@sema-agent/core 7.36.0 → 7.37.1

package/dist/core/runner/inherited-ask-grants.d.ts

@@ -1,41 +1,42 @@
+import type { AskClass } from "../ask-origin.js";
 import type { HumanReviewGateRow } from "../task-result.js";
 import { type OnAsk, type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
-/** JSON.stringify throws on a cyclic value (a deployment
- *  policy's rewrite object carries no acyclicity guarantee) — `undefined` here means "no comparable
- *  shape", which every consumer treats as a mismatch (skip the record / skip the reuse ⇒ the child
- *  gate just re-asks — the safe direction, never a gate failure). */
-export declare function askGrantShapeOf(args: unknown): string | undefined;
-/**
- * Duplicate-frame collapse (single-Runner embedded shape), the CONSUME half: an inherited
- * layer already resolved THIS call as a clean allow at the SAME approver function, on EXACTLY the
- * byte-shape this caller-slot ask now presents. The human's consent covers this consultation
- * verbatim — asking again is the 2-frame UX debt, not a second authority. Guards, all mismatches
- * re-ask (⇒ `undefined`):
- *  · SOURCE: only a caller-slot POLICY ask may reuse — a safety tighten
- *    (egress/irreversible/shellGate stamp `decisionReason:"safety"`), a hook-promoted ask
- *    ("hook"), or a classifier ask carries a DIFFERENT authority/context and keeps its frame.
- *  · IDENTITY: the approver FUNCTION reference (never a name) — compared through
- *    `askApproverIdentity`, not by raw reference (ruled 2026-08-04): a delegated child's approver
- *    is the ancestor's own, wrapped with delegation provenance — a DIFFERENT function object, the
- *    SAME operator. Bare `===` therefore stopped collapsing the frame the moment the ask seam
- *    started forwarding approvers, and one tool call presented the same person the same card
- *    twice. The wrapper adds metadata and delegates every decision, so it grants no authority of
- *    its own; identity here only answers "same consultation".
- *  · SHAPE: byte-equality against the presented SNAPSHOT; reuse re-emits that snapshot
- *    as the executed shape via `presentedInput` — the same schema-revalidated binding
- *    as a main-gate approval (shown == executed, by construction).
- *  · LEDGER: the ONE real consultation (timed on the wrapper arm) is recorded here —
- *    one frame happened, one frame is booked.
- * The grant lives only within one gate evaluation (consumed on reuse, swept at the call site) — a
- * REOPENED checkpoint's re-adjudication never sees a stale grant.
- */
-export declare function consumeInheritedAskGrant(grants: Map<string, {
+/** One inherited ask grant: a person's clean allow at an ancestor's live approver, on ONE presented shape, to ONE question
+ *  (`classes`, the request's class set in `ASK_CLASSES` order) — it answers no stricter question. */
+export interface InheritedAskGrant {
     approver: unknown;
     argsJson: string;
     presented: unknown;
     waitMs: number;
     settled?: object;
-}>, onAsk: OnAsk | undefined, humanReviewRef: {
+    classes: readonly AskClass[];
+}
+/** Does a grant for `granted` cover a question the gate classified as `asked`? `ordinary` — the plain hesitation every other
+ *  class is a stricter form of — is covered by any card answered; every other class must have been on the card (the gate reads
+ *  facts the station cannot hold, and a class those add was asked of nobody). Unclassified, or a card with no class ⇒ never. */
+export declare function askGrantCovers(granted: readonly AskClass[], asked: readonly AskClass[] | undefined): boolean;
+/** JSON.stringify throws on a cyclic value (a rewrite object carries no acyclicity guarantee) — `undefined` means "no
+ *  comparable shape", which every consumer treats as a mismatch (skip the record / reuse ⇒ re-ask, the safe direction). */
+export declare function askGrantShapeOf(args: unknown): string | undefined;
+/**
+ * Duplicate-frame collapse, the CONSUME half: an inherited layer already resolved THIS call as a clean allow at the
+ * SAME approver function, on EXACTLY the byte-shape this caller-slot ask now presents, for a question that covers this
+ * one — asking again is the 2-frame UX debt, not a second authority. Guards, all mismatches re-ask (⇒ `undefined`):
+ *  · SOURCE: only a caller-slot POLICY ask may reuse — a safety tighten (`decisionReason:"safety"`), a hook-promoted
+ *    ask ("hook") or a classifier ask carries a DIFFERENT authority and keeps its frame.
+ *  · IDENTITY: the approver FUNCTION reference (never a name), compared through `askApproverIdentity`: a delegated
+ *    child's approver is the ancestor's own wrapped with provenance — a different function object, the same operator
+ *    (the wrapper grants no authority of its own); identity answers only "same consultation".
+ *  · SHAPE: byte-equality against the presented SNAPSHOT; reuse re-emits that snapshot as the executed shape via
+ *    `presentedInput` — the same binding as a main-gate approval (shown == executed, by construction).
+ *  · CLASS: the gate's stamped `classes` is covered by the set the person answered ({@link askGrantCovers}); a class
+ *    the gate's own judges add (a protected target, an out-of-root read) was not on the card. Not covered ⇒ the gate
+ *    asks its own question and the grant stays (it answers what it answered; the call-site sweep ends it).
+ *  · LEDGER: the ONE real consultation (timed on the wrapper arm) is booked here — one frame happened, one is booked.
+ * The grant lives within one gate evaluation (consumed on reuse, swept at the call site): a REOPENED checkpoint's
+ * re-adjudication never sees a stale grant.
+ */
+export declare function consumeInheritedAskGrant(grants: Map<string, InheritedAskGrant>, onAsk: OnAsk | undefined, humanReviewRef: {
     count: number;
     totalWaitMs: number;
     gates: HumanReviewGateRow[];

package/dist/core/runner/inherited-ask-grants.js

@@ -1,5 +1,8 @@
 import { primaryActivityArg } from "../arg-summary.js";
 import { askApproverIdentity, carryEngineAttestations } from "../tool-policy.js";
+export function askGrantCovers(granted, asked) {
+    return asked !== undefined && asked.length > 0 && granted.length > 0 && asked.every((c) => c === "ordinary" || granted.includes(c));
+}
 export function askGrantShapeOf(args) {
     try {
         return JSON.stringify(args ?? null);
@@ -14,6 +17,8 @@ export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision
     const grant = grants.get(req.toolCallId);
     if (grant === undefined || askApproverIdentity(grant.approver) !== askApproverIdentity(onAsk) || grant.argsJson !== askGrantShapeOf(req.args))
         return undefined;
+    if (!askGrantCovers(grant.classes, decision.action === "ask" ? decision.classes : undefined))
+        return undefined;
     grants.delete(req.toolCallId);
     humanReviewRef.count += 1;
     humanReviewRef.totalWaitMs += grant.waitMs;

package/dist/core/runner/prepare-inherited-gate.js

@@ -36,7 +36,7 @@ export function prepareInheritedGate(input) {
     if (modeSeed.migrated !== undefined) {
         deliverEngineNotice(deps.onNotice, {
             code: "resume.legacy_mode_seed_migrated",
-            message: `the resumed checkpoint row carried pre-mode keys (${modeSeed.migrated.droppedKeys.join(", ")}); read once into ${modeSeed.migrated.permissionMode !== undefined ? `permissionMode: "${modeSeed.migrated.permissionMode}"` : "no mode of its own (the chain's ceiling stands)"}${modeSeed.shellGate !== undefined ? ' with the shell floor "always" kept' : ""} — the next suspend writes the one key; from 7.35.0 a row still carrying these keys is refused`,
+            message: `the resumed checkpoint row carried pre-mode keys (${modeSeed.migrated.droppedKeys.join(", ")}); read once into ${modeSeed.migrated.permissionMode !== undefined ? `permissionMode: "${modeSeed.migrated.permissionMode}"` : "no mode of its own (the chain's ceiling stands)"}${modeSeed.shellGate !== undefined ? ' with the shell floor "always" kept' : ""} — the next suspend writes the one key; this migration is kept through 7.37.x and removed in 7.38.0, which refuses a row still carrying these keys (resume or abandon such rows before upgrading)`,
             detail: { migrated: { ...(modeSeed.migrated.permissionMode !== undefined ? { permissionMode: modeSeed.migrated.permissionMode } : {}), droppedKeys: [...modeSeed.migrated.droppedKeys] }, sessionId, runId },
         });
     }

package/dist/core/runner/prepare-park-ask.d.ts

@@ -9,8 +9,8 @@
  * decomposition exists to make explicit.
  *
  * The thirteen-argument park closure is unchanged: twelve positional seats then the structural {@link AskCarry}, the
- * shape the gate's one invocation site (`parkWith`) holds. The ask's origin word and the denial-limit fallback ride the
- * carry onto the row exactly as before — this phase mints no origin, changes no word, adds no arm to the closed set.
+ * shape the gate's one invocation site (`parkWith`) holds. The ask's origin word, class pair and denial-limit fallback
+ * ride the carry onto the row — this phase mints no origin or class, changes no word, adds no arm to the closed set.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (both closures run per tool call), so the
  * phase adds no yield between the boundary parks before it and the gate station after it.

package/dist/core/runner/prepare-park-ask.js

@@ -173,11 +173,7 @@ export function prepareParkAsk(input) {
                     if (reprojectedRaced.tag === "threw")
                         throw reprojectedRaced.error;
                     const reprojected = refuseOutOfContractDecision(reprojectedRaced.value);
-                    const demanded = reprojected.updatedInput !== undefined ? tryCloneArgs(reprojected.updatedInput) : undefined;
-                    const rewroteTheFiledValue = reprojected.updatedInput !== undefined &&
-                        !(demanded?.ok === true &&
-                            samePlainValue(demanded.value, parkedArgs) &&
-                            samePlainValue(reprojected.updatedInput, parkedArgs));
+                    const rewroteTheFiledValue = reprojected.updatedInput !== undefined && !samePlainValue(reprojected.updatedInput, parkedArgs);
                     if (reprojected.action === "deny" || rewroteTheFiledValue) {
                         throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and the deployment's tool policy does not accept the stored shape` +
                             `${reprojected.action === "deny" && reprojected.message ? `: ${reprojected.message}` : ""} — ` +

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -34,6 +34,7 @@ import { type ActiveSkillScope } from "./active-skill-scope.js";
 import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, StopForDenialLimit } from "./contracts.js";
 import { type Arbitration } from "../ask-origin.js";
 import { type ModeGateSeats, type PermissionModeController } from "../mode-policy.js";
+import { type InheritedAskGrant } from "./inherited-ask-grants.js";
 import { createRuleOffersOf, type PermissionRuleLanes } from "./permission-rule-lanes.js";
 import type { ToolCallLike } from "../tool-registry.js";
 export interface PreparePolicyChainInput {
@@ -45,7 +46,7 @@ export interface PreparePolicyChainInput {
      *  `permissionRuleStore` / `localOwnerRules` (the lanes and the offer factory), `onError` / `onNotice` (the advisories,
      *  the refusal disclosures, the late-ask observer), `tracer` (the admission and rule-store frames), `checkpointStore` (the park facility). Receiver preserved;
      *  the advisory dedupe is KEYED on this object's identity. */
-    deps: Pick<RunnerDeps, "sessionPolicyStore" | "hooks" | "permissionRuleStore" | "localOwnerRules" | "onError" | "onNotice" | "tracer" | "checkpointStore">;
+    deps: Pick<RunnerDeps, "sessionPolicyStore" | "hooks" | "permissionRuleStore" | "localOwnerRules" | "onError" | "onNotice" | "tracer" | "checkpointStore" | "a2a">;
     /** borrowed-readonly — the trusted spawn-side channel: `parentTaskId` (the from-subagent bit), `explicitAgentName` /
      *  `agentName` (the source agent name) — the ask source identity's local, trusted facts. */
     internals: Pick<RunInternals, "parentTaskId" | "explicitAgentName" | "agentName"> | undefined;
@@ -186,13 +187,7 @@ export interface PreparePolicyChainResult {
     }>>;
     /** borrowed-mutable — the grant record. Writers: the inherited arms here (record a clean allow at a live approver);
      *  the gate station (consume on reuse, sweep at settlement). */
-    inheritedAskGrants: Map<string, {
-        approver: unknown;
-        argsJson: string;
-        presented: unknown;
-        waitMs: number;
-        settled?: object;
-    }>;
+    inheritedAskGrants: Map<string, InheritedAskGrant>;
     /** owned — the SINGLE AskRequest source-identity factory every resolveAsk construction site spreads. */
     askSourceIdentity: () => {
         principal?: string;

package/dist/core/runner/prepare-policy-chain.js

@@ -6,12 +6,12 @@ import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
 import { assertHookSeatsCallable } from "../hook-seats.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, wrapToolPolicy, attestAskUnresolvableCause } from "../tool-policy.js";
+import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, wrapToolPolicy, attestAskUnresolvableCause } from "../tool-policy.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
 import { createActiveSkillScopePolicy } from "./active-skill-scope.js";
-import { arbitrateByMode, askMandateMember, classifyAsk } from "../ask-origin.js";
+import { arbitrateByMode, askClassMembersOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
 import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
@@ -20,12 +20,12 @@ import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
 import { thrownText } from "../thrown-value.js";
-import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
+import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
     const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
-    const arbitrateInherited = (ask, toolCallId) => {
-        const verdict = arbitrateByMode(permissionMode.current, classifyAsk(ask, INHERITED_STATION_FACTS), { ...(ask.origin !== undefined ? { origin: ask.origin } : {}), ...(ask.mandate !== undefined ? { mandate: ask.mandate } : {}) });
+    const arbitrateInherited = (ask, toolCallId, classification) => {
+        const verdict = arbitrateByMode(permissionMode.current, classification, { ...(ask.origin !== undefined ? { origin: ask.origin } : {}), ...(ask.mandate !== undefined ? { mandate: ask.mandate } : {}) });
         if (verdict.kind === "ask" || verdict.kind === "accepted")
             return undefined;
         ancestorArbitrations.set(toolCallId, verdict);
@@ -188,7 +188,7 @@ export async function preparePolicyChain(input) {
     }, "mandate_unreconstructible", creq);
     const markerChannelFullDeny = (creq) => attestAskUnresolvableCause({ action: "deny", message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed` }, "approver_unavailable", creq);
     const inheritedAskGrants = new Map();
-    const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs, settled) => {
+    const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs, settled, classes) => {
         if (typeof approver !== "function")
             return;
         if (presented === undefined)
@@ -198,7 +198,7 @@ export async function preparePolicyChain(input) {
         const argsJson = askGrantShapeOf(presented);
         if (argsJson === undefined)
             return;
-        inheritedAskGrants.set(toolCallId, { approver, argsJson, presented, waitMs, settled });
+        inheritedAskGrants.set(toolCallId, { approver, argsJson, presented, waitMs, settled, classes });
     };
     const sandboxDeclared = isIsolated(executionEnv);
     const sandboxAdmissionArmed = (() => {
@@ -259,7 +259,7 @@ export async function preparePolicyChain(input) {
     };
     const callerPolicyLayer = policy !== undefined && sameInstanceAncestorCount > 0
         ? wrapToolPolicy(policy, async (creq, csignal) => {
-            const decision = await policy.check(creq, csignal ?? abortController.signal);
+            const decision = refuseOutOfContractDecision(await policy.check(creq, csignal ?? abortController.signal));
             sharedFirstDecision.set(creq.toolCallId, decision);
             if (sharedFirstDecision.size > SHARED_FIRST_DECISION_CAP) {
                 const oldest = sharedFirstDecision.keys().next().value;
@@ -278,15 +278,33 @@ export async function preparePolicyChain(input) {
             : {}),
         ...(delegation.isDelegatedChild ? { isDelegatedChild: true } : {}),
     });
+    const seatMarksOf = (call) => {
+        const tierSeat = seatOf("report.riskAxes", irreversibilityTier, call);
+        return {
+            tier: tierSeat?.value,
+            egress: heldBy("report.riskAxes.egress", egressTools, call),
+            shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
+            sources: new Set(heldValues("report.markSources", toolMarkSources, call).flatMap((s) => [...s])),
+        };
+    };
     const riskAxesOf = (call) => {
-        const tier = seatOf("report.riskAxes", irreversibilityTier, call)?.value;
+        const seat = seatMarksOf(call);
         const negatives = seatOf("report.riskAxes.negatives", axisExplicitNegatives, call)?.value;
-        const irreversible = tier === "always" || tier === "maybe" ? true : tier === "never" ? false : negatives?.irreversible;
-        const egress = heldBy("report.riskAxes.egress", egressTools, call) ? true : negatives?.egress;
+        const irreversible = seat.tier === "always" || seat.tier === "maybe" ? true : seat.tier === "never" ? false : negatives?.irreversible;
+        const egress = seat.egress ? true : negatives?.egress;
         if (irreversible === undefined && egress === undefined)
             return {};
         return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
     };
+    const inheritedStationFacts = (call) => {
+        const seat = seatMarksOf(call);
+        return {
+            ...INHERITED_STATION_FACTS,
+            mandateMarks: { egress: seat.egress, shellGated: seat.shellGated, ...(seat.tier !== undefined ? { irreversibility: seat.tier } : {}) },
+            ...(seat.sources.size > 0 ? { toolMarkSources: seat.sources } : {}),
+            ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}),
+        };
+    };
     const inheritedAskEvidence = inheritedAskRuleEvidence(deps.permissionRuleStore);
     const { personal: permissionRuleLane, org: permissionRuleOrgLane } = createPermissionRuleLanes({
         provider: deps.permissionRuleStore,
@@ -335,7 +353,7 @@ export async function preparePolicyChain(input) {
             }
             let re;
             try {
-                re = await pol.check({ ...creq, args: editArgs }, csignal ?? abortController.signal);
+                re = refuseOutOfContractDecision(await pol.check({ ...creq, args: editArgs }, csignal ?? abortController.signal));
             }
             catch (err) {
                 return vetoed({
@@ -353,7 +371,7 @@ export async function preparePolicyChain(input) {
             }
             if (re.updatedInput !== undefined)
                 editArgs = re.updatedInput;
-            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
+            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
                 const cleared = { ...judged.result };
                 carryEngineAttestations(judged.result, cleared);
@@ -364,7 +382,7 @@ export async function preparePolicyChain(input) {
                 return vetoed(judged.result);
             const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
             re = editAsk;
-            const editArbitrated = arbitrateInherited(re, creq.toolCallId);
+            const editArbitrated = arbitrateInherited(re, creq.toolCallId, judged.classification);
             if (editArbitrated !== undefined) {
                 const out = editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs } : editArbitrated;
                 carryPrecedingSettlement(settledBy, out);
@@ -435,17 +453,17 @@ export async function preparePolicyChain(input) {
                             return first;
                         return mandateUnreconstructibleDeny(creq);
                     }
-                    const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call", unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
+                    const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call", facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
                     if (judged.kind === "allow")
                         return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && classifyAsk(inheritedAsk, INHERITED_STATION_FACTS).row.sandboxAdmission) {
+                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return { action: "allow" };
                     }
-                    const arbitrated = arbitrateInherited(inheritedAsk, creq.toolCallId);
+                    const arbitrated = arbitrateInherited(inheritedAsk, creq.toolCallId, judged.classification);
                     if (arbitrated !== undefined)
                         return arbitrated;
                     const presentedArgs = creq.args;
@@ -477,14 +495,14 @@ export async function preparePolicyChain(input) {
                     if (resolved.updatedInput !== undefined) {
                         return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                     }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved);
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(judged.classification).classes);
                     return { action: "allow" };
                 },
             }
             : wrapToolPolicy(pc.policy, async (creq, csignal) => {
                 let decision;
                 try {
-                    decision = await pc.policy.check(creq, csignal ?? abortController.signal);
+                    decision = refuseOutOfContractDecision(await pc.policy.check(creq, csignal ?? abortController.signal));
                 }
                 catch (err) {
                     return {
@@ -509,17 +527,17 @@ export async function preparePolicyChain(input) {
                     return mandateUnreconstructibleDeny(creq);
                 }
                 const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
+                const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
                 if (judged.kind === "allow")
                     return judged.result;
                 if (judged.kind === "deny")
                     return judged.result;
                 const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && classifyAsk(inheritedAsk, INHERITED_STATION_FACTS).row.sandboxAdmission) {
+                if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                     recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                     return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
                 }
-                const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId);
+                const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId, judged.classification);
                 if (arbitrated !== undefined)
                     return arbitrated;
                 const askT0 = now();
@@ -551,7 +569,7 @@ export async function preparePolicyChain(input) {
                     return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                 }
                 if (pc.preToolUse === undefined) {
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved);
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(judged.classification).classes);
                 }
                 if (decision.updatedInput === undefined)
                     return resolved;
@@ -572,7 +590,7 @@ export async function preparePolicyChain(input) {
             sameInstanceAdapterIndices.add(j + callerSlotOffset);
     });
     const instrumentedChain = rewriteCapableChain.map((layer, idx) => wrapToolPolicy(layer, async (creq, csignal) => {
-        const d = await layer.check(creq, csignal);
+        const d = refuseOutOfContractDecision(await layer.check(creq, csignal));
         if (d.updatedInput !== undefined)
             rewriteEmitterIndex.set(creq.toolCallId, idx);
         if (d.action === "ask") {
@@ -619,7 +637,7 @@ export async function preparePolicyChain(input) {
             const revalidated = {};
             try {
                 for (const layer of recheckLayers) {
-                    const d = await layer.check(finalReq, signal);
+                    const d = refuseOutOfContractDecision(await layer.check(finalReq, signal));
                     if (d.action === "deny") {
                         const carried = { ...d, updatedInput: decision.updatedInput };
                         carryEngineAttestations(d, carried);

package/dist/core/runner/run-identity-wiring.d.ts

@@ -12,7 +12,7 @@ export interface RunIdentityWiringInput {
      *  task_notification frames. */
     queue: PushQueue<TaskEvent>;
     /** borrowed-mutable — the leg's prepared seat: the harness sinks (`onUndrainedEngineNotes`, `engineInjectionsHeld`,
-     *  `onUndrainedUserInputs`, `onEngineNoteConsumed`) are installed, `nextTurn` is appended to; the ids, the identity
+     *  `onUndrainedUserInputs`, `onEngineNoteConsumed`, `onToolTurnRepaired`) are installed, `nextTurn` is appended to; the ids, the identity
      *  envelope, the hold refs, the memory session and the listing / roster faces are read. */
     prepared: Prepared;
     /** borrowed-readonly — the trusted run-scoped channel: `parentToolCallId`, `onNotifyInjectorReady`. */

package/dist/core/runner/run-identity-wiring.js

@@ -3,6 +3,7 @@ import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js"
 import { recordFrameReceipt, toolResultReceiptKey } from "../frame-settlement.js";
 import { discloseDroppedPending, renderTaskNotificationXml, taskNotificationDedupKey } from "../task-notification.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
+import { createToolTurnRepairSeat } from "./tool-turn-repair-seat.js";
 export function runIdentityWiring(input) {
     const { spec, queue, prepared, internals, taskIdRef, onReady, manualCompactRef, notifyRef, captureOptOutRef, mcpRedialRef, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef, notificationLane, pendingSessionNotifications, runner } = input;
     notificationLane.harness = prepared.harness;
@@ -84,6 +85,7 @@ export function runIdentityWiring(input) {
         if (key !== undefined)
             recordFrameReceipt(seam, key, carrier.kind === "tool_result" ? carrier.content : undefined, entryId);
     };
+    prepared.harness.onToolTurnRepaired = createToolTurnRepairSeat((notice) => runner.deps.onNotice?.(notice), { sessionId: prepared.sessionId, runId: prepared.runId });
     if (notifyRef)
         notifyRef.inject = injectTaskNotification;
     if (captureOptOutRef && prepared.memoryEngineSession?.captureOptOut !== undefined) {

package/dist/core/runner/tool-turn-repair-seat.d.ts

@@ -0,0 +1,8 @@
+import type { EngineNotice } from "../engine-notice.js";
+import type { ToolTurnRepair } from "../../internal/llm.js";
+/** The notice's attribution ids — the same pair, for the same reason, as the fold seat's. */
+export interface ToolTurnRepairSeatIds {
+    sessionId: string;
+    runId: string;
+}
+export declare function createToolTurnRepairSeat(onNotice: ((notice: EngineNotice) => void) | undefined, ids: ToolTurnRepairSeatIds): (repairs: readonly ToolTurnRepair[]) => void;

package/dist/core/runner/tool-turn-repair-seat.js

@@ -0,0 +1,28 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+const FORM_SENTENCE = {
+    trailing_text: "a block after an assistant's tool calls was moved ahead of them",
+    late_result: "a result recorded later was moved up behind its call",
+    missing_result: "a call with no result was closed as interrupted (outcome unknown)",
+    duplicate_result: "a second result recorded for one call was folded into the first (an interrupted close beside a recorded result is left out)",
+};
+export function createToolTurnRepairSeat(onNotice, ids) {
+    const announced = new Set();
+    return (repairs) => {
+        const fresh = repairs.filter((repair) => {
+            const key = `${repair.form}\u0000${[...repair.toolCallIds].sort().join("\u0000")}`;
+            if (announced.has(key))
+                return false;
+            announced.add(key);
+            return true;
+        });
+        if (fresh.length === 0)
+            return;
+        deliverEngineNotice(onNotice, {
+            code: "context.tool_turn_repaired",
+            message: `The session transcript carries ${fresh.length === 1 ? "a tool turn" : `${fresh.length} tool turns`} in a shape a provider lane ` +
+                `rejects, so the request was repaired on its way out: ${[...new Set(fresh.map((r) => FORM_SENTENCE[r.form]))].join("; ")}. ` +
+                `The transcript is unchanged and every later request is repaired the same way; announced once per run.`,
+            detail: { repairs: fresh.map((r) => ({ form: r.form, toolCallIds: [...r.toolCallIds] })), sessionId: ids.sessionId, runId: ids.runId },
+        });
+    };
+}

package/dist/core/session-reconcile.d.ts

@@ -1,4 +1,5 @@
 import type { AgentMessage } from "../internal/harness-types.js";
+import type { ToolResultMessage } from "../internal/llm.js";
 import type { Session } from "./session.js";
 import type { ToolEffect } from "./types.js";
 /**
@@ -116,6 +117,40 @@ export declare const INTERRUPTED_BY_USER_FOR_TOOL_USE_MARKER = "[Request interru
 export declare function appendInterruptionMarker(session: Session, opts: {
     toolUseInFlight: boolean;
 }): Promise<string>;
+/** One synthetic interrupted result: what a call with no recorded result is closed with. */
+export interface InterruptedResult {
+    toolCallId: string;
+    toolName: string;
+    /** The model-facing text. */
+    text: string;
+    /** Which of the two honest states the call is closed in. */
+    errorKind: ReconciledErrorKind;
+}
+/**
+ * The ONE mint of interrupted-result content for a batch of calls that have no recorded result. Two readers: the
+ * persisted reconcile ({@link reconcileInterruptedSession}) and the request view's tool-turn law
+ * (`engine/llm/tool-turns.ts`, which closes a call on the wire only and never writes the transcript) — so a call
+ * closed either way reads the same to the model.
+ *
+ * `toolEffects` / `startedToolCallIds` as on {@link reconcileInterruptedSession}; absent ⇒ every call gets the
+ * conservative unknown-outcome wording. The first call of each class in the batch states it in full and the rest
+ * point back at it (scoped to this call, so a later batch always starts from the full wording again).
+ */
+export declare function interruptedResults(calls: readonly {
+    toolCallId: string;
+    toolName: string;
+}[], toolEffects?: Map<string, ToolEffect>, startedToolCallIds?: ReadonlySet<string>): InterruptedResult[];
+/** Is `message` an INTERRUPTED CLOSE — a result minted to stand in for one that was never recorded (this family's
+ *  two-valued `details.errorKind`, written by the reconcile here and by the loop's turn-scoped interrupt)? A close
+ *  says only "no result was recorded", so it is void beside a recorded result for the same call. Total: a tool's
+ *  `details` is the tool's value, so an unreadable one reads as "not a close" (one guarded read per member). */
+export declare function isInterruptedClose(message: {
+    details?: unknown;
+}): boolean;
+/** The `toolResult` message for one {@link InterruptedResult} — the persisted and the request-view closes are this one shape. */
+export declare function interruptedResultMessage(result: InterruptedResult, timestamp: number): ToolResultMessage<{
+    errorKind: ReconciledErrorKind;
+}>;
 /**
  * Reconcile a resumed session's active branch: close any orphan tool calls with a synthetic
  * interrupted `toolResult` (never re-running the tool). Returns what was recovered.

package/dist/core/session-reconcile.js

@@ -1,3 +1,4 @@
+import { readMember } from "./thrown-value.js";
 const INTERRUPTED_UNKNOWN = "[INTERRUPTED] The previous run ended before this tool call's result was recorded. Its outcome " +
     "is UNKNOWN — the action may have completed, partially completed, or never run. Do not assume " +
     "success or failure. Before relying on it: if it is safe to read, query the current state to " +
@@ -96,30 +97,40 @@ export async function appendInterruptionMarker(session, opts) {
         timestamp: Date.now(),
     });
 }
-export async function reconcileInterruptedSession(session, toolEffects, suspendedBatch, startedToolCallIds) {
-    const { messages } = await session.buildContext();
-    const orphans = findOrphanToolCalls(messages, suspendedBatch).filter((o) => o.kind !== "result");
-    const recovered = [];
+export function interruptedResults(calls, toolEffects, startedToolCallIds) {
     const statedInFull = new Set();
-    for (const orphan of orphans) {
-        const effect = toolEffects?.get(orphan.toolName) ?? "write";
+    return calls.map(({ toolCallId, toolName }) => {
+        const effect = toolEffects?.get(toolName) ?? "write";
         const effectText = effect === "read" ? INTERRUPTED_SAFE : effect === "idempotent" ? INTERRUPTED_IDEMPOTENT : INTERRUPTED_UNKNOWN;
-        const neverStarted = startedToolCallIds !== undefined && !startedToolCallIds.has(orphan.toolCallId);
-        const fullText = neverStarted ? INTERRUPTED_NEVER_STARTED : effectText;
+        const neverStarted = startedToolCallIds !== undefined && !startedToolCallIds.has(toolCallId);
         const cls = neverStarted ? "never_started" : effect === "read" ? "read" : effect === "idempotent" ? "idempotent" : "unknown";
-        const text = statedInFull.has(cls) ? REPEAT_TEXT[cls] : fullText;
+        const text = statedInFull.has(cls) ? REPEAT_TEXT[cls] : neverStarted ? INTERRUPTED_NEVER_STARTED : effectText;
         statedInFull.add(cls);
-        const errorKind = neverStarted ? "interrupted_never_started" : "interrupted_outcome_unknown";
-        const entryId = await session.appendMessage({
-            role: "toolResult",
-            toolCallId: orphan.toolCallId,
-            toolName: orphan.toolName,
-            content: [{ type: "text", text }],
-            details: { errorKind },
-            isError: true,
-            timestamp: Date.now(),
-        });
-        recovered.push({ ...orphan, entryId, text, errorKind });
+        return { toolCallId, toolName, text, errorKind: neverStarted ? "interrupted_never_started" : "interrupted_outcome_unknown" };
+    });
+}
+export function isInterruptedClose(message) {
+    const kind = readMember(readMember(message, "details"), "errorKind");
+    return kind === "interrupted_never_started" || kind === "interrupted_outcome_unknown";
+}
+export function interruptedResultMessage(result, timestamp) {
+    return {
+        role: "toolResult",
+        toolCallId: result.toolCallId,
+        toolName: result.toolName,
+        content: [{ type: "text", text: result.text }],
+        details: { errorKind: result.errorKind },
+        isError: true,
+        timestamp,
+    };
+}
+export async function reconcileInterruptedSession(session, toolEffects, suspendedBatch, startedToolCallIds) {
+    const { messages } = await session.buildContext();
+    const orphans = findOrphanToolCalls(messages, suspendedBatch).filter((o) => o.kind !== "result");
+    const recovered = [];
+    for (const result of interruptedResults(orphans, toolEffects, startedToolCallIds)) {
+        const entryId = await session.appendMessage(interruptedResultMessage(result, Date.now()));
+        recovered.push({ toolCallId: result.toolCallId, toolName: result.toolName, entryId, text: result.text, errorKind: result.errorKind });
     }
     return { recovered };
 }

package/dist/core/side-query.js

@@ -1,3 +1,4 @@
+import { ensureToolTurnInvariants } from "../internal/llm.js";
 import { resolveTaskModel } from "./roles.js";
 import { readDegradation } from "../brain/degrading.js";
 import { cacheFamilyOf, uncachedInputTokensOf } from "./runner/usage-accounting.js";
@@ -33,14 +34,15 @@ export async function runSideQuery(spec, deps) {
             };
         }
         if (m.role === "toolResult") {
-            return { role: "toolResult", toolCallId: m.toolCallId, toolName: m.toolName, content: m.content, isError: m.isError ?? false, timestamp };
+            const details = m.details;
+            return { role: "toolResult", toolCallId: m.toolCallId, toolName: m.toolName, content: m.content, isError: m.isError ?? false, timestamp, ...(details !== undefined ? { details } : {}) };
         }
         return { role: "user", content: m.content, timestamp };
     };
     const effectiveSystemPrompt = spec.systemPrompt ?? resolved.systemPrompt;
     const context = {
         ...(effectiveSystemPrompt !== undefined ? { systemPrompt: effectiveSystemPrompt } : {}),
-        messages: spec.messages.map(normalize),
+        messages: ensureToolTurnInvariants(spec.messages.map(normalize)).messages,
         ...(spec.tools !== undefined && spec.tools.length > 0
             ? { tools: spec.tools.map((t) => ({ name: t.name, description: t.description, parameters: t.parameters })) }
             : {}),

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -381,6 +381,24 @@ export async function checkpointStoreContract(make, runAssertion) {
         assert.equal("mandate" in byId.get("mw-absent"), false, "absent must project the key OMITTED");
         assert.equal("mandate" in byId.get("mw-bogus"), false, "a word outside the closed set must read as absent, never project verbatim");
     });
+    run("#1214 ask class pair: a tool_approval row's `askClass` / `classes` survive the round-trip verbatim (the array whole, in its order); an absent pair stays absent", async () => {
+        const store = make();
+        const single = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "ac-single" });
+        Object.assign(single.pendingAction, { askClass: "denial_limit_fallback", classes: ["denial_limit_fallback"] });
+        const several = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "ac-several" });
+        Object.assign(several.pendingAction, { askClass: "transcript_write", classes: ["transcript_write", "org_rule"] });
+        const absent = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "ac-absent" });
+        for (const cp of [single, several, absent])
+            await store.put(cp.token, cp);
+        for (const [cp, askClass, classes] of [[single, "denial_limit_fallback", ["denial_limit_fallback"]], [several, "transcript_write", ["transcript_write", "org_rule"]]]) {
+            const back = (await store.get(cp.token)).pendingAction;
+            assert.equal(back.askClass, askClass, "the row's askClass must survive the round-trip verbatim");
+            assert.deepEqual(back.classes, classes, "the row's classes must survive the round-trip as the same array, in the same order");
+        }
+        const bare = (await store.get(absent.token)).pendingAction;
+        assert.equal("askClass" in bare, false, "an absent askClass must stay OMITTED on the row");
+        assert.equal("classes" in bare, false, "an absent classes must stay OMITTED on the row");
+    });
     await settle();
 }
 const sortByToken = (a, b) => a.token.localeCompare(b.token);

package/dist/core/tool-name-readings.d.ts

@@ -203,6 +203,10 @@ export declare const NAME_READINGS: {
         readonly rank: "member";
         readonly file: string;
     };
+    readonly "report.markSources": {
+        readonly kind: "any";
+        readonly file: string;
+    };
     readonly "verify.wroteThisRun": {
         readonly kind: "wire";
         readonly file: string;