.filter(isCall)) {
+                const wireId = providerToolCallId(call);
+                const reason = wireId === call.id ? undefined : toolCallIdFoldReason(wireId);
+                if (reason === undefined)
+                    continue;
+                announced = true;
+                deliverEngineNotice(onNotice, {
+                    code: "route.tool_call_id_folded",
+                    message: `The provider named a tool call with an id outside the shape the engine keys calls under ` +
+                        `(${reason === "length" ? `${wireId.length} characters, over 128` : "a control byte, a space, a non-ASCII character or a `~`"}). ` +
+                        `The engine keys it as "${call.id}" on every face — frames, cards, transcript, park rows — and hands the ` +
+                        `provider its own id back for the call and its result, so the run is unchanged. Once per run; later calls ` +
+                        `with such ids are folded the same way without another notice.`,
+                    detail: { toolCallId: call.id, rawLength: wireId.length, reason, sessionId: ids.sessionId, runId: ids.runId },
+                });
+                return;
+            }
+        },
+    };
+}

package/dist/core/sensitive-path-policy.js

@@ -5,7 +5,7 @@ import { compileSegmentPattern, matchSegmentPatterns, READ_FACE_BUILTIN_DENY_TAB
 import { isProtectedWrite, protectivePathTargetOf } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
 import { symlinkChainHops } from "./path-identity.js";
-import { toolNameSetHas } from "./tool-roster.js";
+import { heldBy } from "./tool-name-readings.js";
 export function agentConfigDenyPatterns() {
     return READ_FACE_BUILTIN_DENY_TABLE.filter((row) => row.tier === "agent-config").map((row) => readDenyPatternRun(row.pattern).run);
 }
@@ -147,7 +147,7 @@ export function createSensitivePathPolicy(opts) {
         async check(req, signal) {
             if (compiled.length === 0)
                 return { action: "allow" };
-            if (guardedByName !== undefined ? !toolNameSetHas(guardedByName, req) : !isProtectedWrite(req))
+            if (guardedByName !== undefined ? !heldBy("policy.sensitivePathGuardedByName", guardedByName, req) : !isProtectedWrite(req))
                 return { action: "allow" };
             const protective = protectivePathTargetOf(req);
             const path = writeTargetPath(req, protective);

package/dist/core/side-query.d.ts

@@ -76,9 +76,13 @@ export interface SideQuerySpec {
 export interface SideQueryResult {
     /** Concatenated assistant text (may be empty when the reply is tool-calls-only). */
     text: string;
-    /** Tool calls the model made against the DEFINITIONS (never executed by the engine). */
+    /** Tool calls the model made against the DEFINITIONS (never executed by the engine). `id` is the engine id;
+     *  `wireId` is the provider's own spelling, present only when the two differ (`ToolCall.wireId`, the same
+     *  source). A caller replaying a call carries both on its `toolCall` block and keys the result by `id`; one that
+     *  talks to the provider itself hands it `wireId ?? id`. */
     toolCalls: Array<{
         id: string;
+        wireId?: string;
         name: string;
         args: unknown;
     }>;

package/dist/core/side-query.js

@@ -2,6 +2,7 @@ import { resolveTaskModel } from "./roles.js";
 import { readDegradation } from "../brain/degrading.js";
 import { cacheFamilyOf, uncachedInputTokensOf } from "./runner/usage-accounting.js";
 import { providerReportedModel } from "./message-utils.js";
+import { providerToolCallId } from "../brain/tool-call-id.js";
 function normalizeSideQueryUsage(model, u) {
     const input = uncachedInputTokensOf(cacheFamilyOf(model), u);
     return input === u.input ? u : { ...u, input };
@@ -61,7 +62,10 @@ export async function runSideQuery(spec, deps) {
         .join("");
     const toolCalls = msg.content
         .filter((c) => c.type === "toolCall")
-        .map((c) => ({ id: c.id, name: c.name, args: c.arguments }));
+        .map((c) => {
+        const wireId = providerToolCallId(c);
+        return { id: c.id, ...(wireId !== c.id ? { wireId } : {}), name: c.name, args: c.arguments };
+    });
     const degraded = readDegradation(msg);
     const servedModel = typeof msg.model === "string" && msg.model.length > 0 ? msg.model : resolved.model.id;
     const reportedModel = providerReportedModel(msg);