@sema-agent/core 7.36.0 → 7.37.1

package/dist/core/decision-receipt.d.ts

@@ -0,0 +1,21 @@
+import type { PermissionResult } from "./tool-policy.js";
+/** The screen's one refusal — every arm's deny, so an out-of-contract decision is one code whichever arm caught it. */
+export declare const refusedOutOfContract: (message: string) => PermissionResult;
+/** One level of the receipt, the same for the decision and each record it nests. The carrier is an ORDINARY object — it and
+ *  every object on its prototype chain are looked at for being a Proxy before any descriptor is asked for (a Proxy's traps are
+ *  the caller's code; the look invokes none of them) — so the receipt runs none of the carrier's code: a contract member is
+ *  absent or an own enumerable DATA property, its value taken off the descriptor (no read at all). Anything else refuses the
+ *  carrier, the member named by `path`: an accessor (never invoked), and a member the prototype or a non-enumerable property
+ *  supplies, unless the nearest descriptor holding it spells absence (an `undefined` data property). Descriptors are looked up
+ *  as OWN entries of the descriptor map, so a polluted `Object.prototype` names no member. Members outside the contract are
+ *  not looked at. */
+/** The receipt's own answers carry a `kind` discriminant as an own property: narrowing never asks the prototype chain (`in`) for a
+ *  word, so a polluted `Object.prototype` cannot answer for the receipt either. */
+export type Received = {
+    kind: "held";
+    held: Record<string, unknown>;
+} | {
+    kind: "refused";
+    refused: PermissionResult;
+};
+export declare function receiveContract(carrier: object, members: readonly string[], path: string): Received;

package/dist/core/decision-receipt.js

@@ -0,0 +1,63 @@
+import { types } from "node:util";
+import { thrownText } from "./thrown-value.js";
+export const refusedOutOfContract = (message) => ({ action: "deny", message, decisionReason: "rule" });
+const spellsAbsence = (d) => Object.hasOwn(d, "value") && d.value === undefined;
+function ordinaryChain(carrier) {
+    const chain = [];
+    const seen = new Set();
+    try {
+        for (let o = carrier; o !== null; o = Object.getPrototypeOf(o)) {
+            if (types.isProxy(o))
+                return { kind: "not", why: o === carrier ? "is a Proxy" : "has a Proxy on its prototype chain" };
+            if (seen.has(o))
+                return { kind: "not", why: "has a cyclic prototype chain" };
+            seen.add(o);
+            chain.push(o);
+        }
+    }
+    catch (e) {
+        return { kind: "not", why: `threw while its prototype chain was looked at (${thrownText(e)})` };
+    }
+    return { kind: "chain", chain };
+}
+export function receiveContract(carrier, members, path) {
+    const what = path === "" ? "a permission decision" : `a permission decision's "${path.slice(0, -1)}" record`;
+    const ordinary = ordinaryChain(carrier);
+    if (ordinary.kind === "not") {
+        return { kind: "refused", refused: refusedOutOfContract(`${what} ${ordinary.why} — the engine reads a decision off an ordinary object's own property descriptors and runs none of the carrier's code; denied fail-closed`) };
+    }
+    let own;
+    try {
+        own = Object.getOwnPropertyDescriptors(carrier);
+    }
+    catch (e) {
+        return { kind: "refused", refused: refusedOutOfContract(`${what} threw while its property descriptors were looked at (${thrownText(e)}) — not an ordinary object; denied fail-closed`) };
+    }
+    const held = Object.create(null);
+    for (const m of members) {
+        const d = Object.hasOwn(own, m) ? own[m] : undefined;
+        if (d !== undefined && !Object.hasOwn(d, "value")) {
+            return { kind: "refused", refused: refusedOutOfContract(`${what}'s contract member "${path}${m}" is held by an accessor — contract members must be own data properties, not values supplied through an accessor; denied fail-closed`) };
+        }
+        if (d !== undefined && d.enumerable === true) {
+            held[m] = d.value;
+            continue;
+        }
+        let reached = d;
+        try {
+            for (let i = 1; reached === undefined && i < ordinary.chain.length; i++)
+                reached = Object.getOwnPropertyDescriptor(ordinary.chain[i], m);
+        }
+        catch (e) {
+            return { kind: "refused", refused: refusedOutOfContract(`${what} threw while "${path}${m}" was looked for on its prototype chain (${thrownText(e)}) — not an ordinary object; denied fail-closed`) };
+        }
+        if (reached !== undefined && !spellsAbsence(reached)) {
+            return {
+                kind: "refused",
+                refused: refusedOutOfContract(`${what} supplies "${path}${m}" other than as its own enumerable property (its prototype or a non-enumerable property) — ` +
+                    `contract fields must be own properties, so every reader sees the one value the engine read; denied fail-closed`),
+            };
+        }
+    }
+    return { kind: "held", held };
+}

package/dist/core/engine-notice.d.ts

@@ -258,6 +258,15 @@ export interface EngineNotice {
      *    call fact. Audience `operator`; `detail: { toolCallId, rawLength, reason, sessionId, runId }` —
      *    `toolCallId` the engine id, `reason` `"charset"` (a control byte, a space, a non-ASCII unit or `~`) or
      *    `"length"` (admitted characters, over 128); never the raw bytes. Absent ⇒ no call of the run was folded.
+     *  - `"context.tool_turn_repaired"` (#1224) — a provider request was built from a transcript that breaks the
+     *    tool-turn law, and the request view restored it (`engine/llm/tool-turns.ts`; the transcript is never
+     *    rewritten): a block after an assistant's tool calls moved ahead of them (`trailing_text`), a result recorded
+     *    later moved up behind its call (`late_result`), a call with no result closed with the reconcile family's
+     *    interrupted result (`missing_result`), a second result recorded for one call folded into the first
+     *    (`duplicate_result`; an interrupted close beside a recorded result is left out, no recorded result is). Advisory:
+     *    the run proceeds on the repaired request. Audience `operator`; `detail: { repairs: [{ form, toolCallIds }],
+     *    sessionId, runId }`. ONCE PER RUN PER (form, calls) — the same broken turn is repaired on every request of
+     *    the run and announced on the first. Absent ⇒ every request of the run already had the structure.
      *  - `"config.read_face_deployment_clamped"` (#237) — a deployment-wide `readFace: "open"` is not
      *    in force beside a read-only (verifier) mount: it clamps to "roots" without throwing
      *    (stricter-wins; the clamp verdict stands, only its occurrence was undisclosed). Announced
@@ -337,7 +346,8 @@ export interface EngineNotice {
      *    `permissionMode` (`autoModeRequested: true` ⇒ `auto`; a posture is dropped — it never authorized anything;
      *    `shellGate` `"off"` / `"classify"` are dropped, `"always"` kept) and the next suspend writes the new member.
      *    `detail: { migrated: { permissionMode?, droppedKeys }, sessionId, runId }`. Audience `operator`. A row the
-     *    migration cannot read refuses the resume instead (`resume.legacy_mode_seed`, the error-code row above).
+     *    migration cannot read refuses the resume instead (`resume.legacy_mode_seed`, the error-code row above). The
+     *    migration is kept through 7.37.x and removed in 7.38.0, which refuses a row still carrying these keys.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the
@@ -712,10 +722,12 @@ export interface EngineNotice {
      *    `detail.settlement` names how: `"delivered"` (a re-judgment or an approval released it into
      *    this session's model context), `"refused"` (the setting moved to refuse, or an approval met a
      *    refusing policy), `"expired"` (the `dialogExpiry` deadline, an eviction when the 100-entry queue
-     *    was full, a cancelled review, or a graceful shutdown), `"denied"` (the review face), `"dropped"`
-     *    (the injection lane refused the released frame). `detail.reason` is the trigger
-     *    (`deadline | evicted | shutdown | rejudge | approved | denied | cancelled | inject_failed`); the
-     *    sender was sent the matching receipt whenever the record carried a reply address.
+     *    was full, a cancelled review, a graceful shutdown, or a record another lease holder already settled),
+     *    `"denied"` (the review face), `"dropped"` (the injection lane refused the released frame).
+     *    `detail.reason` is the trigger (`PeerHeldSettleReason`: `deadline | evicted | shutdown | rejudge |
+     *    approved | denied | cancelled | inject_failed | superseded`); the sender was sent the matching receipt
+     *    whenever the record carried a reply address — except on `superseded`, where the lease holder that
+     *    settled the record sent it.
      *    `detail: { settlement, reason, seq, box, fromSession?, heldCount, sessionId, runId }`. Audience
      *    `"user"`: it is this session's user who held (or was holding) the message.
      *  - `"peer.idle_subscription"` (design/385 §5.2, slice 4) — a peer session asked to be told when

package/dist/core/gate-fold.js

@@ -6,11 +6,12 @@ import { traceHookCrash } from "./gate-crash-trace.js";
 import { writeProtectionMandated, writeProtectionTightenDecision, writeProtectionUnresolved } from "./write-protect.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, gateWaitFailureOf, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
+import { refuseOutOfContractDecision } from "./tool-policy.js";
 export async function runGateFold(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, adjudicate } = pass;
     const boundedAwaitDeadlineMs = createGateDeadline(input, notifier);
     pass.req = { toolName, args: pass.currentInput, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
-    pass.decision = adjudicate ? await (callSignal !== undefined ? adjudicate(pass.req, callSignal) : adjudicate(pass.req)) : { action: "allow" };
+    pass.decision = adjudicate ? refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(pass.req, callSignal) : adjudicate(pass.req))) : { action: "allow" };
     {
         const refusedBy = ledger.fromDecision(pass.decision);
         if (refusedBy !== undefined)

package/dist/core/gate-lanes.js

@@ -1,4 +1,4 @@
-import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, describeThrown } from "./tool-policy.js";
+import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, describeThrown, refuseOutOfContractDecision } from "./tool-policy.js";
 import { arbitrateByMode, classifyAsk, fileCommandOptionsSentence, mandateDisclosureOf, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
 import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { classifierUnavailableArm } from "./classifier-unavailable-arm.js";
@@ -181,9 +181,7 @@ export async function runGateLanes(pass) {
         ...(input.toolMarkSources !== undefined ? { toolMarkSources: input.toolMarkSources } : {}),
         ...(input.a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
     });
-    const classifyStanding = (unstamped, facts) => {
-        pass.askClassification = classifyAsk(unstamped, facts);
-    };
+    const classifyStanding = (unstamped, facts) => (pass.askClassification = classifyAsk(unstamped, facts));
     let orgTightenCount = 0;
     let orgEvidence = (() => {
         const w = input.orgRules === undefined ? "not_wired" : "not_adjudicated";
@@ -355,8 +353,7 @@ export async function runGateLanes(pass) {
         const originFacts = askOriginFacts(orgAnswer.org, ruleCallUnreadableOf(laneAnswer));
         if (pass.decision.action === "ask") {
             const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
-            classifyStanding(stamped, originFacts);
-            pass.decision = stampAskOrigin(stamped, originFacts);
+            pass.decision = stampAskOrigin(stamped, originFacts, classifyStanding(stamped, originFacts));
         }
         if (allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() && pass.probeBoundaryDeclined !== true && wireOf("lanes.readOnlyShellAllow", pass.req) === COMMAND_RULE_TOOL) {
             const commandParam = catalogRuleFaceOf(COMMAND_RULE_TOOL)?.primaryParams[0] ?? "command";
@@ -399,8 +396,7 @@ export async function runGateLanes(pass) {
             else if (verdict?.kind === "unavailable") {
                 const arm = classifierUnavailableArm({ ask: pass.decision, req: pass.req, cause: verdict.cause, attribution: verdict.classifier, seat: input.autoMode.unavailable, aborted: classifySignal?.aborted === true });
                 if (arm.kind === "asked") {
-                    classifyStanding(arm.ask, originFacts);
-                    pass.decision = stampAskOrigin(arm.ask, originFacts);
+                    pass.decision = stampAskOrigin(arm.ask, originFacts, classifyStanding(arm.ask, originFacts));
                     pass.classifierRound = undefined;
                 }
                 else
@@ -418,8 +414,7 @@ export async function runGateLanes(pass) {
                         requiresRealApproval: true,
                         denialLimitFallback: tracked.fallback,
                     };
-                    classifyStanding(fallbackAsk, originFacts);
-                    pass.decision = stampAskOrigin(fallbackAsk, originFacts);
+                    pass.decision = stampAskOrigin(fallbackAsk, originFacts, classifyStanding(fallbackAsk, originFacts));
                 }
                 else {
                     const denied = {
@@ -517,6 +512,7 @@ export async function runGateLanes(pass) {
             ...(callSignal !== undefined ? { signal: callSignal } : {}),
             ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
             ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
+            ...(d.action === "ask" && d.askClass !== undefined && d.classes !== undefined ? { askClass: d.askClass, classes: d.classes } : {}),
             ...(d.action === "ask" && d.mandated === true ? { mandated: true, ...(d.mandate !== undefined ? { mandate: d.mandate } : {}) } : {}),
             ...(d.action === "ask" && d.authoredBy === "deployment" ? { authoredBy: "deployment" } : {}),
         });
@@ -662,7 +658,7 @@ export async function runGateLanes(pass) {
                     if (adjudicate) {
                         try {
                             const editReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
-                            recheck = await (callSignal !== undefined ? adjudicate(editReq, callSignal) : adjudicate(editReq));
+                            recheck = refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(editReq, callSignal) : adjudicate(editReq)));
                         }
                         catch (err) {
                             recheck = {
@@ -720,8 +716,7 @@ export async function runGateLanes(pass) {
                     const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
                     markedThisRound = undefined;
                     const editFacts = askOriginFacts(editOrg.org, editRuleCallUnreadable);
-                    classifyStanding(editAskSnapshot, editFacts);
-                    const editAskDecision = stampAskOrigin(editAskSnapshot, editFacts);
+                    const editAskDecision = stampAskOrigin(editAskSnapshot, editFacts, classifyStanding(editAskSnapshot, editFacts));
                     if (input.permissionMode !== undefined && pass.askClassification !== undefined) {
                         const editVerdict = arbitrateByMode(input.permissionMode(), pass.askClassification, { ...(editAskDecision.origin !== undefined ? { origin: editAskDecision.origin } : {}), ...(editAskDecision.mandate !== undefined ? { mandate: editAskDecision.mandate } : {}) });
                         if (editVerdict.kind === "released") {

package/dist/core/gate-outcome.d.ts

@@ -7,7 +7,7 @@
  * policy composes: a policy says allow / ask / deny; this file says how the pass that consumed that
  * verdict ended.
  */
-import { type AskClass, type AskOrigin, type AssertAllKeysHandled, type PermissionMode, type PersistedRuleMandate } from "./ask-origin.js";
+import { type AskClass, type AskOrigin, type AssertAllKeysHandled, type ModeReleaseReason, type PermissionMode, type PersistedRuleMandate } from "./ask-origin.js";
 import { type AutoModeClassifierRound } from "./auto-mode.js";
 /**
  * How the wait an ask was in ENDED — the closed set. One word per way a wait can end; the `who` on the
@@ -303,7 +303,8 @@ export type GateDisposition = {
  * A permission MODE released a surviving ask — the allowed disposition's account of the question it did not put
  * to anyone: the mode, the disclosed class word (`askClass`, the first member of the folded set in `ASK_CLASSES`
  * order — one of {@link RELEASABLE_ASK_CLASSES}), the whole set, and the origin / mandate words the card would
- * have shown. `reason: "rule_unreadable"` marks a release over a rule the call could not be read against.
+ * have shown. `reason` is a member of {@link import("./ask-origin.js").MODE_RELEASE_REASONS} (`isModeReleaseReason`):
+ * `"rule_unreadable"` marks a release over a rule the call could not be read against; absent, the release names none.
  */
 export interface ModeRelease {
     mode: PermissionMode;
@@ -311,7 +312,7 @@ export interface ModeRelease {
     classes: readonly AskClass[];
     origin?: AskOrigin;
     mandate?: PersistedRuleMandate;
-    reason?: "rule_unreadable";
+    reason?: ModeReleaseReason;
 }
 /** The two modes that refuse on their own account (`deniedBy: "mode"`): `dontAsk` every non-authority ask,
  *  `bypassPermissions` a write whose protection could not be judged. `plan` refuses nothing here — its questions ask. */
@@ -341,8 +342,9 @@ export interface ModeRefusal {
  *      {@link import("./auto-mode.js").AUTO_MODE_FALLBACK_CAUSES} — a record whose `to` and `modelUsed`
  *      disagree would let a reader answer "which model decided this call?" two ways;
  *  I7  `disposition.released` present ⇒ `kind === "allowed"`, no settlement, `mode` is `bypassPermissions`,
- *      `askClass` is a releasable class and every member of `classes` is an ask class — a mode releases nothing
- *      a person answered and nothing the table calls immune;
+ *      `askClass` is a releasable class, every member of `classes` is an ask class, `origin` / `reason`, when
+ *      present, are members of their closed sets, and `reason` names a member of `classes` (the mint takes it from
+ *      that set) — a mode releases nothing a person answered and nothing the table calls immune;
  *  I8  `deniedBy === "mode"` ⇔ `mode` present (`bypassPermissions` | `dontAsk`) with `askClass` and `classes`.
  * Nothing here is read out of an ABSENCE: an ordinary allow with no ask is `{ disposition: { kind: "allowed" } }`,
  * a direct policy deny is `{ disposition: { kind: "denied", deniedBy: "policy" } }`, and neither carries a

package/dist/core/gate-outcome.js

@@ -1,4 +1,4 @@
-import { isAskClass, isAskOrigin, isPermissionMode, RELEASABLE_ASK_CLASSES } from "./ask-origin.js";
+import { isAskClass, isAskOrigin, isModeReleaseReason, isPermissionMode, RELEASABLE_ASK_CLASSES } from "./ask-origin.js";
 import { isAutoModeFallbackCause } from "./auto-mode.js";
 export const SETTLEMENT_KINDS = [
     "human_allowed",
@@ -128,6 +128,10 @@ export function screenGateOutcome(g) {
             defects.push("I7: released.classes must be a non-empty list of ask classes");
         if (r.origin !== undefined && !isAskOrigin(r.origin))
             defects.push(`I7: released.origin "${String(r.origin)}" is outside the closed set`);
+        if (r.reason !== undefined && !isModeReleaseReason(r.reason))
+            defects.push(`I7: released.reason "${String(r.reason)}" is outside the closed set`);
+        else if (r.reason !== undefined && Array.isArray(r.classes) && !r.classes.includes(r.reason))
+            defects.push(`I7: released.reason "${r.reason}" is not a member of released.classes`);
     }
     if (d.kind === "denied") {
         const modeRefusal = d.deniedBy === "mode";

package/dist/core/governance-codes.d.ts

@@ -135,7 +135,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "resume.legacy_mode_seed_migrated", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "resume.legacy_mode_seed_migrated", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -179,6 +179,7 @@ export const ENGINE_NOTICE_CODES = [
     "route.base_url_changed_key_unchanged",
     "route.response_model_mismatch",
     "route.tool_call_id_folded",
+    "context.tool_turn_repaired",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
     "steering.parked_input_blocked",
@@ -271,6 +272,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "route.base_url_changed_key_unchanged": "operator",
     "route.response_model_mismatch": "operator",
     "route.tool_call_id_folded": "operator",
+    "context.tool_turn_repaired": "operator",
     "skills.listing_truncated": "operator",
     "agents.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",

package/dist/core/hooks.d.ts

@@ -1737,6 +1737,12 @@ export interface AskCarry {
     /** The surviving ask's engine-stamped origin word ({@link import("./ask-origin.js").AskOrigin}), persisted
      *  on the row so a durable card is rendered by the same word the synchronous card is. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
+    /** The surviving ask's engine-stamped class ({@link import("./tool-policy.js").AskRequest.askClass}), persisted on the
+     *  row so a durable approval seat answers by the class the synchronous one reads. Present exactly when
+     *  {@link classes} is. */
+    readonly askClass?: import("./ask-origin.js").AskClass;
+    /** The whole class set beside it ({@link import("./tool-policy.js").AskRequest.classes}), in `ASK_CLASSES` order. */
+    readonly classes?: readonly import("./ask-origin.js").AskClass[];
     /** The stamped mandate ({@link import("./tool-policy.js").AskRequest.mandated}) — the park site's
      *  rule-offer facts read it, so a parked mandated ask offers no rule, like the live card. */
     readonly mandated?: true;
@@ -1747,11 +1753,14 @@ export interface AskCarry {
 }
 /** What a durable row persists of an {@link AskCarry}: the fallback member COPIED (the row never aliases
  *  the gate's object; its window is already `0` — the gate's carry mint is the one writer of that
- *  number) and the origin word only when it is a member of the closed set (the carry is typed, but the
- *  row is the boundary a host reads back through — the same screen the summary applies). */
+ *  number), the origin word only when it is a member of the closed set, and the class pair only when it is
+ *  well-formed, as a fresh copy (the carry is typed, but the row is the boundary a host reads back through —
+ *  the same screen the summary applies to the word). */
 export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
     origin?: import("./ask-origin.js").AskOrigin;
+    askClass?: import("./ask-origin.js").AskClass;
+    classes?: readonly import("./ask-origin.js").AskClass[];
 };
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant

package/dist/core/hooks.js

@@ -7,7 +7,7 @@ import { runGateLanes } from "./gate-lanes.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
-import { isAskOrigin } from "./ask-origin.js";
+import { isAskOrigin, screenAskClassMembers } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -239,9 +239,11 @@ export function askCarryRowMembers(carry) {
     if (carry === undefined)
         return {};
     const origin = carry.origin;
+    const classed = screenAskClassMembers(carry.askClass, carry.classes);
     return {
         ...(carry.denialLimitFallback !== undefined ? { denialLimitFallback: { ...carry.denialLimitFallback } } : {}),
         ...(isAskOrigin(origin) ? { origin } : {}),
+        ...(classed !== undefined ? classed : {}),
     };
 }
 export async function runToolGate(input) {

package/dist/core/park-selfcheck.js

@@ -77,6 +77,8 @@ function syntheticCheckpoint(scope) {
             mandated: true,
             denialLimitFallback: { consecutive: 3, total: 3, limit: "consecutive", autoDenyAfterMs: 0 },
             origin: "denial_limit_fallback",
+            askClass: "denial_limit_fallback",
+            classes: ["denial_limit_fallback"],
             batchToolCallIds: [`${scope}:call`],
             completedCallIds: [],
         },

package/dist/core/runner/denial-limit-arms.d.ts

@@ -3,7 +3,7 @@ import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
-import { type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
+import { type AskClass, type AskClassFacts, type AskClassification, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import type { Prepared, StopForDenialLimit } from "./contracts.js";
 /**
  * The classifier DENIAL-LIMIT arms of the tool gate's inherited (delegation) lane, extracted
@@ -98,34 +98,38 @@ export type InheritedAsk = Extract<PermissionResult, {
  * classifier runs inside the policy fold, BEFORE the live gate's org layer has spoken and before its
  * question-tool and marked-call lanes run, so they read as absent here and those asks meet their
  * exclusions downstream, where the facts exist. Excluded asks fall through to the frozen approver
- * chain, the delegation lane's original chain. The word is derived inside {@link judgeInheritedClassifier}
- * — once off the incoming ask for the exclusion and the unchanged-ask branches, once off the re-spoken
- * ask this station mints at the bound — and threaded to the request mint, never re-read off the
- * caller-owned object there.
- * The MANDATE marks are empty for the same reason — no tool seat of this task, no tighten of its own;
- * what the ancestor's ask carries on ITSELF still answers, read off the decision by the one predicate.
+ * chain, the delegation lane's original chain. The word and the class set are derived inside
+ * {@link judgeInheritedClassifier} and threaded to every reader ({@link inheritedAskCarry}).
+ * The MANDATE marks here are empty (the base names no seat): the policy-chain phase builds each call's facts over this
+ * base with THIS task's tool seat — the seat the request's risk axes are read from — so a marked tool's ask is
+ * classified by the seat at the station as at the gate. What the ancestor's ask carries on ITSELF still answers.
  */
 export declare const INHERITED_STATION_FACTS: AskOriginFacts;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
- *  they spell themselves: the ask's origin word and its denial-limit fallback. */
+ *  they spell themselves: the ask's origin word, its class (the word and the set, carried together) and its
+ *  denial-limit fallback. */
 export interface AskRequestCarry {
     origin?: AskOrigin;
+    askClass?: AskClass;
+    classes?: readonly AskClass[];
     denialLimitFallback?: DenialLimitFallback;
 }
-/** The GATE's own mint station: both members are read off the surviving decision, which is the gate's
- *  OWN snapshot (its stamp point spreads the policy's object and stamps the word onto the copy), so the
- *  origin is the engine-derived one and the member is the one the gate's classifier step minted. */
+/** The GATE's own mint station: every member is read off the surviving decision, which is the gate's
+ *  OWN snapshot (its stamp point spreads the policy's object and stamps the word and the class onto the copy),
+ *  so the origin and the class are the engine-derived ones and the fallback member is the one the gate's
+ *  classifier step minted. */
 export declare function gateAskCarry(decision: InheritedAsk, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
 /** An INHERITED-lane mint station (the two wrapper arms and the approved-edit re-check): the ask is an
- *  ancestor policy's own decision, never engine-stamped, so BOTH members come from the judgment
- *  {@link judgeInheritedClassifier} handed back — the word it derived under the station facts and the
- *  fallback member it captured — each read ONCE there and threaded here, never re-read off the
+ *  ancestor policy's own decision, never engine-stamped, so EVERY member comes from the judgment
+ *  {@link judgeInheritedClassifier} handed back — the word and the classification it derived under the station
+ *  facts and the fallback member it captured — each read ONCE there and threaded here, never re-read off the
  *  caller-owned object (a stateful accessor could otherwise answer the card with one value and the
- *  settlement with another; a self-declared `origin` on the ancestor's decision is never read). */
+ *  settlement with another; a self-declared `origin` / `askClass` / `classes` on the ancestor's decision is never
+ *  read). */
 export declare function inheritedAskCarry(judged: Pick<Extract<InheritedClassifierJudgment<InheritedAsk>, {
     kind: "resolve";
-}>, "origin" | "fallback" | "ask">, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
+}>, "origin" | "classification" | "fallback" | "ask">, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
 /** What {@link judgeInheritedClassifier} hands back to the arm that called it. */
 export type InheritedClassifierJudgment<A extends InheritedAsk> = 
 /** The frozen classifier allowed. `result` is the allow the arm RETURNS — minted at the judging station so
@@ -146,8 +150,11 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  `origin` is the ask's word under the station facts, threaded to the request mint: on the two
  *  unchanged-ask branches it is the SAME read the exclusion judged by (a caller-owned decision with a
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
- *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
-/** `ask` is the incoming ask unchanged (the caller's own object), or — an UNAVAILABLE classification with a live frozen
+ *  bound branch it is derived from the re-spoken ask this station minted (its own object).
+ *  `classification` is the class set of the ask handed on, under the same station facts: on the two unchanged-ask
+ *  branches the one read the exclusion judged by, on the unavailable and bound branches a read of the object this
+ *  station minted (each adds a real-approval bit, which the set must reflect). */
+/** `ask` is the incoming ask unchanged (the arm's receipt snapshot of the ancestor's decision), or — an UNAVAILABLE classification with a live frozen
 *  approver — that ask with the classifier sentence appended; without one it is a `deny` whose attested cause reads `unavailable`. */
  | {
     kind: "resolve";
@@ -155,6 +162,7 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
     fallback: UnarmedDenialLimitFallback | undefined;
     mintedHere: boolean;
     origin: AskOrigin;
+    classification: AskClassification;
 };
 /**
  * The ancestor's frozen classifier, run BEFORE its frozen approver in the ancestor's own gate order,
@@ -195,6 +203,8 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     allowRewrite?: unknown;
     /** An `unavailable` verdict's fork facts (`classifierUnavailableArm`): is the frozen approver live; who hears it. */
     unavailableSeat?: ClassifierUnavailableSeat;
+    /** The station's facts for this call (the base with this task's tool seat); absent ⇒ {@link INHERITED_STATION_FACTS}. */
+    facts?: AskClassFacts;
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
 export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;

package/dist/core/runner/denial-limit-arms.js

@@ -5,7 +5,7 @@ import { attestClassifierDenyCause, attestClassifierRound } from "../tool-policy
 import { SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { askOriginOf, classifyAsk } from "../ask-origin.js";
+import { askClassMembersOf, askOriginOf, classifyAsk } from "../ask-origin.js";
 export function attachRebuiltDenialTrackers(entries, denialLimit) {
     if (entries === undefined)
         return undefined;
@@ -68,30 +68,34 @@ function fallbackCarry(fallback, liveApprover, tracker) {
 export function gateAskCarry(decision, liveApprover, tracker) {
     return {
         ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
+        ...(decision.askClass !== undefined && decision.classes !== undefined ? { askClass: decision.askClass, classes: decision.classes } : {}),
         ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
     };
 }
 export function inheritedAskCarry(judged, liveApprover, tracker) {
     return {
         origin: judged.origin,
+        ...askClassMembersOf(judged.classification),
         ...fallbackCarry(judged.fallback, liveApprover, tracker),
     };
 }
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, ask, req } = opts;
-    const origin = askOriginOf(ask, INHERITED_STATION_FACTS);
+    const facts = opts.facts ?? INHERITED_STATION_FACTS;
+    const origin = askOriginOf(ask, facts);
+    const classification = classifyAsk(ask, facts);
     const classifierStandsDown = () => {
         const live = opts.liveMode?.();
         return live === "dontAsk" || live === "bypassPermissions" || live === "plan" || (autoMode?.liveMode !== undefined && autoMode.liveMode.current !== "auto");
     };
-    if (autoMode === undefined || classifierStandsDown() || !classifyAsk(ask, INHERITED_STATION_FACTS).row.classifierEligible) {
-        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+    if (autoMode === undefined || classifierStandsDown() || !classification.row.classifierEligible) {
+        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification };
     }
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
     if (verdict.kind === "allow" && classifierStandsDown())
-        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification };
     const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
     if (verdict.kind === "allow") {
         autoMode.denialTracking?.recordAllow();
@@ -100,7 +104,7 @@ export async function judgeInheritedClassifier(opts) {
     if (verdict.kind === "unavailable") {
         const arm = classifierUnavailableArm({ ask, req, cause: verdict.cause, seat: opts.unavailableSeat, aborted: opts.signal.aborted });
         if (arm.kind === "asked")
-            return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+            return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification: classifyAsk(arm.ask, facts) };
         return { kind: "deny", result: attributed(arm.deny) };
     }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
@@ -116,7 +120,7 @@ export async function judgeInheritedClassifier(opts) {
     }
     const fallback = tracked.fallback;
     const minted = { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };
-    return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, INHERITED_STATION_FACTS) };
+    return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, facts), classification: classifyAsk(minted, facts) };
 }
 export function headlessDenyAtFold(r) {
     return r.settlement !== undefined && SETTLEMENT_NOBODY_JUDGED[r.settlement.kind];