@sema-agent/core 7.38.2 → 7.39.0

package/dist/core/task-event.d.ts

@@ -703,7 +703,7 @@ export type TaskEvent = ({
      * is unchanged. `preview` is the injected text clipped to a display bound.
      *
      * design/133 (LOW-11/F11): the turn-boundary attachment producers ride the same echo — sources
-     * `todo_reminder` / `task_reminder` / `changed_files` / `plan_mode` and the G1/续批 members
+     * `todo_reminder` / `task_reminder` / `changed_files` and the G1/续批 members
      * `background_tasks` / `tools_delta` / `agent_listing` / `skills_listing` / `mcp_instructions`
      * (one event per attachment; a multi-attachment boundary still coalesces into ONE steer message
      * on the model lane). [c209-C]: the listing family's FIRST-FRAME deliveries (initial roster /
@@ -714,9 +714,14 @@ export type TaskEvent = ({
      * (first-frame / resume-continuation / compaction re-assert deliveries alike). Its `preview`
      * is a CONSTANT wording on purpose (never frame bytes): branch names and status text are
      * repo-controlled and must not enter the event telemetry plane through this echo.
+     *
+     * `output_style` (additive member): the frame stating the deployment-declared `TaskSpec.outputStyle`, echoed
+     * at every delivery (a leg's first turn, a resumed leg's continuation, each continuing boundary).
+     * The permission-posture frames (planning / bypass / auto, and their exits) are model-lane only and have no
+     * echo; the retired `plan_mode` member was the echo of the opt-in planning reminder they replaced.
      */
     type: "steering_injected";
-    source: "limit_approach" | "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "plan_mode" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "total_tokens_reminder" | "background_tasks" | "tools_delta" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools" | "final_verification" | "git_status";
+    source: "limit_approach" | "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "output_style" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "total_tokens_reminder" | "background_tasks" | "tools_delta" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools" | "final_verification" | "git_status";
     preview: string;
 } & TaskEventIdentity) | ({
     /**

package/dist/core/task-spec.d.ts

@@ -252,6 +252,28 @@ export interface TaskSpec {
      * so it never breaks prefix-cache friendliness. Composes WITH `systemPrompt` (appended after it).
      */
     appendSystemPrompt?: string;
+    /**
+     * The OUTPUT STYLE the deployment's shell has active, declared so the engine can state it to the model in its
+     * own marked reminder: `"<name> output style is active. <turnReminder>"` (the reference implementation's
+     * per-turn reminder sentence; absent `turnReminder` ⇒ its default "Remember to follow the specific guidelines
+     * for this style."). The style's guidelines themselves are not carried here — they go in `systemPrompt` /
+     * `appendSystemPrompt`; this seat is the per-turn statement that the style is in force, which a reminder the
+     * shell splices into the objective cannot be (unmarked reminder-shaped text is data). Declare it only for a
+     * non-default style; there is no client-trusted reminder seat behind it — the engine renders the sentence.
+     *
+     * Cadence: the first turn of every leg (a resumed leg's continuation included) and every continuing turn
+     * boundary — the reference attaches it at every attachment cycle, with no window. Echoed as
+     * `steering_injected` with source `output_style`.
+     *
+     * Refused at prepare (`config.output_style_invalid`), never ignored: a value that is not an object of exactly
+     * these two members; a `name` that is not a string, is empty, or is longer than 256 characters
+     * (`OUTPUT_STYLE_NAME_MAX`, the reference implementation's own bound — it drops the reminder past it); a
+     * `turnReminder` that is present but not a non-empty string.
+     */
+    outputStyle?: {
+        name: string;
+        turnReminder?: string;
+    };
     /**
      * Per-task ROLE-LAYER prompt provider (overrides `RunnerDeps.promptProvider`). Lets one Runner serve
      * different scenarios with different role prompts. 提示词主权批: `stableSystem` supplies the role base
@@ -889,7 +911,7 @@ export interface TaskSpec {
     enableFork?: boolean;
     /**
      * The OPERATOR's shell floor: `"always"` ⇒ every `bash` / `Monitor` command is a confirmed ask (an
-     * `operator_forced` ask — kept under `bypassPermissions`, not settled by `dontAsk`; a standing allow rule never
+     * `operator_forced` ask — kept under `bypassPermissions`, refused by `dontAsk` like every ask; a standing allow rule never
      * clears it). Absent ⇒ no floor: the shape tier the engine installs on every full shell (a provably read-only
      * single command runs, everything else asks) is arbitrated by the task's {@link permissionMode}. The retired
      * values `"off"` / `"classify"` are refused at the door (`config.shell_gate_value_retired`): the tier is no longer a
@@ -912,7 +934,7 @@ export interface TaskSpec {
      * `bypassPermissions` releases every ask but the immune classes (an explicit ask rule, a hook's ask, the
      * question tool, an unverifiable recursive delete, an org rule, an operator's forced confirmation, unreadable
      * governance, the classifier's denial-limit fallback) and discloses each release; `dontAsk` refuses every ask
-     * but a hook's or an operator authority's; `auto` arms the classifier (`RunnerDeps.autoMode` present and
+     * but a hook's own (no rule or safety check also asked); `auto` arms the classifier (`RunnerDeps.autoMode` present and
      * `RuntimeCaps.autoMode` not `false`, else folded to `default` and announced); `plan` reads only and mounts the
      * plan pair; `acceptEdits` writes inside the root without asking; `default` asks. The mode also installs its own
      * seats ({@link import("./mode-policy.js").modePolicyOf}).
@@ -1240,9 +1262,6 @@ export interface TaskSpec {
      *    whose mtime moved past the recorded read time (+2s epsilon) is listed (path-only v1, "do not
      *    blindly revert — re-read"). OFF ⇒ zero stat calls. Self-edits are immune (write-back
      *    refreshes the read stamp); mtime skew on exotic fs remains a documented false-positive source.
-     *  - `planModeReminder`: while `enter_plan_mode` is active, re-surface the read-only constraint
-     *    every 5 assistant turns (full copy every 5th, sparse between) so a long plan phase doesn't
-     *    drift into write-deny thrash. Exiting plan mode stops it.
      *  - `backgroundTasks` (G1 通告层 — CC /compact parity): after a compaction LANDS, the
      *    next boundary announces this run's still pending/running background tasks (task registry
      *    snapshot: id/description/status, CC three-state copy). ONE-SHOT per compaction — never
@@ -1274,8 +1293,12 @@ export interface TaskSpec {
      *    the add lane for a future dynamic-connect face. Added instruction text is UNTRUSTED server
      *    text → fenced with `delimitUntrusted` (deliberate CC deviation: CC injects it raw).
      *
+     * The read-only planning posture is not a member: the engine states it whenever the leg's mode is `plan`
+     * (with its restatement cadence and its exit frame), as it states the bypass and auto postures. A spec still
+     * carrying the retired `planModeReminder` key is refused at prepare (`config.spec_retired_key`).
+     *
      * Telemetry: `steering_injected` (source `todo_reminder`/`task_reminder`/`changed_files`/
-     * `plan_mode`/`background_tasks`/`tools_delta`/`agent_listing`/`skills_listing`/
+     * `output_style`/`background_tasks`/`tools_delta`/`agent_listing`/`skills_listing`/
      * `mcp_instructions`) + `stats.mechanisms.attachmentsInjected` (first-frame listing deliveries
      * emit the same echo frames and count too — source-accurate observability for the shell).
      */
@@ -1308,7 +1331,6 @@ export interface TaskSpec {
         changedFiles?: true | {
             maxFiles?: number;
         };
-        planModeReminder?: true;
         /**
          * SR-3 (CC 198 `budget_usd` lane, producer QFm pretty.js:480424-480428 + renderer :600225): the
          * progressive $-budget readout `USD budget: $used/$total; $remaining remaining` (CC-verbatim

package/dist/core/terminal-cause.d.ts

@@ -20,7 +20,9 @@ import type { AssertAllKeysHandled } from "./ask-origin.js";
  * the one cause→plane derivation, for the faces that still speak the word.
  *  - `completed` — the run finished (a person's clean halt included — see `TaskResult.haltedByUser`).
  *  - `failed` — a limit, a provider failure, an abort, an invalid output…
- *  - `blocked` — the AGENT reported, through `report_blocked`, that it cannot finish, and why. A TERMINAL
+ *  - `blocked` — the run ended without doing the work, and `detail` says by whom: ABSENT = the AGENT reported,
+ *    through `ReportBlocked`, that it cannot finish, and why; `detail.kind === "prompt_blocked_by_hook"` = a
+ *    `userPromptSubmit` hook kept the prompt from being submitted (see {@link TerminalBlockedDetail}). A TERMINAL
  *    cause: the leg is over and it waits for nobody (nothing to resume, no token). The waiting-on-a-person
  *    states are the `paused` cause's two status words — `suspended` (a pre-action approval of a tool
  *    call) and `needs_review` (a review pause); the task-registry face spells both as `parked`.
@@ -87,9 +89,23 @@ export type TerminalCause = {
     nestedPause?: PausedCause;
 } | {
     kind: "blocked";
-    /** Why the agent could not finish — the agent's own words from its `report_blocked` call. Terminal: the
-     *  run is over and nobody is being waited on (contrast `paused`, whose token is the resume capability). */
+    /**
+     * Why the run ended without doing the work — one of two sources, told apart by {@link detail}. With no
+     * `detail`: the agent's own words from its `ReportBlocked` call. With `detail.kind ===
+     * "prompt_blocked_by_hook"`: the engine's sentence about the deployment's `userPromptSubmit` hook, framed
+     * as a reminder for the model-facing lane (the hook's own words, when it gave some, sit inside the
+     * frame). Terminal: the run is over and nobody is being waited on (contrast `paused`, whose token is the
+     * resume capability).
+     */
     reason: string;
+    /**
+     * WHO stopped the run, for the one shape a consumer offers its own way out of: `prompt_blocked_by_hook` —
+     * the prompt was NOT submitted (the objective never became a message and the loop never started), so
+     * changing it and sending again is meaningful; `cause` says which of the hook's four endings it was.
+     * PRESENCE: only on that terminal. ABSENT means the agent reported `ReportBlocked` ("I cannot go on"), or an
+     * engine from before this key — branch on `detail?.kind`, never on the prose in `reason`.
+     */
+    detail?: TerminalBlockedDetail;
 } | {
     kind: "paused";
     /**
@@ -136,6 +152,31 @@ export interface TerminalFailureDetail {
     /** The provider's own word for the refusal (its error envelope's `error.code`, else `error.type`), when stated. */
     code?: string;
 }
+/**
+ * The endings of a `userPromptSubmit` hook that keep a prompt from being submitted — the closed set of
+ * {@link TerminalBlockedDetail.cause} words:
+ * - `"block"` — the hook answered and refused the prompt (its words ride `hookReason`).
+ * - `"crashed"` — the hook threw or rejected; the seat is fail-closed, a screen that failed has not cleared the prompt.
+ * - `"timeout"` — the hook did not answer within its `timeoutMs` bound; fail-closed the same way.
+ * - `"cancelled"` — the task was cancelled while the hook was still screening.
+ */
+export declare const PROMPT_BLOCK_CAUSES: readonly ["block", "crashed", "timeout", "cancelled"];
+export type PromptBlockCause = (typeof PROMPT_BLOCK_CAUSES)[number];
+/** Membership test for {@link PromptBlockCause}. */
+export declare function isPromptBlockCause(v: unknown): v is PromptBlockCause;
+/** The machine-readable account a `blocked` cause may carry ({@link TerminalCause}). `kind` is closed; one member. */
+export interface TerminalBlockedDetail {
+    kind: "prompt_blocked_by_hook";
+    /** Which of the hook seat's endings kept the prompt back ({@link PROMPT_BLOCK_CAUSES}). */
+    cause: PromptBlockCause;
+    /**
+     * The hook's own words for refusing the prompt, folded to one line, bounded, with the engine's envelope tags
+     * defused — still the hook's text, so a consumer renders it as untrusted. PRESENT only on cause `"block"` and
+     * only when the hook gave words; never carries the engine's reminder frame or its session mark (the framed
+     * sentence is `reason`).
+     */
+    hookReason?: string;
+}
 /** The paused arm alone — the shape the run's committed-pause holder carries. */
 /**
  * The one disposition table over `TerminalCause["kind"]`: which causes a resume journal may REPLAY

package/dist/core/terminal-cause.js

@@ -1,3 +1,8 @@
+export const PROMPT_BLOCK_CAUSES = Object.freeze(["block", "crashed", "timeout", "cancelled"]);
+const PROMPT_BLOCK_CAUSE_SET = new Set(PROMPT_BLOCK_CAUSES);
+export function isPromptBlockCause(v) {
+    return PROMPT_BLOCK_CAUSE_SET.has(v);
+}
 export const TERMINAL_CAUSE_IS_REPLAYABLE = {
     completed: true,
     failed: false,

package/dist/core/tool-policy.d.ts

@@ -1,6 +1,7 @@
 import { type AskOrigin, type AssertAllKeysHandled } from "./ask-origin.js";
 import { type ReadRootGrantScreen } from "./read-root-grant-screen.js";
 import { type Settlement } from "./gate-outcome.js";
+export { policyCannotAnswer, rowDemandsAPerson } from "./real-approval.js";
 import { type DecisionReason } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
 /** A tool call presented to a policy before it executes. */
@@ -160,8 +161,8 @@ export declare function advertisedWritableRootsSeat(seat: {
 export type { DecisionReason };
 /** Carry every engine attestation from a decision onto a reconstruction of it — the
  *  seam for the engine's OWN clone sites outside this module (the inherited chain's final-form re-check carries the
- *  post-rewrite args on a spread of an ancestor's deny). Not re-exported from `src/index.ts`. */
-export declare function carryEngineAttestations(from: object, to: object): void;
+ *  post-rewrite args on a spread of an ancestor's deny). Returns the reconstruction. Not re-exported from `src/index.ts`. */
+export declare function carryEngineAttestations<T extends object>(from: object, to: T): T;
 /** Carry a PRECEDING decision's settlement onto a later deny that has none of its own — the veto record (a person's
  *  yes on the settlement, the refusing layer on the disposition; invariant I3) for the engine's own clone sites,
  *  where the deny is minted over a decision that already carried an attested approval. A deny that carries its own
@@ -255,7 +256,9 @@ export declare function screenApproverAttribution(v: unknown): {
  *    configuration is "no approver looked at this at all", indistinguishable from headless, for a rule
  *    whose whole point is that a blanket policy setting must not be the thing that clears it (see
  *    {@link resolveAsk}). A live auto-mode classifier verdict (tried earlier in the gate, if configured)
- *    or a genuine approver CALLBACK (actual judgment, even if it always says yes) still can.
+ *    or a genuine approver CALLBACK (actual judgment, even if it always says yes) still can — unless the
+ *    callback itself reports its allow as the deployment's POLICY (`settledBy: "policy"`): that is the same
+ *    "nobody judged this" a blanket seat is, and it is refused the same way.
  *  - `deny` blocks the call.
  * Human-readable text is `message`; read it via {@link decisionText}.
  *
@@ -402,14 +405,15 @@ export type PermissionResult = {
     ruleUnreadable?: "content_deny" | "content_ask" | "persisted_call";
     /** The ask was authored by the DEPLOYMENT's own governance (an operator's must-ask list, a managed command
      *  policy's default ask) — a fact a host's policy states on its own ask so the class derivation reads it
-     *  as `operator_forced`: a permission mode releases nothing an operator mandated, and `dontAsk` does not
-     *  settle it. Public: a host composing such a policy sets it; {@link combinePolicies} carries it onto the
+     *  as `operator_forced`: a permission mode releases nothing an operator mandated (`dontAsk` refuses it like
+     *  every ask). Public: a host composing such a policy sets it; {@link combinePolicies} carries it onto the
      *  surviving ask (tighten-only). Not on the approval request — the card shows `origin` / `mandate`. */
     authoredBy?: "deployment";
     /** The classes of the OTHER asks a policy fold collapsed into this one
      *  ({@link import("./ask-origin.js").decisionAskClassesOf} per contributing ask, unioned), so a member the
      *  fold does not copy — a guard mark, an unreadable-rule fact, a bare real-approval bit — is not lost behind
-     *  the ask that won the slot. ENGINE-WRITTEN by {@link combinePolicies}; fold-internal, never on the request. */
+     *  the ask that won the slot. ENGINE-WRITTEN by {@link combinePolicies}, which attests the object it returns; the receipt
+     *  refuses the member on any other object (a policy's own, a copy, an edited list). Fold-internal, never on the request. */
     foldedAskClasses?: readonly import("./ask-origin.js").AskClass[];
 } | {
     action: "deny";
@@ -757,7 +761,7 @@ export declare const DECISION_MEMBERS: readonly DecisionMember[];
  * consumers with two values, and which consumer read which value would decide the call. So the caller's object is read
  * ONCE, here, and every station after the receipt (the fold's ranking, the origin stamp, the classifier's eligibility, the
  * mode arbitration, the approval request, the rewrite that executes) reads the copy; a copy handed to the screen again
- * comes back as it is, unread. In order: (1) the CARRIER's type — a decision that is not an object (a string, a function
+ * comes back as it is, unread (so does the engine's own refusal, {@link isEngineRefusal}). In order: (1) the CARRIER's type — a decision that is not an object (a string, a function
  * holding the members) has no `action`; (2) the ONE READ — ONE function ({@link receiveContract}) for the decision and for the
  * records it nests (`receiveNestedRecords`, decision-receipt.ts), on an ORDINARY object (a Proxy, as the carrier or anywhere on its prototype
  * chain, is refused before a trap of its could run): each contract member absent or an own enumerable DATA property, its value
@@ -793,6 +797,20 @@ export declare const DECISION_MEMBERS: readonly DecisionMember[];
 export declare function refuseOutOfContractDecision(d: PermissionResult, opts?: {
     reasonIsNonInput?: boolean;
 }): PermissionResult;
+/**
+ * The PreToolUse hook seat's receipt under its public name — what a host that composes several hooks into the one the
+ * engine takes runs on EACH slot's result before folding it, so it reads the result the way the engine will. It is
+ * {@link refuseOutOfContractDecision} at the hook seam (`reasonIsNonInput`), the same function the engine's seat calls (hooks.ts
+ * `screenPreToolUseResult`): no second statement of the contract.
+ *
+ * What comes back, for an object: the engine's own refusal (a `deny` for which {@link isEngineRefusal} is true — return it as the
+ * composed hook's answer and the engine takes it as its own fail-closed deny), or the engine's frozen, detached copy of the
+ * result (fold the copy, never the original). `undefined`, `null` and `false` are no opinion and come back as themselves. The
+ * caller's object is not changed and none of its code runs; an answer handed back to this function returns as itself.
+ */
+export declare function receiveHookResult(result: unknown): (PermissionResult & {
+    additionalContext?: string;
+}) | null | undefined | false;
 /** The raw tool-name lists a name-keyed policy was built from (audit feed, see block note above). */
 export interface ToolPolicyNameSets {
     readonly allow?: readonly string[];
@@ -861,9 +879,10 @@ export type ApprovalSeatOutcome = boolean | (Extract<AskOutcome, {
  * WHAT `approve` MAY RETURN: a boolean, as always, or the `{allow, …}` OUTCOME OBJECT the `onAsk` seat
  * takes, read by the SAME screen ({@link readApproverOutcomeObject}) and narrowed to what this seat has
  * a lane for ({@link ApprovalSeatOutcome}) — so a deployment here can report WHO ended the wait
- * (`settledBy:"policy"` / `"timeout"`), attach the decider's `reason` and name the `approver`. A bare
- * `false` is unchanged: a person's refusal, with this factory's own terse sentence. Before this it was
- * the only refusal spelling there was, so a machine's decision filed a PERSON's record.
+ * (`settledBy:"policy"` for its own policy's yes or no, `"timeout"` for its own elapsed window), attach the
+ * decider's `reason` and name the `approver`. A bare `true` / `false` is unchanged: a person's approval or
+ * refusal, the refusal with this factory's own terse sentence. Before the object arm a bare boolean was the
+ * only spelling there was, so a machine's decision filed a PERSON's record.
  */
 export declare function createApprovalPolicy(opts: {
     /** Tools that need an approval decision. */
@@ -1302,9 +1321,10 @@ export interface AskRequest {
      *    drives which deny text the model is told (stop-and-wait vs adapt-or-report), forks included. */
     readonly isDelegatedChild?: true;
     /** Carried from the originating {@link PermissionResult}'s ask
-     *  variant of the same name: `true` ⇒ {@link resolveAsk} must not let a blanket `onAsk: "allow"`
-     *  clear this ask (see that field's doc). `readonly`, filled by the gate from the decision, never a
-     *  caller/worker-settable field. */
+     *  variant of the same name: `true` ⇒ {@link resolveAsk} must not let an allow NO PERSON JUDGED clear
+     *  this ask — a blanket `onAsk: "allow"`, or an approver's allow it reports as the deployment's policy
+     *  (`settledBy: "policy"`) (see that field's doc). `readonly`, filled by the gate from the decision, never
+     *  a caller/worker-settable field. */
     readonly requiresRealApproval?: boolean;
     /**
      * PRESENCE ONLY, and a FACT ABOUT THIS ASK: no persisted allow rule and no STANDING ANSWER — a release
@@ -1499,15 +1519,19 @@ export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal)
  * refusing. The three words the host may self-report:
  *  - `"human"` — a person answered (identical to omitting the field);
  *  - `"timeout"` — the host's own approval window elapsed with no answer;
- *  - `"policy"` — the deployment's OWN policy answered: a machine refused, not a person (a headless lane
- *    whose approver seat exists but can show nobody a prompt). Spelled `false`, such a deny told the model
- *    the USER did not want to proceed and to wait for their direction — a sentence about a person, in a run
- *    where none is coming; with the word it reads {@link policyRefusalMessage} instead, and the note travels
- *    as the policy's words. OMITTING the field still reads as `"human"`, so an unrevised host is unchanged.
- * The two non-human words are legal ONLY with `allow: false` — neither an elapsed window nor a refusing
- * policy can be what APPROVED an action, and neither has an allow-side settlement to become — so
- * `{allow: true, settledBy: "timeout" | "policy"}` is refused fail-closed (the same narrowing the
- * `PermissionResult` allow arm already spells in its type).
+ *  - `"policy"` — the deployment's OWN policy answered, either way: a machine decided, not a person (an
+ *    unattended lane answering by class, a headless lane whose approver seat exists but can show nobody a
+ *    prompt). Its allow settles `policy_allowed`, its refusal `policy_refused`. Spelled `true` / `false`, such
+ *    an answer filed a PERSON's record, and its refusal told the model the USER did not want to proceed and to
+ *    wait for their direction — a sentence about a person, in a run where none is coming; with the word the
+ *    refusal reads {@link policyRefusalMessage} instead, and the note travels as the policy's words. A
+ *    policy's allow is the same allow a person's is — the edit, the `readRootGrant` and every lane after the
+ *    gate treat it alike — and only the record names a different party, with ONE exception that is about the
+ *    party itself: an ask carrying {@link AskRequest.requiresRealApproval} demands a person, and a policy's
+ *    allow is refused there exactly as the blanket `"allow"` seat is (`blanket_allow_refused`). OMITTING the
+ *    field still reads as `"human"`, so an unrevised host is unchanged.
+ * `"timeout"` is legal ONLY with `allow: false` — an elapsed window is a wait nobody answered, and it cannot be
+ * what APPROVED an action — so `{allow: true, settledBy: "timeout"}` is refused fail-closed.
  * `"aborted"` is deliberately NOT accepted here — that word names the engine's OWN fail-closed ends
  * (abort, throw, unavailable, out-of-contract value), each already stamped at its own arm, and a
  * self-reported one would let a host relabel its refusal as an engine failure.
@@ -1542,14 +1566,15 @@ export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal)
  * the party that ended this wait. Core does not authenticate it, compare it, or read it back to decide
  * anything; it transcribes it onto the settlement observation next to `settledBy`, so an audit that can
  * already say "a person ended this wait" can also say which one, without core growing an identity
- * surface it deliberately does not have. Read the two together: `settledBy:"timeout"` with an
- * `approver` names the queue whose window elapsed, NOT someone who refused.
+ * surface it deliberately does not have. Read the two together: `settledBy:"policy"` with an `approver` names
+ * WHICH of the deployment's answering seats decided (a closed word the host owns, never a person).
  * Screened, not trusted (see {@link screenApproverAttribution}): a non-string, an over-long value or one
  * carrying control characters is a loud fail-closed refusal at {@link resolveAsk}, the same posture this
  * seam takes for every other out-of-contract value — and the same reason, since a defective attribution
  * that were quietly dropped would leave a settlement looking unattributed rather than misreported. It is
- * carried on the arms where the CALLER settled something (its allow, its human/timeout deny) and never
- * on an end the engine produced (an abort, a throw, an unclonable edit): nobody approved those.
+ * carried on the DECIDER arms (a person's or a policy's allow or refusal) and never on an end the engine
+ * produced (an abort, a throw, an unclonable edit): nobody approved those. A host's own elapsed window has
+ * no attribution seat on its record (`approval_window_expired` names the host as a party, not a seat).
  *
  * `readRootGrant` — "yes, and add this directory": the card's {@link AskRequest.readRootCandidate} `dir`, sent back
  * byte for byte (`shell.read_boundary.grant_candidate_is_the_grant`). Beside `allow: true` on an ask carrying that
@@ -1708,8 +1733,8 @@ export declare function policyRefusalMessage(toolName: string, askMessage: strin
 export type ResolvedAsk = (Extract<PermissionResult, {
     action: "allow";
 }> & {
-    /** Present exactly when a PERSON approved (`human_allowed`, with the channel's attribution when it
-     *  reported one); absent on the posture allows (a blanket `"allow"`, a reused grant) — nobody was
+    /** Present exactly when a DECIDER approved (`human_allowed` / `policy_allowed`, with the channel's
+     *  attribution when it reported one); absent on the posture allows (a blanket `"allow"`) — nobody was
      *  asked, so nothing was settled. */
     settlement?: Settlement;
     /** The EXACT data snapshot the approver was shown (the `structuredClone` of the presented args). On
@@ -1766,7 +1791,8 @@ export declare function carriesBidiControls(value: unknown, limits?: {
  * arm: the approver's own verdicts settle as a person's unless the outcome names another word on
  * {@link AskOutcome.settledBy} (its own window, its own policy), and the fail-closed ends around them
  * (abort, a throw, an "unavailable" report, an unclonable presentation, an out-of-contract value) settle
- * as the engine's own nobody-ended family. The three POSTURE arms at the top — blanket `"allow"`, its
+ * as the engine's own nobody-ended family; a policy's allow on a `requiresRealApproval` ask is refused as the
+ * blanket seat's is ({@link unjudgedAllowRefused}). The three POSTURE arms at the top — blanket `"allow"`, its
  * `requiresRealApproval` refusal, and the headless auto-deny — name no person and no window on purpose:
  * nobody was asked, so there is no wait for anyone to have ended, and `decisionReason: "mode"` is already
  * the honest word for what produced them.

package/dist/core/tool-policy.js

@@ -3,7 +3,9 @@ import { homedir } from "node:os";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { decisionAskClassesOf, headlessDenialMessage } from "./ask-origin.js";
 import { ownReadRootCandidate, readRootGrantSeat } from "./read-root-grant-screen.js";
-import { decidersNote, settledByPerson } from "./gate-outcome.js";
+import { decidersNote, settledByDecider } from "./gate-outcome.js";
+import { unjudgedAllowRefused } from "./real-approval.js";
+export { policyCannotAnswer, rowDemandsAPerson } from "./real-approval.js";
 import { sanitizeAutoModeArmingRecipe } from "./auto-mode-arming.js";
 import { join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
@@ -13,7 +15,7 @@ import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
 import { thrownText } from "./thrown-value.js";
-import { nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
+import { isEngineRefusal, nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
 import { protocolOf } from "./protocol-table.js";
@@ -46,6 +48,7 @@ function hasEngineAttestation(o) {
 }
 export function carryEngineAttestations(from, to) {
     transferEngineAttestations(from, to);
+    return to;
 }
 export function carryPrecedingSettlement(preceding, to) {
     if (ENGINE_SETTLEMENTS.get(to) !== undefined)
@@ -93,7 +96,12 @@ export function askUnresolvableCauseOf(d, call) {
         return undefined;
     return v.cause;
 }
-const ENGINE_ATTESTATION_SEATS = [ENGINE_SETTLEMENTS, CLASSIFIER_DENY_CAUSES_SEAT, ASK_UNRESOLVABLE_CAUSES_SEAT, CLASSIFIER_ROUNDS_SEAT];
+const FOLDED_CLASSES_SEAT = new WeakMap();
+function foldedAskClassesAttested(d, held) {
+    const signed = FOLDED_CLASSES_SEAT.get(d);
+    return signed !== undefined && Array.isArray(held) && signed.length === held.length && signed.every((c, i) => c === held[i]);
+}
+const ENGINE_ATTESTATION_SEATS = [ENGINE_SETTLEMENTS, CLASSIFIER_DENY_CAUSES_SEAT, ASK_UNRESOLVABLE_CAUSES_SEAT, CLASSIFIER_ROUNDS_SEAT, FOLDED_CLASSES_SEAT];
 export function engineSettlementOf(d, call) {
     if (typeof d !== "object" || d === null)
         return undefined;
@@ -265,7 +273,7 @@ export function refuseOutOfContractDecision(d, opts) {
     if (typeof d !== "object" || d === null) {
         return refusedOutOfContract(`a permission decision's "action" is absent (the decision is ${d === null || d === undefined ? String(d) : `a ${typeof d}`}, not an object) — the closed set is allow/deny/ask; denied fail-closed rather than reading a word outside it as an allow`);
     }
-    if ((hookSeam ? HOOK_RECEIPTS : ENGINE_RECEIPTS).has(d))
+    if ((hookSeam ? HOOK_RECEIPTS : ENGINE_RECEIPTS).has(d) || isEngineRefusal(d))
         return d;
     const decision = receiveContract(d, hookSeam ? HOOK_RESULT_MEMBERS : DECISION_MEMBERS, "");
     if (decision.kind === "refused")
@@ -276,6 +284,11 @@ export function refuseOutOfContractDecision(d, opts) {
     const refused = receiveNestedRecords(contract) ?? screenContractValues(contract, hookSeam ? { skip: HOOK_SEAM_UNREAD, optional: HOOK_SEAM_OPTIONAL } : undefined);
     if (refused !== undefined)
         return refused;
+    if (contract.foldedAskClasses !== undefined && !foldedAskClassesAttested(d, contract.foldedAskClasses)) {
+        return refusedOutOfContract(`a permission decision carries "foldedAskClasses" that no policy fold of the engine wrote on this object — the member is ` +
+            `engine-written (combinePolicies records the classes of the asks it collapsed); denied fail-closed rather than letting a ` +
+            `class no station judged reach the class derivation`);
+    }
     if (hookSeam && contract.additionalContext !== undefined && typeof contract.additionalContext !== "string") {
         return refusedOutOfContract(`a PreToolUse hook result's "additionalContext" is not a string — the member is the text appended for the model; denied fail-closed rather than rendering a value this layer cannot classify`);
     }
@@ -298,6 +311,9 @@ export function refuseOutOfContractDecision(d, opts) {
     (hookSeam ? HOOK_RECEIPTS : ENGINE_RECEIPTS).add(receipt);
     return receipt;
 }
+export function receiveHookResult(result) {
+    return refuseOutOfContractDecision(result, { reasonIsNonInput: true });
+}
 const DEADLINE_ELAPSED = Symbol("approval.deadline_elapsed");
 function withTimeout(p, ms, onTimeout) {
     if (ms === undefined) {
@@ -474,7 +490,7 @@ export function createApprovalPolicy(opts) {
                 }
                 const okRaw = ok;
                 if (okRaw === true)
-                    return attest({ action: "allow" }, settledByPerson("human_allowed", undefined));
+                    return attest({ action: "allow" }, settledByDecider("person", "allowed", undefined));
                 if (okRaw !== false) {
                     return attest({
                         action: "deny",
@@ -482,7 +498,7 @@ export function createApprovalPolicy(opts) {
                             `(this policy's \`approve\` returns true, false, or the {allow, settledBy?, reason?, approver?} outcome object)`,
                     }, settledByNobody("approver_contract"));
                 }
-                return attest({ action: "deny", message: `approval denied for "${req.toolName}"` }, settledByPerson("human_refused", undefined));
+                return attest({ action: "deny", message: `approval denied for "${req.toolName}"` }, settledByDecider("person", "refused", undefined));
             }
             if (opts.denyByDefault && !nameListHolds(auto, req) && !namespacedCoveringHit(autoCovering, req)) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
@@ -584,7 +600,10 @@ export function combinePolicies(...policies) {
                         for (const k of decisionAskClassesOf(c))
                             folded.add(k);
                 const withClasses = folded.size > 0 ? { ...withAuthor, foldedAskClasses: [...folded] } : withAuthor;
-                return merged !== undefined ? { ...withClasses, updatedInput: merged } : withClasses;
+                const out = merged !== undefined ? { ...withClasses, updatedInput: merged } : withClasses;
+                if (folded.size > 0)
+                    FOLDED_CLASSES_SEAT.set(out, Object.freeze([...folded]));
+                return out;
             }
             const allowed = rewrite ?? ALLOW;
             if (!anyRecord)
@@ -1251,11 +1270,7 @@ function readApproverOutcomeObject(ok, toolName, editLane) {
     if (editLane === "none" && grant !== undefined) {
         return refused(`the approver for "${toolName}" attached a readRootGrant on a seat that offers no directory — denied fail-closed (a grant answers an approval card's readRootCandidate)`, settledByNobody("approver_contract"));
     }
-    if (settledWord !== "human" && allowed === true) {
-        return refused(`the approver for "${toolName}" returned an allow settled by "${settledWord}" — only a person approves, and that word ` +
-            `names a wait that ended with nobody judging: it cannot be what approved a call; denied fail-closed ` +
-            `(report "${settledWord}" with allow:false, or allow with settledBy "human"/omitted)`, settledByNobody("approver_contract"));
-    }
+    const decider = settledWord === "policy" ? "policy" : settledWord === "human" ? "person" : undefined;
     if (allowed !== true) {
         let reasonText;
         try {
@@ -1275,15 +1290,16 @@ function readApproverOutcomeObject(ok, toolName, editLane) {
             word: settledWord,
             note,
             grant,
-            settlement: settledWord === "timeout"
-                ? { kind: "approval_window_expired", who: { party: "host" }, when: Date.now() }
-                : settledWord === "policy"
-                    ? settledByNobody("policy_refused")
-                    : settledByPerson("human_refused", attribution.approver, note),
+            settlement: decider === undefined ? { kind: "approval_window_expired", who: { party: "host" }, when: Date.now() } : settledByDecider(decider, "refused", attribution.approver, note),
         };
     }
+    if (decider === undefined) {
+        return refused(`the approver for "${toolName}" returned an allow settled by "${settledWord}" — that word names a wait that ended ` +
+            `with nobody answering: it cannot be what approved a call; denied fail-closed ` +
+            `(report "${settledWord}" with allow:false; a person's allow is settledBy "human"/omitted, the deployment policy's is "policy")`, settledByNobody("approver_contract"));
+    }
     if (suppliedEdit === undefined)
-        return { kind: "allow", edit: undefined, settlement: settledByPerson("human_allowed", attribution.approver), grant };
+        return { kind: "allow", edit: undefined, settlement: settledByDecider(decider, "allowed", attribution.approver), grant };
     if (editLane === "none") {
         return refused(`the approver for "${toolName}" attached an edit (updatedInput) on a seat that has no lane to adjudicate one — ` +
             `this seat's answer is the deployment POLICY's verdict, and an edit arriving through it would execute without the ` +
@@ -1294,20 +1310,12 @@ function readApproverOutcomeObject(ok, toolName, editLane) {
     if (!edit.ok) {
         return refused(`the approved edit for "${toolName}" is not safely clonable (${edit.reason}) — denied fail-closed`, settledByNobody("presentation_failed"));
     }
-    return { kind: "allow", edit: { value: edit.value }, settlement: settledByPerson("human_allowed", attribution.approver), grant };
+    return { kind: "allow", edit: { value: edit.value }, settlement: settledByDecider(decider, "allowed", attribution.approver), grant };
 }
 async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
     if (onAsk === "allow") {
-        if (req.requiresRealApproval === true) {
-            return {
-                action: "deny",
-                message: `approval required for "${req.toolName}" but the wired approver is a blanket "allow" (no ` +
-                    `judgment was applied) — this decision requires an actual auto-mode classifier verdict or a ` +
-                    `real approval callback, neither of which a blanket bypass can provide: ${req.message}`,
-                decisionReason: "mode",
-                settlement: settledByNobody("blanket_allow_refused"),
-            };
-        }
+        if (req.requiresRealApproval === true)
+            return unjudgedAllowRefused(req, "blanket");
         return { action: "allow", decisionReason: "mode" };
     }
     if (onAsk === undefined || onAsk === "deny") {
@@ -1396,6 +1404,9 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
         const reading = readApproverOutcomeObject(ok, req.toolName, "readjudicated");
         if (reading.kind === "refused")
             return { action: "deny", message: reading.message, decisionReason: "mode", settlement: reading.settlement };
+        if (reading.kind === "allow" && reading.settlement.who.party === "policy" && req.requiresRealApproval === true) {
+            return { ...unjudgedAllowRefused(req, "policy"), ...readRootGrantSeat(reading.grant, offered, false) };
+        }
         const grantSeat = readRootGrantSeat(reading.grant, offered, reading.kind === "allow");
         if (reading.kind === "deny") {
             return {
@@ -1416,7 +1427,7 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
     }
     const okRaw = ok;
     if (okRaw === true)
-        return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settlement: settledByPerson("human_allowed", undefined) };
+        return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settlement: settledByDecider("person", "allowed", undefined) };
     if (okRaw !== false) {
         return {
             action: "deny",
@@ -1425,5 +1436,5 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
             settlement: settledByNobody("approver_contract"),
         };
     }
-    return { action: "deny", message: humanRefusalMessage(req), decisionReason: "mode", settlement: settledByPerson("human_refused", undefined) };
+    return { action: "deny", message: humanRefusalMessage(req), decisionReason: "mode", settlement: settledByDecider("person", "refused", undefined) };
 }

package/dist/core/types.d.ts

@@ -30,5 +30,5 @@ export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegatio
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";
 export type { EngineNotice, OwedUserInputAccount, UserSteerUndrainedCause } from "./engine-notice.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, settleOwedUserInput, undrainedUserInputNotices, USER_STEER_UNDRAINED_CAUSES } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_STEER_UNDRAINED_CAUSES } from "./engine-notice.js";
 export type { AgentTool, Model, StreamFn, ThinkingLevel, ToolInputValidationContext, ToolInputVerdict };

package/dist/core/types.js

@@ -1,4 +1,4 @@
 export { MODEL_ROLES } from "./model-seat.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, settleOwedUserInput, undrainedUserInputNotices, USER_STEER_UNDRAINED_CAUSES } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_STEER_UNDRAINED_CAUSES } from "./engine-notice.js";

package/dist/core/wiring-manifest.d.ts

@@ -20,6 +20,7 @@
  * copies of the derivation would drift, so there is exactly one. A startup snapshot and a leg's
  * effective snapshot are two DIFFERENT facts; neither may impersonate the other.
  */
+import { type PermissionMode } from "./ask-origin.js";
 import type { RunnerDeps, TaskSpec } from "./types.js";
 import { type StoreDurability } from "./checkpoint-store.js";
 import type { WiringManifestHookEntry } from "./hook-seats.js";
@@ -600,8 +601,13 @@ export declare function resolveSubagentTranscriptTier(agentStoreWired: boolean,
 } | undefined): SubagentTranscriptTier;
 /**
  * The ONE `ask.effective` derivation (design/173) — shared by the effective manifest AND
- * the posture door (`config.interaction_posture`), so "what does the door require" and "what does
- * the manifest report" can never disagree:
+ * the posture door (`config.interaction_posture`): the door passes no `mode` and judges the SEAT alone, the
+ * manifest passes its leg's effective mode AT THE LEG'S START (the manifest is minted once; a runtime reader pairs
+ * {@link askSeatEffective} with the live mode instead), so the two read one table and differ only by the one fact the
+ * door does not have:
+ *  - MODE BEFORE SEAT: under `dontAsk` the mode refuses every ask a policy raises (`arbitrateByMode`; only a
+ *    hook's own ask beside no rule or safety ask is handed on, and that is the hook lane's decision, not a policy
+ *    `ask`), so no seat answers one — whatever the seat and the park lane say, the word is `auto_deny`;
  *  - a live approver callback ⇒ `human_reachable` (regardless of the park lane);
  *  - blanket `"allow"`/`"deny"` ⇒ the park lane decides first: a string seat is NOT a live approver,
  *    so on an armed park lane the ask parks and the honest report is `park_only` — reporting the
@@ -610,7 +616,15 @@ export declare function resolveSubagentTranscriptTier(agentStoreWired: boolean,
  *  - no seat at all ⇒ the park lane decides: armed ⇒ `park_only`, unresolved ⇒ `unresolved`,
  *    else the headless degrade `auto_deny`.
  */
-export declare function deriveAskEffective(form: AskSeamForm, parkEffective: boolean | "unresolved"): AskEffective;
+export declare function deriveAskEffective(form: AskSeamForm, parkEffective: boolean | "unresolved", mode?: PermissionMode): AskEffective;
+/**
+ * The SEAT's own `ask.effective` of an effective manifest — {@link deriveAskEffective} with no mode, from the manifest's own
+ * form and park facts. The manifest's `ask.effective` is the word AS OF THE LEG'S START under its start mode, and a steer moves
+ * the mode afterwards; a runtime consumer that reads the word per call (the classifier's approval seat, the posture row, the peer
+ * lane's mode fold) therefore reads THIS word and the leg's LIVE mode beside it — never the start-of-leg fold, which would carry a
+ * `dontAsk` start's refusal into the leg's later modes.
+ */
+export declare function askSeatEffective(manifest: Pick<WiringManifest, "ask" | "parkLane">): AskEffective;
 /**
  * Does an ask this leg hands on carrying `requiresRealApproval` reach a PERSON — never an automatic yes? The leg's
  * APPROVAL SEAT, read off the ONE ask derivation above, never re-derived: `human_reachable` (a live approver) and