@sema-agent/core 7.37.1 → 7.38.1

package/dist/core/governance-codes.d.ts

@@ -1,3 +1,4 @@
+import type { AssertAllKeysHandled } from "./ask-origin.js";
 /** Retry class of a governance code: `transient` = a later retry can self-heal (control-plane
  *  absence/outage); `terminal` = policy adjudicated, re-issuing changes nothing. */
 export type GovernanceRetryClass = "transient" | "terminal";
@@ -118,28 +119,131 @@ export type RuleQuarantineReason = Exclude<RuleSyncDropReason, "own_actor_forged
  */
 export type NoticeAudience = "user" | "operator";
 /**
- * The CLOSED catalog of EngineNotice codes this engine mints — the enumeration half of the
- * presentation registry below, and the thing a consumer's own audience table can be diffed against
- * (that is the point of exporting it: a downstream table with a row missing, or a row for a code
- * this engine no longer mints, is a mechanically detectable disagreement rather than an argument).
+ * The CLOSED catalog of EngineNotice codes — every code this engine mints, plus the few a server mints through the
+ * same sink ({@link NOTICE_MINTER}) — the enumeration half of the presentation registry below, and the thing a
+ * consumer's own audience table can be diffed against (that is the point of exporting it: a downstream table with a
+ * row missing, or a row for a code no longer minted, is a mechanically detectable disagreement rather than an
+ * argument).
  *
- * Kept in LOCKSTEP with {@link NOTICE_AUDIENCE} by the compiler (`satisfies Record<EngineNoticeCode,
- * …>` below: a catalog entry with no audience row, or an audience row for a non-member, is a tsc
- * error — a mirrored enumeration that is only checked at runtime is a mirror that drifts). The
- * other half — "is the catalog itself still complete?" — cannot be a type: `EngineNotice.code` is
- * declared `string` (a host may forward its own), so the gate test (governance-codes.test.ts) scans
- * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
- * no longer minted.
+ * Kept in LOCKSTEP with {@link NOTICE_AUDIENCE} and {@link NOTICE_MINTER} by the compiler (`satisfies
+ * Record<EngineNoticeCode, …>` below: a catalog entry with no row, or a row for a non-member, is a tsc error — a
+ * mirrored enumeration that is only checked at runtime is a mirror that drifts). The other half — "is the catalog
+ * itself still complete?" — cannot be a type: `EngineNotice.code` is declared `string` (a host may forward its own),
+ * so the gate test (governance-codes.test.ts) scans src/ for notice mint shapes and names any code that is minted but
+ * unregistered, an engine-minted code that is no longer minted, or a server-minted code minted here.
  *
  * Each row's own story — what fires it, its `detail` shape, its dedup unit and its audience — lives at
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "resume.legacy_mode_seed_migrated", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
-/** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "resume.legacy_mode_seed_migrated", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
+/** A catalogued code (see {@link ENGINE_NOTICE_CODES}); {@link NOTICE_MINTER} says who mints it. NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */
 export type EngineNoticeCode = (typeof ENGINE_NOTICE_CODES)[number];
+/**
+ * The presentation-tier registry (the server's wire whitelist retires into this table once
+ * shipped): one row per {@link ENGINE_NOTICE_CODES} member. Presentation tier is a property of the
+ * CODE (closed set, one code one tier) — never of an individual emission, which is why this is a
+ * registry and not an EngineNotice field. Codes absent from the table (a host's own code forwarded
+ * through the same sink) read as `"operator"`: the conservative default, never push an unclassified
+ * code at an end user. Orthogonal to {@link NON_GOVERNANCE_MEMORY_CODES} (a retry-semantics table,
+ * not presentation).
+ *
+ * The judgment applied per row: WHO IS ENTITLED to the fact, not who could be shown it. A notice
+ * that a session can be attributed to is still an operator's fact when the person who would act on
+ * it runs the deployment — three rows below are exactly that case and say so.
+ */
+declare const NOTICE_AUDIENCE_TABLE: {
+    readonly "memory.session_polluted": "user";
+    readonly "memory.harvest_quarantined": "user";
+    readonly "memory.delegation_static_mark_waived": "user";
+    readonly "memory.hold_opened": "user";
+    readonly "memory.hold_released": "user";
+    readonly "memory.hold_disposed": "user";
+    readonly "task.user_steer_undrained": "user";
+    readonly "task.user_followup_undrained": "user";
+    readonly "classifier.denial_limit": "user";
+    readonly "classifier.unavailable": "user";
+    readonly "classifier.fallback": "operator";
+    readonly "classifier.role_defaulted": "operator";
+    readonly "classifier.contract_broken": "operator";
+    readonly "task.turn_interrupted": "user";
+    readonly "steering.parked_input_blocked": "user";
+    readonly "task.halt_unconsumed": "user";
+    readonly "task.late_approval": "user";
+    readonly "task.interrupt_unconsumed": "user";
+    readonly "task.tool_turn_incomplete": "user";
+    readonly "approval.read_root_granted": "user";
+    readonly "approval.read_root_grant_rejected": "user";
+    readonly "config.durable_gate_unavailable": "user";
+    readonly "config.permission_mode_unavailable": "user";
+    readonly "permission.ask_released_by_mode": "user";
+    readonly "permission.read_deny_unapplied": "user";
+    readonly "permission.rule_store_unavailable": "user";
+    readonly "memory.capture_opted_out": "user";
+    readonly "memory.capture_optout_unpersisted": "user";
+    readonly "memory.consolidation_withheld": "operator";
+    readonly "delegation.ask_unresolvable": "user";
+    readonly "config.autocompact_window_clamped": "operator";
+    readonly "resume.legacy_mode_seed_migrated": "operator";
+    readonly "config.env_timeout_discarded": "operator";
+    readonly "config.materialize_env_discarded": "operator";
+    readonly "config.models_swapped": "operator";
+    readonly "config.context_settings_swapped": "operator";
+    readonly "config.read_face_swapped": "operator";
+    readonly "config.read_face_deployment_clamped": "operator";
+    readonly "config.write_face_swapped": "operator";
+    readonly "config.write_face_deployment_clamped": "operator";
+    readonly "config.tool_model_gate_removed": "operator";
+    readonly "config.tool_model_gate_unknown_class": "operator";
+    readonly "config.tool_model_gate_env_invalid": "operator";
+    readonly "config.artifact_host_invalid": "operator";
+    readonly "config.task_root_not_canonical": "operator";
+    readonly "config.write_protection_target_view_absent": "operator";
+    readonly "config.write_protection_unresolved": "operator";
+    readonly "config.execution_env_capability_invalid": "operator";
+    readonly "config.tool_card_undeclared": "operator";
+    readonly "config.tool_face_undeclared": "operator";
+    readonly "config.tool_face_invalid": "operator";
+    readonly "config.peer_lane_unmounted": "operator";
+    readonly "config.peer_admission_out_of_range": "operator";
+    readonly "config.secret_env_scrubbed": "operator";
+    readonly "peer.inbound_disposition": "user";
+    readonly "peer.held_settled": "user";
+    readonly "peer.idle_subscription": "user";
+    readonly "delegation.transcript_integrity": "operator";
+    readonly "checkpoint.execution_outcome_unrecorded": "operator";
+    readonly "mcp.injection_dropped": "user";
+    readonly "mcp.revocation_probe_failed": "operator";
+    readonly "mcp.server_redialed": "operator";
+    readonly "workflow.governance_key_stripped": "operator";
+    readonly "workflow.agent_option_ignored": "operator";
+    readonly "memory.content_class_declared": "operator";
+    readonly "memory.consolidation_recommended": "operator";
+    readonly "memory.consolidation_committed": "operator";
+    readonly "memory.consolidation_conflict": "operator";
+    readonly "memory.consolidation_incomplete": "operator";
+    readonly "memory.consolidation_refused": "operator";
+    readonly "memory.restore_withheld": "operator";
+    readonly "memory.project_scope_absent": "operator";
+    readonly "route.fallback_to_primary": "operator";
+    readonly "route.classifier_unroutable": "operator";
+    readonly "route.base_url_changed_key_unchanged": "operator";
+    readonly "route.response_model_mismatch": "operator";
+    readonly "route.tool_call_id_folded": "operator";
+    readonly "context.tool_turn_repaired": "operator";
+    readonly "skills.listing_truncated": "operator";
+    readonly "agents.listing_truncated": "operator";
+    readonly "tool_result.offload_put_failed": "operator";
+    readonly "config.forward_sink_failed": "operator";
+    readonly "instructions.source_changed": "user";
+    readonly "session.records_skipped": "user";
+    readonly "server.model_unreachable": "user";
+    readonly "memory.layer_locked_legacy": "operator";
+};
+/** Compile-time fence: every catalogued code has an audience row (and, via `satisfies`, only those). */
+export type AudienceTableCoversEveryNoticeCode = AssertAllKeysHandled<Exclude<EngineNoticeCode, keyof typeof NOTICE_AUDIENCE_TABLE>>;
 /**
  * The presentation-tier registry — see {@link NOTICE_AUDIENCE_TABLE} for the per-row judgment.
  * The exported TYPE stays the open `Record<string, …>` on purpose: a consumer indexing it with a
@@ -149,3 +253,107 @@ export type EngineNoticeCode = (typeof ENGINE_NOTICE_CODES)[number];
 export declare const NOTICE_AUDIENCE: Readonly<Record<string, NoticeAudience>>;
 /** The audience for `code` — table lookup with the conservative `"operator"` default. */
 export declare function noticeAudienceOf(code: string): NoticeAudience;
+/**
+ * WHO MINTS a catalogued code: `"engine"` = this package (the catalog gate finds its mint site in src/); `"server"` = a
+ * server process that forwards its own notices through the same sink — registered here so its audience comes from
+ * {@link NOTICE_AUDIENCE} like every other row, and NEVER minted by this package (the catalog gate reds a mint site for
+ * one in src/). One code, one minter: a code two processes mint would be two facts under one spelling.
+ *
+ * Member-level exception, stated where a consumer reads the minter: `task.user_steer_undrained` is an engine row, and
+ * its `detail.cause: "crashed"` arm is minted by the server — the engine's process is gone when that loss is counted
+ * (see `USER_STEER_UNDRAINED_CAUSES`). The code keeps one row here and one spelling for both arms.
+ */
+export type NoticeMinter = "engine" | "server";
+declare const NOTICE_MINTER_TABLE: {
+    readonly "config.autocompact_window_clamped": "engine";
+    readonly "config.env_timeout_discarded": "engine";
+    readonly "config.materialize_env_discarded": "engine";
+    readonly "config.models_swapped": "engine";
+    readonly "config.context_settings_swapped": "engine";
+    readonly "config.read_face_swapped": "engine";
+    readonly "config.read_face_deployment_clamped": "engine";
+    readonly "config.write_face_swapped": "engine";
+    readonly "config.write_face_deployment_clamped": "engine";
+    readonly "config.tool_model_gate_removed": "engine";
+    readonly "config.tool_model_gate_unknown_class": "engine";
+    readonly "config.tool_model_gate_env_invalid": "engine";
+    readonly "config.artifact_host_invalid": "engine";
+    readonly "config.task_root_not_canonical": "engine";
+    readonly "config.write_protection_target_view_absent": "engine";
+    readonly "config.write_protection_unresolved": "engine";
+    readonly "config.execution_env_capability_invalid": "engine";
+    readonly "config.tool_card_undeclared": "engine";
+    readonly "config.tool_face_undeclared": "engine";
+    readonly "config.tool_face_invalid": "engine";
+    readonly "config.forward_sink_failed": "engine";
+    readonly "config.durable_gate_unavailable": "engine";
+    readonly "config.peer_admission_out_of_range": "engine";
+    readonly "config.peer_lane_unmounted": "engine";
+    readonly "config.secret_env_scrubbed": "engine";
+    readonly "config.permission_mode_unavailable": "engine";
+    readonly "permission.ask_released_by_mode": "engine";
+    readonly "permission.read_deny_unapplied": "engine";
+    readonly "permission.rule_store_unavailable": "engine";
+    readonly "resume.legacy_mode_seed_migrated": "engine";
+    readonly "peer.inbound_disposition": "engine";
+    readonly "peer.held_settled": "engine";
+    readonly "peer.idle_subscription": "engine";
+    readonly "classifier.denial_limit": "engine";
+    readonly "classifier.fallback": "engine";
+    readonly "classifier.role_defaulted": "engine";
+    readonly "classifier.contract_broken": "engine";
+    readonly "classifier.unavailable": "engine";
+    readonly "checkpoint.execution_outcome_unrecorded": "engine";
+    readonly "delegation.transcript_integrity": "engine";
+    readonly "delegation.ask_unresolvable": "engine";
+    readonly "mcp.injection_dropped": "engine";
+    readonly "mcp.revocation_probe_failed": "engine";
+    readonly "mcp.server_redialed": "engine";
+    readonly "workflow.governance_key_stripped": "engine";
+    readonly "workflow.agent_option_ignored": "engine";
+    readonly "memory.session_polluted": "engine";
+    readonly "memory.harvest_quarantined": "engine";
+    readonly "memory.delegation_static_mark_waived": "engine";
+    readonly "memory.content_class_declared": "engine";
+    readonly "memory.hold_opened": "engine";
+    readonly "memory.hold_released": "engine";
+    readonly "memory.hold_disposed": "engine";
+    readonly "memory.consolidation_recommended": "engine";
+    readonly "memory.consolidation_committed": "engine";
+    readonly "memory.consolidation_conflict": "engine";
+    readonly "memory.consolidation_incomplete": "engine";
+    readonly "memory.consolidation_refused": "engine";
+    readonly "memory.consolidation_withheld": "engine";
+    readonly "memory.restore_withheld": "engine";
+    readonly "memory.project_scope_absent": "engine";
+    readonly "route.fallback_to_primary": "engine";
+    readonly "route.classifier_unroutable": "engine";
+    readonly "route.base_url_changed_key_unchanged": "engine";
+    readonly "route.response_model_mismatch": "engine";
+    readonly "route.tool_call_id_folded": "engine";
+    readonly "context.tool_turn_repaired": "engine";
+    readonly "task.user_steer_undrained": "engine";
+    readonly "task.user_followup_undrained": "engine";
+    readonly "steering.parked_input_blocked": "engine";
+    readonly "task.turn_interrupted": "engine";
+    readonly "task.halt_unconsumed": "engine";
+    readonly "task.late_approval": "engine";
+    readonly "task.interrupt_unconsumed": "engine";
+    readonly "task.tool_turn_incomplete": "engine";
+    readonly "approval.read_root_granted": "engine";
+    readonly "approval.read_root_grant_rejected": "engine";
+    readonly "memory.capture_opted_out": "engine";
+    readonly "memory.capture_optout_unpersisted": "engine";
+    readonly "skills.listing_truncated": "engine";
+    readonly "agents.listing_truncated": "engine";
+    readonly "tool_result.offload_put_failed": "engine";
+    readonly "instructions.source_changed": "server";
+    readonly "session.records_skipped": "server";
+    readonly "memory.layer_locked_legacy": "server";
+    readonly "server.model_unreachable": "server";
+};
+/** Compile-time fence: every catalogued code has a minter row (and, via `satisfies`, only those). */
+export type MinterTableCoversEveryNoticeCode = AssertAllKeysHandled<Exclude<EngineNoticeCode, keyof typeof NOTICE_MINTER_TABLE>>;
+/** The minter registry — see {@link NoticeMinter}. Frozen: a caller writing a row would move the catalog gate's verdict. */
+export declare const NOTICE_MINTER: Readonly<Record<EngineNoticeCode, NoticeMinter>>;
+export {};

package/dist/core/governance-codes.js

@@ -14,6 +14,7 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.partition_adopt_failed",
     "memory.partition_split",
     "memory.layout_migrated",
+    "memory.layer_locked_legacy",
     "memory.layout_unowned_root_content",
     "memory.tail",
     "memory.pollution_mark_failed",
@@ -92,7 +93,7 @@ export function governanceRetryClass(code) {
         return "terminal";
     return undefined;
 }
-export const TOOL_DECLARATION_CODES = [
+export const TOOL_DECLARATION_CODES = Object.freeze([
     "config.tool_mount_denied",
     "config.tool_roster_bound",
     "config.tool_name_too_long",
@@ -102,7 +103,7 @@ export const TOOL_DECLARATION_CODES = [
     "config.tool_name_invalid",
     "config.egress_requires_write_effect",
     "config.reserved_tool_name",
-];
+]);
 export const RULE_SYNC_DROP_CODES = {
     invalid_rule_text: "inbound-refused-or-local-quarantined",
     metadata_mismatch: "inbound-refused-or-local-quarantined",
@@ -112,7 +113,7 @@ export const RULE_SYNC_DROP_CODES = {
     server_rejected: "local-quarantined",
     session_scope_not_durable: "inbound-refused",
 };
-export const ENGINE_NOTICE_CODES = [
+export const ENGINE_NOTICE_CODES = Object.freeze([
     "config.autocompact_window_clamped",
     "config.env_timeout_discarded",
     "config.materialize_env_discarded",
@@ -187,6 +188,7 @@ export const ENGINE_NOTICE_CODES = [
     "task.halt_unconsumed",
     "task.late_approval",
     "task.interrupt_unconsumed",
+    "task.tool_turn_incomplete",
     "approval.read_root_granted",
     "approval.read_root_grant_rejected",
     "memory.capture_opted_out",
@@ -194,7 +196,11 @@ export const ENGINE_NOTICE_CODES = [
     "skills.listing_truncated",
     "agents.listing_truncated",
     "tool_result.offload_put_failed",
-];
+    "instructions.source_changed",
+    "session.records_skipped",
+    "memory.layer_locked_legacy",
+    "server.model_unreachable",
+]);
 const NOTICE_AUDIENCE_TABLE = {
     "memory.session_polluted": "user",
     "memory.harvest_quarantined": "user",
@@ -214,6 +220,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "task.halt_unconsumed": "user",
     "task.late_approval": "user",
     "task.interrupt_unconsumed": "user",
+    "task.tool_turn_incomplete": "user",
     "approval.read_root_granted": "user",
     "approval.read_root_grant_rejected": "user",
     "config.durable_gate_unavailable": "user",
@@ -277,8 +284,101 @@ const NOTICE_AUDIENCE_TABLE = {
     "agents.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",
     "config.forward_sink_failed": "operator",
+    "instructions.source_changed": "user",
+    "session.records_skipped": "user",
+    "server.model_unreachable": "user",
+    "memory.layer_locked_legacy": "operator",
 };
 export const NOTICE_AUDIENCE = NOTICE_AUDIENCE_TABLE;
 export function noticeAudienceOf(code) {
     return NOTICE_AUDIENCE[code] ?? "operator";
 }
+const NOTICE_MINTER_TABLE = {
+    "config.autocompact_window_clamped": "engine",
+    "config.env_timeout_discarded": "engine",
+    "config.materialize_env_discarded": "engine",
+    "config.models_swapped": "engine",
+    "config.context_settings_swapped": "engine",
+    "config.read_face_swapped": "engine",
+    "config.read_face_deployment_clamped": "engine",
+    "config.write_face_swapped": "engine",
+    "config.write_face_deployment_clamped": "engine",
+    "config.tool_model_gate_removed": "engine",
+    "config.tool_model_gate_unknown_class": "engine",
+    "config.tool_model_gate_env_invalid": "engine",
+    "config.artifact_host_invalid": "engine",
+    "config.task_root_not_canonical": "engine",
+    "config.write_protection_target_view_absent": "engine",
+    "config.write_protection_unresolved": "engine",
+    "config.execution_env_capability_invalid": "engine",
+    "config.tool_card_undeclared": "engine",
+    "config.tool_face_undeclared": "engine",
+    "config.tool_face_invalid": "engine",
+    "config.forward_sink_failed": "engine",
+    "config.durable_gate_unavailable": "engine",
+    "config.peer_admission_out_of_range": "engine",
+    "config.peer_lane_unmounted": "engine",
+    "config.secret_env_scrubbed": "engine",
+    "config.permission_mode_unavailable": "engine",
+    "permission.ask_released_by_mode": "engine",
+    "permission.read_deny_unapplied": "engine",
+    "permission.rule_store_unavailable": "engine",
+    "resume.legacy_mode_seed_migrated": "engine",
+    "peer.inbound_disposition": "engine",
+    "peer.held_settled": "engine",
+    "peer.idle_subscription": "engine",
+    "classifier.denial_limit": "engine",
+    "classifier.fallback": "engine",
+    "classifier.role_defaulted": "engine",
+    "classifier.contract_broken": "engine",
+    "classifier.unavailable": "engine",
+    "checkpoint.execution_outcome_unrecorded": "engine",
+    "delegation.transcript_integrity": "engine",
+    "delegation.ask_unresolvable": "engine",
+    "mcp.injection_dropped": "engine",
+    "mcp.revocation_probe_failed": "engine",
+    "mcp.server_redialed": "engine",
+    "workflow.governance_key_stripped": "engine",
+    "workflow.agent_option_ignored": "engine",
+    "memory.session_polluted": "engine",
+    "memory.harvest_quarantined": "engine",
+    "memory.delegation_static_mark_waived": "engine",
+    "memory.content_class_declared": "engine",
+    "memory.hold_opened": "engine",
+    "memory.hold_released": "engine",
+    "memory.hold_disposed": "engine",
+    "memory.consolidation_recommended": "engine",
+    "memory.consolidation_committed": "engine",
+    "memory.consolidation_conflict": "engine",
+    "memory.consolidation_incomplete": "engine",
+    "memory.consolidation_refused": "engine",
+    "memory.consolidation_withheld": "engine",
+    "memory.restore_withheld": "engine",
+    "memory.project_scope_absent": "engine",
+    "route.fallback_to_primary": "engine",
+    "route.classifier_unroutable": "engine",
+    "route.base_url_changed_key_unchanged": "engine",
+    "route.response_model_mismatch": "engine",
+    "route.tool_call_id_folded": "engine",
+    "context.tool_turn_repaired": "engine",
+    "task.user_steer_undrained": "engine",
+    "task.user_followup_undrained": "engine",
+    "steering.parked_input_blocked": "engine",
+    "task.turn_interrupted": "engine",
+    "task.halt_unconsumed": "engine",
+    "task.late_approval": "engine",
+    "task.interrupt_unconsumed": "engine",
+    "task.tool_turn_incomplete": "engine",
+    "approval.read_root_granted": "engine",
+    "approval.read_root_grant_rejected": "engine",
+    "memory.capture_opted_out": "engine",
+    "memory.capture_optout_unpersisted": "engine",
+    "skills.listing_truncated": "engine",
+    "agents.listing_truncated": "engine",
+    "tool_result.offload_put_failed": "engine",
+    "instructions.source_changed": "server",
+    "session.records_skipped": "server",
+    "memory.layer_locked_legacy": "server",
+    "server.model_unreachable": "server",
+};
+export const NOTICE_MINTER = Object.freeze(NOTICE_MINTER_TABLE);

package/dist/core/hook-seats.js

@@ -1,4 +1,4 @@
-export const HOOK_FAMILIES = [
+export const HOOK_FAMILIES = Object.freeze([
     "preToolUse",
     "postToolUse",
     "userPromptSubmit",
@@ -9,7 +9,7 @@ export const HOOK_FAMILIES = [
     "postCompact",
     "stopFailure",
     "permissionDenied",
-];
+]);
 export const HOOKS_INVALID_CODE = "config.hooks_invalid";
 export function assertHookSeatsCallable(hooks, provenance) {
     if (hooks === undefined)

package/dist/core/hooks.d.ts

@@ -5,6 +5,7 @@ import type { GateOutcome } from "./gate-outcome.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
+import { type PermissionMode } from "./ask-origin.js";
 import type { AutoModeDenialTracker } from "./auto-mode.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
@@ -202,8 +203,9 @@ export interface Hooks {
      *  - a **PreToolUse hook deny** (CC-exact: "PreToolUse hook denies circumvention canUseTool and are not
      *    covered here").
      * DOES fire for a **PreToolUse hook CRASH** (RB-442, `source:"hook"`): a throwing hook is intercepted by
-     * the ENGINE, which then makes its OWN fail-closed deny decision. The R5 exclusion above covers the
-     * hook's own DENY DECISION — not an engine decision that merely happened near a hook.
+     * the ENGINE, which then makes its OWN fail-closed deny decision — likewise a hook result the decision
+     * receipt REFUSES (out of contract, undetachable). The R5 exclusion above covers the hook's own DENY
+     * DECISION — not an engine decision that merely happened near a hook.
      * Observe-only v1 (CC-exact payload `{toolName, input, toolCallId, reason}` + our `source` enum standing
      * in for CC `decision_reason_type`): no `retry` capability (recorded — retry semantics vs our adjudicate
      * chain need their own design), no additionalContext. A throwing callback is swallowed + traced via
@@ -411,6 +413,8 @@ export interface PermissionDeniedPayload {
      * settled none.
      */
     gate: GateOutcome;
+    /** {@link HookToolContext.permissionMode}, read when the deny is observed. */
+    permissionMode?: PermissionMode;
     /** {@link HookSeatSignal} — this invocation's own abort signal. On an OBSERVATION seat the deny has
      *  already happened and nothing this callback does can change it, so the signal says exactly one
      *  thing: stop reading, nobody is waiting for your answer any more. */
@@ -562,6 +566,8 @@ export interface StopHookContext {
         description?: string;
         status: string;
     }>;
+    /** {@link HookToolContext.permissionMode}. */
+    permissionMode?: PermissionMode;
     /** {@link HookSeatSignal} — this invocation's own abort signal. */
     signal?: AbortSignal;
 }
@@ -799,6 +805,15 @@ export interface HookToolContext {
      * machine's answer). Absence means "this engine cannot tell you", never "the root".
      */
     cwd?: string;
+    /** The leg's EFFECTIVE permission mode when the callback is invoked — the mode seat's `observed` read (it arms
+     *  no classifier on the leg or an ancestor, so it moves no decision); a steer, a plan-mode entry or exit and a
+     *  resumed leg's restored word show on the next callback. Stamped by the Runner on its own legs' contexts (this
+     *  one, {@link PermissionDeniedPayload}, {@link UserPromptSubmitContext}, {@link PostToolBatchContext},
+     *  {@link StopHookContext}); ABSENT ⇔ no leg seat: a host-driven {@link runToolGate} (its
+     *  `ToolGateInput.permissionMode` is the arbitration's reader, never called for this), the delegation-fold twin,
+     *  the `"resume_message"` screen (before the resumed leg exists). Not a version signal. The compaction seats and
+     *  {@link StopFailureContext} carry none (the reference's hook input omits it there). */
+    permissionMode?: PermissionMode;
     /** {@link HookSeatSignal} — this invocation's own abort signal. A FRESH one per screening pass, like
      *  the context object it rides: phase 1 and the approval-edit re-screen are two bounded waits, and a
      *  shared signal would let the first pass's expiry cancel the second. */
@@ -852,6 +867,8 @@ export interface PostToolUseResult {
 export interface UserPromptSubmitContext {
     /** The run/leg identity envelope — see {@link HookInvocationIdentity} for the presence law. */
     identity?: HookInvocationIdentity;
+    /** {@link HookToolContext.permissionMode} (absent on `"resume_message"`, screened before the leg exists). */
+    permissionMode?: PermissionMode;
     /** {@link HookSeatSignal} — this invocation's own abort signal. */
     signal?: AbortSignal;
     /**
@@ -905,6 +922,8 @@ export interface UserPromptSubmitContext {
 export interface PostToolBatchContext {
     /** The run/leg identity envelope — see {@link HookInvocationIdentity} for the presence law. */
     identity?: HookInvocationIdentity;
+    /** {@link HookToolContext.permissionMode}. */
+    permissionMode?: PermissionMode;
     /** {@link HookSeatSignal} — this invocation's own abort signal. */
     signal?: AbortSignal;
 }

package/dist/core/hooks.js

@@ -1,4 +1,4 @@
-import { decisionText, describeThrown, refuseOutOfContractDecision } from "./tool-policy.js";
+import { decisionText, describeThrown, refuseOutOfContractDecision, isEngineRefusal } from "./tool-policy.js";
 import { asThrownError } from "./thrown-value.js";
 import { createSettlementLedger, engineFailClosedExit, hookDenyExit } from "./runner/gate-exit.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
@@ -339,6 +339,9 @@ export async function runToolGate(input) {
             return await engineFailClosedExit(pass, reason);
         }
         if (r) {
+            if (isEngineRefusal(r)) {
+                return await engineFailClosedExit(pass, String(r.message ?? `the PreToolUse hook's result for "${toolName}" was refused by the engine`));
+            }
             if (r.additionalContext) {
                 pass.preToolContext.push(r.additionalContext);
             }

package/dist/core/mailbox-store.js

@@ -1,7 +1,7 @@
 import { assertRetentionPolicy } from "./retention-policy.js";
-export const MAILBOX_PEER_FROM_MODES = ["bypass", "prompting"];
-export const MAILBOX_PEER_RECORD_KINDS = ["peer_message", "idle_notice", "delivery_notice", "idle_subscription", "engine_frame"];
-export const MAILBOX_PEER_NOTICE_STATES = ["held", "denied", "expired", "delivered", "refused", "dropped", "idle", "exited", "unavailable"];
+export const MAILBOX_PEER_FROM_MODES = Object.freeze(["bypass", "prompting"]);
+export const MAILBOX_PEER_RECORD_KINDS = Object.freeze(["peer_message", "idle_notice", "delivery_notice", "idle_subscription", "engine_frame"]);
+export const MAILBOX_PEER_NOTICE_STATES = Object.freeze(["held", "denied", "expired", "delivered", "refused", "dropped", "idle", "exited", "unavailable"]);
 export const MAILBOX_INVALID_PEER_META_CODE = "mailbox.invalid_peer_meta";
 export const MAILBOX_CROSS_PROCESS_UNSAFE_CODE = "mailbox.cross_process_unsafe";
 const PEER_META_STRING_KEYS = ["fromSession", "fromRoot", "senderKey", "fromScope", "gateReceiptId"];

package/dist/core/mcp-failure.js

@@ -1,6 +1,6 @@
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-export const MCP_FAILURE_KINDS = [
+export const MCP_FAILURE_KINDS = Object.freeze([
     "connect_refused",
     "connection_failed",
     "connection_closed",
@@ -11,8 +11,8 @@ export const MCP_FAILURE_KINDS = [
     "protocol",
     "invalid_config",
     "unknown",
-];
-export const MCP_DELIVERY_VERDICTS = ["yes", "no", "unknown"];
+]);
+export const MCP_DELIVERY_VERDICTS = Object.freeze(["yes", "no", "unknown"]);
 export const DELIVERED_BY_KIND = {
     connect_refused: "no",
     connection_failed: "unknown",
@@ -25,7 +25,7 @@ export const DELIVERED_BY_KIND = {
     invalid_config: "no",
     unknown: "unknown",
 };
-export const MCP_LIVENESS_STATES = ["reachable", "unreachable", "unknown"];
+export const MCP_LIVENESS_STATES = Object.freeze(["reachable", "unreachable", "unknown"]);
 export const LIVENESS_BY_FAILURE_KIND = {
     connect_refused: "unreachable",
     connection_failed: "unreachable",

package/dist/core/mcp-injection-drop.js

@@ -1,4 +1,4 @@
-export const MCP_INJECTION_DROP_REASONS = ["malformed_entry", "name_reserved_by_deployment", "gate_closed", "over_cap"];
+export const MCP_INJECTION_DROP_REASONS = Object.freeze(["malformed_entry", "name_reserved_by_deployment", "gate_closed", "over_cap"]);
 export const MCP_INJECTION_DROP_TEXT = {
     malformed_entry: "its declaration could not be read — fix the entry and start a new session",
     name_reserved_by_deployment: "the deployment mounts a server of that name and its own wins — rename the entry",

package/dist/core/memory-engine/consolidation.js

@@ -373,4 +373,4 @@ export class ConsolidationRefusedError extends Error {
 export function productAddPatch(product) {
     return { op: "add", id: product.id, entry: product, guard: "absent" };
 }
-export const CONSOLIDATION_RUN_STOP_REASONS = ["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed", "mint_invalidated", "purity_violation"];
+export const CONSOLIDATION_RUN_STOP_REASONS = Object.freeze(["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed", "mint_invalidated", "purity_violation"]);

package/dist/core/memory-engine/delegation-settlement.d.ts

@@ -202,6 +202,14 @@ export declare function openLayerWriters(controlDir: string, selfLeg: string | u
 };
 /** The leg that holds `sessionId`'s account row (undefined ⇔ no row, or a row without one). */
 export declare function sessionAccountLeg(controlDir: string, sessionId: string): string | undefined;
+/** The write scope `sessionId`'s account row records — the scope its newest account-opening mount wrote
+ *  under (the value that mount's handle carries as `writeScope`), whether that leg is still live or has
+ *  ended. Undefined ⇔ no row, a row written before the field, or a v1 ledger (whose rows predate it —
+ *  answered without the conversion, so this read writes nothing). Throws on a corrupt ledger. */
+export declare function sessionAccountWriteHome(controlDir: string, sessionId: string): {
+    writeScope: string;
+    openedAt: number;
+} | undefined;
 /** The membership question the harvest asks per file: is `(scope, rel)` in the session's sticky
  *  set? A session carrying members the conversion could not attribute answers yes for every seat. */
 export interface SessionUnattributedSet {

package/dist/core/memory-engine/delegation-settlement.js

@@ -331,6 +331,13 @@ export function openLayerWriters(controlDir, selfLeg) {
 export function sessionAccountLeg(controlDir, sessionId) {
     return readSessionAccountsConverted(controlDir).rows.find((r) => r.sessionId === sessionId)?.leg;
 }
+export function sessionAccountWriteHome(controlDir, sessionId) {
+    const read = coerceSessionAccounts(readStrictSidecar(controlDir, SESSION_ACCOUNTS_FILE, "memory session-account ledger"));
+    if (read.version !== 2)
+        return undefined;
+    const row = read.rows.find((r) => r.sessionId === sessionId);
+    return row?.writeScope === undefined ? undefined : { writeScope: row.writeScope, openedAt: row.openedAt };
+}
 export function emptyUnattributedSet() {
     return { has: () => false, empty: true };
 }