@sema-agent/core 7.4.0 → 7.5.1

package/dist/core/auto-mode.js

@@ -99,6 +99,23 @@ class AutoModeTimeout extends Error {
         super("auto-mode classify timeout");
     }
 }
+export function readDenialLimitFallback(v) {
+    if (typeof v !== "object" || v === null)
+        return undefined;
+    const o = v;
+    const count = (x) => typeof x === "number" && Number.isFinite(x) && x >= 0;
+    if (!count(o["consecutive"]) || !count(o["total"]) || !count(o["autoDenyAfterMs"]))
+        return undefined;
+    if (o["limit"] !== "consecutive" && o["limit"] !== "total")
+        return undefined;
+    return { consecutive: o["consecutive"], total: o["total"], limit: o["limit"], autoDenyAfterMs: o["autoDenyAfterMs"] };
+}
+export function unarmedWindow(fallback) {
+    return { ...countsOf(fallback), autoDenyAfterMs: 0 };
+}
+function countsOf(fallback) {
+    return { consecutive: fallback.consecutive, total: fallback.total, limit: fallback.limit };
+}
 const MAX_TIMER_DELAY_MS = 2_147_483_647;
 export function createAutoModeDenialTracker(opts = {}) {
     const bound = (name, v, dflt) => {
@@ -121,6 +138,8 @@ export function createAutoModeDenialTracker(opts = {}) {
     let consecutive = 0;
     let total = 0;
     let timedFallbackShown = false;
+    let windowArmedAt;
+    let minted = new WeakSet();
     return {
         recordBlock() {
             consecutive += 1;
@@ -128,23 +147,32 @@ export function createAutoModeDenialTracker(opts = {}) {
             if (consecutive < maxConsecutive && total < maxTotal)
                 return { limitReached: false };
             const totalTripped = total >= maxTotal;
-            const windowMs = timedFallbackShown || totalTripped ? 0 : autoDenyAfterMs;
-            const fallback = { consecutive, total, limit: totalTripped ? "total" : "consecutive", autoDenyAfterMs: windowMs };
+            const fallback = { consecutive, total, limit: totalTripped ? "total" : "consecutive" };
+            minted.add(fallback);
             if (totalTripped) {
                 consecutive = 0;
                 total = 0;
                 timedFallbackShown = false;
-            }
-            else if (windowMs > 0) {
-                timedFallbackShown = true;
+                windowArmedAt = undefined;
+                minted = new WeakSet();
+                minted.add(fallback);
             }
             return { limitReached: true, fallback };
         },
+        armTimedWindow(fallback) {
+            if (!minted.delete(fallback) || fallback.limit === "total" || timedFallbackShown || autoDenyAfterMs === 0)
+                return unarmedWindow(fallback);
+            timedFallbackShown = true;
+            windowArmedAt = Date.now();
+            return { ...countsOf(fallback), autoDenyAfterMs };
+        },
         recordAllow() {
             consecutive = 0;
             timedFallbackShown = false;
+            windowArmedAt = undefined;
+            minted = new WeakSet();
         },
-        snapshot: () => ({ consecutive, total, timedFallbackShown }),
+        snapshot: () => ({ consecutive, total, timedFallbackShown, ...(windowArmedAt !== undefined ? { windowArmedAt } : {}) }),
     };
 }
 export function denialLimitFallbackMessage(fallback, latestBlockedAction) {

package/dist/core/checkpoint-store.d.ts

@@ -439,7 +439,9 @@ export declare function buildRiskDescriptor(input: {
  * refuses to redeem such a row (the governed boundary must not vanish with a deployment's wiring).
  */
 export interface RealApprovalGateBit {
-    origin: "org_rule" | "org_unavailable" | "policy";
+    /** The three members of the closed ask-origin set that can mint the bit — derived FROM that set, so
+     *  the two vocabularies cannot drift into two spellings of one word. */
+    origin: Extract<import("./ask-origin.js").AskOrigin, "org_rule" | "org_unavailable" | "policy">;
 }
 export type CheckpointGate = 
 /** F4: a human (or any external authority) must allow/deny a pending tool call. design/80 §D-E:
@@ -803,6 +805,28 @@ export type PendingAction = {
      *  consent record threads it as `prepareCardApproval`'s `execCwd`. Present only beside
      *  {@link ruleOffers} when the run had a tracked cwd; echo-only, never a control input. */
     execCwd?: string;
+    /** #557 (additive; no checkpoint-version bump — the `previewWithheld` precedent: an optional
+     *  field an older reader ignores and the resume path never reads) — the PARK twin of
+     *  `AskRequest.requiresRealApproval`: present (`true`) ⇔ this parked ask demanded real human
+     *  judgment (the gate's `realApproval` bit was minted — the SAME fact, restated where a card
+     *  reader looks for it, so an inbox needs no gate-kind decoding to say "only a person can clear
+     *  this"). Absent otherwise (never `false`). Display metadata: the resume belts keep reading the
+     *  gate's own bit. */
+    requiresRealApproval?: true;
+    /** #557 (additive, same precedent) — the PARK twin of `AskRequest.denialLimitFallback`: present
+     *  ⇔ this parked ask is the classifier DENIAL-LIMIT fallback, carrying the counts that tripped
+     *  the bound. Its `autoDenyAfterMs` is ALWAYS `0` on a row: the window is a fact of the ask's
+     *  route, armed only at a hand-out to a live approver, and nothing counts down on the parked lane
+     *  — a park's expiry is the row's own `deadline`/ttl, the engine arms NO timer off this row, and
+     *  its settlement never reads as the fallback's auto-deny (see `tool_end.autoDenied`). A durable
+     *  card renders the counts and the limit; it has no countdown to render. Echo-only. */
+    denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** (additive, same precedent) — the PARK twin of `AskRequest.origin`: WHICH AUTHORITY raised the
+     *  parked ask, one word from the closed {@link import("./ask-origin.js").AskOrigin} set, the same
+     *  word the synchronous card is rendered by (engine-stamped at the gate, never a policy's claim).
+     *  Written only when it is a member of the set; a pre-existing row reads absent (unreported).
+     *  Display metadata — the resume belts keep reading the gate's own bit. */
+    origin?: import("./ask-origin.js").AskOrigin;
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -1157,11 +1181,7 @@ export interface CheckpointState {
      * catalog left the tool description with Q4). Absent (older checkpoint / never announced) ⇒ drift
      * undetectable, silent (conservative, same B-5 direction).
      */
-    announcedListings?: {
-        agents?: string[];
-        skills?: string[];
-        models?: string[];
-    };
+    announcedListings?: import("../internal/harness.js").AnnouncedListingSnapshot;
     /**
      * The git-status frame's announced `(kind, hash)` state at suspend (env-tail migration: the
      * run-loop-maintained mirror, advanced at every frame receipt). The LOWEST rung of the resume
@@ -1842,6 +1862,21 @@ export interface CheckpointSummary {
      *  projection's own materials (a pre-#457 row therefore reads absent, which is honest: unreported).
      *  ECHO-ONLY display metadata; nothing gates on it. */
     previewWithheld?: "oversize" | "unavailable";
+    /** #557 — the row's `PendingAction.tool_approval.requiresRealApproval`, projected so the ONE-CALL
+     *  inbox can label "only a person can clear this" without an N+1 `get`. `true` or OMITTED (the
+     *  {@link toolCallId} absence-shape contract); pure echo of the persisted bit — a pre-#557 row reads
+     *  absent, which is honest (unreported), never a claim that budget may clear it. */
+    requiresRealApproval?: true;
+    /** #557 — the row's `PendingAction.tool_approval.denialLimitFallback`, projected BESIDE the preview
+     *  for the same one-call reason: a card that shows the fallback's counts and limit must not re-open
+     *  the row to learn them (`autoDenyAfterMs` is `0` on every row — see the row member). Pure echo;
+     *  OMITTED when the row carries none. */
+    denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** The row's `PendingAction.tool_approval.origin`, projected for the same one-call reason: a card
+     *  rendered by the ask's origin word must not re-open the row to learn it. Echoed ONLY when the stored
+     *  value is a member of the closed set ({@link import("./ask-origin.js").isAskOrigin}) — a bad value
+     *  reads as absent, never as a word. OMITTED when the row carries none (a pre-existing row). */
+    origin?: import("./ask-origin.js").AskOrigin;
     /**
      * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;

package/dist/core/checkpoint-store.js

@@ -2,6 +2,8 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
+import { readDenialLimitFallback } from "./auto-mode.js";
+import { isAskOrigin } from "./ask-origin.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
@@ -262,6 +264,12 @@ export function summarizeCheckpoint(cp) {
             : {}),
         ...(tool?.preview !== undefined ? { preview: tool.preview } : {}),
         ...(tool?.previewWithheld === "oversize" || tool?.previewWithheld === "unavailable" ? { previewWithheld: tool.previewWithheld } : {}),
+        ...(tool?.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+        ...(() => {
+            const fb = readDenialLimitFallback(tool?.denialLimitFallback);
+            return fb !== undefined ? { denialLimitFallback: fb } : {};
+        })(),
+        ...(tool !== undefined && isAskOrigin(tool.origin) ? { origin: tool.origin } : {}),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }

package/dist/core/hooks.d.ts

@@ -962,6 +962,19 @@ export interface ToolGateResult {
      * `tool_end` frame — the machine-readable "why was this refused" a consumer classifies on.
      */
     resolution?: import("./tool-policy.js").AskDenyResolution;
+    /**
+     * `true` ⇔ this BLOCK is the classifier denial-limit fallback's own auto-deny: the ask's window
+     * (`AskRequest.denialLimitFallback.autoDenyAfterMs`) elapsed with nobody answering and the resolver
+     * refused it itself — the same fact the `permissionDenied` observer payload's `autoDenied` carries,
+     * read from the same two places (this gate's own resolution, or the module-private attestation an
+     * inherited arm bound to THIS call). Rides to the call's `tool_end` frame so a consumer can tell
+     * "the classifier fallback's own 120 s window auto-denied" from "the approval factory's own window
+     * (`approvalTimeoutMs`) elapsed" — both settle as `settledBy:"timeout"` / `resolution:"window_expired"`,
+     * and the factory's deadline NEVER carries this. A durable park's expiry settles on the decide lane
+     * with no `resolution` word, so it is told apart by that absence, not by this bit.
+     * Absent everywhere else (a person's no, a policy deny, an executing call).
+     */
+    autoDenied?: true;
     /**
      * design/252 G-7 — WHOSE settlement that was: the identifier the approval channel reported, carried
      * out verbatim beside {@link settledBy}. This layer authenticates nothing and compares nothing; the
@@ -1226,13 +1239,14 @@ export interface ToolGateInput {
      * design/384 slice 1 — the PER-CALL abort signal, carried in from the `tool_call` hook event's
      * own `signal` seat (the loop's turn-scoped controller; the run abort is composed into it). The
      * gate itself never awaits on it — it hands the signal verbatim to the four consuming seats
-     * below (`adjudicate`, `resolveAsk`, `resolveContentAsk`, and — slice 2 — `suspendAsk`, whose
-     * park closure composes it into the halt×park fence) as their optional trailing argument, and
-     * the Runner's closures compose it with the run signal so a turn interrupt (bare halt /
-     * steer-now) releases the wait — or, on the durable leg, makes the park concede. Absent (a host
-     * driving the gate directly, or an unthreaded emit) ⇒ every seat is invoked exactly as before —
-     * same arity, no trailing `undefined` (the threading is a conditional invocation) — and waits
-     * stay bound to the run signal alone: the historical shape, byte-identical.
+     * below: `adjudicate`, `resolveAsk` and `resolveContentAsk` take it as their optional trailing
+     * argument; `suspendAsk` (slice 2) reads it as `carry.signal` inside its structural seat
+     * ({@link AskCarry}), and its park closure composes it into the halt×park fence. The Runner's
+     * closures compose it with the run signal so a turn interrupt (bare halt / steer-now) releases
+     * the wait — or, on the durable leg, makes the park concede. Absent (a host driving the gate
+     * directly, or an unthreaded emit) ⇒ the three synchronous seats are invoked exactly as before —
+     * same arity, no trailing `undefined` (the threading is a conditional invocation) — the carry has
+     * no `signal` member, and waits stay bound to the run signal alone: the historical shape.
      */
     callSignal?: AbortSignal;
     /** The combined tool-policy check (abort-bound), or undefined when no policy is wired (→ allow).
@@ -1321,12 +1335,13 @@ export interface ToolGateInput {
      *  states — every parameter here is positional — and typed `boolean` so a mis-bind against the two
      *  trailing `string` seats is a compile error rather than a silent re-binding. */
     probeMandated?: boolean, 
-    /** design/384 slice 2 — {@link ToolGateInput.callSignal}, threaded VERBATIM as a CONDITIONAL
-     *  trailing argument (the slice-1 arity discipline: absent means the historical arity, never a
-     *  trailing `undefined`). The park closure composes it with the run signal into the halt×park
-     *  fence's cut signal; an implementation that ignores it keeps the run-level binding. APPENDED at
-     *  the tail like its neighbours, and typed `AbortSignal` so a mis-bind is a compile error. */
-    callSignal?: AbortSignal) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
+    /** The ONE structural seat after the twelve positional ones — everything else the park closure needs
+     *  travels inside it ({@link AskCarry}: the per-call signal, the surviving ask's fallback member, its
+     *  origin word), so the tuple does not grow a seat per member. ALWAYS passed by the gate (thirteen
+     *  arguments, every call) — optional on the TYPE only because the ten seats before it are optional and
+     *  a required parameter cannot follow one. The twelve seats above are the historical shape; a host-built
+     *  closure that read the signal as the 13th positional argument now reads `carry.signal`. */
+    carry?: AskCarry) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
     /**
      * design/174 — route a policy `ask` on the reserved question tool to this run's CONTENT-ask channel
      * before it can become a park or a refusal. Called in the `ask` branch with the FINAL post-hook,
@@ -1454,12 +1469,12 @@ export interface ToolGateInput {
      * resolution for safety asks simply does not arm auto mode. The classifier can never AUTO-ALLOW by
      * failing — only an affirmative `<block>no</block>` allows.
      * EXCLUDED from that scope (the ask flows the ORIGINAL chain untouched, exactly as if this field
-     * were absent for that one call): an org-constrained ask (design/182 §7.4, either org arm), the
-     * reserved question tool, a call MARKED unresolvable (design/153), a hook-raised or hook-promoted
-     * ask (`decisionReason:"hook"`), and an ask carrying `matchedAskRule` (an explicit `ask` permission
-     * rule matched — #213: a person's standing "ask me each time" is not classifier hesitation). The
-     * last two are the same pair the persisted-rule lane refuses, so the gate's two ask→allow seams
-     * answer provenance questions identically.
+     * were absent for that one call): every ask whose ORIGIN is not the plain `policy` family — the
+     * closed set and the classifier's per-origin table are in `ask-origin.ts` (an org-constrained ask on
+     * either org arm, the reserved question tool, a call MARKED unresolvable, a hook-raised or
+     * hook-promoted ask, an explicit matched `ask` rule, and the classifier's own denial-limit fallback).
+     * The hook and ask-rule rows are the same pair the persisted-rule lane refuses, so the gate's two
+     * ask→allow seams answer provenance questions identically.
      */
     autoMode?: {
         decider: import("./auto-mode.js").AutoModeDecider;
@@ -1723,6 +1738,35 @@ export declare function persistedRuleMandateOf(marks: {
      *  {@link import("./types.js").ReversibilityVerdict.mandated}. */
     probeMandated?: boolean;
 }): "operator_always" | "tool_marks" | "probe_mandate" | undefined;
+/**
+ * The park closure's ONE structural seat — what the gate hands the durable park beyond the twelve
+ * positional seats. Every member is optional and read by name, so a new thing the park must know
+ * becomes a member here, never a fourteenth positional argument (each of the last four seats was
+ * appended "at the tail so nothing re-binds", which is the growth this seat ends).
+ */
+export interface AskCarry {
+    /** design/384 slice 2 — {@link ToolGateInput.callSignal}, verbatim: the park closure composes it
+     *  with the run signal into the halt×park fence's cut signal. Absent ⇒ the run-level binding alone. */
+    readonly signal?: AbortSignal;
+    /** The surviving ask's `denialLimitFallback` (the classifier denial-limit counts) run through the
+     *  window-less route station ({@link import("./auto-mode.js").unarmedWindow}) when the gate builds the
+     *  carry: a park is not a hand-out to a live approver, so nothing on this lane counts down. The
+     *  decision's member cannot state a window (its type has no such member), and this is the one place
+     *  the `0` a park row shows is written. Persisted on the row so a durable card shows the counts the
+     *  synchronous card shows. Absent then means: not a fallback ask. */
+    readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** The surviving ask's engine-stamped origin word ({@link import("./ask-origin.js").AskOrigin}), persisted
+     *  on the row so a durable card is rendered by the same word the synchronous card is. */
+    readonly origin?: import("./ask-origin.js").AskOrigin;
+}
+/** What a durable row persists of an {@link AskCarry}: the fallback member COPIED (the row never aliases
+ *  the gate's object; its window is already `0` — the gate's carry mint is the one writer of that
+ *  number) and the origin word only when it is a member of the closed set (the carry is typed, but the
+ *  row is the boundary a host reads back through — the same screen the summary applies). */
+export declare function askCarryRowMembers(carry: AskCarry | undefined): {
+    denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    origin?: import("./ask-origin.js").AskOrigin;
+};
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant
  * structural ("a hook's `allow` cannot bypass the policy's `deny`/`ask`"):

package/dist/core/hooks.js

@@ -1,6 +1,7 @@
 import { coreMintedAutoDeniedOf, coreMintedResolutionOf, decisionText, describeThrown, isAskDenyResolution, refuseOutOfContractDecision } from "./tool-policy.js";
 import { brandPolicyAskClass } from "./ask-class.js";
-import { denialLimitFallbackMessage } from "./auto-mode.js";
+import { askOriginOf, classifierMayAnswer, isAskOrigin } from "./ask-origin.js";
+import { denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { mintSystemReminder } from "./reminder-mint.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
@@ -424,6 +425,17 @@ export function persistedRuleMandateOf(marks) {
                     ? "tool_marks"
                     : undefined;
 }
+export function askCarryRowMembers(carry) {
+    if (carry === undefined)
+        return {};
+    return {
+        ...(carry.denialLimitFallback !== undefined ? { denialLimitFallback: { ...carry.denialLimitFallback } } : {}),
+        ...(isAskOrigin(carry.origin) ? { origin: carry.origin } : {}),
+    };
+}
+function parkWith(suspendAsk, parkArgs, carry) {
+    return suspendAsk(...parkArgs, carry);
+}
 export async function runToolGate(input) {
     const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
     const { toolCallId, toolName } = event;
@@ -632,6 +644,11 @@ export async function runToolGate(input) {
     }
     let orgRealApprovalRequired = false;
     let orgAskOrigin;
+    const askOriginFacts = () => ({
+        contentQuestion: toolName === ASK_USER_QUESTION_TOOL_NAME,
+        markedUnresolvable: input.isMarkedUnresolvable?.(input.event.toolCallId) === true,
+        org: orgAskOrigin,
+    });
     let orgTightenCount = 0;
     let resolvedApprover;
     let orgEvidence = (() => {
@@ -798,17 +815,12 @@ export async function runToolGate(input) {
                 };
             }
         }
+        const originFacts = askOriginFacts();
         if (decision.action === "ask") {
-            decision = { ...decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
+            const stamped = { ...decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
+            decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
         }
-        if (input.autoMode &&
-            !orgRealApprovalRequired &&
-            decision.action === "ask" &&
-            decision.decisionReason !== "hook" &&
-            decision.matchedAskRule === undefined &&
-            decision.denialLimitFallback === undefined &&
-            req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
-            input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
+        if (input.autoMode && decision.action === "ask" && decision.origin !== undefined && classifierMayAnswer(decision.origin)) {
             const verdict = await input.autoMode.decider
                 .decide({ req, askMessage: decisionText(decision) }, input.abortSignal)
                 .catch(() => ({ kind: "unavailable", cause: "error" }));
@@ -826,13 +838,14 @@ export async function runToolGate(input) {
                 const category = verdict.category ? inlineUntrusted(verdict.category) : "";
                 const tracked = input.autoMode.denialTracking?.recordBlock();
                 if (tracked?.limitReached === true) {
-                    decision = {
+                    const fallbackAsk = {
                         ...decision,
                         message: denialLimitFallbackMessage(tracked.fallback, reason || category || toolName),
                         decisionReason: "classifier",
                         requiresRealApproval: true,
                         denialLimitFallback: tracked.fallback,
                     };
+                    decision = { ...fallbackAsk, origin: askOriginOf(fallbackAsk, originFacts) };
                     denySource = "classifier";
                 }
                 else {
@@ -875,9 +888,14 @@ export async function runToolGate(input) {
         const realApprovalOf = (d) => d.action === "ask" && d.requiresRealApproval === true
             ? { origin: orgAskOrigin !== undefined ? `org_${orgAskOrigin}` : "policy" }
             : undefined;
+        const carryOf = (d) => ({
+            ...(callSignal !== undefined ? { signal: callSignal } : {}),
+            ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
+            ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
+        });
         if (suspendAsk && decision.action === "ask") {
             const parkArgs = [req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined, decision.action === "ask" ? decision.probeMandated : undefined];
-            const suspended = await (callSignal !== undefined ? suspendAsk(...parkArgs, callSignal) : suspendAsk(...parkArgs));
+            const suspended = await parkWith(suspendAsk, parkArgs, carryOf(decision));
             if (suspended) {
                 if ("parkFailed" in suspended)
                     parkFailed = suspended.parkFailed;
@@ -897,7 +915,7 @@ export async function runToolGate(input) {
                 }
                 if (suspendAsk && outcome.parkDeclined && parkFailed === undefined) {
                     const parkArgs = [req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined, decision.action === "ask" ? decision.probeMandated : undefined];
-                    const suspended = await (callSignal !== undefined ? suspendAsk(...parkArgs, callSignal) : suspendAsk(...parkArgs));
+                    const suspended = await parkWith(suspendAsk, parkArgs, carryOf(decision));
                     if (suspended) {
                         if ("parkFailed" in suspended)
                             parkFailed = suspended.parkFailed;
@@ -932,7 +950,7 @@ export async function runToolGate(input) {
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
                 const parkArgs = [req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined];
-                const suspended = await (callSignal !== undefined ? suspendAsk(...parkArgs, callSignal) : suspendAsk(...parkArgs));
+                const suspended = await parkWith(suspendAsk, parkArgs, carryOf(askBeforeResolve));
                 if (suspended) {
                     if ("parkFailed" in suspended)
                         parkFailed = suspended.parkFailed;
@@ -949,7 +967,7 @@ export async function runToolGate(input) {
                     askDenyResolution === "approver_unavailable" ||
                     resolved.approverUnavailable === true) {
                     try {
-                        input.onHeadlessDenialLimit?.({ toolName, toolCallId, fallback: askBeforeResolve.denialLimitFallback });
+                        input.onHeadlessDenialLimit?.({ toolName, toolCallId, fallback: unarmedWindow(askBeforeResolve.denialLimitFallback) });
                     }
                     catch {
                     }
@@ -1035,6 +1053,7 @@ export async function runToolGate(input) {
                         editRewrittenSinceHuman = true;
                     }
                     const orgTightensBefore = orgTightenCount;
+                    orgAskOrigin = undefined;
                     recheck = await applyOrgLayer(recheck, editArgs);
                     const orgRaisedThisRound = orgTightenCount > orgTightensBefore;
                     if (recheck.action === "deny") {
@@ -1052,7 +1071,8 @@ export async function runToolGate(input) {
                         editArgs = recheck.updatedInput;
                         editRewrittenSinceHuman = true;
                     }
-                    const editAskDecision = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                    const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts()) };
                     const editAskReq = { toolName, args: editArgs, toolCallId };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     resolvedApprover = rr.action !== "ask" ? rr.approver : undefined;
@@ -1105,6 +1125,7 @@ export async function runToolGate(input) {
             reason: formatHookFeedback(denyReason, input.reminderMark),
             ...(denySettledBy !== undefined ? { settledBy: denySettledBy } : {}),
             ...(denyResolution !== undefined ? { resolution: denyResolution } : {}),
+            ...(denyAutoDenied ? { autoDenied: true } : {}),
             ...(denyApprover !== undefined ? { approver: denyApprover } : {}),
             preToolContext,
         };

package/dist/core/mcp.d.ts

@@ -1,58 +1,3 @@
-/**
- * MCP client integration. Protocol revision `2025-11-25`, supplied by `@modelcontextprotocol/sdk` 1.30.0
- * (core pins the SDK EXACTLY and does not negotiate the revision itself). Client side only — core never
- * implements an MCP server.
- *
- * ── DEPRECATION-IMMUNITY REGISTRY (MCP revision `2026-07-28`) ────────────────────────────────────────
- * The `2026-07-28` revision deprecates four surfaces this module has NEVER implemented. That is not an
- * accident and not an unfinished edge: each one was declined on its own merits, and the revision has now
- * put all four on a deprecation clock. So there is no migration debt here — and, symmetrically, none of
- * the four may be "completed" later on the grounds that the client looks incomplete next to the older
- * revision's feature list:
- *
- *  1. **roots** (`roots/list`, `notifications/roots/list_changed`) — never implemented. The replacement the
- *     revision itself names is what this module already does: directory/file scope travels as ordinary tool
- *     arguments or resource URIs, never as a client-hosted root list a server can enumerate.
- *  2. **sampling** (`sampling/createMessage`) — never implemented. A server that wants model inference uses
- *     its own provider; core never lends the caller's model channel (or budget) to a connected server.
- *  3. **logging** (`logging/setLevel`, `notifications/message`) — never implemented. Server diagnostics
- *     arrive as stdio stderr, or as ordinary tool/resource content, or not at all.
- *  4. **HTTP+SSE transport** — never implemented. `buildTransport` builds stdio and Streamable HTTP only;
- *     the SDK's `SSEClientTransport` is not imported anywhere. The revision's SSE off-ramp is therefore a
- *     no-op here.
- *
- * Consequence for future edits: adding any of the four is a REGRESSION, not a gap being closed. The bar for
- * reopening one is a LATER protocol revision that revives the surface, or a concrete consumer requirement
- * recorded under its own ticket — not the absence of the feature.
- *
- * THE `2026-07-28` DELIVERY FORM, and why it does not narrow the four (design/384 §1, §2-J). That revision
- * does not carry `roots/list`, `sampling/createMessage` or `elicitation/create` as standalone JSON-RPC
- * methods at all. Its request-method table (as a 2026-era client dispatches it — CC 2.1.250's bundled era
- * descriptor) is exactly: `tools/call`, `tools/list`, `prompts/get`, `prompts/list`, `resources/list`,
- * `resources/templates/list`, `resources/read`, `completion/complete`, `server/discover`,
- * `subscriptions/listen`. The three arrive instead through a DIFFERENT door — as embedded `inputRequests`
- * inside an `input_required` result of `tools/call` / `prompts/get` / `resources/read`, answered by
- * RETRYING the original request with `inputResponses`.
- *
- * That is a change of DELIVERY FORM ONLY, and it buys no exemption. Items 1 and 2 are reasoned about what
- * the capability MEANS, not about how it is framed on the wire: an embedded `roots/list` enumerates the
- * very root list item 1 refuses to host, and an embedded `sampling/createMessage` spends the very model
- * channel and budget item 2 refuses to lend. So embedded roots/sampling are banned ON THE SAME TERMS and
- * must clear the SAME reopening bar — a new door is not a reason, and "the registry only named the legacy
- * method" is not a loophole. What this paragraph exists to prevent is the OPPOSITE misreading: items 1-4
- * were written against the `2025-11-25` surface and are not themselves a ruling on the 2026 mechanics.
- * `elicitation/create` — which core DOES implement (opt-in, form mode) and which is NOT one of the four —
- * comes through that same door, so an era connection would have to decide how it is driven; that is
- * design/384 P3's question, not this registry's. Nothing here is reachable today: core speaks `2025-11-25`,
- * where all three are standalone methods, and core's `initialize` declares neither `roots` nor `sampling`
- * (pinned).
- *
- * Two more revision-relevant absences, same reasoning, different cause:
- *  - `resources/subscribe` / `resources/unsubscribe` — the revision REMOVES the methods. Tool-list freshness
- *    here is served by the explicit `RefreshMcpTools` tool over the existing connection, which is also the
- *    only thing this module's connect-per-task connection lifetime can honestly support.
- *  - `ping` — likewise removed by the revision. Liveness here is the idle watchdog plus per-call timeouts.
- */
 import { type ProtocolId } from "./protocol-table.js";
 import type { AgentTool } from "../internal/harness-types.js";
 import type { ImageContent, TextContent } from "../internal/llm.js";
@@ -313,6 +258,11 @@ export interface McpServerStatus {
     };
     toolNames?: string[];
     error?: string;
+    /** Present iff `status === "failed"` — the failure's CLASS, judged from the thrown error object at
+     *  connect time ({@link mcpFailureCodeOf}; the closed set is {@link MCP_FAILURE_CODES} plus the
+     *  `http_<status>` form). A consumer keys an action off THIS (a `http_401` is a re-authorization
+     *  door, a `spawn_failed` is a missing binary) instead of parsing the neutralized `error` text. */
+    errorCode?: McpFailureCode;
     /**
      * RB-437-a — set to `true` once core OBSERVES this server's transport close during the task; absent
      * otherwise (never `false`: absence means "no close was observed", which is not the same as "alive").
@@ -460,6 +410,48 @@ export interface HttpTransportFailure {
  * reached them" means.
  */
 export declare function describeHttpTransportFailure(err: unknown): HttpTransportFailure | undefined;
+/**
+ * The closed vocabulary of MCP connect-failure classes a per-server status record may carry
+ * ({@link McpServerStatus.errorCode}, relayed onto the wiring manifest's `mcp[]` read face). The
+ * transport family is named by the failure's SHAPE wherever the SDK exposes one (error class, JSON-RPC
+ * code, errno on the cause chain, HTTP status), so a consumer can map a class to an action without
+ * parsing the neutralized error string. Two words are the exception and are text-derived, because
+ * undici and the SDK surface those two conditions as bare messages with no code: `network` (a
+ * `TypeError` whose message matches `fetch failed|terminated|network` and carries no errno) and the
+ * non-`McpError` arm of `connection_closed` (a message matching `not connected|connection closed`).
+ * A wording change in those libraries moves such a failure to `unknown`, never to a wrong word; the
+ * classifier table pins both regexes. An HTTP endpoint that answered with a status is
+ * reported in the `http_<status>` form (`http_401` = the endpoint wants (re-)authorization, `http_5xx` =
+ * the endpoint is down) — a template member of the type beside these fixed words. Additive-only: a new
+ * word here is a new arm for consumers, never a re-meaning of an existing one.
+ *  · `connect_refused`   — a connect-phase errno (ECONNREFUSED / ENOTFOUND / …): the request provably never left;
+ *  · `connection_failed` — a network errno past the connect phase (reset / timed out mid-exchange);
+ *  · `network`           — the HTTP request failed at the network layer with no errno on the cause chain;
+ *  · `not_mcp_response`  — the HTTP endpoint answered something that is not an MCP payload (no status to name);
+ *  · `spawn_failed`      — a stdio server process could not be started (a missing/unexecutable command);
+ *  · `connection_closed` — the transport closed during the handshake (the server process exited, the stream ended);
+ *  · `timeout`           — the handshake's request timed out;
+ *  · `protocol`          — the server answered the handshake with an MCP/JSON-RPC error (a version mismatch, a
+ *                          rejected capability, …) — `error` carries the named condition;
+ *  · `invalid_config`    — the declaration itself could not be dialed (a malformed `url`): a configuration
+ *                          fault to fix in the spec, never an outage to wait out;
+ *  · `unknown`           — none of the above could be established from the thrown value.
+ */
+export declare const MCP_FAILURE_CODES: readonly ["connect_refused", "connection_failed", "network", "not_mcp_response", "spawn_failed", "connection_closed", "timeout", "protocol", "invalid_config", "unknown"];
+export type McpFailureCode = (typeof MCP_FAILURE_CODES)[number] | `http_${number}`;
+/**
+ * Classify one connect-time failure into {@link McpFailureCode}. Reads the thrown value's SHAPE
+ * (error class, JSON-RPC code, errno on the cause chain, HTTP status) first; only the two
+ * message-shaped conditions named on {@link MCP_FAILURE_CODES} (`network`, the non-`McpError`
+ * `connection_closed`) are decided by a fixed regex over the message, and no other word can be chosen
+ * by message text — a remote's own wording can at most leave a failure at `unknown`.
+ * `transport` disambiguates the errno family: on a stdio server an errno is the child
+ * process failing to spawn, on an HTTP server it is the socket; a caller that could not establish the
+ * kind passes `undefined` and the errno family reads as the transport-neutral `connection_failed`.
+ * Total: every input maps to a word, and `unknown` is the honest word for a value this table cannot
+ * read (a caller must not receive a guess).
+ */
+export declare function mcpFailureCodeOf(err: unknown, transport: "stdio" | "http" | undefined): McpFailureCode;
 export { normalizeNameSegment as normalizeMcpName, clampNameSegment } from "./protocol-naming.js";
 export * from "./image-downsample.js";
 /**