@sema-agent/core 7.37.1 → 7.38.0

package/dist/core/memory-engine/engine.d.ts

@@ -829,6 +829,11 @@ export interface SessionMemoryStatus {
     /** Newest lineage `lastAt` for this session (ms epoch) — rides the same single ledger read as
      *  `committedCount`. Absent = ledger unreadable, or no committed contribution exists at all. */
     lastCaptureAt?: number;
+    /** The canonical absolute directory of the session's write home: the home of the write scope its
+     *  newest leg wrote under (the path that leg's handle carries as `writableRoot`). Absent = no source
+     *  names a scope, or a source faulted — see the method doc for the sources and the absence law. An
+     *  engine predating the key never answers it, but absence alone does not identify such an engine. */
+    writeHome?: string;
 }
 export declare class MemoryEngine {
     private readonly backend;
@@ -1608,9 +1613,14 @@ export declare class MemoryEngine {
      *    carried rather than dropped; absent ⇔ the ledger is unreadable OR the session has no
      *    committed contribution at all (there is no such moment to name — the one key whose absence
      *    also covers "no fact exists", stated here so consumers need not guess).
+     *  - `writeHome` — the canonical home of the write scope the session wrote under most recently (the newer of the dated account row and the newest committed contribution); sources, order and the
+     *    absence law in {@link sessionWriteHomeOf} (a faulted source never falls through).
      *
-     * Side-effect-free committed reads throughout (capture face + lineage sidecar + audit-face
-     * headers/getByIds); never throws — an unreadable source is an absent key, which IS the answer.
+     * Committed reads throughout (capture face + lineage sidecar + session-account sidecar + scope registry +
+     * audit-face headers/getByIds), none of which commits anything for this session; the File backend's
+     * audit face runs that backend's layout seat as each of its lock-free read faces does (loose root content
+     * in a v2 store is adopted into its owner's home — `foldedCount`'s header read has always reached it).
+     * Never throws — an unreadable source is an absent key, which IS the answer.
      */
     sessionMemoryStatus(sessionId: string): Promise<SessionMemoryStatus>;
     /** The committed, side-effect-free audit read: the adoption-restricted committed view when the

package/dist/core/memory-engine/engine.js

@@ -13,6 +13,7 @@ import { ConsolidationRefusedError, CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, CONSO
 import { deriveShadowedSet } from "./shadowing.js";
 import { classifySessionSettlements, clearHoldResolution, closeSessionAccount, disposeHold, effectiveSettlements, expireOverdueSettlements, foreignDanglingSessionAccounts, openLayerWriters, terminateSessionAccount, sessionAccountLeg, markHoldReleased, openInstructionHold, openSessionAccount, readHoldCustody, readHolds, reconcileHolds, replayExternalSettlementEffects, resolveHoldRecord, resolveSessionAccountRecord, resolveSettlementRecord, sessionSettlements, sessionUnattributedSet, emptyUnattributedSet, convertV1SidecarKeys, } from "./delegation-settlement.js";
 import { noReplaceRestore, retireStagingToCustody, stagingPathBeside } from "./delegation-settlement.js";
+import { sessionWriteHomeOf } from "./session-write-home.js";
 import { landedUndecided, layerDigest, layerObservationLookup, readOnlyLayerCandidates, readOnlyLayerCensus, recordLayerObservations, settleUndecidedLayerObservations, observationBacked, sameObservation, undecidedLayerObservations } from "./layer-observations.js";
 import { markOriginClearanceTombstoned, openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
 import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, canonicalJsonStringify, captureErasureInput, erasureRequestInvalid, erasureSelectHash, scanEntryFiles, } from "./file-backend.js";
@@ -2006,7 +2007,7 @@ export class MemoryEngine {
                     unattributedSet = sessionUnattributedSet(this.controlDir, lineageSessionId);
                 }
             }
-            const rec = reconcileLineage(this.controlDir, this.now);
+            const rec = reconcileLineage(this.controlDir);
             this.settlePromotions(rec.promoted);
             for (const u of rec.undecidable) {
                 report.warnings.push(u.kind === "latch-only"
@@ -2779,7 +2780,7 @@ export class MemoryEngine {
                 if (lineageArmed) {
                     try {
                         recordLineageCredential(this.controlDir, txnId, patchReport.applied.filter((a) => a.op !== "delete").map((a) => a.id), this.now);
-                        const promoted = promoteLineagePending(this.controlDir, txnId, this.now);
+                        const promoted = promoteLineagePending(this.controlDir, txnId);
                         this.settlePromotions(promoted);
                     }
                     catch (err) {
@@ -3108,7 +3109,7 @@ export class MemoryEngine {
         }
         try {
             recordLineageCredential(this.controlDir, txnId, patchReport.applied.filter((a) => a.op !== "delete").map((a) => a.id), this.now);
-            const promoted = promoteLineagePending(this.controlDir, txnId, this.now);
+            const promoted = promoteLineagePending(this.controlDir, txnId);
             this.settlePromotions(promoted);
         }
         catch (err) {
@@ -3720,7 +3721,7 @@ export class MemoryEngine {
             if (lineageArmed) {
                 try {
                     recordLineageCredential(this.controlDir, txnId, report.applied.filter((a) => a.op !== "delete").map((a) => a.id), this.now);
-                    this.settlePromotions(promoteLineagePending(this.controlDir, txnId, this.now));
+                    this.settlePromotions(promoteLineagePending(this.controlDir, txnId));
                 }
                 catch (err) {
                     plan.audit.push({ at: this.now(), event: "lineage_settle_failed", detail: thrownText(err) });
@@ -4325,13 +4326,13 @@ export class MemoryEngine {
         let mine;
         try {
             const committed = readLineageRecord(this.controlDir).committed;
-            const ids = new Set();
+            const ids = new Map();
             let lastAt;
             for (const [entryId, sessions] of Object.entries(committed)) {
                 const c = sessions[sessionId];
                 if (c === undefined)
                     continue;
-                ids.add(entryId);
+                ids.set(entryId, c.lastAt);
                 if (lastAt === undefined || c.lastAt > lastAt)
                     lastAt = c.lastAt;
             }
@@ -4342,6 +4343,9 @@ export class MemoryEngine {
         }
         catch {
         }
+        const writeHome = await sessionWriteHomeOf({ memoryDir: this.memoryDir, controlDir: this.controlDir, sessionId, contributions: mine, readEntries: (ids) => this.committedAuditFace().getByIds(ids) });
+        if (writeHome !== undefined)
+            out.writeHome = writeHome;
         if (mine !== undefined) {
             if (mine.size === 0) {
                 out.foldedCount = 0;

package/dist/core/memory-engine/export-bundle.js

@@ -3,7 +3,7 @@ import { canonicalJsonStringify } from "./file-backend.js";
 import { computeEntryRev } from "./frontmatter.js";
 import { MEMORY_ORIGIN_CAUSES } from "./types.js";
 import { ambiguousOriginRepresentation, committedOriginOf } from "./frontmatter.js";
-export const BUNDLE_SECTION_KEYS = ["meta", "entries", "governance", "residuals"];
+export const BUNDLE_SECTION_KEYS = Object.freeze(["meta", "entries", "governance", "residuals"]);
 function sha256Line(text) {
     return createHash("sha256").update(`${text}\n`, "utf8").digest("hex");
 }

package/dist/core/memory-engine/layout.d.ts

@@ -733,10 +733,10 @@ export interface LineagePromotion {
     marked?: true;
 }
 /** Promote a CREDENTIALED pending transaction: rows named by the credential's applied set join the
- *  committed contribution set (deduped by (entryId, sessionId) — a repeat pair refreshes
- *  lastRev/lastAt, never grows the set); rows NOT in the applied set (conflicted/refused ops) are
+ *  committed contribution set (deduped by (entryId, sessionId) — a repeat pair takes the incoming
+ *  lastRev and the credential's date, never grows the set); rows NOT in the applied set (conflicted/refused ops) are
  *  dropped without ever becoming ancestry. Throws when the txn is unknown or uncredentialed. */
-export declare function promoteLineagePending(controlDir: string, txnId: string, now: () => number): LineagePromotion[];
+export declare function promoteLineagePending(controlDir: string, txnId: string): LineagePromotion[];
 /** The host adjudication for the UNDECIDABLE crash window (a pending txn with no credential —
  *  design/180 r5: never auto-discarded). `"promote"` = the host verified the commit landed (all
  *  staged rows join the committed set); `"discard"` = the host verified it did not. Idempotent on
@@ -744,7 +744,7 @@ export declare function promoteLineagePending(controlDir: string, txnId: string,
 export declare function adjudicateLineagePending(controlDir: string, txnId: string, action: "promote" | "discard", now: () => number): LineagePromotion[];
 /** Reconciliation (harvest-opening / host-triggered): promote every CREDENTIALED orphan pending
  *  txn; report the uncredentialed ones (their latch stays until the host adjudicates). */
-export declare function reconcileLineage(controlDir: string, now: () => number): {
+export declare function reconcileLineage(controlDir: string): {
     promoted: LineagePromotion[];
     undecidable: Array<{
         txnId: string;
@@ -853,8 +853,8 @@ export interface LineageImportDivergence {
 }
 /**
  * design/178 v2-c §5.1 — the lineage FIDELITY importer: write bundle lineage rows into the
- * committed set VERBATIM (`lastRev`/`lastAt` carried byte-for-byte — the promote leg mints its own
- * `now` and is therefore unusable for carriage). Deterministic same-key merge, idempotent under
+ * committed set VERBATIM (`lastRev`/`lastAt` carried byte-for-byte: the promote leg dates a contribution by its credential,
+ * the import carries the exporter's date — neither reads a clock here). Deterministic same-key merge, idempotent under
  * re-import of the same bundle:
  *  - destination has no (entryId, sessionId) row ⇒ the source row lands verbatim;
  *  - both present, source `lastAt` is GREATER ⇒ source wins ("last contribution" is a time-axis

package/dist/core/memory-engine/layout.js

@@ -313,7 +313,7 @@ export function dirCaseFolds(dir) {
 }
 export const SCOPE_DIR_LABEL_RE = /^[A-Za-z0-9_][A-Za-z0-9._-]*$/;
 export const CASEFOLD_PROBE_PREFIX = ".casefold-probe-";
-export const SCOPE_REGISTRY_SHAPES = ["absent", "v1", "v2", "migrating"];
+export const SCOPE_REGISTRY_SHAPES = Object.freeze(["absent", "v1", "v2", "migrating"]);
 export const REGISTRY_SHAPE_DERIVES_PATHS = {
     absent: true,
     v1: false,
@@ -1657,7 +1657,7 @@ export function recordLineageCredential(controlDir, txnId, appliedIds, now) {
         return { next: rec, result: undefined };
     });
 }
-export function promoteLineagePending(controlDir, txnId, now) {
+export function promoteLineagePending(controlDir, txnId) {
     return lockedStrictUpdate(controlDir, LINEAGE_FILE, "memory lineage ledger", coerceLineage, (rec) => {
         const txn = rec.pending[txnId];
         if (txn === undefined)
@@ -1666,7 +1666,7 @@ export function promoteLineagePending(controlDir, txnId, now) {
             throw new ControlPlaneCorruptError(`memory lineage ledger: refusing to promote uncredentialed pending transaction ${txnId} (the commit outcome is not durably known)`);
         }
         const applied = new Set(txn.credential.appliedIds);
-        const at = now();
+        const at = txn.credential.at;
         const promoted = [];
         for (const row of txn.rows) {
             if (!applied.has(row.entryId))
@@ -1692,7 +1692,7 @@ export function adjudicateLineagePending(controlDir, txnId, action, now) {
             return { next: rec, result: [] };
         }
         const applied = txn.credential !== undefined ? new Set(txn.credential.appliedIds) : undefined;
-        const at = now();
+        const at = txn.credential?.at ?? now();
         const promoted = [];
         for (const row of txn.rows) {
             if (applied !== undefined && !applied.has(row.entryId))
@@ -1705,11 +1705,10 @@ export function adjudicateLineagePending(controlDir, txnId, action, now) {
         return { next: rec, result: promoted };
     });
 }
-export function reconcileLineage(controlDir, now) {
+export function reconcileLineage(controlDir) {
     return lockedStrictUpdate(controlDir, LINEAGE_FILE, "memory lineage ledger", coerceLineage, (rec) => {
         const promoted = [];
         const undecidable = [];
-        let at;
         let changed = false;
         for (const [txnId, txn] of Object.entries(rec.pending)) {
             if (txn.credential === undefined) {
@@ -1720,9 +1719,8 @@ export function reconcileLineage(controlDir, now) {
             for (const row of txn.rows) {
                 if (!applied.has(row.entryId))
                     continue;
-                at ??= now();
                 const sessions = (rec.committed[row.entryId] ??= Object.create(null));
-                sessions[txn.sessionId] = { lastRev: row.rev, lastAt: at, ...(row.marked === true ? { marked: true } : {}), ...(txn.incarnation !== undefined ? { incarnation: txn.incarnation } : {}) };
+                sessions[txn.sessionId] = { lastRev: row.rev, lastAt: txn.credential.at, ...(row.marked === true ? { marked: true } : {}), ...(txn.incarnation !== undefined ? { incarnation: txn.incarnation } : {}) };
                 promoted.push({ entryId: row.entryId, sessionId: txn.sessionId, rev: row.rev, ...(row.marked === true ? { marked: true } : {}) });
             }
             delete rec.pending[txnId];

package/dist/core/memory-engine/session-write-home.d.ts

@@ -0,0 +1,30 @@
+/**
+ * A session's write home, as {@link import("./engine.js").MemoryEngine.sessionMemoryStatus} reports it
+ * (`SessionMemoryStatus.writeHome`): the canonical absolute directory of the write scope the session wrote under MOST
+ * RECENTLY — `canonicalize(scopeDirFor(write scope))`, the derivation behind a leg's handle's `writableRoot`. Two sources
+ * name a scope, each dated, and the NEWER one wins:
+ *   1. the session's account row: every account-opening mount (a sessioned, unrestricted mount with a write face) records
+ *      its write scope there, dated by the account's (re-)open time — readable from any engine on the control plane;
+ *   2. the entry carrying the session's newest committed lineage contribution, dated by that contribution — a session that
+ *      wrote without opening an account (provenance "off", a row written before the field) names its home this way, and so
+ *      does a leg that wrote AFTER an older account leg (an off-mode commit under another scope after a carry leg ended:
+ *      the older row must not hide the newer home).
+ *   3. neither — ABSENT: a session that never opened an account and never committed.
+ * A FAULTED source (a read that throws: an unreadable account ledger or lineage) answers absent and never falls through —
+ * it may hide the newer scope, so the other source's word would be a stand-in. A SILENT source (the newest contribution's
+ * entry is gone — deleted or a tombstone — or there is no account row) yields to the other source: a deleted note is an
+ * ordinary state, not a fault, and the account row is the durable record of where the session writes. Older contributions
+ * are never consulted. A registry that cannot derive a home (v1, an unfinished layout move)
+ * answers absent before either source is read, so no read here goes through a face whose layout seat would finish the move
+ * first and then name a post-move home.
+ */
+import type { MemoryEntry } from "./types.js";
+export declare function sessionWriteHomeOf(input: {
+    memoryDir: string;
+    controlDir: string;
+    sessionId: string;
+    /** The caller's lineage read: entry id → this session's `lastAt` on it (undefined ⇔ that read faulted). */
+    contributions: ReadonlyMap<string, number> | undefined;
+    /** A committed, side-effect-free entry read (the engine's audit face). */
+    readEntries: (ids: readonly string[]) => Promise<MemoryEntry[]>;
+}): Promise<string | undefined>;

package/dist/core/memory-engine/session-write-home.js

@@ -0,0 +1,34 @@
+import { canonicalize, REGISTRY_SHAPE_DERIVES_PATHS, scopeDirFor, scopeRegistryShape } from "./layout.js";
+import { sessionAccountWriteHome } from "./delegation-settlement.js";
+export async function sessionWriteHomeOf(input) {
+    const { memoryDir, controlDir, sessionId, contributions } = input;
+    try {
+        if (!REGISTRY_SHAPE_DERIVES_PATHS[scopeRegistryShape(controlDir)])
+            return undefined;
+        if (contributions === undefined)
+            return undefined;
+        let newest;
+        for (const [id, at] of contributions) {
+            if (newest === undefined || at > newest.at || (at === newest.at && id > newest.id))
+                newest = { id, at };
+        }
+        const account = sessionAccountWriteHome(controlDir, sessionId);
+        const sources = [];
+        const fromAccount = async () => account?.writeScope;
+        const fromNewest = async () => (newest === undefined ? undefined : (await input.readEntries([newest.id])).find((e) => e.id === newest.id)?.scope);
+        if (account !== undefined && (newest === undefined || account.openedAt >= newest.at))
+            sources.push(fromAccount, fromNewest);
+        else
+            sources.push(fromNewest, fromAccount);
+        let scope;
+        for (const source of sources) {
+            scope = await source();
+            if (scope !== undefined)
+                break;
+        }
+        return scope === undefined ? undefined : canonicalize(scopeDirFor(memoryDir, controlDir, scope));
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/core/memory-engine/tools.js

@@ -11,7 +11,7 @@ import { toolFace } from "../tool-catalog-entries.js";
 export const MEMORY_SEARCH_TOOL_NAME = "memory_search";
 export const MEMORY_GET_TOOL_NAME = "memory_get";
 export const MEMORY_INDEX_TOOL_NAME = "memory_index";
-export const MEMORY_ENGINE_TOOL_NAMES = [MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME];
+export const MEMORY_ENGINE_TOOL_NAMES = Object.freeze([MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME]);
 export const MEMORY_SEARCH_DEFAULT_LIMIT = 8;
 export const MEMORY_SEARCH_MAX_LIMIT = 20;
 export const MEMORY_INDEX_PAGE_ROWS = 100;

package/dist/core/memory-engine/types.js

@@ -1,4 +1,4 @@
-export const MEMORY_ORIGIN_CAUSES = ["observed", "derived", "static", "unattributed"];
+export const MEMORY_ORIGIN_CAUSES = Object.freeze(["observed", "derived", "static", "unattributed"]);
 export function writableRootOf(handle) {
     if (handle.writableRoot === null)
         throw new Error("memory session handle has no write face (writeScope is null) — writableRoot is not available");

package/dist/core/memory.js

@@ -363,7 +363,7 @@ export function parseNoteTimestamp(ts) {
     const ms = Date.parse(`${ts.replace(" ", "T")}:00Z`);
     return Number.isFinite(ms) ? { mtimeMs: ms } : { mtimeMs: 0, timestampMissing: true };
 }
-export const MEMORY_PROJECT_KEY_ABSENT_REASONS = ["not_git", "bare", "unreadable"];
+export const MEMORY_PROJECT_KEY_ABSENT_REASONS = Object.freeze(["not_git", "bare", "unreadable"]);
 export function normalizeMemorySpec(input) {
     if (!input)
         return undefined;

package/dist/core/mode-policy.d.ts

@@ -128,9 +128,12 @@ export interface PermissionModeArming {
      *  or a rejection from it is contained. */
     readonly onArmFault?: (error: unknown) => void;
 }
-/** A live ceiling: the parent leg's own controller (`current` tracks the parent's steers), or a recorded word. */
+/** A live ceiling: the parent leg's own controller (`current` tracks the parent's steers), or a recorded word. A ceiling
+ *  that can start something on a read (a controller, the engine's leg ceiling) also answers `observed` — the same word,
+ *  read without starting anything; one without it is read through `current` on an observation too. */
 export type PermissionModeCeiling = {
     readonly current: PermissionMode;
+    readonly observed?: PermissionMode;
 } | PermissionMode;
 /**
  * The one resolution of a leg's effective mode. `current` is derived on every read from three inputs —
@@ -170,8 +173,14 @@ export declare class PermissionModeController {
      *  failure goes to {@link PermissionModeArming.onArmFault}; the leg then has no classifier, so its asks go on to the
      *  approval seat as under `default`. */
     get current(): PermissionMode;
+    /** The effective mode read to REPORT it (a hook context), not to decide with it: the word {@link current} answers,
+     *  reached through the ceilings' own `observed`, so neither this leg nor an ancestor starts its classifier's arming.
+     *  A decision read is what starts it; an observation that did would arm a leg earlier than its own gate, and so move
+     *  who answers the leg's next ask. */
+    get observed(): PermissionMode;
     /** The three-member answer as it stands right now. */
     receipt(): PermissionModeReceipt;
+    private receiptOf;
     /** The ceiling's source moved to another leg (the parent session's next leg); `before` is this leg's receipt under the
      *  previous one. A ceiling fold the move produced — or changed — is announced, as the construction-time fold is. */
     ceilingRebound(before: PermissionModeReceipt): void;

package/dist/core/mode-policy.js

@@ -6,8 +6,8 @@ import { clampPermissionMode } from "./ask-origin.js";
 import { argvOf, lexShellText } from "../shell/lex.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
 import { createSafeNotifier } from "./safe-notify.js";
-export const PERMISSION_MODE_FOLD_REASONS = ["operator_deny", "face_absent", "inherited_ceiling"];
-export const ACCEPT_EDITS_FILE_COMMANDS = ["mkdir", "touch", "rm", "rmdir", "mv", "cp", "sed"];
+export const PERMISSION_MODE_FOLD_REASONS = Object.freeze(["operator_deny", "face_absent", "inherited_ceiling"]);
+export const ACCEPT_EDITS_FILE_COMMANDS = Object.freeze(["mkdir", "touch", "rm", "rmdir", "mv", "cp", "sed"]);
 const MODE_POLICY_TABLE = {
     plan: { enablePlanMode: true, writeGate: "plan", fileCommands: [], writeFace: undefined },
     acceptEdits: { enablePlanMode: false, writeGate: "accept_root", fileCommands: ACCEPT_EDITS_FILE_COMMANDS, writeFace: undefined },
@@ -94,14 +94,16 @@ export class PermissionModeController {
     get requested() {
         return this.steers.at(-1)?.word ?? this.requestedBySpec;
     }
-    ceilingNow() {
-        return this.ceiling === undefined ? undefined : typeof this.ceiling === "string" ? this.ceiling : this.ceiling.current;
+    ceilingNow(observe) {
+        if (this.ceiling === undefined || typeof this.ceiling === "string")
+            return this.ceiling;
+        return observe ? (this.ceiling.observed ?? this.ceiling.current) : this.ceiling.current;
     }
     get declared() {
         return this.declaration().effective;
     }
-    declaration() {
-        const ceiling = this.ceilingNow();
+    declaration(observe = false) {
+        const ceiling = this.ceilingNow(observe);
         if (ceiling === undefined)
             return { effective: this.requested ?? "default", clamped: false };
         return clampPermissionMode(this.requested, ceiling);
@@ -117,8 +119,14 @@ export class PermissionModeController {
         }
         return effective;
     }
+    get observed() {
+        return this.receiptOf(true).effective;
+    }
     receipt() {
-        const { effective: declared, clamped } = this.declaration();
+        return this.receiptOf(false);
+    }
+    receiptOf(observe) {
+        const { effective: declared, clamped } = this.declaration(observe);
         const requested = this.requested;
         const base = requested !== undefined ? { requested } : {};
         const a = this.arming;

package/dist/core/model-seat.js

@@ -1 +1 @@
-export const MODEL_ROLES = ["default", "summarize", "subagent", "team", "synthesize", "advisor", "verifier", "classifier", "consolidate"];
+export const MODEL_ROLES = Object.freeze(["default", "summarize", "subagent", "team", "synthesize", "advisor", "verifier", "classifier", "consolidate"]);

package/dist/core/permission-rule-model.js

@@ -8,7 +8,7 @@ import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
-export const RULE_BEHAVIORS = ["deny", "ask", "allow"];
+export const RULE_BEHAVIORS = Object.freeze(["deny", "ask", "allow"]);
 const RULE_BEHAVIOR_SET = new Set(RULE_BEHAVIORS);
 export function isRuleBehavior(v) {
     return RULE_BEHAVIOR_SET.has(v);
@@ -342,7 +342,7 @@ function parsePathRuleContent(text, tool, content, behavior) {
     }
     return { rule: { behavior, rule: formatRuleText(content, "path", tool), tool, match: "path", command: content } };
 }
-export const PATH_RULE_BASES = ["cwd", "root", "home"];
+export const PATH_RULE_BASES = Object.freeze(["cwd", "root", "home"]);
 export const PATH_RULE_BASE_LABEL = {
     cwd: "the working directory",
     root: "the project root",
@@ -493,7 +493,7 @@ function hasUnescapedStar(s) {
 export function ruleAdmitsCommand(rule, command) {
     return admitsUnder(rule, command, MATCH_READING);
 }
-export const PROGRAM_RUN_REACHES = ["reached", "not_reached", "unreadable"];
+export const PROGRAM_RUN_REACHES = Object.freeze(["reached", "not_reached", "unreadable"]);
 const REACHED = { reach: "reached" };
 const NOT_REACHED = { reach: "not_reached" };
 export function programRunReachOf(rule, command) {

package/dist/core/permission-rule-store.js

@@ -462,8 +462,8 @@ export async function ruleStoreChecksum(payload) {
     const { createHash } = await import("node:crypto");
     return `sha256:${createHash("sha256").update(canonicalize(payload), "utf8").digest("hex")}`;
 }
-export const REMOVAL_LIVENESS_WORDS = ["yes", "no", "unknown"];
-export const RULE_WRITE_COMMITTED_WORDS = ["no", "unknown"];
+export const REMOVAL_LIVENESS_WORDS = Object.freeze(["yes", "no", "unknown"]);
+export const RULE_WRITE_COMMITTED_WORDS = Object.freeze(["no", "unknown"]);
 function resolveRuleWriter(store) {
     let w;
     try {

package/dist/core/read-only-shell-table.js

@@ -1,4 +1,4 @@
-export const READ_ONLY_FLAG_ARITIES = ["none", "number", "string", "char", "{}", "EOF"];
+export const READ_ONLY_FLAG_ARITIES = Object.freeze(["none", "number", "string", "char", "{}", "EOF"]);
 export const FLAG_VALUE_ACCEPTS = {
     none: () => false,
     number: (value) => /^\d+$/.test(value),
@@ -474,12 +474,12 @@ export const READ_ONLY_COMMAND_TABLE = {
         },
     },
 };
-export const READ_ONLY_BARE_PROGRAMS = ["docker ps", "docker images", "cal", "uptime", "cat", "head", "tail", "wc", "stat", "strings", "hexdump", "od", "nl", "id", "uname", "free", "df", "du", "locale", "groups", "nproc", "basename", "dirname", "realpath", "cut", "paste", "tr", "column", "tac", "rev", "fold", "expand", "unexpand", "fmt", "comm", "cmp", "numfmt", "readlink", "diff", "true", "false", "sleep", "which", "type", "expr", "seq", "tsort", "pr"];
-export const READ_ONLY_GLOB_PROGRAMS = ["ls", "cat", "head", "tail", "wc", "stat", "grep", "egrep", "fgrep", "diff", "du", "df", "echo", "strings", "hexdump", "od", "nl", "cut", "column", "tr", "tac", "rev", "cmp", "basename", "dirname", "realpath", "readlink", "sha256sum", "sha1sum", "md5sum", "cd"];
+export const READ_ONLY_BARE_PROGRAMS = Object.freeze(["docker ps", "docker images", "cal", "uptime", "cat", "head", "tail", "wc", "stat", "strings", "hexdump", "od", "nl", "id", "uname", "free", "df", "du", "locale", "groups", "nproc", "basename", "dirname", "realpath", "cut", "paste", "tr", "column", "tac", "rev", "fold", "expand", "unexpand", "fmt", "comm", "cmp", "numfmt", "readlink", "diff", "true", "false", "sleep", "which", "type", "expr", "seq", "tsort", "pr"]);
+export const READ_ONLY_GLOB_PROGRAMS = Object.freeze(["ls", "cat", "head", "tail", "wc", "stat", "grep", "egrep", "fgrep", "diff", "du", "df", "echo", "strings", "hexdump", "od", "nl", "cut", "column", "tr", "tac", "rev", "cmp", "basename", "dirname", "realpath", "readlink", "sha256sum", "sha1sum", "md5sum", "cd"]);
 export const READ_ONLY_EXACT_FORMS = [["claude", "-h"], ["claude", "--help"], ["node", "-v"], ["node", "--version"], ["python", "--version"], ["python3", "--version"], ["ip", "addr"]];
-export const READ_ONLY_BARE_ONLY = ["pwd", "whoami", "alias"];
-export const FIND_ACTION_PRIMARIES = ["-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint", "-fprint0", "-fls", "-fprintf", "-files0-from"];
-export const FIND_VALUE_PRIMARIES = ["-name", "-iname", "-path", "-ipath", "-lname", "-ilname", "-regex", "-iregex", "-wholename", "-iwholename", "-samefile", "-newer", "-anewer", "-cnewer", "-mnewer", "-perm", "-user", "-group", "-uid", "-gid", "-size", "-type", "-xtype", "-fstype", "-inum", "-links", "-used", "-context", "-amin", "-cmin", "-mmin", "-atime", "-ctime", "-mtime", "-mindepth", "-maxdepth", "-printf", "-regextype", "-D", "-f", "-flags", "-Bnewer", "-Btime", "-Bmin", "-files0-from", "-xattrname"];
+export const READ_ONLY_BARE_ONLY = Object.freeze(["pwd", "whoami", "alias"]);
+export const FIND_ACTION_PRIMARIES = Object.freeze(["-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint", "-fprint0", "-fls", "-fprintf", "-files0-from"]);
+export const FIND_VALUE_PRIMARIES = Object.freeze(["-name", "-iname", "-path", "-ipath", "-lname", "-ilname", "-regex", "-iregex", "-wholename", "-iwholename", "-samefile", "-newer", "-anewer", "-cnewer", "-mnewer", "-perm", "-user", "-group", "-uid", "-gid", "-size", "-type", "-xtype", "-fstype", "-inum", "-links", "-used", "-context", "-amin", "-cmin", "-mmin", "-atime", "-ctime", "-mtime", "-mindepth", "-maxdepth", "-printf", "-regextype", "-D", "-f", "-flags", "-Bnewer", "-Btime", "-Bmin", "-files0-from", "-xattrname"]);
 export const FIND_NEWER_PRIMARY = /^-newer[aBcm][aBcmt]$/;
-export const READ_ONLY_ENV_NAMES = ["GOEXPERIMENT", "GOOS", "GOARCH", "CGO_ENABLED", "GO111MODULE", "RUST_BACKTRACE", "RUST_LOG", "NODE_ENV", "PYTHONUNBUFFERED", "PYTHONDONTWRITEBYTECODE", "PYTEST_DISABLE_PLUGIN_AUTOLOAD", "PYTEST_DEBUG", "ANTHROPIC_API_KEY", "LANG", "LANGUAGE", "LC_ALL", "LC_CTYPE", "LC_TIME", "CHARSET", "TERM", "COLORTERM", "NO_COLOR", "FORCE_COLOR", "TZ", "LS_COLORS", "LSCOLORS", "GREP_COLOR", "GREP_COLORS", "GCC_COLORS", "TIME_STYLE", "BLOCK_SIZE", "BLOCKSIZE", "COLUMNS", "LINES", "CLICOLOR", "CLICOLOR_FORCE", "CI", "DEBIAN_FRONTEND", "GIT_TERMINAL_PROMPT"];
-export const XARGS_READ_ONLY_TARGETS = ["echo", "printf", "wc", "grep", "egrep", "fgrep", "head", "tail"];
+export const READ_ONLY_ENV_NAMES = Object.freeze(["GOEXPERIMENT", "GOOS", "GOARCH", "CGO_ENABLED", "GO111MODULE", "RUST_BACKTRACE", "RUST_LOG", "NODE_ENV", "PYTHONUNBUFFERED", "PYTHONDONTWRITEBYTECODE", "PYTEST_DISABLE_PLUGIN_AUTOLOAD", "PYTEST_DEBUG", "ANTHROPIC_API_KEY", "LANG", "LANGUAGE", "LC_ALL", "LC_CTYPE", "LC_TIME", "CHARSET", "TERM", "COLORTERM", "NO_COLOR", "FORCE_COLOR", "TZ", "LS_COLORS", "LSCOLORS", "GREP_COLOR", "GREP_COLORS", "GCC_COLORS", "TIME_STYLE", "BLOCK_SIZE", "BLOCKSIZE", "COLUMNS", "LINES", "CLICOLOR", "CLICOLOR_FORCE", "CI", "DEBIAN_FRONTEND", "GIT_TERMINAL_PROMPT"]);
+export const XARGS_READ_ONLY_TARGETS = Object.freeze(["echo", "printf", "wc", "grep", "egrep", "fgrep", "head", "tail"]);

package/dist/core/retention.js

@@ -1,5 +1,5 @@
-export const RETENTION_CASCADE_DOMAINS = ["checkpoints", "session-trees", "orphan-tool-results"];
-export const RETENTION_CASCADE_EXEMPT = ["session-pollution", "session-capture-optout", "lineage.json"];
+export const RETENTION_CASCADE_DOMAINS = Object.freeze(["checkpoints", "session-trees", "orphan-tool-results"]);
+export const RETENTION_CASCADE_EXEMPT = Object.freeze(["session-pollution", "session-capture-optout", "lineage.json"]);
 function codedError(code, message) {
     const e = new Error(message);
     e.code = code;

package/dist/core/runner/assemble-result.js

@@ -1,5 +1,5 @@
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
-import { extractErrorCode, isProviderEchoShape, stripErrorCodePrefix } from "../../brain/errors.js";
+import { extractErrorCode, isProviderEchoShape, refusedTheRequest, stripErrorCodePrefix } from "../../brain/errors.js";
 import { terminalProjection } from "./terminal-projection.js";
 import { haltConsumed } from "./halt-attribution.js";
 import { providerReportedModel } from "../message-utils.js";
@@ -124,12 +124,17 @@ export function terminalCauseOf(final, stats, flags) {
     else if (final.stopReason === "error") {
         let message = final.errorMessage ?? "model error";
         let code;
-        if (final.isApiErrorMessage === true) {
+        const apiError = readMember(final, "isApiErrorMessage") === true;
+        const apiStatus = readMember(final, "apiErrorStatus");
+        const apiRequestId = readMember(final, "requestId");
+        const apiCode = readMember(final, "apiErrorCode");
+        if (apiError) {
             apiFailure = {
-                ...(final.apiErrorStatus !== undefined ? { status: final.apiErrorStatus } : {}),
-                ...(typeof final.requestId === "string" && isProviderEchoShape(final.requestId) ? { requestId: final.requestId } : {}),
+                ...(apiStatus !== undefined ? { status: apiStatus } : {}),
+                ...(typeof apiRequestId === "string" && isProviderEchoShape(apiRequestId) ? { requestId: apiRequestId } : {}),
             };
         }
+        let providerNamed = true;
         const lifted = extractErrorCode(message);
         if (lifted) {
             code = lifted;
@@ -137,14 +142,19 @@ export function terminalCauseOf(final, stats, flags) {
         }
         else if (flags.gitCoreOverBudget) {
             code = "irreducible_core_over_budget";
+            providerNamed = false;
         }
         else if (flags.conflict) {
             code = "conflict";
+            providerNamed = false;
         }
         else {
             code = "provider.error";
         }
-        terminal = { kind: "failed", code, message };
+        const detail = apiError && providerNamed && typeof apiStatus === "number" && refusedTheRequest(apiStatus)
+            ? { kind: "provider_rejected", status: apiStatus, ...(typeof apiCode === "string" && isProviderEchoShape(apiCode) ? { code: apiCode } : {}) }
+            : undefined;
+        terminal = { kind: "failed", code, message, ...(detail !== undefined ? { detail } : {}) };
     }
     else {
         terminal = { kind: "completed" };

package/dist/core/runner/classifier-ladder.js

@@ -18,7 +18,7 @@ function sameRouteQuietly(a, b) {
         return false;
     }
 }
-export const CLASSIFIER_ROLE_DEFAULT_REASONS = ["tier_below_main", "tier_table", "role_fallback", "main_only", "role_unresolvable"];
+export const CLASSIFIER_ROLE_DEFAULT_REASONS = Object.freeze(["tier_below_main", "tier_table", "role_fallback", "main_only", "role_unresolvable"]);
 export function classifierSeatModel(args) {
     const { main } = args;
     const deps = normalizeSeatDeps(args.deps);

package/dist/core/runner/denial-limit-arms.d.ts

@@ -188,6 +188,8 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  * vouches for no name and the seat stays empty (absence = unknown); a block AT the bound reaches no seat at
  * all, since it becomes an ask and the disposition then names that resolution.
  */
+/** The provenance sentence an inherited card carries when the ancestor's ask brought no words of its own — the one spelling the request mint and the frame join share. */
+export declare const inheritedAskFallbackMessage: (toolName: string) => string;
 export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     autoMode: InheritedAutoMode | undefined;
     /** The leg's live permission mode (the gate's seat): under `dontAsk` / `bypassPermissions` / `plan` the decider is not

package/dist/core/runner/denial-limit-arms.js

@@ -1,3 +1,4 @@
+import { markTightenMessage } from "../safety-axis-vocab.js";
 import { classifierParseFailureDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
 import { classifierUnavailableArm } from "../classifier-unavailable-arm.js";
@@ -79,9 +80,12 @@ export function inheritedAskCarry(judged, liveApprover, tracker) {
         ...fallbackCarry(judged.fallback, liveApprover, tracker),
     };
 }
+export const inheritedAskFallbackMessage = (toolName) => `approval required for "${toolName}" (inherited parent policy)`;
 export async function judgeInheritedClassifier(opts) {
-    const { autoMode, ask, req } = opts;
-    const facts = opts.facts ?? INHERITED_STATION_FACTS;
+    const { autoMode, req } = opts;
+    const facts = opts.facts ?? INHERITED_STATION_FACTS, m = facts.mandateMarks;
+    const frames = m.shellGated === true ? [] : [...(m.egress === true ? [markTightenMessage(req.toolName, "egress")] : []), ...(m.irreversibility === "always" ? [markTightenMessage(req.toolName, "irreversible")] : [])];
+    const ask = (frames.length > 0 ? { ...opts.ask, message: [opts.ask.message ?? inheritedAskFallbackMessage(req.toolName), ...frames].join(" — ") } : opts.ask);
     const origin = askOriginOf(ask, facts);
     const classification = classifyAsk(ask, facts);
     const classifierStandsDown = () => {

package/dist/core/runner/inherited-ask-grants.d.ts

@@ -20,10 +20,8 @@ export declare function askGrantCovers(granted: readonly AskClass[], asked: read
 export declare function askGrantShapeOf(args: unknown): string | undefined;
 /**
  * Duplicate-frame collapse, the CONSUME half: an inherited layer already resolved THIS call as a clean allow at the
- * SAME approver function, on EXACTLY the byte-shape this caller-slot ask now presents, for a question that covers this
- * one — asking again is the 2-frame UX debt, not a second authority. Guards, all mismatches re-ask (⇒ `undefined`):
- *  · SOURCE: only a caller-slot POLICY ask may reuse — a safety tighten (`decisionReason:"safety"`), a hook-promoted
- *    ask ("hook") or a classifier ask carries a DIFFERENT authority and keeps its frame.
+ * SAME approver function, on EXACTLY the byte-shape this ask now presents, for a question that covers this one — asking
+ * again is the 2-frame UX debt, not a second authority. Guards, all mismatches re-ask (⇒ `undefined`):
  *  · IDENTITY: the approver FUNCTION reference (never a name), compared through `askApproverIdentity`: a delegated
  *    child's approver is the ancestor's own wrapped with provenance — a different function object, the same operator
  *    (the wrapper grants no authority of its own); identity answers only "same consultation".
@@ -31,7 +29,10 @@ export declare function askGrantShapeOf(args: unknown): string | undefined;
  *    `presentedInput` — the same binding as a main-gate approval (shown == executed, by construction).
  *  · CLASS: the gate's stamped `classes` is covered by the set the person answered ({@link askGrantCovers}); a class
  *    the gate's own judges add (a protected target, an out-of-root read) was not on the card. Not covered ⇒ the gate
- *    asks its own question and the grant stays (it answers what it answered; the call-site sweep ends it).
+ *    asks its own question and the grant stays (it answers what it answered; the call-site sweep ends it). The class
+ *    set is also the AUTHORITY test (a hook's ask carries `hook`, a fallback `denial_limit_fallback`, a marked tool
+ *    `operator_forced`, a protected write `write_protection`, an out-of-root read `probe`; the shell seat's classify-tier
+ *    hesitation is `ordinary`, the one question a yes on the same bytes answers) — the ask's `decisionReason` is not read.
  *  · LEDGER: the ONE real consultation (timed on the wrapper arm) is booked here — one frame happened, one is booked.
  * The grant lives within one gate evaluation (consumed on reuse, swept at the call site): a REOPENED checkpoint's
  * re-adjudication never sees a stale grant.

package/dist/core/runner/inherited-ask-grants.js

@@ -1,3 +1,4 @@
+import { askMandateMember } from "../ask-origin.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { askApproverIdentity, carryEngineAttestations } from "../tool-policy.js";
 export function askGrantCovers(granted, asked) {
@@ -12,13 +13,13 @@ export function askGrantShapeOf(args) {
     }
 }
 export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision, req) {
-    if (decision.decisionReason !== undefined && decision.decisionReason !== "rule")
-        return undefined;
     const grant = grants.get(req.toolCallId);
     if (grant === undefined || askApproverIdentity(grant.approver) !== askApproverIdentity(onAsk) || grant.argsJson !== askGrantShapeOf(req.args))
         return undefined;
     if (!askGrantCovers(grant.classes, decision.action === "ask" ? decision.classes : undefined))
         return undefined;
+    if (decision.action === "ask" && askMandateMember(decision).mandate === "operator_always")
+        return undefined;
     grants.delete(req.toolCallId);
     humanReviewRef.count += 1;
     humanReviewRef.totalWaitMs += grant.waitMs;