@sema-agent/core 7.36.0 → 7.37.0

package/dist/core/hooks.d.ts

@@ -1737,6 +1737,12 @@ export interface AskCarry {
     /** The surviving ask's engine-stamped origin word ({@link import("./ask-origin.js").AskOrigin}), persisted
      *  on the row so a durable card is rendered by the same word the synchronous card is. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
+    /** The surviving ask's engine-stamped class ({@link import("./tool-policy.js").AskRequest.askClass}), persisted on the
+     *  row so a durable approval seat answers by the class the synchronous one reads. Present exactly when
+     *  {@link classes} is. */
+    readonly askClass?: import("./ask-origin.js").AskClass;
+    /** The whole class set beside it ({@link import("./tool-policy.js").AskRequest.classes}), in `ASK_CLASSES` order. */
+    readonly classes?: readonly import("./ask-origin.js").AskClass[];
     /** The stamped mandate ({@link import("./tool-policy.js").AskRequest.mandated}) — the park site's
      *  rule-offer facts read it, so a parked mandated ask offers no rule, like the live card. */
     readonly mandated?: true;
@@ -1747,11 +1753,14 @@ export interface AskCarry {
 }
 /** What a durable row persists of an {@link AskCarry}: the fallback member COPIED (the row never aliases
  *  the gate's object; its window is already `0` — the gate's carry mint is the one writer of that
- *  number) and the origin word only when it is a member of the closed set (the carry is typed, but the
- *  row is the boundary a host reads back through — the same screen the summary applies). */
+ *  number), the origin word only when it is a member of the closed set, and the class pair only when it is
+ *  well-formed, as a fresh copy (the carry is typed, but the row is the boundary a host reads back through —
+ *  the same screen the summary applies to the word). */
 export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
     origin?: import("./ask-origin.js").AskOrigin;
+    askClass?: import("./ask-origin.js").AskClass;
+    classes?: readonly import("./ask-origin.js").AskClass[];
 };
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant

package/dist/core/hooks.js

@@ -7,7 +7,7 @@ import { runGateLanes } from "./gate-lanes.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
-import { isAskOrigin } from "./ask-origin.js";
+import { isAskOrigin, screenAskClassMembers } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -239,9 +239,11 @@ export function askCarryRowMembers(carry) {
     if (carry === undefined)
         return {};
     const origin = carry.origin;
+    const classed = screenAskClassMembers(carry.askClass, carry.classes);
     return {
         ...(carry.denialLimitFallback !== undefined ? { denialLimitFallback: { ...carry.denialLimitFallback } } : {}),
         ...(isAskOrigin(origin) ? { origin } : {}),
+        ...(classed !== undefined ? classed : {}),
     };
 }
 export async function runToolGate(input) {

package/dist/core/park-selfcheck.js

@@ -77,6 +77,8 @@ function syntheticCheckpoint(scope) {
             mandated: true,
             denialLimitFallback: { consecutive: 3, total: 3, limit: "consecutive", autoDenyAfterMs: 0 },
             origin: "denial_limit_fallback",
+            askClass: "denial_limit_fallback",
+            classes: ["denial_limit_fallback"],
             batchToolCallIds: [`${scope}:call`],
             completedCallIds: [],
         },

package/dist/core/runner/denial-limit-arms.d.ts

@@ -3,7 +3,7 @@ import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
-import { type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
+import { type AskClass, type AskClassFacts, type AskClassification, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import type { Prepared, StopForDenialLimit } from "./contracts.js";
 /**
  * The classifier DENIAL-LIMIT arms of the tool gate's inherited (delegation) lane, extracted
@@ -98,34 +98,38 @@ export type InheritedAsk = Extract<PermissionResult, {
  * classifier runs inside the policy fold, BEFORE the live gate's org layer has spoken and before its
  * question-tool and marked-call lanes run, so they read as absent here and those asks meet their
  * exclusions downstream, where the facts exist. Excluded asks fall through to the frozen approver
- * chain, the delegation lane's original chain. The word is derived inside {@link judgeInheritedClassifier}
- * — once off the incoming ask for the exclusion and the unchanged-ask branches, once off the re-spoken
- * ask this station mints at the bound — and threaded to the request mint, never re-read off the
- * caller-owned object there.
- * The MANDATE marks are empty for the same reason — no tool seat of this task, no tighten of its own;
- * what the ancestor's ask carries on ITSELF still answers, read off the decision by the one predicate.
+ * chain, the delegation lane's original chain. The word and the class set are derived inside
+ * {@link judgeInheritedClassifier} and threaded to every reader ({@link inheritedAskCarry}).
+ * The MANDATE marks here are empty (the base names no seat): the policy-chain phase builds each call's facts over this
+ * base with THIS task's tool seat — the seat the request's risk axes are read from — so a marked tool's ask is
+ * classified by the seat at the station as at the gate. What the ancestor's ask carries on ITSELF still answers.
  */
 export declare const INHERITED_STATION_FACTS: AskOriginFacts;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
- *  they spell themselves: the ask's origin word and its denial-limit fallback. */
+ *  they spell themselves: the ask's origin word, its class (the word and the set, carried together) and its
+ *  denial-limit fallback. */
 export interface AskRequestCarry {
     origin?: AskOrigin;
+    askClass?: AskClass;
+    classes?: readonly AskClass[];
     denialLimitFallback?: DenialLimitFallback;
 }
-/** The GATE's own mint station: both members are read off the surviving decision, which is the gate's
- *  OWN snapshot (its stamp point spreads the policy's object and stamps the word onto the copy), so the
- *  origin is the engine-derived one and the member is the one the gate's classifier step minted. */
+/** The GATE's own mint station: every member is read off the surviving decision, which is the gate's
+ *  OWN snapshot (its stamp point spreads the policy's object and stamps the word and the class onto the copy),
+ *  so the origin and the class are the engine-derived ones and the fallback member is the one the gate's
+ *  classifier step minted. */
 export declare function gateAskCarry(decision: InheritedAsk, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
 /** An INHERITED-lane mint station (the two wrapper arms and the approved-edit re-check): the ask is an
- *  ancestor policy's own decision, never engine-stamped, so BOTH members come from the judgment
- *  {@link judgeInheritedClassifier} handed back — the word it derived under the station facts and the
- *  fallback member it captured — each read ONCE there and threaded here, never re-read off the
+ *  ancestor policy's own decision, never engine-stamped, so EVERY member comes from the judgment
+ *  {@link judgeInheritedClassifier} handed back — the word and the classification it derived under the station
+ *  facts and the fallback member it captured — each read ONCE there and threaded here, never re-read off the
  *  caller-owned object (a stateful accessor could otherwise answer the card with one value and the
- *  settlement with another; a self-declared `origin` on the ancestor's decision is never read). */
+ *  settlement with another; a self-declared `origin` / `askClass` / `classes` on the ancestor's decision is never
+ *  read). */
 export declare function inheritedAskCarry(judged: Pick<Extract<InheritedClassifierJudgment<InheritedAsk>, {
     kind: "resolve";
-}>, "origin" | "fallback" | "ask">, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
+}>, "origin" | "classification" | "fallback" | "ask">, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
 /** What {@link judgeInheritedClassifier} hands back to the arm that called it. */
 export type InheritedClassifierJudgment<A extends InheritedAsk> = 
 /** The frozen classifier allowed. `result` is the allow the arm RETURNS — minted at the judging station so
@@ -146,8 +150,11 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  `origin` is the ask's word under the station facts, threaded to the request mint: on the two
  *  unchanged-ask branches it is the SAME read the exclusion judged by (a caller-owned decision with a
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
- *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
-/** `ask` is the incoming ask unchanged (the caller's own object), or — an UNAVAILABLE classification with a live frozen
+ *  bound branch it is derived from the re-spoken ask this station minted (its own object).
+ *  `classification` is the class set of the ask handed on, under the same station facts: on the two unchanged-ask
+ *  branches the one read the exclusion judged by, on the unavailable and bound branches a read of the object this
+ *  station minted (each adds a real-approval bit, which the set must reflect). */
+/** `ask` is the incoming ask unchanged (the arm's receipt snapshot of the ancestor's decision), or — an UNAVAILABLE classification with a live frozen
 *  approver — that ask with the classifier sentence appended; without one it is a `deny` whose attested cause reads `unavailable`. */
  | {
     kind: "resolve";
@@ -155,6 +162,7 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
     fallback: UnarmedDenialLimitFallback | undefined;
     mintedHere: boolean;
     origin: AskOrigin;
+    classification: AskClassification;
 };
 /**
  * The ancestor's frozen classifier, run BEFORE its frozen approver in the ancestor's own gate order,
@@ -195,6 +203,8 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     allowRewrite?: unknown;
     /** An `unavailable` verdict's fork facts (`classifierUnavailableArm`): is the frozen approver live; who hears it. */
     unavailableSeat?: ClassifierUnavailableSeat;
+    /** The station's facts for this call (the base with this task's tool seat); absent ⇒ {@link INHERITED_STATION_FACTS}. */
+    facts?: AskClassFacts;
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
 export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;

package/dist/core/runner/denial-limit-arms.js

@@ -5,7 +5,7 @@ import { attestClassifierDenyCause, attestClassifierRound } from "../tool-policy
 import { SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { askOriginOf, classifyAsk } from "../ask-origin.js";
+import { askClassMembersOf, askOriginOf, classifyAsk } from "../ask-origin.js";
 export function attachRebuiltDenialTrackers(entries, denialLimit) {
     if (entries === undefined)
         return undefined;
@@ -68,30 +68,34 @@ function fallbackCarry(fallback, liveApprover, tracker) {
 export function gateAskCarry(decision, liveApprover, tracker) {
     return {
         ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
+        ...(decision.askClass !== undefined && decision.classes !== undefined ? { askClass: decision.askClass, classes: decision.classes } : {}),
         ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
     };
 }
 export function inheritedAskCarry(judged, liveApprover, tracker) {
     return {
         origin: judged.origin,
+        ...askClassMembersOf(judged.classification),
         ...fallbackCarry(judged.fallback, liveApprover, tracker),
     };
 }
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, ask, req } = opts;
-    const origin = askOriginOf(ask, INHERITED_STATION_FACTS);
+    const facts = opts.facts ?? INHERITED_STATION_FACTS;
+    const origin = askOriginOf(ask, facts);
+    const classification = classifyAsk(ask, facts);
     const classifierStandsDown = () => {
         const live = opts.liveMode?.();
         return live === "dontAsk" || live === "bypassPermissions" || live === "plan" || (autoMode?.liveMode !== undefined && autoMode.liveMode.current !== "auto");
     };
-    if (autoMode === undefined || classifierStandsDown() || !classifyAsk(ask, INHERITED_STATION_FACTS).row.classifierEligible) {
-        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+    if (autoMode === undefined || classifierStandsDown() || !classification.row.classifierEligible) {
+        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification };
     }
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
     if (verdict.kind === "allow" && classifierStandsDown())
-        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification };
     const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
     if (verdict.kind === "allow") {
         autoMode.denialTracking?.recordAllow();
@@ -100,7 +104,7 @@ export async function judgeInheritedClassifier(opts) {
     if (verdict.kind === "unavailable") {
         const arm = classifierUnavailableArm({ ask, req, cause: verdict.cause, seat: opts.unavailableSeat, aborted: opts.signal.aborted });
         if (arm.kind === "asked")
-            return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+            return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification: classifyAsk(arm.ask, facts) };
         return { kind: "deny", result: attributed(arm.deny) };
     }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
@@ -116,7 +120,7 @@ export async function judgeInheritedClassifier(opts) {
     }
     const fallback = tracked.fallback;
     const minted = { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };
-    return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, INHERITED_STATION_FACTS) };
+    return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, facts), classification: classifyAsk(minted, facts) };
 }
 export function headlessDenyAtFold(r) {
     return r.settlement !== undefined && SETTLEMENT_NOBODY_JUDGED[r.settlement.kind];

package/dist/core/runner/inherited-ask-grants.d.ts

@@ -1,41 +1,42 @@
+import type { AskClass } from "../ask-origin.js";
 import type { HumanReviewGateRow } from "../task-result.js";
 import { type OnAsk, type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
-/** JSON.stringify throws on a cyclic value (a deployment
- *  policy's rewrite object carries no acyclicity guarantee) — `undefined` here means "no comparable
- *  shape", which every consumer treats as a mismatch (skip the record / skip the reuse ⇒ the child
- *  gate just re-asks — the safe direction, never a gate failure). */
-export declare function askGrantShapeOf(args: unknown): string | undefined;
-/**
- * Duplicate-frame collapse (single-Runner embedded shape), the CONSUME half: an inherited
- * layer already resolved THIS call as a clean allow at the SAME approver function, on EXACTLY the
- * byte-shape this caller-slot ask now presents. The human's consent covers this consultation
- * verbatim — asking again is the 2-frame UX debt, not a second authority. Guards, all mismatches
- * re-ask (⇒ `undefined`):
- *  · SOURCE: only a caller-slot POLICY ask may reuse — a safety tighten
- *    (egress/irreversible/shellGate stamp `decisionReason:"safety"`), a hook-promoted ask
- *    ("hook"), or a classifier ask carries a DIFFERENT authority/context and keeps its frame.
- *  · IDENTITY: the approver FUNCTION reference (never a name) — compared through
- *    `askApproverIdentity`, not by raw reference (ruled 2026-08-04): a delegated child's approver
- *    is the ancestor's own, wrapped with delegation provenance — a DIFFERENT function object, the
- *    SAME operator. Bare `===` therefore stopped collapsing the frame the moment the ask seam
- *    started forwarding approvers, and one tool call presented the same person the same card
- *    twice. The wrapper adds metadata and delegates every decision, so it grants no authority of
- *    its own; identity here only answers "same consultation".
- *  · SHAPE: byte-equality against the presented SNAPSHOT; reuse re-emits that snapshot
- *    as the executed shape via `presentedInput` — the same schema-revalidated binding
- *    as a main-gate approval (shown == executed, by construction).
- *  · LEDGER: the ONE real consultation (timed on the wrapper arm) is recorded here —
- *    one frame happened, one frame is booked.
- * The grant lives only within one gate evaluation (consumed on reuse, swept at the call site) — a
- * REOPENED checkpoint's re-adjudication never sees a stale grant.
- */
-export declare function consumeInheritedAskGrant(grants: Map<string, {
+/** One inherited ask grant: a person's clean allow at an ancestor's live approver, on ONE presented shape, to ONE question
+ *  (`classes`, the request's class set in `ASK_CLASSES` order) — it answers no stricter question. */
+export interface InheritedAskGrant {
     approver: unknown;
     argsJson: string;
     presented: unknown;
     waitMs: number;
     settled?: object;
-}>, onAsk: OnAsk | undefined, humanReviewRef: {
+    classes: readonly AskClass[];
+}
+/** Does a grant for `granted` cover a question the gate classified as `asked`? `ordinary` — the plain hesitation every other
+ *  class is a stricter form of — is covered by any card answered; every other class must have been on the card (the gate reads
+ *  facts the station cannot hold, and a class those add was asked of nobody). Unclassified, or a card with no class ⇒ never. */
+export declare function askGrantCovers(granted: readonly AskClass[], asked: readonly AskClass[] | undefined): boolean;
+/** JSON.stringify throws on a cyclic value (a rewrite object carries no acyclicity guarantee) — `undefined` means "no
+ *  comparable shape", which every consumer treats as a mismatch (skip the record / reuse ⇒ re-ask, the safe direction). */
+export declare function askGrantShapeOf(args: unknown): string | undefined;
+/**
+ * Duplicate-frame collapse, the CONSUME half: an inherited layer already resolved THIS call as a clean allow at the
+ * SAME approver function, on EXACTLY the byte-shape this caller-slot ask now presents, for a question that covers this
+ * one — asking again is the 2-frame UX debt, not a second authority. Guards, all mismatches re-ask (⇒ `undefined`):
+ *  · SOURCE: only a caller-slot POLICY ask may reuse — a safety tighten (`decisionReason:"safety"`), a hook-promoted
+ *    ask ("hook") or a classifier ask carries a DIFFERENT authority and keeps its frame.
+ *  · IDENTITY: the approver FUNCTION reference (never a name), compared through `askApproverIdentity`: a delegated
+ *    child's approver is the ancestor's own wrapped with provenance — a different function object, the same operator
+ *    (the wrapper grants no authority of its own); identity answers only "same consultation".
+ *  · SHAPE: byte-equality against the presented SNAPSHOT; reuse re-emits that snapshot as the executed shape via
+ *    `presentedInput` — the same binding as a main-gate approval (shown == executed, by construction).
+ *  · CLASS: the gate's stamped `classes` is covered by the set the person answered ({@link askGrantCovers}); a class
+ *    the gate's own judges add (a protected target, an out-of-root read) was not on the card. Not covered ⇒ the gate
+ *    asks its own question and the grant stays (it answers what it answered; the call-site sweep ends it).
+ *  · LEDGER: the ONE real consultation (timed on the wrapper arm) is booked here — one frame happened, one is booked.
+ * The grant lives within one gate evaluation (consumed on reuse, swept at the call site): a REOPENED checkpoint's
+ * re-adjudication never sees a stale grant.
+ */
+export declare function consumeInheritedAskGrant(grants: Map<string, InheritedAskGrant>, onAsk: OnAsk | undefined, humanReviewRef: {
     count: number;
     totalWaitMs: number;
     gates: HumanReviewGateRow[];

package/dist/core/runner/inherited-ask-grants.js

@@ -1,5 +1,8 @@
 import { primaryActivityArg } from "../arg-summary.js";
 import { askApproverIdentity, carryEngineAttestations } from "../tool-policy.js";
+export function askGrantCovers(granted, asked) {
+    return asked !== undefined && asked.length > 0 && granted.length > 0 && asked.every((c) => c === "ordinary" || granted.includes(c));
+}
 export function askGrantShapeOf(args) {
     try {
         return JSON.stringify(args ?? null);
@@ -14,6 +17,8 @@ export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision
     const grant = grants.get(req.toolCallId);
     if (grant === undefined || askApproverIdentity(grant.approver) !== askApproverIdentity(onAsk) || grant.argsJson !== askGrantShapeOf(req.args))
         return undefined;
+    if (!askGrantCovers(grant.classes, decision.action === "ask" ? decision.classes : undefined))
+        return undefined;
     grants.delete(req.toolCallId);
     humanReviewRef.count += 1;
     humanReviewRef.totalWaitMs += grant.waitMs;

package/dist/core/runner/prepare-inherited-gate.js

@@ -36,7 +36,7 @@ export function prepareInheritedGate(input) {
     if (modeSeed.migrated !== undefined) {
         deliverEngineNotice(deps.onNotice, {
             code: "resume.legacy_mode_seed_migrated",
-            message: `the resumed checkpoint row carried pre-mode keys (${modeSeed.migrated.droppedKeys.join(", ")}); read once into ${modeSeed.migrated.permissionMode !== undefined ? `permissionMode: "${modeSeed.migrated.permissionMode}"` : "no mode of its own (the chain's ceiling stands)"}${modeSeed.shellGate !== undefined ? ' with the shell floor "always" kept' : ""} — the next suspend writes the one key; from 7.35.0 a row still carrying these keys is refused`,
+            message: `the resumed checkpoint row carried pre-mode keys (${modeSeed.migrated.droppedKeys.join(", ")}); read once into ${modeSeed.migrated.permissionMode !== undefined ? `permissionMode: "${modeSeed.migrated.permissionMode}"` : "no mode of its own (the chain's ceiling stands)"}${modeSeed.shellGate !== undefined ? ' with the shell floor "always" kept' : ""} — the next suspend writes the one key; this migration is kept through 7.37.x and removed in 7.38.0, which refuses a row still carrying these keys (resume or abandon such rows before upgrading)`,
             detail: { migrated: { ...(modeSeed.migrated.permissionMode !== undefined ? { permissionMode: modeSeed.migrated.permissionMode } : {}), droppedKeys: [...modeSeed.migrated.droppedKeys] }, sessionId, runId },
         });
     }

package/dist/core/runner/prepare-park-ask.d.ts

@@ -9,8 +9,8 @@
  * decomposition exists to make explicit.
  *
  * The thirteen-argument park closure is unchanged: twelve positional seats then the structural {@link AskCarry}, the
- * shape the gate's one invocation site (`parkWith`) holds. The ask's origin word and the denial-limit fallback ride the
- * carry onto the row exactly as before — this phase mints no origin, changes no word, adds no arm to the closed set.
+ * shape the gate's one invocation site (`parkWith`) holds. The ask's origin word, class pair and denial-limit fallback
+ * ride the carry onto the row — this phase mints no origin or class, changes no word, adds no arm to the closed set.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (both closures run per tool call), so the
  * phase adds no yield between the boundary parks before it and the gate station after it.

package/dist/core/runner/prepare-park-ask.js

@@ -173,11 +173,7 @@ export function prepareParkAsk(input) {
                     if (reprojectedRaced.tag === "threw")
                         throw reprojectedRaced.error;
                     const reprojected = refuseOutOfContractDecision(reprojectedRaced.value);
-                    const demanded = reprojected.updatedInput !== undefined ? tryCloneArgs(reprojected.updatedInput) : undefined;
-                    const rewroteTheFiledValue = reprojected.updatedInput !== undefined &&
-                        !(demanded?.ok === true &&
-                            samePlainValue(demanded.value, parkedArgs) &&
-                            samePlainValue(reprojected.updatedInput, parkedArgs));
+                    const rewroteTheFiledValue = reprojected.updatedInput !== undefined && !samePlainValue(reprojected.updatedInput, parkedArgs);
                     if (reprojected.action === "deny" || rewroteTheFiledValue) {
                         throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and the deployment's tool policy does not accept the stored shape` +
                             `${reprojected.action === "deny" && reprojected.message ? `: ${reprojected.message}` : ""} — ` +

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -34,6 +34,7 @@ import { type ActiveSkillScope } from "./active-skill-scope.js";
 import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, StopForDenialLimit } from "./contracts.js";
 import { type Arbitration } from "../ask-origin.js";
 import { type ModeGateSeats, type PermissionModeController } from "../mode-policy.js";
+import { type InheritedAskGrant } from "./inherited-ask-grants.js";
 import { createRuleOffersOf, type PermissionRuleLanes } from "./permission-rule-lanes.js";
 import type { ToolCallLike } from "../tool-registry.js";
 export interface PreparePolicyChainInput {
@@ -45,7 +46,7 @@ export interface PreparePolicyChainInput {
      *  `permissionRuleStore` / `localOwnerRules` (the lanes and the offer factory), `onError` / `onNotice` (the advisories,
      *  the refusal disclosures, the late-ask observer), `tracer` (the admission and rule-store frames), `checkpointStore` (the park facility). Receiver preserved;
      *  the advisory dedupe is KEYED on this object's identity. */
-    deps: Pick<RunnerDeps, "sessionPolicyStore" | "hooks" | "permissionRuleStore" | "localOwnerRules" | "onError" | "onNotice" | "tracer" | "checkpointStore">;
+    deps: Pick<RunnerDeps, "sessionPolicyStore" | "hooks" | "permissionRuleStore" | "localOwnerRules" | "onError" | "onNotice" | "tracer" | "checkpointStore" | "a2a">;
     /** borrowed-readonly — the trusted spawn-side channel: `parentTaskId` (the from-subagent bit), `explicitAgentName` /
      *  `agentName` (the source agent name) — the ask source identity's local, trusted facts. */
     internals: Pick<RunInternals, "parentTaskId" | "explicitAgentName" | "agentName"> | undefined;
@@ -186,13 +187,7 @@ export interface PreparePolicyChainResult {
     }>>;
     /** borrowed-mutable — the grant record. Writers: the inherited arms here (record a clean allow at a live approver);
      *  the gate station (consume on reuse, sweep at settlement). */
-    inheritedAskGrants: Map<string, {
-        approver: unknown;
-        argsJson: string;
-        presented: unknown;
-        waitMs: number;
-        settled?: object;
-    }>;
+    inheritedAskGrants: Map<string, InheritedAskGrant>;
     /** owned — the SINGLE AskRequest source-identity factory every resolveAsk construction site spreads. */
     askSourceIdentity: () => {
         principal?: string;

package/dist/core/runner/prepare-policy-chain.js

@@ -6,12 +6,12 @@ import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
 import { assertHookSeatsCallable } from "../hook-seats.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, wrapToolPolicy, attestAskUnresolvableCause } from "../tool-policy.js";
+import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, wrapToolPolicy, attestAskUnresolvableCause } from "../tool-policy.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
 import { createActiveSkillScopePolicy } from "./active-skill-scope.js";
-import { arbitrateByMode, askMandateMember, classifyAsk } from "../ask-origin.js";
+import { arbitrateByMode, askClassMembersOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
 import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
@@ -20,12 +20,12 @@ import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
 import { thrownText } from "../thrown-value.js";
-import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
+import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
     const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
-    const arbitrateInherited = (ask, toolCallId) => {
-        const verdict = arbitrateByMode(permissionMode.current, classifyAsk(ask, INHERITED_STATION_FACTS), { ...(ask.origin !== undefined ? { origin: ask.origin } : {}), ...(ask.mandate !== undefined ? { mandate: ask.mandate } : {}) });
+    const arbitrateInherited = (ask, toolCallId, classification) => {
+        const verdict = arbitrateByMode(permissionMode.current, classification, { ...(ask.origin !== undefined ? { origin: ask.origin } : {}), ...(ask.mandate !== undefined ? { mandate: ask.mandate } : {}) });
         if (verdict.kind === "ask" || verdict.kind === "accepted")
             return undefined;
         ancestorArbitrations.set(toolCallId, verdict);
@@ -188,7 +188,7 @@ export async function preparePolicyChain(input) {
     }, "mandate_unreconstructible", creq);
     const markerChannelFullDeny = (creq) => attestAskUnresolvableCause({ action: "deny", message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed` }, "approver_unavailable", creq);
     const inheritedAskGrants = new Map();
-    const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs, settled) => {
+    const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs, settled, classes) => {
         if (typeof approver !== "function")
             return;
         if (presented === undefined)
@@ -198,7 +198,7 @@ export async function preparePolicyChain(input) {
         const argsJson = askGrantShapeOf(presented);
         if (argsJson === undefined)
             return;
-        inheritedAskGrants.set(toolCallId, { approver, argsJson, presented, waitMs, settled });
+        inheritedAskGrants.set(toolCallId, { approver, argsJson, presented, waitMs, settled, classes });
     };
     const sandboxDeclared = isIsolated(executionEnv);
     const sandboxAdmissionArmed = (() => {
@@ -259,7 +259,7 @@ export async function preparePolicyChain(input) {
     };
     const callerPolicyLayer = policy !== undefined && sameInstanceAncestorCount > 0
         ? wrapToolPolicy(policy, async (creq, csignal) => {
-            const decision = await policy.check(creq, csignal ?? abortController.signal);
+            const decision = refuseOutOfContractDecision(await policy.check(creq, csignal ?? abortController.signal));
             sharedFirstDecision.set(creq.toolCallId, decision);
             if (sharedFirstDecision.size > SHARED_FIRST_DECISION_CAP) {
                 const oldest = sharedFirstDecision.keys().next().value;
@@ -278,15 +278,33 @@ export async function preparePolicyChain(input) {
             : {}),
         ...(delegation.isDelegatedChild ? { isDelegatedChild: true } : {}),
     });
+    const seatMarksOf = (call) => {
+        const tierSeat = seatOf("report.riskAxes", irreversibilityTier, call);
+        return {
+            tier: tierSeat?.value,
+            egress: heldBy("report.riskAxes.egress", egressTools, call),
+            shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
+            sources: new Set(heldValues("report.markSources", toolMarkSources, call).flatMap((s) => [...s])),
+        };
+    };
     const riskAxesOf = (call) => {
-        const tier = seatOf("report.riskAxes", irreversibilityTier, call)?.value;
+        const seat = seatMarksOf(call);
         const negatives = seatOf("report.riskAxes.negatives", axisExplicitNegatives, call)?.value;
-        const irreversible = tier === "always" || tier === "maybe" ? true : tier === "never" ? false : negatives?.irreversible;
-        const egress = heldBy("report.riskAxes.egress", egressTools, call) ? true : negatives?.egress;
+        const irreversible = seat.tier === "always" || seat.tier === "maybe" ? true : seat.tier === "never" ? false : negatives?.irreversible;
+        const egress = seat.egress ? true : negatives?.egress;
         if (irreversible === undefined && egress === undefined)
             return {};
         return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
     };
+    const inheritedStationFacts = (call) => {
+        const seat = seatMarksOf(call);
+        return {
+            ...INHERITED_STATION_FACTS,
+            mandateMarks: { egress: seat.egress, shellGated: seat.shellGated, ...(seat.tier !== undefined ? { irreversibility: seat.tier } : {}) },
+            ...(seat.sources.size > 0 ? { toolMarkSources: seat.sources } : {}),
+            ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}),
+        };
+    };
     const inheritedAskEvidence = inheritedAskRuleEvidence(deps.permissionRuleStore);
     const { personal: permissionRuleLane, org: permissionRuleOrgLane } = createPermissionRuleLanes({
         provider: deps.permissionRuleStore,
@@ -335,7 +353,7 @@ export async function preparePolicyChain(input) {
             }
             let re;
             try {
-                re = await pol.check({ ...creq, args: editArgs }, csignal ?? abortController.signal);
+                re = refuseOutOfContractDecision(await pol.check({ ...creq, args: editArgs }, csignal ?? abortController.signal));
             }
             catch (err) {
                 return vetoed({
@@ -353,7 +371,7 @@ export async function preparePolicyChain(input) {
             }
             if (re.updatedInput !== undefined)
                 editArgs = re.updatedInput;
-            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
+            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
                 const cleared = { ...judged.result };
                 carryEngineAttestations(judged.result, cleared);
@@ -364,7 +382,7 @@ export async function preparePolicyChain(input) {
                 return vetoed(judged.result);
             const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
             re = editAsk;
-            const editArbitrated = arbitrateInherited(re, creq.toolCallId);
+            const editArbitrated = arbitrateInherited(re, creq.toolCallId, judged.classification);
             if (editArbitrated !== undefined) {
                 const out = editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs } : editArbitrated;
                 carryPrecedingSettlement(settledBy, out);
@@ -435,17 +453,17 @@ export async function preparePolicyChain(input) {
                             return first;
                         return mandateUnreconstructibleDeny(creq);
                     }
-                    const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call", unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
+                    const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call", facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
                     if (judged.kind === "allow")
                         return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && classifyAsk(inheritedAsk, INHERITED_STATION_FACTS).row.sandboxAdmission) {
+                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return { action: "allow" };
                     }
-                    const arbitrated = arbitrateInherited(inheritedAsk, creq.toolCallId);
+                    const arbitrated = arbitrateInherited(inheritedAsk, creq.toolCallId, judged.classification);
                     if (arbitrated !== undefined)
                         return arbitrated;
                     const presentedArgs = creq.args;
@@ -477,14 +495,14 @@ export async function preparePolicyChain(input) {
                     if (resolved.updatedInput !== undefined) {
                         return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                     }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved);
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(judged.classification).classes);
                     return { action: "allow" };
                 },
             }
             : wrapToolPolicy(pc.policy, async (creq, csignal) => {
                 let decision;
                 try {
-                    decision = await pc.policy.check(creq, csignal ?? abortController.signal);
+                    decision = refuseOutOfContractDecision(await pc.policy.check(creq, csignal ?? abortController.signal));
                 }
                 catch (err) {
                     return {
@@ -509,17 +527,17 @@ export async function preparePolicyChain(input) {
                     return mandateUnreconstructibleDeny(creq);
                 }
                 const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
+                const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
                 if (judged.kind === "allow")
                     return judged.result;
                 if (judged.kind === "deny")
                     return judged.result;
                 const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && classifyAsk(inheritedAsk, INHERITED_STATION_FACTS).row.sandboxAdmission) {
+                if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                     recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                     return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
                 }
-                const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId);
+                const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId, judged.classification);
                 if (arbitrated !== undefined)
                     return arbitrated;
                 const askT0 = now();
@@ -551,7 +569,7 @@ export async function preparePolicyChain(input) {
                     return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                 }
                 if (pc.preToolUse === undefined) {
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved);
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(judged.classification).classes);
                 }
                 if (decision.updatedInput === undefined)
                     return resolved;
@@ -572,7 +590,7 @@ export async function preparePolicyChain(input) {
             sameInstanceAdapterIndices.add(j + callerSlotOffset);
     });
     const instrumentedChain = rewriteCapableChain.map((layer, idx) => wrapToolPolicy(layer, async (creq, csignal) => {
-        const d = await layer.check(creq, csignal);
+        const d = refuseOutOfContractDecision(await layer.check(creq, csignal));
         if (d.updatedInput !== undefined)
             rewriteEmitterIndex.set(creq.toolCallId, idx);
         if (d.action === "ask") {
@@ -619,7 +637,7 @@ export async function preparePolicyChain(input) {
             const revalidated = {};
             try {
                 for (const layer of recheckLayers) {
-                    const d = await layer.check(finalReq, signal);
+                    const d = refuseOutOfContractDecision(await layer.check(finalReq, signal));
                     if (d.action === "deny") {
                         const carried = { ...d, updatedInput: decision.updatedInput };
                         carryEngineAttestations(d, carried);