@sema-agent/core 7.35.2 → 7.37.0

package/dist/core/tool-policy.d.ts

@@ -4,10 +4,10 @@ import { type Settlement } from "./gate-outcome.js";
 /** A tool call presented to a policy before it executes. */
 /** design/388 B6 — the per-call face (see {@link ToolCallRequest.face}). */
 export interface ToolCallFace {
-    /** Every name a tool-name rule may spell this tool by: the tool's wire name first, then each alias that resolves to
-     *  it on the leg's roster (`rosterToolName`). A rule reaches the call iff its tool name is on this list — read it
-     *  through {@link ruleNamesOf}, never off `toolName` alone. Absent on a face rebuilt from a park row that predates it
-     *  (the call's own name is then the list). */
+    /** Every name a tool-name rule may spell this tool by: the name the call was made under first (the model's spelling),
+     *  then the tool's wire name and each other alias that resolves to it on the leg's roster (`rosterToolName`). A rule
+     *  reaches the call iff its tool name is on this list — read it through `ruleNamesOf`, never off `toolName` alone.
+     *  Absent on a face rebuilt from a park row that predates it (the call's own name is then the list). */
     names?: readonly string[];
     family: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
@@ -18,7 +18,7 @@ export interface ToolCallFace {
 }
 export interface ToolCallRequest {
     /** The tool's wire name — the Runner's gate resolves a call made under an alias to the wire name of the tool it
-     *  dispatches to before any policy runs (`rosterToolName`); the names a rule may use for it are {@link ruleNamesOf}. */
+     *  dispatches to before any policy runs (`rosterToolName`); the names a rule may use for it are `ruleNamesOf`. */
     toolName: string;
     args: unknown;
     toolCallId: string;
@@ -262,18 +262,9 @@ export declare function screenApproverAttribution(v: unknown): {
  * or `approver` member on its verdict is putting an unread property on it.
  * RB-479-B① (ruled 2026-08-02): the legacy `reason` field is REMOVED — one name for one thing.
  *
- * How far the TYPE carries that retirement (measured 2026-08-03, correcting this note's earlier claim
- * that a policy returning `{reason}` "compiles red for TS consumers"): TypeScript's excess-property
- * check fires only where the decision is a LITERAL in an ANNOTATED position — `const d: PermissionResult
- * = {…}`, or a `check` written with an explicit `: PermissionResult` return annotation. The ordinary
- * policy shape, `{ check: () => ({…}) }` with an INFERRED return type (also the method-syntax and
- * assign-then-return forms), compiles GREEN with a stray `reason`. That is not a hole to plug in the
- * type system — it is how contextual typing works — so the enforcement is at RUNTIME instead: every
- * point that CONSUMES a decision REFUSES one carrying an own `reason` property, fail-closed (deny, with
- * a migration message) — the {@link combinePolicies} fold, the PreToolUse hook face, and the durable
- * resume-edit rechecks (see {@link refuseOutOfContractDecision}). Same doctrine as the strict `approve`
- * / `onAsk` folds in this file: an out-of-contract value on the permission face is a loud rejection,
- * never a best-effort read.
+ * The TYPE carries that retirement only where a decision is a literal in an annotated position; an inferred `check`
+ * return compiles green with a stray `reason`, so the enforcement is at RUNTIME — every point that consumes a decision
+ * refuses one carrying an own `reason` property, fail-closed ({@link refuseOutOfContractDecision}).
  */
 export type PermissionResult = {
     action: "allow";
@@ -387,6 +378,13 @@ export type PermissionResult = {
      *  render the card by it. Optional on the TYPE only because a decision is caller-composable; every ask
      *  the gate hands to its resolver carries it. */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** The ask's CLASS — the first member of {@link classes} (see {@link AskRequest.askClass}). ENGINE-STAMPED at the
+     *  same single stamp as {@link origin}, from the class set the gate's lanes read; a policy that self-declares it is
+     *  overwritten there, and no lane reads it back (they read the classification itself). */
+    askClass?: import("./ask-origin.js").AskClass;
+    /** The ask's whole class set, in {@link import("./ask-origin.js").ASK_CLASSES} order (see
+     *  {@link AskRequest.classes}). Stamped beside {@link askClass}, under the same rule. */
+    classes?: readonly import("./ask-origin.js").AskClass[];
     /** WHICH integrity guard minted this ask — the unverifiable recursive delete or the session-transcript
      *  write. ENGINE-STAMPED by the two guard policies; a fold-internal fact the class derivation reads
      *  ({@link import("./ask-origin.js").classifyAsk}) so the two guards, which mint the same
@@ -737,63 +735,53 @@ export declare function constraintChainEntryOfSuppliedLayer(layer: ConstraintCha
  * different frozen deny data now digest differently.
  */
 export declare function constraintChainDigest(chain: readonly ConstraintChainEntry[]): string;
+/** Every member of the decision union — a member the union gains and this list lacks is a type error at `satisfies`.
+ *  The receipt walks it: a contract member not held as an own enumerable data property is refused if a descriptor on the
+ *  prototype chain holds one (an `undefined` data value spells absence). Not re-exported from `src/index.ts`. */
+export type DecisionMember = PermissionResult extends infer U ? (U extends unknown ? keyof U : never) : never;
+export declare const DECISION_MEMBERS: readonly DecisionMember[];
 /**
- * Refuse a decision that speaks the retired `reason` dialect (RB-479-B①, tripwire ruled 2026-08-03).
- *
- * Applied at every point a decision is CONSUMED, because no single fold sees them all (ruled
- * 2026-08-03): {@link combinePolicies} (the runner's gate path), the PreToolUse hook's result seam
- * (`hooks.ts` — a hook result reaches the gate decision without ever passing through a fold), and the
- * durable resume-edit rechecks (`runtask.ts` — direct `check()` calls on the caller's own policy). The
- * wording is face-neutral for that reason: one construction point, three consumers. The export exists
- * for those two engine modules only and is deliberately NOT re-exported from `src/index.ts`: this is an
- * internal screen on inputs the engine receives, not a facility deployments call.
- *
- * Why this is a DENY and not a best-effort read of the old field: the retirement is settled, so the
- * value is out-of-contract input to the permission face — the same class as an untyped `approve`
- * returning a truthy non-`true`, which this file already refuses fail-closed. Reading the old name
- * anyway would re-open the two-names-for-one-thing surface; ignoring it (the pre-tripwire behavior)
- * silently dropped the policy's own text and returned the per-site generic default, so a deployment
- * whose deny messages had quietly degraded looked healthy. The type system cannot carry this alone —
- * excess-property checking does not reach an inferred `check` return (see {@link PermissionResult}).
- *
- * OWN property only (`hasOwnProperty`, not `in`): a decision whose PROTOTYPE happens to expose
- * `reason` never wrote the retired field. A non-object decision is passed through untouched — reading
- * `.action` off it is the caller's existing failure, and inventing a second failure mode here would
- * change which error a broken policy raises.
- *
- * Any accumulated `updatedInput` is deliberately NOT carried onto this deny: it came from the same
- * out-of-contract decision object, so it is not a rewrite this layer is willing to report as audited.
- * (A rewrite from an EARLIER, contract-shaped policy still rides out — {@link combinePolicies} adds it
- * on the deny path per the observer contract.)
- *
- * The second arm screens `decisionReason` against the closed set ({@link DecisionReason}): a
- * deployment-authored `ToolPolicy.check` returning a value outside it would otherwise ride silently
- * into every consumer that BRANCHES on the word — provenance-keyed exclusions, audit rows, checkpoint
- * discriminants — each of which would treat the unclassifiable value as "none of the reasons I know",
- * a meaning the producing policy never chose. Same doctrine as the retired-field arm: out-of-contract
- * input to the permission face is refused loudly, not passed through as an accidental tenth reason.
- * An ABSENT `decisionReason` stays legal (it is optional; `undefined` is the typed spelling of
- * absence), and hook results never reach here with a foreign word — the hook seam stamps its own
- * (`hooks.ts`) — so this arm's live producers are exactly the deployment policies the tripwire exists
- * to screen. Unlike the retired-field arm this one reads the property PLAINLY (prototype chain
- * included), because it answers a different question: the retired arm asks whether the AUTHOR wrote
- * the old field (own property = authorship), this arm asks what a CONSUMER would read — and every
- * consumer branches on a plain `d.decisionReason` read, which the prototype can satisfy.
- *
- * SCOPE of the carrier check (ruled after three review rounds converged on the same root): it screens
- * STRUCTURALLY unstable carriers — getters, prototype-supplied values — i.e. shapes an ordinary
- * deployment can write by accident. It does NOT try to defeat a Proxy whose descriptor trap reports a
- * data property while its get trap stays stateful: same-process JavaScript has no trust boundary a
- * function can enforce (an untrusted party who ships such a Proxy can as easily patch this module), so
- * chasing that shape adds complexity without adding a guarantee. The screen's promise is against
- * drift and accident, not against a untrusted co-resident.
- *
- * `reasonIsNonInput` (the HOOK seam's spelling — merged-code scan, 5.28 window): at that seam the
- * field is documented as DISCARDED — every mint point downstream unconditionally re-stamps
- * `decisionReason:"hook"` (fold, deny arm, delegated twin), and the allow path never reads it — so
- * both reason arms are skipped there: refusing a value that cannot travel would fail-close a call
- * over a field with no consumer, which inverted the discard contract the stamp exists to enforce.
- * The retired-`reason` arm still applies (that one is about the MESSAGE channel, which does travel).
+ * The RECEIPT of a permission decision — the one point at which the engine takes a decision in from whoever composed it,
+ * on every lane: each layer of {@link combinePolicies}' fold, the gate's adjudication entry and its approved-edit re-check,
+ * the inherited lane's receipts of an ancestor policy's decision, the final-form re-check, the direct `check()` rechecks
+ * (the resume edit, the park re-projection, the changed-files probe), and the PreToolUse hook's result seam (its own
+ * reach, below). NOT re-exported from `src/index.ts`: an internal screen on inputs the engine receives.
+ *
+ * WHAT COMES BACK is the engine's own frozen copy, never the caller's object. A decision is caller-supplied data: a
+ * stateful accessor, a Proxy, or a policy that keeps and mutates an object it returned could otherwise answer two
+ * consumers with two values, and which consumer read which value would decide the call. So the caller's object is read
+ * ONCE, here, and every station after the receipt (the fold's ranking, the origin stamp, the classifier's eligibility, the
+ * mode arbitration, the approval request, the rewrite that executes) reads the copy; a copy handed to the screen again
+ * comes back as it is, unread. In order: (1) the CARRIER's type — a decision that is not an object (a string, a function
+ * holding the members) has no `action`; (2) the ONE READ — ONE function ({@link receiveContract}) for the decision and for the
+ * records it nests ({@link NESTED_CONTRACTS}), on an ORDINARY object (a Proxy, as the carrier or anywhere on its prototype
+ * chain, is refused before a trap of its could run): each contract member absent or an own enumerable DATA property, its value
+ * taken off the carrier's own descriptor (a member outside the contract is neither read nor carried — a policy's self-declared
+ * record on another name finds no reader); any other spelling refused by name — an accessor (never invoked), a member the
+ * prototype or a non-enumerable property supplies unless that descriptor spells absence (an `undefined` data value) — judged by
+ * descriptor, never read; (3) the retired `reason` field as an OWN property, judged without a read (authorship of the old
+ * spelling: a prototype exposing it never wrote it; ignoring it silently dropped the policy's text); (4) the VALUES, off the engine's
+ * one-read record, never a second read of the caller's object — the retired window absent, `action` in
+ * {@link DECISION_ACTIONS} (a consumer ranks a decision by testing two of its words, so any other value used to rank as an
+ * allow; a `canUseTool` result outside its set is a failure in CC) and `decisionReason` in {@link DECISION_REASONS} when
+ * present (absence stays legal); (5) the DETACH —
+ * the contract members' values structured-cloned ({@link tryCloneArgs}; one that cannot be, a function inside a rewrite,
+ * is refused), the engine's identity-keyed records carried across ({@link carryEngineAttestations}), the copy frozen and
+ * marked as this module's. A refusal is a deny in the screen's words, one code for every arm (`decisionReason: "rule"`),
+ * carrying no `updatedInput` from the refused object (a rewrite from an EARLIER, contract-shaped layer still rides out of
+ * {@link combinePolicies}' deny path). `null` / `undefined` carry nothing and take the carrier's refusal (the caller's own
+ * read of `.action` would throw instead, and that throw was being reported as an aborted check).
+ *
+ * SCOPE: the receipt runs NONE of the carrier's code — a Proxy (its traps are the caller's code) is refused unread, and on an
+ * ordinary object descriptor looks and `Object.getPrototypeOf` invoke nothing. What the receipt does not reach: code inside a
+ * member's VALUE, run by the detach itself (an accessor inside a rewrite is invoked by the structured clone, and what it answers
+ * there is what is cloned and what runs — one read, consistent) and by a refusal's rendering of a foreign word (`String(v)` on an
+ * out-of-set `action`, after the deny is decided). Same-process JavaScript has no trust boundary a function can enforce.
+ *
+ * `reasonIsNonInput` (the HOOK seam): a hook's `decisionReason` is DISCARDED there — every mint point downstream re-stamps
+ * `"hook"`, and the seam maps a hook's deny and ask and reads anything else as no objection, the policy still adjudicating
+ * the call — so that seam takes the two retired-field arms alone and its object back unchanged (`undefined` = no
+ * opinion): refusing a value that cannot travel would fail-close a call over a field with no consumer.
  */
 export declare function refuseOutOfContractDecision(d: PermissionResult, opts?: {
     reasonIsNonInput?: boolean;
@@ -911,22 +899,11 @@ export declare function createApprovalPolicy(opts: {
  */
 export declare function combinePolicies(...policies: ToolPolicy[]): ToolPolicy;
 /**
- * The shell tools whose `{ command }` arg a coarse command-name policy parses. Other tools are out of scope.
- *
- * `Monitor` belongs here. It takes a `command` and runs it through the
- * SAME `env.spawnBackground` seam as Bash, and prepare-task's own note says so in as many words — "Monitor
- * runs an arbitrary shell `command` through the SAME env seam — it must sit behind the SAME shellGate
- * tighten (else it becomes a policy side-door around a gated Bash)". The shellGate half was implemented;
- * this half — the two ALWAYS-ON, core-owned parity gates that a caller's policy cannot remove — was keyed
- * on a list containing only "Bash". The probe drove the whole thing end to end: the identical
- * `rm -rf $(cat targets)` was denied as Bash and executed as Monitor, deleting a real directory with no
- * gate at all; the same substitution makes `rm -rf ~/.ai-agent/sessions` a way to erase the audit trail.
- */
-/**
- * EXPORTED. A downstream governance layer keeps its own copy of this list so its
- * per-command ask-list gates the same tools core does, and it had no way to read the real one — its guard
- * had to probe a hand-written candidate list of names, which stays green for any name nobody thought to
- * put in it. The list itself is the fact; publishing it removes the guess.
+ * The shell tools whose `{ command }` arg a coarse command-name policy parses; other tools are out of scope. `Monitor`
+ * belongs here: it runs an arbitrary shell `command` through the same env seam as Bash, so the always-on parity gates
+ * keyed on this list reach it too (a list of `Bash` alone let the identical command run ungated as `Monitor`). EXPORTED:
+ * a downstream governance layer keeps its own copy of this list so its per-command ask-list gates the same tools core
+ * does — the list itself is the fact, and publishing it removes the guess.
  */
 export declare const COARSE_SHELL_TOOLS: string[];
 /**
@@ -1389,6 +1366,19 @@ export interface AskRequest {
      *  therefore reading the deployment's own claim about its own ask, which is the direction that cannot
      *  loosen anything. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
+    /** The ask's CLASS: the first member of {@link classes} in {@link import("./ask-origin.js").ASK_CLASSES} order — the
+     *  row key of {@link import("./ask-origin.js").MODE_ARBITRATION} a permission mode reads. Filled by every station that
+     *  fills {@link origin}, from the same classification the gate's lanes arbitrated this ask by; never written by a
+     *  caller or worker (a policy's self-declared value is replaced at the stamp), and a policy can move it only through
+     *  the tighten-only inputs the classification reads. ABSENT = unclassified: a request from a station that fills no
+     *  {@link origin} (the shared-artifact read confirmation), or a request built by a deployment itself. An approver
+     *  that answers by class treats absence as a class it will not answer. */
+    readonly askClass?: import("./ask-origin.js").AskClass;
+    /** Every class this ask belongs to, in {@link import("./ask-origin.js").ASK_CLASSES} order, `classes[0] ===
+     *  askClass`. One ask can carry several (an org verdict beside a hook's question); an approver that answers by class
+     *  reads the whole set — a class it will not answer anywhere in it is a question it does not answer. Present exactly
+     *  when {@link askClass} is. */
+    readonly classes?: readonly import("./ask-origin.js").AskClass[];
     /** Engine-judged risk axes of the action awaiting approval, for the human decision surface: a
      *  coarse `requiresRealApproval` cannot tell "cannot be undone" from "data leaves the machine",
      *  and those call for different scrutiny. Filled by the gate from the SAME resolved axes the

package/dist/core/tool-policy.js

@@ -8,15 +8,18 @@ import { sanitizeAutoModeArmingRecipe } from "./auto-mode-arming.js";
 import { join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
-import { ruleNamesOf, toolNameSetHas } from "./tool-roster.js";
+import { heldBy } from "./tool-name-readings.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
 import { thrownText } from "./thrown-value.js";
+import { receiveContract, refusedOutOfContract } from "./decision-receipt.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
 import { protocolOf } from "./protocol-table.js";
 import { isAbsoluteForFamily, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { ASSIGNMENT_PREFIX, writtenAssignmentPrefix } from "../tools/fs/bash-program-position.js";
+const nameListHolds = (set, req) => heldBy("policy.nameLists", set, req);
+const shellToolsListHolds = (set, req) => heldBy("policy.shellToolsList", set, req);
 export function advertisedWritableRootsSeat(seat) {
     return seat === undefined ? {} : { advertisedWritableRoots: Object.freeze([...seat.roots]) };
 }
@@ -165,21 +168,21 @@ export function namespacedCoveringHit(covering, toolName) {
     return covering.length > 0 && covering.some((e) => namespacedRuleNameCovers(e, toolName));
 }
 export function checkToolPolicyProjection(projection, req) {
-    const names = ruleNamesOf(req);
+    const listed = (list) => heldBy("policy.projectionReplay", { has: (n) => list.includes(n) }, req);
     for (const c of projection.components) {
         if (c.kind === "tool_deny") {
-            if (names.some((n) => c.names.includes(n)) || namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
+            if (listed(c.names) || namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by a frozen inherited policy projection` };
             }
             continue;
         }
         if (c.kind === "tool_allowlist") {
-            if (!names.some((n) => c.names.includes(n)) && !namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
+            if (!listed(c.names) && !namespacedCoveringHit(namespacedCoveringEntries(c.names), req.toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in a frozen inherited policy projection's allowlist` };
             }
             continue;
         }
-        if (!names.some((n) => c.tools.includes(n)))
+        if (!listed(c.tools))
             continue;
         const command = req.args?.command;
         if (typeof command !== "string") {
@@ -242,56 +245,90 @@ function stableJson(v) {
 export function constraintChainDigest(chain) {
     return `cpv1:${createHash("sha256").update(stableJson(chain)).digest("hex")}`;
 }
-const ALLOW = { action: "allow" };
+const ALLOW = Object.freeze({ action: "allow" });
 const RETIRED_TEXT_FIELD = "reason";
 const RETIRED_WINDOW_MEMBER = "autoDenyAfterMs";
 const RETIRED_WINDOW_MEMBER_DENY_MESSAGE = `a permission decision's "denialLimitFallback" carries "${RETIRED_WINDOW_MEMBER}" — the decision names the counts only; ` +
     `the auto-deny window is decided by the ask's route (a live approver arms it, every other route runs none) and cannot be ` +
     `declared by a policy; denied fail-closed rather than silently replacing the declared number`;
+const carriesRetiredWindow = (fallback) => typeof fallback === "object" && fallback !== null && fallback[RETIRED_WINDOW_MEMBER] !== undefined;
+const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
+const DECISION_ACTION_SET = new Set(DECISION_ACTIONS);
+export const DECISION_MEMBERS = Object.keys({
+    action: 0, updatedInput: 0, message: 0, decisionReason: 0, requiresRealApproval: 0, denialLimitFallback: 0, persistedRuleShadowed: 0, probeReason: 0,
+    probeCause: 0, probeMandated: 0, mandated: 0, mandate: 0, probeReadRootCandidate: 0, matchedAskRule: 0, ruleEvidence: 0, segmentCoverage: 0,
+    origin: 0, askClass: 0, classes: 0, guard: 0, ruleUnreadable: 0, authoredBy: 0, foldedAskClasses: 0,
+});
+const OPERAND_MEMBERS = Object.keys({ shown: 0, total: 0 });
+const NESTED_CONTRACTS = [
+    ["", "denialLimitFallback", Object.keys({ consecutive: 0, total: 0, limit: 0, autoDenyAfterMs: 0 })],
+    ["", "probeCause", Object.keys({ code: 0, roots: 0, further: 0 })],
+    ["probeCause.", "roots", OPERAND_MEMBERS],
+    ["probeCause.", "further", OPERAND_MEMBERS],
+];
+const refusedAction = (what) => refusedOutOfContract(`a permission decision's "action" is ${what} — the closed set is ${DECISION_ACTIONS.join("/")}; denied fail-closed rather than reading a word outside it as an allow`);
+function renderForeignValue(v) {
+    try {
+        return JSON.stringify(String(v).slice(0, 64));
+    }
+    catch {
+        return `[unprintable ${typeof v}]`;
+    }
+}
 const RETIRED_TEXT_FIELD_DENY_MESSAGE = `a permission decision carries the retired "${RETIRED_TEXT_FIELD}" field — rename it to "message" (the one text field ` +
     `a decision carries); denied fail-closed rather than executing a decision whose text this layer cannot read`;
+const ENGINE_RECEIPTS = new WeakSet();
 export function refuseOutOfContractDecision(d, opts) {
+    if (opts?.reasonIsNonInput === true) {
+        if (d === null || d === undefined)
+            return d;
+        if (Object.prototype.hasOwnProperty.call(d, RETIRED_TEXT_FIELD))
+            return refusedOutOfContract(RETIRED_TEXT_FIELD_DENY_MESSAGE);
+        return carriesRetiredWindow(d.denialLimitFallback) ? refusedOutOfContract(RETIRED_WINDOW_MEMBER_DENY_MESSAGE) : d;
+    }
     if (typeof d !== "object" || d === null)
+        return refusedAction(`absent (the decision is ${d === null || d === undefined ? String(d) : `a ${typeof d}`}, not an object)`);
+    if (ENGINE_RECEIPTS.has(d))
         return d;
-    if (Object.prototype.hasOwnProperty.call(d, RETIRED_TEXT_FIELD)) {
-        return { action: "deny", message: RETIRED_TEXT_FIELD_DENY_MESSAGE, decisionReason: "rule" };
+    const decision = receiveContract(d, DECISION_MEMBERS, "");
+    if (decision.kind === "refused")
+        return decision.refused;
+    if (Object.prototype.hasOwnProperty.call(d, RETIRED_TEXT_FIELD))
+        return refusedOutOfContract(RETIRED_TEXT_FIELD_DENY_MESSAGE);
+    const contract = decision.held;
+    const records = Object.assign(Object.create(null), { "": contract });
+    for (const [holder, member, members] of NESTED_CONTRACTS) {
+        const held = records[holder];
+        if (held === undefined || typeof held[member] !== "object" || held[member] === null)
+            continue;
+        const nested = receiveContract(held[member], members, `${holder}${member}.`);
+        if (nested.kind === "refused")
+            return nested.refused;
+        held[member] = records[`${holder}${member}.`] = nested.held;
     }
-    const fb = d.denialLimitFallback;
-    if (typeof fb === "object" && fb !== null && fb.autoDenyAfterMs !== undefined) {
-        return { action: "deny", message: RETIRED_WINDOW_MEMBER_DENY_MESSAGE, decisionReason: "rule" };
+    if (carriesRetiredWindow(contract.denialLimitFallback))
+        return refusedOutOfContract(RETIRED_WINDOW_MEMBER_DENY_MESSAGE);
+    if (!DECISION_ACTION_SET.has(contract.action))
+        return refusedAction(contract.action === undefined ? "absent" : renderForeignValue(contract.action));
+    if (contract.decisionReason !== undefined && !DECISION_REASON_SET.has(contract.decisionReason)) {
+        return refusedOutOfContract(`a permission decision carries an unrecognized "decisionReason" value (${renderForeignValue(contract.decisionReason)}) — ` +
+            `the closed set is ${DECISION_REASONS.join("/")}; denied fail-closed rather than letting consumers branch on a value this layer cannot classify`);
     }
-    if (opts?.reasonIsNonInput === true)
-        return d;
-    const dr = d.decisionReason;
-    if (dr === undefined)
-        return d;
-    if (!DECISION_REASON_SET.has(dr)) {
-        let rendered;
-        try {
-            rendered = JSON.stringify(String(dr).slice(0, 64));
-        }
-        catch {
-            rendered = `[unprintable ${typeof dr}]`;
-        }
-        return {
-            action: "deny",
-            message: `a permission decision carries an unrecognized "decisionReason" value (${rendered}) — ` +
-                `the closed set is ${DECISION_REASONS.join("/")}; denied fail-closed rather than letting consumers ` +
-                `branch on a value this layer cannot classify`,
-            decisionReason: "rule",
-        };
+    const detached = tryCloneArgs(contract);
+    if (!detached.ok) {
+        return refusedOutOfContract(`a permission decision's members could not be detached from the policy that returned them (${detached.reason}) — ` +
+            `the engine keeps its own copy of what it read; denied fail-closed`);
     }
-    const carrier = Object.getOwnPropertyDescriptor(d, "decisionReason");
-    if (carrier === undefined || !("value" in carrier)) {
-        return {
-            action: "deny",
-            message: `a permission decision supplies "decisionReason" through ${carrier === undefined ? "its prototype" : "an accessor"} — ` +
-                `contract fields must be own data properties, so consumers re-reading the field cannot be shown a ` +
-                `different value than this screen validated; denied fail-closed`,
-            decisionReason: "rule",
-        };
+    const receipt = Object.freeze(detached.value);
+    const ownRecord = (o, k) => (typeof o === "object" && o !== null && Object.hasOwn(o, k) ? o[k] : undefined);
+    for (const [holder, member] of NESTED_CONTRACTS) {
+        const record = ownRecord(holder.split(".").filter(Boolean).reduce(ownRecord, receipt), member);
+        if (typeof record === "object" && record !== null)
+            Object.freeze(record);
     }
-    return d;
+    carryEngineAttestations(d, receipt);
+    ENGINE_RECEIPTS.add(receipt);
+    return receipt;
 }
 const DEADLINE_ELAPSED = Symbol("approval.deadline_elapsed");
 function withTimeout(p, ms, onTimeout) {
@@ -388,10 +425,10 @@ export function createAllowDenyPolicy(opts) {
         nameSets: [{ ...(opts.allow ? { allow: [...opts.allow] } : {}), ...(opts.deny ? { deny: [...opts.deny] } : {}) }],
         check(req) {
             const toolName = req.toolName;
-            if (toolNameSetHas(deny, req) || namespacedCoveringHit(denyCovering, toolName)) {
+            if (nameListHolds(deny, req) || namespacedCoveringHit(denyCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (allow && !toolNameSetHas(allow, req) && !namespacedCoveringHit(allowCovering, toolName)) {
+            if (allow && !nameListHolds(allow, req) && !namespacedCoveringHit(allowCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
             return ALLOW;
@@ -428,10 +465,10 @@ export function createApprovalPolicy(opts) {
         ],
         async check(req, signal) {
             const toolName = req.toolName;
-            if (toolNameSetHas(deny, req) || namespacedCoveringHit(denyCovering, toolName)) {
+            if (nameListHolds(deny, req) || namespacedCoveringHit(denyCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (toolNameSetHas(need, req) || namespacedCoveringHit(needCovering, toolName)) {
+            if (nameListHolds(need, req) || namespacedCoveringHit(needCovering, toolName)) {
                 const attest = (d, settlement) => attestEngineSettlement(d, { settlement, origin: "policy" }, req);
                 if (signal?.aborted) {
                     return attest({ action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)` }, settledByNobody("task_aborted"));
@@ -481,7 +518,7 @@ export function createApprovalPolicy(opts) {
                 }
                 return attest({ action: "deny", message: `approval denied for "${req.toolName}"` }, settledByPerson("human_refused", undefined));
             }
-            if (opts.denyByDefault && !toolNameSetHas(auto, req) && !namespacedCoveringHit(autoCovering, toolName)) {
+            if (opts.denyByDefault && !nameListHolds(auto, req) && !namespacedCoveringHit(autoCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
             }
             return ALLOW;
@@ -621,7 +658,7 @@ export function createCoarseCommandNamePolicy(opts) {
     return brandPolicyAskClass({
         projection,
         check(req) {
-            if (!toolNameSetHas(shellTools, req))
+            if (!shellToolsListHolds(shellTools, req))
                 return ALLOW;
             const command = req.args?.command;
             if (typeof command !== "string") {
@@ -875,7 +912,7 @@ export function createUnverifiableDeletePolicy(opts) {
     const shellTools = canonicalToolNameSet(opts?.tools);
     return brandPolicyAskClass({
         check(req) {
-            if (!toolNameSetHas(shellTools, req))
+            if (!shellToolsListHolds(shellTools, req))
                 return ALLOW;
             const command = req.args?.command;
             if (typeof command !== "string")
@@ -972,7 +1009,7 @@ export function createTranscriptIntegrityPolicy(opts) {
     });
     return brandPolicyAskClass({
         check(req) {
-            if (toolNameSetHas(shellTools, req)) {
+            if (shellToolsListHolds(shellTools, req)) {
                 const command = req.args?.command;
                 if (typeof command !== "string")
                     return ALLOW;

package/dist/core/tool-registry.d.ts

@@ -52,36 +52,6 @@ export interface ToolCallLike {
     } | undefined;
 }
 type CallPathTarget = ToolCallPathTarget;
-/**
- * The names a tool-name rule may spell this call's tool by — the face's `names` when they include the call's name,
- * else the call's name alone (a bare request, or a face minted for another name). Every name-keyed matcher and the
- * protective path floor read a rule's tool name against THIS list, which is the roster's one canonicalization seen
- * from the call's side: a rule written against an alias and one written against the wire name reach the same calls.
- */
-export declare function ruleNamesOf(req: Pick<ToolCallLike, "toolName" | "face">): readonly string[];
-/** Does the call answer to `name` — is it one of the call's names ({@link ruleNamesOf})? The engine's TIGHTENS keyed on
- *  one of its own tool names read this, so a tool that wears the name under any of its names is tightened (the
- *  fail-safe direction); a grant or a routing keyed on an engine tool name reads the wire name. */
-export declare function callAnswersTo(req: Pick<ToolCallLike, "toolName" | "face">, name: string): boolean;
-/** Does a set of rule tool names name this call's tool ({@link ruleNamesOf})? */
-export declare function toolNameSetHas(set: {
-    has(name: string): boolean;
-}, req: Pick<ToolCallLike, "toolName" | "face">): boolean;
-/** Does `set` hold any of the call's names ({@link ruleNamesOf})? The read of a MEMBERSHIP tighten keyed on the engine's
- *  own tool names (the egress set, a read station's tools, the compliance veto): a tool is held under every name it
- *  answers to. A grant or a routing keyed on an engine tool name reads the wire name instead. */
-export declare function anyNamed(set: {
-    has(name: string): boolean;
-}, names: readonly string[]): boolean;
-/** The first of the call's names ({@link ruleNamesOf}, the spelling first) that `map` holds an entry for, with the entry.
- *  The read of a SEAT keyed on the engine's own tool names (a tier, a mark's sources): every key of one seat is read under
- *  the ONE name this returns — a seat is never assembled from two names' entries. */
-export declare function firstNamed<V>(map: {
-    get(name: string): V | undefined;
-}, names: readonly string[]): {
-    readonly name: string;
-    readonly value: V;
-} | undefined;
 /**
  * design/388 B6/B17 — the path target a PROTECTIVE fence reads (a deny-list judging a write's target: sensitive paths,
  * frozen paths, write protection, the transcript gate; edit tracking): the object face's own declaration first, the
@@ -89,7 +59,7 @@ export declare function firstNamed<V>(map: {
  * face that declares none. Reading the catalog for an undeclared same-name tool can only TIGHTEN a deny-list (it adds
  * a slot to judge — the pre-388 posture, never wider), which is exactly why this floor is wrong for a grant.
  *
- * The floor reads EVERY name the call answers to (`ruleNamesOf`: the face's `names`, else the call's name alone) in
+ * The floor is a `member` seat over every name the call answers to (the face's `names`, else the call's name alone) in
  * the face's order — the name the call was made under first, then the wire name, then the other aliases — and the
  * first name the catalog declares a target for wins: a call made under a catalog name and resolved to a tool that
  * declares none keeps THAT name's slot, also when the tool answers to a second catalog name with another slot.

package/dist/core/tool-registry.js

@@ -1,5 +1,6 @@
 import { TOOL_MOUNT_TAGS, pathTargetSlotOnly } from "./tool-face.js";
 import { ENGINE_CARDS, TOOL_CATALOG_ENTRIES } from "./tool-catalog-entries.js";
+import { seatOf } from "./tool-name-readings.js";
 export function describeToolCatalog() {
     return TOOL_CATALOG_ENTRIES;
 }
@@ -51,31 +52,10 @@ export function pathTargetValue(args, pt) {
     }
     return undefined;
 }
-export function ruleNamesOf(req) {
-    const names = req.face?.names;
-    return names !== undefined && names.includes(req.toolName) ? names : [req.toolName];
-}
-export function callAnswersTo(req, name) {
-    return ruleNamesOf(req).includes(name);
-}
-export function toolNameSetHas(set, req) {
-    return anyNamed(set, ruleNamesOf(req));
-}
-export function anyNamed(set, names) {
-    return names.some((n) => set.has(n));
-}
-export function firstNamed(map, names) {
-    for (const name of names) {
-        const value = map.get(name);
-        if (value !== undefined)
-            return { name, value };
-    }
-    return undefined;
-}
 export function protectivePathTargetOf(call) {
     if (call.face?.pathTarget !== undefined)
         return call.face.pathTarget;
-    const floor = ruleNamesOf(call).map((n) => pathTargetOf(n)).find((pt) => pt !== undefined);
+    const floor = seatOf("floor.protectivePathTarget", { get: pathTargetOf }, call)?.value;
     return floor === undefined || call.face === undefined ? floor : pathTargetSlotOnly(floor);
 }
 export const BARE_REQUEST_CODE = "policy.bare_request";

package/dist/core/tool-result-budget.d.ts

@@ -23,6 +23,9 @@ export interface AggregateBudgetOptions {
     budgetChars?: number;
     /** Tool names exempt from the budget (their own caps bound them) — e.g. read_file, read_tool_result. */
     exemptTools?: ReadonlySet<string>;
+    /** The wire name a result's recorded tool name resolves to on the leg's roster (an exemption is judged on the tool the
+     *  call ran, not the spelling the model used). Absent ⇒ the recorded name. */
+    toolNameOf?: (recorded: string) => string;
     /** design/30 store for offload+read-back. Absent ⇒ self-contained truncation preview. */
     store?: ToolResultStore;
     /** Namespaces the stable ref so an offloaded result is globally addressable. */

package/dist/core/tool-result-budget.js

@@ -1,6 +1,7 @@
 import { isToolResult } from "./message-utils.js";
 import { buildPreview, buildToolResultRef, PERSISTED_OUTPUT_PREFIX, toolResultContentSegment, toolResultProvenanceOf, } from "./tool-result-store.js";
 import { budgetExemptToolNames } from "./tool-registry.js";
+import { wireOf } from "./tool-name-readings.js";
 export const AGGREGATE_TOOL_RESULT_BUDGET_CHARS = 200_000;
 const HEAD = 1_000;
 const TAIL = 1_000;
@@ -38,6 +39,7 @@ const CATALOG_BUDGET_EXEMPT_TOOLS = budgetExemptToolNames();
 export async function capAggregateToolResults(messages, opts) {
     const budget = opts.budgetChars ?? AGGREGATE_TOOL_RESULT_BUDGET_CHARS;
     const exempt = opts.exemptTools ?? CATALOG_BUDGET_EXEMPT_TOOLS;
+    const exemptResult = (m) => m.toolName !== undefined && exempt.has(wireOf("budget.exemptResult", { toolName: opts.toolNameOf !== undefined ? opts.toolNameOf(m.toolName) : m.toolName }));
     let out;
     let i = 0;
     while (i < messages.length) {
@@ -52,7 +54,7 @@ export async function capAggregateToolResults(messages, opts) {
         let total = 0;
         for (let k = i; k < j; k++) {
             const m = arr[k];
-            if (m.toolName && exempt.has(m.toolName))
+            if (exemptResult(m))
                 continue;
             total += textChars(m.content);
         }
@@ -94,7 +96,7 @@ export async function capAggregateToolResults(messages, opts) {
             const cand = [];
             for (let k = i; k < j; k++) {
                 const m = out[k];
-                if (m.toolName && exempt.has(m.toolName))
+                if (exemptResult(m))
                     continue;
                 if (isOffloadedPreview(m.content))
                     continue;
@@ -112,7 +114,7 @@ export async function capAggregateToolResults(messages, opts) {
                 const cand2 = [];
                 for (let k = i; k < j; k++) {
                     const m = out[k];
-                    if (m.toolName && exempt.has(m.toolName))
+                    if (exemptResult(m))
                         continue;
                     if (isOffloadedPreview(messages[k].content))
                         continue;