@sema-agent/core 7.38.3 → 7.39.1

package/dist/core/runner/contracts.d.ts

@@ -211,7 +211,7 @@ export interface FrameReceipt {
     text: string;
     /** Which frame this receipt settles. A boundary collector must not render a listing whose receipt is
      *  still pending (the frame is queued, not yet in the transcript). */
-    source: "git_status" | "agent_listing" | "skills_listing" | "date_change";
+    source: "git_status" | "agent_listing" | "skills_listing" | "date_change" | "output_style";
     /** Runs inside the `message_end` walk (synchronous, never awaited): advances the run-local record
      *  and parks any session write for the next serialization point. */
     commit: (entryId: string) => void;
@@ -283,8 +283,10 @@ export interface Prepared {
     /** Whether the full shell is on this leg's roster (the inherited-gate phase's bit, asserted against the mount). */
     fullShellReachable: boolean;
     /** The run's approval-posture facts as prepared — the effective permission mode and the ask seam's effective
-     *  answer. The first user turn renders them into the engine's own marked reminder; no gate decision keys on them. */
+     *  answer. The posture composition renders them into the engine's own marked reminders; no gate decision keys on them. */
     approvalPosture: import("../auto-mode-directive.js").ApprovalPostureFacts;
+    /** The output-style frame body, rendered once at prepare from the screened `TaskSpec.outputStyle` (absent = no seat). */
+    outputStyleFrame?: string;
     /** The leg's live permission-mode seat: the effective mode every mode consumer reads, the steer verb writes. */
     permissionMode: PermissionModeController;
     /** The ISOLATION-AWARE working-tree root for this task (a worktree's cwd when `isolation: "worktree"`, else
@@ -1179,10 +1181,8 @@ export interface Prepared {
      *  handler matches on, and the re-assert closure the compaction landing + boundary retry call.
      *  Always present (empty object on a hands-less leg — the lane is then out of scope). */
     gitStatusRef: GitStatusLaneRef;
-    /** The posture directive's newest engine carrier (replace-by-key, the git frame's protection slot twin). */
-    postureFrameRef: {
-        protectedText?: string;
-    };
+    /** The posture composition's run-local half (the newest carrier's protection slot; the row last composed for). */
+    postureFrameRef: import("../auto-mode-directive.js").PostureFrameRef;
     /** G1 通告层 — narrow post-compact getter over the process task registry: THIS run's visible
      *  pending/running background tasks (same owner/scope/session identity the TaskOutput/TaskStop tools
      *  use), as a bounded display projection (id/description/status — never handles/env/abort). Called by

package/dist/core/runner/denial-limit-arms.js

@@ -2,7 +2,7 @@ import { markTightenMessage } from "../safety-axis-vocab.js";
 import { classifierParseFailureDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
 import { classifierUnavailableArm } from "../classifier-unavailable-arm.js";
-import { attestClassifierDenyCause, attestClassifierRound } from "../tool-policy.js";
+import { attestClassifierDenyCause, attestClassifierRound, carryEngineAttestations } from "../tool-policy.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -84,8 +84,8 @@ export const inheritedAskFallbackMessage = (toolName) => `approval required for
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, req } = opts;
     const facts = opts.facts ?? INHERITED_STATION_FACTS, m = facts.mandateMarks;
-    const frames = m.shellGated === true ? [] : [...(m.egress === true ? [markTightenMessage(req.toolName, "egress")] : []), ...(m.irreversibility === "always" ? [markTightenMessage(req.toolName, "irreversible")] : [])];
-    const ask = (frames.length > 0 ? { ...opts.ask, message: [opts.ask.message ?? inheritedAskFallbackMessage(req.toolName), ...frames].join(" — ") } : opts.ask);
+    const frames = [...(m.egress === true ? [markTightenMessage(req.toolName, "egress")] : []), ...(m.irreversibility === "always" ? [markTightenMessage(req.toolName, "irreversible")] : [])];
+    const ask = (frames.length > 0 ? carryEngineAttestations(opts.ask, { ...opts.ask, message: [opts.ask.message ?? inheritedAskFallbackMessage(req.toolName), ...frames].join(" — ") }) : opts.ask);
     const origin = askOriginOf(ask, facts);
     const classification = classifyAsk(ask, facts);
     const classifierStandsDown = () => {
@@ -123,7 +123,7 @@ export async function judgeInheritedClassifier(opts) {
         return { kind: "deny", result: attributed(verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied) };
     }
     const fallback = tracked.fallback;
-    const minted = { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };
+    const minted = carryEngineAttestations(ask, { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback });
     return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, facts), classification: classifyAsk(minted, facts) };
 }
 export function headlessDenyAtFold(r) {

package/dist/core/runner/inherited-ask-grants.d.ts

@@ -31,8 +31,10 @@ export declare function askGrantShapeOf(args: unknown): string | undefined;
  *    the gate's own judges add (a protected target, an out-of-root read) was not on the card. Not covered ⇒ the gate
  *    asks its own question and the grant stays (it answers what it answered; the call-site sweep ends it). The class
  *    set is also the AUTHORITY test (a hook's ask carries `hook`, a fallback `denial_limit_fallback`, a marked tool
- *    `operator_forced`, a protected write `write_protection`, an out-of-root read `probe`; the shell seat's classify-tier
- *    hesitation is `ordinary`, the one question a yes on the same bytes answers) — the ask's `decisionReason` is not read.
+ *    `operator_forced`, a protected write `write_protection`, an out-of-root read `probe`, the operator's shell floor
+ *    `shell_floor` — a class no inherited station mints from its facts, so no station card answers it; the shell seat's classify-tier
+ *    hesitation is `ordinary`, the one question a yes on the same bytes answers) — neither the ask's `decisionReason` nor
+ *    its `mandate` word is read.
  *  · LEDGER: the ONE real consultation (timed on the wrapper arm) is booked here — one frame happened, one is booked.
  * The grant lives within one gate evaluation (consumed on reuse, swept at the call site): a REOPENED checkpoint's
  * re-adjudication never sees a stale grant.

package/dist/core/runner/inherited-ask-grants.js

@@ -1,4 +1,3 @@
-import { askMandateMember } from "../ask-origin.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { askApproverIdentity, carryEngineAttestations } from "../tool-policy.js";
 export function askGrantCovers(granted, asked) {
@@ -18,8 +17,6 @@ export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision
         return undefined;
     if (!askGrantCovers(grant.classes, decision.action === "ask" ? decision.classes : undefined))
         return undefined;
-    if (decision.action === "ask" && askMandateMember(decision).mandate === "operator_always")
-        return undefined;
     grants.delete(req.toolCallId);
     humanReviewRef.count += 1;
     humanReviewRef.totalWaitMs += grant.waitMs;

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -120,6 +120,24 @@ export interface PermissionRuleLanes {
         adjudicate: (req: ToolCallRequest) => Promise<OrgGateVerdict>;
     } | undefined;
 }
+/** The ORG lane: the org's verdict about one call, off the store view `read` supplies — the gate's `orgRules` face over the
+ *  per-call handoff ({@link createPermissionRuleLanes}), and {@link orgVerdictBeforeClaim} over a view of its own. */
+export declare function orgRuleLane(cfg: {
+    read: (toolCallId: string) => Promise<EffectivePermissionRules>;
+    questionToolMounted: boolean;
+    questionToolName: string;
+    onRevisionDefect: (message: string) => void;
+}): NonNullable<PermissionRuleLanes["org"]>;
+/** The org's CURRENT verdict about a parked call, read by the resume entry before the claim (the row's session and principal,
+ *  bounded like the gate's wait; unreadable ⇒ unavailable). The mount and a revision defect are the resumed leg's facts, so
+ *  the reserved name is exempted and the defect left to that leg: this read can leave a question unasked, never invent one. */
+export declare function orgVerdictBeforeClaim(cfg: {
+    provider: PermissionRuleStoreProvider;
+    principal: string | undefined;
+    localOwnerDeclared: boolean;
+    sessionId: string;
+    signal: AbortSignal | undefined;
+}, req: ToolCallRequest): Promise<OrgGateVerdict>;
 /**
  * Build the gate's two permission-rule lanes over the unified store, resolved once per task.
  *

package/dist/core/runner/permission-rule-lanes.js

@@ -5,7 +5,8 @@ import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
 import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
 import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
-import { orgRuleVerdictFor } from "../permission-rule-org.js";
+import { orgRuleVerdictFor, settleOrgVerdictWithin } from "../permission-rule-org.js";
+import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
 import { strongestAnswer } from "../persisted-rule-arms.js";
@@ -46,6 +47,38 @@ export function pathRuleLaneAnswer(table, req, ctx) {
         return undefined;
     return persistedRuleAnswerOf(adjudicatePersistedPathRules(table, { tool: req.toolName, cwd: ctx.root, sessionId: ctx.sessionId }, { ...(tighten !== undefined ? { tighten } : {}), ...(allow !== undefined ? { allow } : {}) }, bases));
 }
+export function orgRuleLane(cfg) {
+    return {
+        adjudicate: async (req) => {
+            if (wireOf("offer.orgQuestionExemption", req) === cfg.questionToolName && cfg.questionToolMounted)
+                return { status: "available" };
+            let resolution;
+            try {
+                resolution = (await cfg.read(req.toolCallId)).org;
+            }
+            catch (err) {
+                return { status: "unavailable", disclosures: [`the permission-rule store threw while resolving the org partition: ${thrownText(err)}`] };
+            }
+            if (resolution.status === "unavailable" || resolution.status === "ungoverned") {
+                return { status: "unavailable", disclosures: resolution.status === "ungoverned" ? ["the store reports no org partition while the provider declares one — unreadable governance, never an empty one"] : resolution.disclosures };
+            }
+            const revisionCell = orgRevisionEvidenceOf(resolution, cfg.onRevisionDefect);
+            const command = req.args?.command;
+            if (!laneToolNamesOf(req).includes(PERSISTED_RULE_TOOL) || typeof command !== "string")
+                return { status: "available", ...revisionCell };
+            const verdict = orgRuleVerdictFor(resolution.rules, { tool: PERSISTED_RULE_TOOL, command });
+            return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
+        },
+    };
+}
+export function orgVerdictBeforeClaim(cfg, req) {
+    const unreadable = { status: "unavailable", disclosures: [] };
+    const read = () => {
+        const store = ownerStoreOf(cfg.provider, cfg.principal, cfg.localOwnerDeclared);
+        return orgRuleLane({ read: () => store.effective({ sessionId: cfg.sessionId }), questionToolMounted: true, questionToolName: ASK_USER_QUESTION_TOOL_NAME, onRevisionDefect: () => undefined }).adjudicate(req);
+    };
+    return settleOrgVerdictWithin(Promise.resolve().then(read).catch(() => unreadable), unreadable, { timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS, ...(cfg.signal !== undefined ? { signal: cfg.signal } : {}) });
+}
 export function createPermissionRuleLanes(cfg) {
     const provider = cfg.provider;
     if (cfg.home !== undefined && !isAbsolutePathForm(cfg.home)) {
@@ -90,30 +123,7 @@ export function createPermissionRuleLanes(cfg) {
         handed.delete(toolCallId);
         return p;
     };
-    const org = provider.partitions.org
-        ? {
-            adjudicate: async (req) => {
-                if (wireOf("offer.orgQuestionExemption", req) === cfg.questionToolName && cfg.questionToolMounted)
-                    return { status: "available" };
-                let resolution;
-                try {
-                    resolution = (await hand(req.toolCallId)).org;
-                }
-                catch (err) {
-                    return { status: "unavailable", disclosures: [`the permission-rule store threw while resolving the org partition: ${thrownText(err)}`] };
-                }
-                if (resolution.status === "unavailable" || resolution.status === "ungoverned") {
-                    return { status: "unavailable", disclosures: resolution.status === "ungoverned" ? ["the store reports no org partition while the provider declares one — unreadable governance, never an empty one"] : resolution.disclosures };
-                }
-                const revisionCell = orgRevisionEvidenceOf(resolution, cfg.onRevisionDefect);
-                const command = req.args?.command;
-                if (!laneToolNamesOf(req).includes(PERSISTED_RULE_TOOL) || typeof command !== "string")
-                    return { status: "available", ...revisionCell };
-                const verdict = orgRuleVerdictFor(resolution.rules, { tool: PERSISTED_RULE_TOOL, command });
-                return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
-            },
-        }
-        : undefined;
+    const org = provider.partitions.org ? orgRuleLane({ read: hand, questionToolMounted: cfg.questionToolMounted, questionToolName: cfg.questionToolName, onRevisionDefect: cfg.onRevisionDefect }) : undefined;
     const personalAdjudicate = async (req) => {
         if (anonymous && !cfg.localOwnerDeclared)
             return undefined;

package/dist/core/runner/prepare-context-lane.d.ts

@@ -62,6 +62,7 @@ export interface PrepareContextLaneInput {
     /** borrowed-mutable — the posture directive's newest engine carrier (the first-turn mint and each post-compaction restatement write it); the clip guard reads it. */
     postureFrameRef: {
         protectedText?: string;
+        unwritten?: string;
     };
     /** borrowed-mutable — the per-request lossy-projection flag. Writers here: the handler re-derives it at every request
      *  build, and the repair sink raises it when the provider boundary's law left recorded content out of the same request

package/dist/core/runner/prepare-context-lane.js

@@ -105,6 +105,12 @@ export function prepareContextLane(input) {
                 if (kept.action === "kept" || kept.action === "reinserted")
                     trimmed = kept.messages;
             }
+            if (postureFrameRef.unwritten !== undefined) {
+                let at = trimmed.length;
+                while (at > 0 && trimmed[at - 1].role === "user")
+                    at--;
+                trimmed = [...trimmed.slice(0, at), { role: "user", content: [{ type: "text", text: postureFrameRef.unwritten }], timestamp: Date.now(), engineMinted: true }, ...trimmed.slice(at)];
+            }
             requestLossyRef.current =
                 replayed !== healed ||
                     capped !== replayed ||

package/dist/core/runner/prepare-inherited-gate.js

@@ -8,7 +8,7 @@ import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { PermissionModeController, modeRequestAfterResume } from "../mode-policy.js";
 import { SessionModeSeats } from "./session-mode-seats.js";
-import { migrateLegacyModeSeed } from "../checkpoint-store.js";
+import { recordedModeSeed } from "../checkpoint-store.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { asThrownError } from "../thrown-value.js";
 export function prepareInheritedGate(input) {
@@ -32,14 +32,7 @@ export function prepareInheritedGate(input) {
         const extras = liveRules.filter((l) => !seedRules.some((s) => s.sessionId === l.sessionId && s.principal === l.principal));
         return [...merged, ...extras];
     })();
-    const modeSeed = migrateLegacyModeSeed(seedInheritedGate);
-    if (modeSeed.migrated !== undefined) {
-        deliverEngineNotice(deps.onNotice, {
-            code: "resume.legacy_mode_seed_migrated",
-            message: `the resumed checkpoint row carried pre-mode keys (${modeSeed.migrated.droppedKeys.join(", ")}); read once into ${modeSeed.migrated.permissionMode !== undefined ? `permissionMode: "${modeSeed.migrated.permissionMode}"` : "no mode of its own (the chain's ceiling stands)"}${modeSeed.shellGate !== undefined ? ' with the shell floor "always" kept' : ""} — the next suspend writes the one key; this migration is kept through 7.38.x and removed in 7.39.0, which refuses a row still carrying these keys (resume or abandon such rows before upgrading)`,
-            detail: { migrated: { ...(modeSeed.migrated.permissionMode !== undefined ? { permissionMode: modeSeed.migrated.permissionMode } : {}), droppedKeys: [...modeSeed.migrated.droppedKeys] }, sessionId, runId },
-        });
-    }
+    const modeSeed = recordedModeSeed(seedInheritedGate);
     const inheritedShellGate = liveInheritedGate?.shellGate ?? modeSeed.shellGate;
     const inheritedParentConstraints = attachRebuiltDenialTrackers(liveInheritedGate?.parentConstraints, deps.autoMode?.denialLimit);
     const parentSeat = liveInheritedGate?.permissionModeCeiling;

package/dist/core/runner/prepare-task.js

@@ -11,10 +11,10 @@ import { callerToolMembership } from "../../agents/inherited-tool-pool.js";
 import { toolPolicyPathDenyRules, toolPolicyWriteTargetGuard } from "../tool-policy.js";
 import { loadAnnounceOnceLedger } from "./announce-once-ledger.js";
 import { isValidReminderMark, mintReminderMark } from "../reminder-mint.js";
-import { clampPermissionMode, isPermissionMode, PERMISSION_MODES } from "../ask-origin.js";
-import { modePolicyOf, modeRequestAfterResume } from "../mode-policy.js";
-import { assertNoRetiredKeys, RETIRED_TASK_SPEC_KEYS } from "../retired-keys.js";
-import { migrateLegacyModeSeed } from "../checkpoint-store.js";
+import { clampPermissionMode } from "../ask-origin.js";
+import { modePolicyOf, modeRequestAfterResume, refusePermissionModeDoors } from "../mode-policy.js";
+import { resolveOutputStyleFrame } from "../output-style.js";
+import { recordedModeSeed } from "../checkpoint-store.js";
 import { emitTrace } from "../trace.js";
 import { persistedPathRowsOfTask, ruleStoreUnreadableNotice } from "./persisted-path-rows.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -81,6 +81,7 @@ import { selfOrchestrationFailClosedReason } from "../../orchestration/workflow-
 import { remainingBudgetMicroUsd, resolveCheckpointStore } from "../checkpoint-store.js";
 import { checkpointSeatOf } from "../checkpoint-seat.js";
 import { handsWriteHalfMounts } from "../../tools/fs/index.js";
+import { askSeatEffective } from "../wiring-manifest.js";
 import { durableParkGapFor } from "../park-selfcheck.js";
 import { deliverEngineNotice } from "../types.js";
 import { ToolRosterDeltaSeat } from "../tool-roster.js";
@@ -266,22 +267,6 @@ function refuseRegistryScopeMismatch(spec, internals) {
 function validateInputFaultNotice(onError, sessionId) {
     return ({ toolName, toolCallId, error }) => onError?.(new Error(`tool input pre-validation (validateInput) threw for ${toolName} (call ${toolCallId}) — read as no verdict; the call proceeded to the gate: ${thrownText(error)}`), { phase: "hook", sessionId });
 }
-function refusePermissionModeDoors(spec) {
-    assertNoRetiredKeys(spec, RETIRED_TASK_SPEC_KEYS, "TaskSpec");
-    const mode = spec.permissionMode;
-    if (mode !== undefined && !isPermissionMode(mode)) {
-        const e = new Error(`permissionMode must be one of ${PERMISSION_MODES.map((w) => JSON.stringify(w)).join(", ")} when present (got ${JSON.stringify(mode)}) — omit it for the default mode; an unrecognized word is refused rather than read as any mode.`);
-        e.code = "config.permission_mode_invalid";
-        throw e;
-    }
-    const floor = spec.shellGate;
-    if (floor !== undefined && floor !== "always") {
-        const e = new Error(`shellGate must be the floor word "always" when present (got ${JSON.stringify(floor)}) — the doctrine values "off" / "classify" are retired: the shell's shape tier is installed on every full shell and the permission mode (permissionMode) decides what its asks become; omit shellGate for no operator floor.`);
-        e.code = "config.shell_gate_value_retired";
-        throw e;
-    }
-    return mode;
-}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf, runIdSink, holdSessionLock) {
     const runId = uuidv7();
     if (runIdSink !== undefined)
@@ -291,8 +276,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     spec = doors.spec;
     const checkpointStore = resolveCheckpointStore(spec, deps), checkpointSeat = checkpointSeatOf(spec, checkpointStore);
     const permissionModeSeat = refusePermissionModeDoors(spec);
+    const outputStyleFrame = resolveOutputStyleFrame(spec.outputStyle);
     const declaredModeAtDoor = (() => {
-        const requested = modeRequestAfterResume(permissionModeSeat, migrateLegacyModeSeed(resume?.seed.inheritedGate), resume?.outcome);
+        const requested = modeRequestAfterResume(permissionModeSeat, recordedModeSeed(resume?.seed.inheritedGate), resume?.outcome);
         const ceiling = internals?.inheritedGate?.permissionModeCeiling?.current ?? internals?.inheritedGate?.permissionMode;
         return ceiling === undefined ? (requested ?? "default") : clampPermissionMode(requested, ceiling).effective;
     })();
@@ -754,13 +740,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
         const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
-        prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.pathDenyRules.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: wiringManifest.ask, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
-        const postureFrameRef = {};
+        prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.pathDenyRules.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
+        const postureFrameRef = { report: (err) => deps.onError?.(err, { phase: "degraded", sessionId }) };
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas: rosterSeat, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, contextOverlay: legContextOverlay, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: wiringManifest.ask.effective ?? "unresolved" }, permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
         rollback.commit();
         commitModeSeats(abortController.signal);
         const prepared = buildPrepared();

package/dist/core/runner/prepare-wiring-manifest.js

@@ -11,7 +11,7 @@ import { inlineUntrusted } from "../untrusted-text.js";
 import { mountWriteProtection } from "./write-protection-station.js";
 import { autoRunOnRecommendationEffective } from "./memory-consolidation-driver.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
-import { LSP_CONTRACT_ID, countElicitOptIns, deriveHandsSeam, deriveLspSeam, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
+import { LSP_CONTRACT_ID, askSeatEffective, countElicitOptIns, deriveHandsSeam, deriveLspSeam, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
 import { DEFAULT_IRREVERSIBLE_SCOPE } from "./checkpoint-scope.js";
 export function mcpManifestEntries(entries, statuses) {
     return (entries ?? []).map((entry) => {
@@ -222,7 +222,7 @@ export function prepareWiringManifest(input) {
         hands: deriveHandsSeam(handsEnabled),
         fileHistory: fileHistoryFact,
     });
-    peerLaneRefs.askEffective = wiringManifest.ask.effective;
+    peerLaneRefs.askEffective = askSeatEffective(wiringManifest);
     peerLaneRefs.permissionMode = () => permissionMode.current;
     const sessionBoxBound = sessionBox !== undefined && internals?.onTaskNotification !== undefined ? sessionBox : undefined;
     if (sessionBoxBound !== undefined && internals?.onTaskNotification !== undefined) {

package/dist/core/runner/prompt-block.d.ts

@@ -0,0 +1,9 @@
+import type { PromptBlockCause } from "../terminal-cause.js";
+import type { BlockedRef } from "./synthetic-tools.js";
+/**
+ * Hold the task's first prompt back: `ref.reason` is `text` in the engine's reminder frame, `ref.detail` names `cause`.
+ * `text` is the hook's own words when `cause` is `"block"` — they also become `detail.hookReason`, folded to one line,
+ * bounded, envelope tags defused, with no reminder frame and no session mark; a reason that folds to nothing leaves the
+ * key out. For every other cause `text` is the engine's sentence about the hook's ending and `hookReason` is never minted.
+ */
+export declare function holdPrompt(ref: BlockedRef, mark: string | undefined, cause: PromptBlockCause, text: string): void;

package/dist/core/runner/prompt-block.js

@@ -0,0 +1,8 @@
+import { formatHookFeedback } from "../hooks.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+const HOOK_REASON_MAX = 240;
+export function holdPrompt(ref, mark, cause, text) {
+    ref.reason = formatHookFeedback(text, mark);
+    const hookReason = cause === "block" ? inlineUntrusted(String(text), HOOK_REASON_MAX) : "";
+    ref.detail = { kind: "prompt_blocked_by_hook", cause, ...(hookReason !== "" ? { hookReason } : {}) };
+}

package/dist/core/runner/resume-admission.js

@@ -1,4 +1,5 @@
-import { CheckpointError, readPendingSteerQueue, resolveCheckpointStore, validatePendingSteer } from "../checkpoint-store.js";
+import { CheckpointError, readPendingSteerQueue, refuseRetiredModeSeed, resolveCheckpointStore, validatePendingSteer } from "../checkpoint-store.js";
+import { refuseResumeDoors } from "../mode-policy.js";
 import { describeSuppliedValue } from "./decide-continuation.js";
 export async function resumeAdmission(input) {
     const { token, outcome, taskConfig, runner, parentConstraintRegistry } = input;
@@ -36,6 +37,8 @@ export async function resumeAdmission(input) {
     const outcomeGate = outcome.gate;
     const resumeSignal = config.signal;
     let suppliedMessage;
+    refuseRetiredModeSeed(cp.state);
+    refuseResumeDoors(config, cp.state.inheritedGate);
     const parkedSteers = readPendingSteerQueue(cp.state);
     if (outcomeGate === "wake") {
         suppliedMessage = outcome.message;

package/dist/core/runner/resume-apply.js

@@ -2,12 +2,13 @@ import { snapshotActorAssertion } from "../../internal/llm.js";
 import { isAskOrigin } from "../ask-origin.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { CheckpointError, remainingBudgetMicroUsd } from "../checkpoint-store.js";
-import { settledByPerson } from "../gate-outcome.js";
+import { settledByDecider } from "../gate-outcome.js";
 import { cloneObserverInput, mintHookInvocationIdentity, resolveHookTimeoutMs, runHookSeat } from "../hooks.js";
-import { checkToolPolicyProjection, refuseOutOfContractDecision } from "../tool-policy.js";
+import { checkToolPolicyProjection, policyCannotAnswer, refuseOutOfContractDecision } from "../tool-policy.js";
 import { callFaceSeat, parkedCallFaceOf } from "../tool-roster.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { deepJsonEqual, describeSuppliedValue } from "./decide-continuation.js";
+import { orgVerdictBeforeClaim } from "./permission-rule-lanes.js";
 import { mintGateOutcome } from "./gate-exit.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
 import { wireOf } from "../tool-name-readings.js";
@@ -75,6 +76,19 @@ export async function resumeApply(input) {
                 await recheckGovernanceWindow();
         }
     }
+    const editSignal = config.signal;
+    const raceEditAbort = async (p) => {
+        if (editSignal === undefined)
+            return p;
+        if (editSignal.aborted) {
+            throw new CheckpointError("checkpoint.resume_aborted", "the resume was aborted while re-adjudicating the call before the claim — the checkpoint stays pending and is resumable with a live signal");
+        }
+        return new Promise((resolve, reject) => {
+            const onAbort = () => reject(new CheckpointError("checkpoint.resume_aborted", "the resume was aborted while re-adjudicating the call before the claim — the checkpoint stays pending and is resumable with a live signal"));
+            editSignal.addEventListener("abort", onAbort, { once: true });
+            p.then((v) => { editSignal.removeEventListener("abort", onAbort); resolve(v); }, (e) => { editSignal.removeEventListener("abort", onAbort); reject(e); });
+        });
+    };
     if (plainPolicyOutcome !== undefined &&
         plainPolicyOutcome.decision === "allow" &&
         plainPolicyOutcome.updatedInput !== undefined &&
@@ -94,19 +108,6 @@ export async function resumeApply(input) {
             ...callFaceSeat(parkedCallFaceOf(cp.pendingAction)),
             ...(cp.state.handsCwd !== undefined ? { cwd: cp.state.handsCwd } : {}),
         };
-        const editSignal = config.signal;
-        const raceEditAbort = async (p) => {
-            if (editSignal === undefined)
-                return p;
-            if (editSignal.aborted) {
-                throw new CheckpointError("checkpoint.resume_aborted", "the resume was aborted while re-adjudicating the approver's edit — the checkpoint stays pending and is resumable with a live signal");
-            }
-            return new Promise((resolve, reject) => {
-                const onAbort = () => reject(new CheckpointError("checkpoint.resume_aborted", "the resume was aborted while re-adjudicating the approver's edit — the checkpoint stays pending and is resumable with a live signal"));
-                editSignal.addEventListener("abort", onAbort, { once: true });
-                p.then((v) => { editSignal.removeEventListener("abort", onAbort); resolve(v); }, (e) => { editSignal.removeEventListener("abort", onAbort); reject(e); });
-            });
-        };
         const ig = cp.state.inheritedGate;
         if (ig?.requiresParentConstraint === true) {
             const chain = ig.constraintChain;
@@ -148,6 +149,8 @@ export async function resumeApply(input) {
                 throw new CheckpointError("resume.constraint_rejected", `the approver EDITED this call's input and the deployment's resume-edit policy denies the edited args${rechecked.message ? `: ${rechecked.message}` : ""}. ` +
                     "Refused pre-CAS (the checkpoint stays pending and remains decidable)");
             }
+            if (policyCannotAnswer(rechecked, plainPolicyOutcome.hostDecision.decidedBy))
+                throw new CheckpointError("checkpoint.invalid_outcome", `the approver EDITED this call's input, the edited args raise a question that requires real approval, and the decision is the deployment's policy — a policy's answer is not a person's (decide the edit as "person", or approve the shown input); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
             if (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, editedArgs)) {
                 throw new CheckpointError("resume.constraint_rejected", `the deployment's resume-edit policy REWROTE the approver's edited args to a different value than was approved — the durable resume cannot execute either the un-adjudicated edit or an unapproved rewrite; ` +
                     `refused pre-CAS (the checkpoint stays pending); re-submit the edited action so the rewrite is adjudicated and approved synchronously`);
@@ -169,6 +172,15 @@ export async function resumeApply(input) {
             }
         }
     }
+    const orgProvider = runner.deps.permissionRuleStore;
+    if (plainPolicyOutcome?.decision === "allow" && plainPolicyOutcome.hostDecision.decidedBy !== "person" && orgProvider?.partitions.org === true && cp.pendingAction.kind === "tool_approval") {
+        const call = { toolName: cp.pendingAction.toolName, args: plainPolicyOutcome.updatedInput !== undefined ? plainPolicyOutcome.updatedInput : cp.pendingAction.args, toolCallId: cp.pendingAction.toolCallId };
+        const orgNow = await raceEditAbort(orgVerdictBeforeClaim({ provider: orgProvider, principal: config.principal || cp.principal || undefined, localOwnerDeclared: runner.deps.localOwnerRules === true, sessionId: cp.sessionId, signal: editSignal }, call));
+        if (policyCannotAnswer(orgNow, plainPolicyOutcome.hostDecision.decidedBy)) {
+            const rule = orgNow.status === "available" ? orgNow.verdict?.rule : undefined;
+            throw new CheckpointError("checkpoint.invalid_outcome", `resume carries decision "allow" decided by "${plainPolicyOutcome.hostDecision.decidedBy}" on a call an organization policy rule (${rule}) requires a person's approval for — a policy's answer is not a person's (decide it as "person", or refuse it as "policy"); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
+        }
+    }
     if (plainPolicyOutcome !== undefined) {
         const parkedOrigin = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction.origin : undefined;
         if (!isAskOrigin(parkedOrigin)) {
@@ -177,9 +189,7 @@ export async function resumeApply(input) {
         const facts = plainPolicyOutcome.hostDecision;
         const settlement = facts.decidedBy === "sla_timeout"
             ? { kind: "park_sla_expired", who: { party: "host", ...(facts.approver !== undefined ? { approver: facts.approver } : {}) }, when: Date.now() }
-            : facts.decidedBy === "policy"
-                ? { kind: "policy_refused", who: { party: "none" }, when: Date.now() }
-                : settledByPerson(plainPolicyOutcome.decision === "allow" ? "human_allowed" : "human_refused", facts.approver, plainPolicyOutcome.decision === "deny" ? plainPolicyOutcome.reason : undefined);
+            : settledByDecider(facts.decidedBy, plainPolicyOutcome.decision === "allow" ? "allowed" : "refused", facts.approver, plainPolicyOutcome.decision === "deny" ? plainPolicyOutcome.reason : undefined);
         plainPolicyOutcome = { ...plainPolicyOutcome, gateOutcome: mintGateOutcome({ ...(plainPolicyOutcome.decision === "deny" ? { deniedBy: "ask_resolution" } : {}), settled: { settlement, origin: parkedOrigin } }) };
     }
     const outcomeForStore = plainPolicyOutcome ?? plainReviewOutcome ?? plainParkOutcome;

package/dist/core/runner/resume-policy-outcome.js

@@ -1,6 +1,6 @@
 import { canonicalizeCapturedPlainData, classifyQuestionOutcome, isLiveQuestionFace } from "../ask-question.js";
 import { CHECKPOINT_FEATURES, CheckpointError, checkpointVersionOf, winnerFromOutcome } from "../checkpoint-store.js";
-import { screenApproverAttribution } from "../tool-policy.js";
+import { policyCannotAnswer, screenApproverAttribution } from "../tool-policy.js";
 import { sanitizeUntrustedText } from "../untrusted-text.js";
 import { assertOutcomeText, describeSuppliedValue, pendingContentAskCallId, sameWinner } from "./decide-continuation.js";
 const REFUSED_DECIDE_KEYS = [
@@ -55,9 +55,15 @@ export function resumePolicyOutcome(input) {
         if (decidedBy !== "person" && decidedBy !== "sla_timeout" && decidedBy !== "policy") {
             throw new CheckpointError("checkpoint.invalid_outcome", `resume hostDecision.decidedBy "${describeSuppliedValue(decidedBy)}" is outside the closed set — it is exactly "person", "sla_timeout" or "policy"; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
         }
-        if (decidedBy !== "person" && decision === "allow") {
-            throw new CheckpointError("checkpoint.invalid_outcome", `resume carries decision "allow" decided by "${decidedBy}" — only a person approves an action that EXECUTES, and that word names a decision nobody made; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
-        }
+        const cannotAllow = decision !== "allow"
+            ? undefined
+            : decidedBy === "sla_timeout"
+                ? ` — that word names a wait that ended with nobody answering, and it cannot approve an action that EXECUTES (an allow is decided by "person" or "policy")`
+                : policyCannotAnswer(cp, decidedBy)
+                    ? ` on a row that requires real approval — a policy's answer is not a person's, and this row demands a person (decide it as "person", or refuse it as "policy")`
+                    : undefined;
+        if (cannotAllow !== undefined)
+            throw new CheckpointError("checkpoint.invalid_outcome", `resume carries decision "allow" decided by "${decidedBy}"${cannotAllow}; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
         const attribution = screenApproverAttribution(hostDecisionRaw.approver);
         if (attribution.defect !== undefined) {
             throw new CheckpointError("checkpoint.invalid_outcome", `resume carries an approver attribution this engine refuses: ${attribution.defect}; refusing pre-CAS, the checkpoint stays pending`, { field: "approver" });

package/dist/core/runner/run-attachment-seats.js

@@ -15,7 +15,7 @@ export async function runAttachmentSeats(input) {
     rs.attach.skillsListingOn = rs.attach.attachmentsCfg?.skillsListing !== false && eventDefaultOn("skills_listing");
     const listingsLive = (rs.attach.agentListingOn && prepared.agentListing !== undefined) || (rs.attach.skillsListingOn && prepared.skillsListing !== undefined);
     const backgroundTasksLive = (rs.attach.attachmentsCfg?.backgroundTasks ?? eventDefaultOn("background_tasks")) === true;
-    rs.attach.attachState = rs.attach.attachmentsCfg !== undefined || listingsLive || backgroundTasksLive ? createAttachmentState() : undefined;
+    rs.attach.attachState = rs.attach.attachmentsCfg !== undefined || listingsLive || backgroundTasksLive || prepared.outputStyleFrame !== undefined ? createAttachmentState() : undefined;
     rs.attach.dateState = prepared.dateChange !== undefined ? { announcedDate: prepared.dateChange.anchor?.current?.announcedDate ?? prepared.dateChange.legDate } : undefined;
     rs.attach.instrProbe = runner.deps.probeInstructionSources;
     rs.attach.instrState =

package/dist/core/runner/run-identity-wiring.js

@@ -2,7 +2,9 @@ import { uuidv7 } from "../../internal/harness.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { recordFrameReceipt, toolResultReceiptKey } from "../frame-settlement.js";
 import { discloseDroppedPending, renderTaskNotificationXml, taskNotificationDedupKey } from "../task-notification.js";
-import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
+import { buildAppliedHumanInputEvent } from "../human-input-projection.js";
+import { announceAcceptance, nextHumanInputSeq } from "./steer-admission.js";
+import { deliverDelegationLifecycle, deliverEngineNotice, parentLegIds, undrainedUserInputNotices } from "../types.js";
 export function runIdentityWiring(input) {
     const { spec, queue, prepared, internals, taskIdRef, onReady, manualCompactRef, notifyRef, captureOptOutRef, mcpRedialRef, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef, notificationLane, pendingSessionNotifications, runner } = input;
     notificationLane.harness = prepared.harness;
@@ -59,7 +61,7 @@ export function runIdentityWiring(input) {
             undrainedUserAtEnd = counts;
             return;
         }
-        for (const notice of undrainedUserInputNotices(counts, spec.taskId ?? prepared.sessionId, prepared.sessionId, prepared.runId)) {
+        for (const notice of undrainedUserInputNotices(counts, spec.taskId ?? prepared.sessionId, prepared.sessionId, prepared.runId, parentLegIds(internals))) {
             deliverEngineNotice(runner.deps.onNotice, notice);
         }
     };
@@ -71,6 +73,11 @@ export function runIdentityWiring(input) {
         if (notificationLane.sessionId !== undefined && typeof payload?.task_id === "string" && typeof payload.status === "string")
             pendingSessionNotifications.markDelivered(notificationLane.sessionId, taskNotificationDedupKey(payload));
     };
+    prepared.harness.onUserInputConsumed = (record) => {
+        const steer = record;
+        const identity = announceAcceptance(steer);
+        queue.push({ ...buildAppliedHumanInputEvent({ carrier: "steer", source: "steer", sessionSeq: nextHumanInputSeq(prepared.harness), inputId: steer.inputId, actor: steer.actor, principal: spec.principal }), eventId: uuidv7(), ...identity });
+    };
     prepared.harness.onFrameCommitted = (carrier, entryId) => {
         const seam = prepared.frameSettlement;
         if (seam.awaiting.size === 0)