@sema-agent/core 7.4.0 → 7.5.1

package/dist/core/sensitive-path-policy.js

@@ -32,7 +32,7 @@ export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".zsh_history",
 ];
 const CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
-function dataRootSpellings(explicit) {
+export function dataRootSpellings(explicit) {
     const raw = explicit ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
     const home = homedir();
     const tilde = expandHomeTilde(raw, home);

package/dist/core/tool-policy.d.ts

@@ -211,14 +211,18 @@ export type PermissionResult = {
     /** #548 (additive): this ask is the classifier DENIAL-LIMIT fallback — the block that reached a
      *  bound (CC 2.1.250 `FO`, count-then-judge) handed to a person instead of being denied.
      *  ENGINE-STAMPED beside `requiresRealApproval: true` and `decisionReason: "classifier"` at the
-     *  classifier block sites (the gate's own and the inherited-lane arms); carries the counts and
-     *  THIS ask's auto-deny window — see {@link import("./auto-mode.js").DenialLimitFallback}.
-     *  Consumers: the gate's classifier step refuses to re-judge an ask carrying it (the classifier
-     *  already spoke; rules and classifier stand BEFORE this ask, never after), and the ask resolver
-     *  arms its deadline from `autoDenyAfterMs`. Carried onto the approval request. A policy that
-     *  self-declares it only ever opts its own ask OUT of classifier resolution and INTO a bounded
-     *  wait (tightening — the same safe direction as `matchedAskRule`). */
-    denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+     *  classifier block sites (the gate's own and the inherited-lane arms); carries the COUNTS ONLY —
+     *  the auto-deny window is a fact of the ask's ROUTE, so this type has no member to hold one
+     *  ({@link import("./auto-mode.js").UnarmedDenialLimitFallback}) and the window appears first on
+     *  the {@link AskRequest} the mint station builds, iff that request goes to a live function
+     *  approver. Consumers: the gate's classifier step refuses to re-judge an ask carrying it (the
+     *  classifier already spoke; rules and classifier stand BEFORE this ask, never after), and the ask
+     *  resolver arms its deadline from the REQUEST's `autoDenyAfterMs`. Carried onto the approval
+     *  request through one of the two route stations. A policy that self-declares it only ever opts
+     *  its own ask OUT of classifier resolution and INTO the fallback's bounded lane (tightening — the
+     *  same safe direction as `matchedAskRule`); it cannot state a window of its own, because the
+     *  route it would be a window for has not been chosen yet. */
+    denialLimitFallback?: import("./auto-mode.js").UnarmedDenialLimitFallback;
     /** #144 disclosure (additive): a persisted allow rule MATCHED this call but could not clear the
      *  ask, because the ask is MANDATED (operator shellGate:"always", or the tool's own
      *  egress/irreversibility marks) rather than a classifier's hesitation — "allow rules silence
@@ -277,6 +281,17 @@ export type PermissionResult = {
      *  value nobody stamps over can only shrink or annotate the card's ADVISORY offers — every
      *  offered rule still passes the validator at redemption. */
     segmentCoverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
+    /** WHICH AUTHORITY raised this ask — one word from the closed {@link import("./ask-origin.js").AskOrigin}
+     *  set (org rule / org unavailable / hook / explicit ask rule / the classifier's denial-limit
+     *  fallback / the reserved question tool / a marked call / plain policy). ENGINE-STAMPED inside the
+     *  gate at the same single stamp point as `ruleEvidence`, derived from what the gate's own layers
+     *  did ({@link import("./ask-origin.js").askOriginOf}) — a policy that self-declares it is overwritten
+     *  there, so the member is never a channel a policy can loosen through. Consumers: the gate's
+     *  auto-mode classifier step admits an ask by ONE table lookup on this word
+     *  ({@link import("./ask-origin.js").classifierMayAnswer}) instead of a chain of per-kind
+     *  exclusions; an approval surface may render the card by it. Optional on the TYPE only because a
+     *  decision is caller-composable; every ask the gate hands to its resolver carries it. */
+    origin?: import("./ask-origin.js").AskOrigin;
 } | {
     action: "deny";
     updatedInput?: unknown;
@@ -1190,8 +1205,25 @@ export interface AskRequest {
      *  this ask's own auto-deny window. Two readers: a card renders it as a countdown; {@link resolveAsk}
      *  arms its deadline from `autoDenyAfterMs` (> 0 ⇒ an unanswered function approver auto-denies at
      *  that deadline — `settledBy:"timeout"`, `resolution:"window_expired"`, `autoDenied:true`). Filled
-     *  by the gate from the decision, never a caller/worker-settable field. */
+     *  by the gate from the decision, never a caller/worker-settable field. This is the ARMED type: the
+     *  decision's member carries the counts alone, and the only two ways to reach this one are the route
+     *  stations — `AutoModeDenialTracker.armTimedWindow` (a hand-out to a live function approver, the one
+     *  writer of a non-zero window) and `unarmedWindow` (every route that cannot count down). An adapter
+     *  that forwards a decision's member here does not compile, which is the point: the window is the
+     *  route's fact, and forwarding it silently is how a configured window becomes a wait with none. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** (additive) WHICH AUTHORITY raised this ask — the wire twin of the {@link PermissionResult} ask-arm
+     *  member of the same name, one word from the closed {@link import("./ask-origin.js").AskOrigin} set.
+     *  The gate's own mint station copies the engine-stamped word; the three inherited-lane stations
+     *  derive it from the ancestor's decision under the station facts (a self-declared value on that
+     *  decision is never read). An approver renders the card by it; a durable park persists the same word
+     *  on its row (`PendingAction.tool_approval.origin`). Filled by the mint station, never written by a
+     *  caller/worker directly — a policy can only STEER the derivation toward a stricter class by
+     *  self-declaring one of its tighten-only inputs (`decisionReason: "hook"`, `matchedAskRule`,
+     *  `denialLimitFallback`), never toward `policy`; a card that attributes an ask to a hook or a rule is
+     *  therefore reading the deployment's own claim about its own ask, which is the direction that cannot
+     *  loosen anything. */
+    readonly origin?: import("./ask-origin.js").AskOrigin;
     /** Engine-judged risk axes of the action awaiting approval, for the human decision surface: a
      *  coarse `requiresRealApproval` cannot tell "cannot be undone" from "data leaves the machine",
      *  and those call for different scrutiny. Filled by the gate from the SAME resolved axes the
@@ -1383,6 +1415,22 @@ export declare function withDelegationProvenance(onAsk: OnAsk, delegation: AskDe
  * consultation". A non-wrapper value (including `"allow"`/`"deny"`/undefined) is its own identity.
  */
 export declare function askApproverIdentity(onAsk: unknown): unknown;
+/**
+ * Is this `onAsk` seat a LIVE APPROVER — a person the run can actually reach?
+ *
+ * Only a function is. A blanket `"allow"`/`"deny"` string is a policy setting (the same reading the
+ * interaction-posture door gives it), and an absent seat is nobody at all; neither can answer an ask, so
+ * neither may outrank a durable park.
+ *
+ * ONE definition on purpose. Two sites must agree on this — the run's own sync-first decline, and the
+ * mandate frozen into the chain its children inherit — and when they were two hand-written booleans they
+ * drifted: the decline narrowed to the function test while the freeze kept testing mere presence, and
+ * each still read correctly on its own, so nothing pointed at the pair. A blanket seat was therefore not
+ * an approver for the parent's asks and an approver for its children's. Declared here, in the vocabulary
+ * beside {@link askApproverIdentity}, because the two sites are now two prepare phases (the inherited-gate
+ * fold and the wiring station) plus the orchestrator, and each reaches DOWN for the one definition.
+ */
+export declare function isLiveApproverSeat(onAsk: OnAsk | undefined): boolean;
 /** EXACT structural clone for the approval boundary (alias isolation) — fail-closed, never lossy,
  *  never identity: a JSON round-trip would silently DROP unclonable members (presented ≠ executing =
  *  consent misrepresentation) and an identity fallback would hand the approver the live executing

package/dist/core/tool-policy.js

@@ -133,6 +133,10 @@ export function constraintChainDigest(chain) {
 }
 const ALLOW = { action: "allow" };
 const RETIRED_TEXT_FIELD = "reason";
+const RETIRED_WINDOW_MEMBER = "autoDenyAfterMs";
+const RETIRED_WINDOW_MEMBER_DENY_MESSAGE = `a permission decision's "denialLimitFallback" carries "${RETIRED_WINDOW_MEMBER}" — the decision names the counts only; ` +
+    `the auto-deny window is decided by the ask's route (a live approver arms it, every other route runs none) and cannot be ` +
+    `declared by a policy; denied fail-closed rather than silently replacing the declared number`;
 const RETIRED_TEXT_FIELD_DENY_MESSAGE = `a permission decision carries the retired "${RETIRED_TEXT_FIELD}" field — rename it to "message" (the one text field ` +
     `a decision carries); denied fail-closed rather than executing a decision whose text this layer cannot read`;
 export function refuseOutOfContractDecision(d, opts) {
@@ -141,6 +145,10 @@ export function refuseOutOfContractDecision(d, opts) {
     if (Object.prototype.hasOwnProperty.call(d, RETIRED_TEXT_FIELD)) {
         return { action: "deny", message: RETIRED_TEXT_FIELD_DENY_MESSAGE, decisionReason: "rule" };
     }
+    const fb = d.denialLimitFallback;
+    if (typeof fb === "object" && fb !== null && fb.autoDenyAfterMs !== undefined) {
+        return { action: "deny", message: RETIRED_WINDOW_MEMBER_DENY_MESSAGE, decisionReason: "rule" };
+    }
     if (opts?.reasonIsNonInput === true)
         return d;
     const dr = d.decisionReason;
@@ -839,6 +847,9 @@ export function withDelegationProvenance(onAsk, delegation) {
 export function askApproverIdentity(onAsk) {
     return typeof onAsk === "function" ? (delegatedApproverRoot.get(onAsk) ?? onAsk) : onAsk;
 }
+export function isLiveApproverSeat(onAsk) {
+    return typeof onAsk === "function";
+}
 export function tryCloneArgs(v) {
     try {
         const value = structuredClone(v);

package/dist/core/types.d.ts

@@ -662,7 +662,7 @@ export interface ToolExecuteContext {
              * at all; a park under a screening entry announces the requirement on `onError`
              * (classification `screening-constraint-in-durable-chain`) at park time.
              */
-            inheritedGate?: import("./runner/prepare-task.js").InheritedGate;
+            inheritedGate?: import("./runner/contracts.js").InheritedGate;
         };
         /**
          * design/176 — the peer-chain SEED for a message-driven (tier-3) revival: the hop chain of the
@@ -1046,7 +1046,7 @@ export interface ToolExecuteContext {
      * read-only, NEVER a model/tool argument (same posture as {@link activeSkillScope}). Undefined when the
      * tool runs outside a Runner task.
      */
-    inheritedGateForChildren?: () => import("./runner/prepare-task.js").InheritedGate;
+    inheritedGateForChildren?: () => import("./runner/contracts.js").InheritedGate;
     /**
      * design/180 half A — the delegation runtime-provenance ARMING face. Runner-filled; a delegation
      * tool calls it at spawn time: a non-undefined return means this (parent) run is armed (it mounts
@@ -1492,6 +1492,14 @@ export interface AgentDefinition {
 export interface McpServerSpec {
     /** Stable name; tool names are namespaced as `<name>__<tool>` to avoid collisions. */
     name: string;
+    /**
+     * Where this declaration CAME FROM, in the declaring side's own words (a shell's `plugin` / `user` /
+     * `project` / `local` config tiers, or anything else the deployment finds useful). Core reads
+     * nothing off it: it is echoed verbatim (single-line, length-bounded) onto the wiring manifest's
+     * per-server read face (`WiringManifest.mcp[].source`) so a consumer can group servers by their
+     * declaring tier without keeping a side table keyed on names. Optional; absent stays absent.
+     */
+    source?: string;
     transport: {
         kind: "stdio";
         command: string;
@@ -4495,6 +4503,22 @@ export type TaskEvent = ({
      * `settledBy`/reason instead). A consumer must not read a semantic out of the absence.
      */
     resolution?: import("./tool-policy.js").AskDenyResolution;
+    /**
+     * #557 (additive) — `true` ⇔ this frame closes a call the classifier DENIAL-LIMIT fallback ask
+     * auto-denied itself: the ask's own window (`AskRequest.denialLimitFallback.autoDenyAfterMs`,
+     * 120 s by default) elapsed with nobody answering. Such a frame also reads `settledBy:"timeout"`
+     * + `resolution:"window_expired"` — the SAME two words the approval factory's own window
+     * (`createApprovalPolicy.approvalTimeoutMs`) settles with — and this bit is the discriminant: the
+     * factory's deadline never carries it, so a shell that sees the pair without it is looking at the
+     * host-configured approval window having elapsed, and with it at the classifier fallback's own
+     * countdown having run out. A DURABLE park's expiry is neither: it settles on the decide lane with
+     * its own `settledBy`/reason and carries no `resolution` word at all (see that field's doc above).
+     * Minted at the resolver's deadline arm and carried on
+     * the engine-owned settlement sideband (never read out of the tool result, never writable by a
+     * tool or policy — a marker on an executing call is dropped with a defect reported). ABSENT on
+     * everything else; a consumer must not read a semantic out of the absence.
+     */
+    autoDenied?: true;
     /**
      * design/252 G-7 — WHOSE settlement that was: the identifier the approval channel reported for
      * the party that ended this wait, beside the {@link settledBy} word that says what KIND of end
@@ -6872,64 +6896,50 @@ export interface RunnerDeps {
      */
     sessionPolicyStore?: import("./session-policy-store.js").SessionPolicyStore;
     /**
-     * design/179 — persisted ALLOW rules: the standing form of approvals a person already gave, so a command
-     * they confirmed once is not asked about again.
-     *
-     * This is the one seam in this file that LOOSENS, and it is shaped so it can only do so within limits
-     * the engine holds. The provider hands out a READ face anchored to one verified principal. The write
-     * face is an exported BACKEND CONTRACT (ruled 2026-08-10: an out-of-repo store twin builds against the
-     * same definitions instead of mirroring them), but the ENGINE reaches it only on the consent lanes —
-     * redemption of a confirmed human decision, the tighten-delete, and the sync join — a wiring invariant
-     * pinned by a registered-caller scan (test/permission-rule-writer-callers); no exported convenience
-     * mints a rule around consent. Rules are consumed post-fold, in the gate's ask branch, and never
-     * resolve an ask carrying `requiresRealApproval` or one a PreToolUse hook raised.
-     *
-     * Omitted ⇒ the lane does not exist: no rules are read, no field is added to any ask, and the decision
-     * path is byte-identical to a build without it. An unauthenticated task (no `principal`) resolves to
-     * zero rules rather than to a shared bucket, and a store that cannot be read yields zero rules plus a
-     * disclosure — a loosening face fails toward asking.
-     */
-    permissionRuleStore?: import("./permission-rule-store.js").PermissionRuleStoreProvider;
+     * design/389 — the ONE permission-rule seam: the unified store, partitioned by source
+     * (`org | user | project | session`), built by `createPermissionRuleStoreProvider({ durable?, org?, session? })`.
+     *
+     * It is the one seam in this file that LOOSENS, and it is shaped so it can only do so within limits the
+     * engine holds. The provider hands out a store whose ONE read query answers every partition with each
+     * row's source and effective status; the write face is an exported BACKEND CONTRACT for the durable
+     * partition (an out-of-repo store twin builds against the same definitions instead of mirroring them),
+     * but the ENGINE reaches it only on the consent lanes — redemption of a confirmed human decision, the
+     * tighten-delete, and the sync join — a wiring invariant pinned by a registered-caller scan
+     * (test/permission-rule-writer-callers); no exported convenience mints a rule around consent. Personal
+     * rules are consumed post-fold, in the gate's ask branch, and never resolve an ask carrying
+     * `requiresRealApproval` or one a PreToolUse hook raised.
+     *
+     * The ORG partition (present iff the provider was composed with an `org` config — the governance
+     * declaration, design/182 §7.4) is the outermost TIGHTENING authority: every tool call is adjudicated
+     * against the org's published deny/ask snapshot BEFORE the ask-resolution chain (org deny > org ask >
+     * personal allow rule > bare ask), and while the org partition cannot adjudicate the WHOLE decision
+     * boundary fails closed — every terminal allow becomes a real-approval ask and both ask→allow seams are
+     * disarmed. The SESSION partition (present iff composed with one) is where `{kind:"session"}` grants
+     * land and are read from, spliced in front of the durable rows on every adjudication of that session.
+     *
+     * Omitted ⇒ no rule lane, no org layer, no session source: no rules are read, no field is added to any
+     * ask, and the decision path is byte-identical to a build without it. An unauthenticated task (no
+     * `principal`) resolves to zero personal rules rather than to a shared bucket (the org partition still
+     * adjudicates), and a store whose durable partition cannot be read yields zero rules plus a disclosure
+     * — a loosening face fails toward asking.
+     */
+    permissionRuleStore?: import("./permission-rule-provider.js").PermissionRuleStoreProvider;
     /**
      * design/182 §4.5 (F-011) — declare that this deployment keeps its permission rules in the
      * IDENTITY-LESS local bucket: a task with no `principal` resolves rules through the provider's
      * `forLocalOwner()` face instead of resolving to zero rules.
      *
-     * A DECLARATION, never an inference (same rule as {@link permissionRuleOrg}): the local bucket is
-     * "this machine's owner", a fact only the deployment knows. Omitted/`false` ⇒ v1 exactly — an
-     * unauthenticated task reads no rules. Declared `true` while the wired provider has no local-owner
-     * face (or while no provider is wired at all) is a configuration contradiction and is refused loudly
-     * at prepare, rather than silently degrading to "the rules this person approved stopped applying".
+     * A DECLARATION, never an inference: the local bucket is "this machine's owner", a fact only the
+     * deployment knows. Omitted/`false` ⇒ an unauthenticated task reads no rules. Declared `true` while the
+     * wired provider has no local-owner face (or while no provider is wired at all) is a configuration
+     * contradiction and is refused loudly at prepare, rather than silently degrading to "the rules this
+     * person approved stopped applying".
      *
      * A local-owner bucket cannot cloud-sync (syncing is an authenticated act); it is adopted into a
      * principal bucket by `adoptFilePermissionRuleStore`, after which the local-owner face resolves the
      * adopted principal's bucket forever.
      */
     localOwnerRules?: boolean;
-    /**
-     * design/382 §4.3 — the SESSION-RULE OVERLAY: where `{kind:"session"}` scoped allow rules live
-     * (the session's own state, never the persisted store). Wired, the gate's persisted-rule lane
-     * splices the CURRENT session's overlay rows in front of the store's `list()` on every
-     * adjudication — session > project > global, the narrowest-first reporting order — and threads the
-     * session's identity as the eligibility context's third axis; a host lands rows into it through
-     * the consent protocol (`RuleConsentDeps.sessionRules`, a session-scope candidate's redemption).
-     * Omitted ⇒ the session dimension does not exist at this gate and the lane is byte-identical.
-     * See `permission-rule-session.ts` for the contract and the reference implementation.
-     */
-    sessionPermissionRules?: import("./permission-rule-session.js").SessionRuleOverlay;
-    /**
-     * design/182 §7 — the ORG rule overlay for an org-GOVERNED deployment. Constructed with
-     * `createOrgRuleOverlay` (that constructor is the boot gate: a governed declaration with no snapshot
-     * provider refuses to boot), so a value here IS the declaration — nothing is inferred from wiring.
-     *
-     * Present ⇒ every tool call is adjudicated against the org's published deny/ask snapshot BEFORE the
-     * ask-resolution chain (org deny > org ask > personal allow rule > bare ask), and while the overlay
-     * cannot adjudicate (never installed / past the staleness bound / a refused rollback) the WHOLE
-     * decision boundary fails closed: every terminal allow becomes a real-approval ask and both
-     * ask→allow seams are disarmed. Omitted ⇒ the org layer does not exist and the decision path is
-     * byte-identical to a build without it.
-     */
-    permissionRuleOrg?: import("./permission-rule-org.js").OrgRuleOverlay;
     /**
      * design/182 §9 — DECLARE that this deployment drives cloud sync (`syncPermissionRules`) for the
      * wired rule store. Purely a disclosure input: it is reported as `permissionRules.syncWired` on the
@@ -7064,8 +7074,10 @@ export interface RunnerDeps {
          * — the block that reaches a bound is itself the one that becomes an `ask` (the 3rd consecutive
          * block asks). That ask carries `requiresRealApproval: true` (no automatic lane may clear it — not
          * a sandbox admission, not an inherited resolver, not a blanket `onAsk:"allow"`) plus the additive
-         * `denialLimitFallback` member with the counts and its own auto-deny window; an unanswered ask
-         * auto-denies after `autoDenyAfterMs` (default 120s; `0` = no window). A classifier allow, or a
+         * `denialLimitFallback` member with the counts and its own auto-deny window; an ask handed to a LIVE
+         * function approver and left unanswered auto-denies after `autoDenyAfterMs` (default 120s; `0` = no
+         * window) — the window is armed at that hand-out only, so a durably PARKED fallback carries `0`
+         * (nothing counts down on that lane). A classifier allow, or a
          * person's allow of the fallback ask, zeroes the consecutive count; reaching the total bound
          * zeroes everything. With no approver wired at all (headless), the fallback has nowhere to go and
          * the run STOPS with `TaskResult.errorCode = "classifier.denial_limit"` (a notice of the same

package/dist/core/wiring-manifest.d.ts

@@ -22,6 +22,7 @@
  */
 import type { RunnerDeps, TaskSpec } from "./types.js";
 import { type StoreDurability } from "./checkpoint-store.js";
+import type { McpFailureCode } from "./mcp.js";
 export type { StoreDurability };
 /** The manifest-face projection of {@link StoreDurability}: `"declared_durable"` (the name says it —
  *  a DECLARATION relayed, not a verification) vs `"process_local"` (declared so, or fail-closed
@@ -78,6 +79,26 @@ export type ParkLaneReason = "no_checkpoint_store" | "no_durable_approval_opt_in
  */
 export declare const AUTO_MODE_ARM_REASONS: readonly ["armed", "no_intent", "no_face", "denied", "resolver_fault", "latch_open"];
 export type AutoModeArmReason = (typeof AUTO_MODE_ARM_REASONS)[number];
+/**
+ * One declared MCP server's materialization result for THIS leg — the per-server connection-state
+ * read face on {@link WiringManifest.mcp}. `status` is the connect-time verdict of this leg's
+ * materialize (a snapshot, never a heartbeat — the same semantics as `MaterializedMcp.statuses`,
+ * which it is projected from): `connected` (tools listed; `toolCount` = the mounted roster size after
+ * intake), `failed` (the connect or the tool listing threw — `errorCode` names the class, `error` the
+ * neutralized, length-bounded remote text), `skipped` (declared on the spec but this leg produced no
+ * status for it — the materialization did not reach it). `source` is the DECLARING side's own label
+ * (`McpServerSpec.source`: plugin / user / project / local, or anything the deployment writes),
+ * echoed back so a shell can group servers by where the declaration came from; core reads nothing
+ * off it. Ordered as declared.
+ */
+export interface WiringManifestMcpEntry {
+    name: string;
+    source?: string;
+    status: "connected" | "failed" | "skipped";
+    errorCode?: McpFailureCode;
+    error?: string;
+    toolCount: number;
+}
 /**
  * design/173 §2.2/§8.4 — the wiring manifest. Consumers MUST ignore unknown fields
  * (`schemaVersion` bumps only on a semantic break of an EXISTING field). The TaskEvent face is the
@@ -178,8 +199,8 @@ export interface WiringManifest {
          *  reads off the manifest rather than infers. `false` on a deployment that does not sync — same
          *  present-and-false shape as `storeWired`, for the same reason. */
         syncWired: boolean;
-        /** design/182 §7 — this deployment DECLARED org governance (`RunnerDeps.permissionRuleOrg`, whose
-         *  constructor refuses to boot a governed declaration with no snapshot provider). `true` also means
+        /** design/182 §7 / design/389 — this deployment DECLARED org governance (the store was composed with
+         *  an `org` partition, whose constructor refuses a declaration with no snapshot source). `true` also means
          *  the fail-closed availability contract is armed: while no org snapshot can be adjudicated
          *  against, every terminal allow tightens to a real-approval ask. */
         orgGoverned: boolean;
@@ -225,6 +246,19 @@ export interface WiringManifest {
         armed: boolean;
         reason: AutoModeArmReason;
     };
+    /**
+     * EFFECTIVE half only, and ALWAYS present on an engine-minted effective manifest (the `autoMode`
+     * posture: every leg has an answer — an empty array is "this leg declared no servers", absence is
+     * an older mint or an external derivation). The per-server MCP connection-state read face: one
+     * {@link WiringManifestMcpEntry} per server the leg's frozen spec declared, in declaration order,
+     * projected from THIS leg's materialization (`MaterializedMcp.statuses`) — a connect-time snapshot
+     * of "did this leg connect", never a live health signal. A shell that shows per-server state
+     * (connected / failed with a cause a person can act on / tool counts, grouped by declaring
+     * `source`) reads it here instead of inferring from the roster or the failure notices. NOT part of
+     * {@link configFingerprint}: connection state is a fact about this leg's attempt, not about the
+     * assembly, and legs of one assembly must fingerprint alike whether or not a server was up.
+     */
+    mcp?: readonly WiringManifestMcpEntry[];
     /** EFFECTIVE half only — a short, non-sensitive fingerprint (sha256 prefix over the canonical
      *  JSON of this manifest's own resolved facts; every field here is an enum/boolean/count, no
      *  secrets) so an operator can correlate legs that ran under the same resolved assembly. */
@@ -293,10 +327,13 @@ export interface WiringFacts {
         armed: boolean;
         reason: AutoModeArmReason;
     };
+    /** Effective half only — see {@link WiringManifest.mcp}; the static half materializes nothing.
+     *  Copied entry-wise onto the manifest (the caller's array is never aliased). */
+    mcp?: readonly WiringManifestMcpEntry[];
 }
 /** Named view of the deps seats the static half reads (a `Pick` of the real {@link RunnerDeps} —
  *  single-source shapes, no parallel hand-copied interface). */
-export type StaticWiringDeps = Pick<RunnerDeps, "onAsk" | "onQuestion" | "interactionPosture" | "onElicit" | "checkpointStore" | "sessionStore" | "backgroundAgentStore" | "onBackgroundChildEvent" | "lockedConfig" | "compliancePostureResolver" | "memoryScopeAdmission" | "retentionPolicy" | "permissionRuleStore" | "permissionRuleSyncWired" | "permissionRuleOrg">;
+export type StaticWiringDeps = Pick<RunnerDeps, "onAsk" | "onQuestion" | "interactionPosture" | "onElicit" | "checkpointStore" | "sessionStore" | "backgroundAgentStore" | "onBackgroundChildEvent" | "lockedConfig" | "compliancePostureResolver" | "memoryScopeAdmission" | "retentionPolicy" | "permissionRuleStore" | "permissionRuleSyncWired">;
 /** Named view of the spec seats the static half reads (a `Pick` of the real {@link TaskSpec}). */
 export type StaticWiringSpec = Pick<TaskSpec, "onAsk" | "onQuestion" | "checkpointStore" | "durableApproval" | "mcp" | "interactiveTools" | "interactionPosture">;
 /**

package/dist/core/wiring-manifest.js

@@ -126,9 +126,10 @@ export function deriveWiringManifest(facts) {
         },
         ...(facts.half === "effective" && facts.modelGate !== undefined ? { modelGate: { class: facts.modelGate.class, removed: [...facts.modelGate.removed], restore: facts.modelGate.restore } } : {}),
         ...(facts.half === "effective" && facts.autoMode !== undefined ? { autoMode: readAutoModeFact(facts.autoMode) } : {}),
+        ...(facts.half === "effective" && facts.mcp !== undefined ? { mcp: facts.mcp.map((e) => ({ ...e })) } : {}),
     };
     if (facts.half === "effective") {
-        const { leg: _leg, ...assembly } = manifest;
+        const { leg: _leg, mcp: _mcp, ...assembly } = manifest;
         const { provenance: _askSeat, ...askForHash } = assembly.ask;
         const { provenance: _questionSeat, ...questionForHash } = assembly.question;
         manifest.configFingerprint = createHash("sha256")
@@ -211,9 +212,9 @@ export function describeStaticWiring(deps, spec = {}) {
         sessionDurability: resolveDeclaredDurability(deps.sessionStore, "sessionStore"),
         backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
         subagentTranscriptTier: resolveSubagentTranscriptTier(deps.backgroundAgentStore !== undefined, deps.sessionStore),
-        permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
+        permissionRuleStoreWired: deps.permissionRuleStore?.partitions.durable === true,
         permissionRuleSyncWired: deps.permissionRuleSyncWired === true,
-        permissionRuleOrgGoverned: deps.permissionRuleOrg !== undefined,
+        permissionRuleOrgGoverned: deps.permissionRuleStore?.partitions.org === true,
         hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
         lockedConfigWired: deps.lockedConfig !== undefined,
         complianceWired: deps.compliancePostureResolver !== undefined,

package/dist/core/write-protect.d.ts

@@ -57,8 +57,16 @@ export interface WriteProtectionMatcher {
  * Compile the write-protection judge for a deployment configuration. Returns `undefined` when the
  * resolved table is EMPTY (`[]` replacement) — the caller then mounts no tighten at all, keeping an
  * opted-out deployment's decision path byte-identical to a build without this layer.
+ *
+ * `opts.dataRoot` names the engine data root for the passthrough in the module header (same seat and
+ * same meaning as `createSensitivePathPolicy`'s): omitted ⇒ the knob its consumers read
+ * (`$AGENT_DATA_DIR ?? ~/.ai-agent`), read ONCE here at compile so the judge stays pure and
+ * synchronous. The passthrough is a property of the JUDGE, not of the default table — a deployment
+ * that replaces the table wholesale gets the same law over its own rows.
  */
-export declare function compileWriteProtection(entries?: readonly WriteProtectedEntry[]): WriteProtectionMatcher | undefined;
+export declare function compileWriteProtection(entries?: readonly WriteProtectedEntry[], opts?: {
+    dataRoot?: string;
+}): WriteProtectionMatcher | undefined;
 /**
  * Build the ENGINE-FILLED gate input (`ToolGateInput.writeProtectionCheck`): covered tools are the
  * path-confinable write set (Write/Edit/NotebookEdit — the shared spelling), the judged target is
@@ -69,5 +77,8 @@ export declare function compileWriteProtection(entries?: readonly WriteProtected
  * the tool's own schema validation refuses it before any write); the fail-closed treatment of the
  * unresolvable case belongs to the containment gates (fs-write-gate-policy documents that split).
  * Returns `undefined` when the resolved table is empty — nothing to judge, mount nothing.
+ * `opts.dataRoot` is the judge's own seat, passed straight through ({@link compileWriteProtection}).
  */
-export declare function createWriteProtectionCheck(entries?: readonly WriteProtectedEntry[]): ((toolName: string, args: unknown) => WriteProtectedHit | null) | undefined;
+export declare function createWriteProtectionCheck(entries?: readonly WriteProtectedEntry[], opts?: {
+    dataRoot?: string;
+}): ((toolName: string, args: unknown) => WriteProtectedHit | null) | undefined;

package/dist/core/write-protect.js

@@ -1,5 +1,6 @@
-import { writeTargetPath } from "../tools/fs/safety.js";
+import { isWinFormPath, writeTargetPath, isUncPath } from "../tools/fs/safety.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./runner/session-rule-policy.js";
+import { dataRootSpellings } from "./sensitive-path-policy.js";
 const freezeTable = (rows) => Object.freeze(rows.map((r) => Object.freeze(r)));
 export const WRITE_PROTECTED_DEFAULT_TABLE = freezeTable([
     { name: ".gitconfig", kind: "basename" },
@@ -51,6 +52,8 @@ export const WRITE_PROTECTED_DEFAULT_TABLE = freezeTable([
     { name: ".config/git", kind: "segment-run" },
     { name: ".ssh", kind: "segment" },
     { name: ".gnupg", kind: "segment" },
+    { name: ".sema.json", kind: "basename" },
+    { name: ".sema", kind: "segment" },
 ]);
 export function foldWriteProtectCase(s) {
     return s.toLowerCase().replace(/ı/g, "i").replace(/ſ/g, "s");
@@ -110,10 +113,56 @@ export function resolveWriteProtectedTable(entries) {
     }
     return freezeTable(out);
 }
-export function compileWriteProtection(entries) {
+function pathViewSegments(path, win32, seps = BOTH_SEPARATOR_FAMILIES, anchorFloor = 0) {
+    const segs = [];
+    for (const raw of path.split(seps)) {
+        if (raw.length === 0)
+            continue;
+        const dot = !win32 || /^\.{1,2}$/.test(raw) ? raw : raw.replace(/ +$/, "");
+        if (dot === ".")
+            continue;
+        if (dot === "..") {
+            const last = segs[segs.length - 1];
+            if (segs.length > anchorFloor && last !== "..")
+                segs.pop();
+            else if (segs.length > anchorFloor || anchorFloor === 0)
+                segs.push("..");
+            continue;
+        }
+        const stripped = win32 ? raw.replace(/[. ]+$/, "") : raw;
+        segs.push(stripped.length > 0 ? stripped : raw);
+    }
+    return segs;
+}
+const BOTH_SEPARATOR_FAMILIES = /[\\/]/;
+const POSIX_SEPARATOR_FAMILY = /\//;
+function uncAnchorSegments(path) {
+    const third = path[2];
+    return isUncPath(path) && third !== undefined && third !== "\\" && third !== "/" ? 2 : 0;
+}
+function relativeUnderDataRoot(path, roots) {
+    for (const root of roots) {
+        if (root.segments.length === 0)
+            continue;
+        if (root.win ? !isWinFormPath(path) : isWinFormPath(path) || !path.startsWith("/"))
+            continue;
+        const seps = root.win ? BOTH_SEPARATOR_FAMILIES : POSIX_SEPARATOR_FAMILY;
+        const segs = pathViewSegments(path, false, seps, uncAnchorSegments(path));
+        if (segs.length < root.segments.length)
+            continue;
+        if (root.segments.every((s, i) => segs[i] === s))
+            return segs.slice(root.segments.length).join("/");
+    }
+    return null;
+}
+export function compileWriteProtection(entries, opts) {
     const rows = resolveWriteProtectedTable(entries);
     if (rows.length === 0)
         return undefined;
+    const rootViews = dataRootSpellings(opts?.dataRoot).map((r) => {
+        const win = isWinFormPath(r);
+        return { win, segments: pathViewSegments(r, false, win ? BOTH_SEPARATOR_FAMILIES : POSIX_SEPARATOR_FAMILY, uncAnchorSegments(r)) };
+    });
     const basenames = new Map();
     const segments = new Map();
     const runs = [];
@@ -134,30 +183,11 @@ export function compileWriteProtection(entries) {
     return {
         rows,
         matchPath(path) {
-            const viewOf = (win32) => {
-                const segs = [];
-                for (const raw of path.split(/[\\/]/)) {
-                    if (raw.length === 0)
-                        continue;
-                    const dot = !win32 || /^\.{1,2}$/.test(raw) ? raw : raw.replace(/ +$/, "");
-                    if (dot === ".")
-                        continue;
-                    if (dot === "..") {
-                        const last = segs[segs.length - 1];
-                        if (segs.length > 0 && last !== "..")
-                            segs.pop();
-                        else
-                            segs.push("..");
-                        continue;
-                    }
-                    const stripped = win32 ? raw.replace(/[. ]+$/, "") : raw;
-                    segs.push(foldWriteProtectCase(stripped.length > 0 ? stripped : raw));
-                }
-                return segs;
-            };
-            const judge = (segs) => {
-                if (segs.length === 0)
+            const judged = relativeUnderDataRoot(path, rootViews) ?? path;
+            const judge = (raw) => {
+                if (raw.length === 0)
                     return null;
+                const segs = raw.map(foldWriteProtectCase);
                 const base = basenames.get(segs[segs.length - 1] ?? "");
                 if (base !== undefined)
                     return { name: base, kind: "basename" };
@@ -175,13 +205,12 @@ export function compileWriteProtection(entries) {
                 }
                 return null;
             };
-            const posix = viewOf(false);
-            return judge(posix) ?? judge(viewOf(true));
+            return judge(pathViewSegments(judged, false)) ?? judge(pathViewSegments(judged, true));
         },
     };
 }
-export function createWriteProtectionCheck(entries) {
-    const matcher = compileWriteProtection(entries);
+export function createWriteProtectionCheck(entries, opts) {
+    const matcher = compileWriteProtection(entries, opts);
     if (matcher === undefined)
         return undefined;
     return (toolName, args) => {