@sema-agent/core 7.4.0 → 7.5.1

package/dist/core/permission-rule-provider.js

@@ -0,0 +1,148 @@
+import { escapeForDisclosure } from "./permission-rule-model.js";
+import { PERMISSION_RULE_WRITER, errText, normalizePersistedRule, sameScope, writerOf, } from "./permission-rule-store.js";
+import { UNGOVERNED_ORG_RESOLUTION, compileOrgShadowPredicate, createOrgRulePartition } from "./permission-rule-org.js";
+export function ruleSourceOf(scope) {
+    return scope.kind === "global" ? "user" : scope.kind;
+}
+function usableSessionId(sessionId) {
+    return typeof sessionId === "string" && sessionId !== "" ? sessionId : undefined;
+}
+const EMPTY_DURABLE = { rules: [], tombstones: [], rev: 0 };
+export function createPermissionRuleStoreProvider(cfg) {
+    if (cfg === null || typeof cfg !== "object") {
+        throw new Error("createPermissionRuleStoreProvider takes a config object naming the partitions to compose");
+    }
+    const durable = cfg.durable;
+    const org = cfg.org !== undefined ? createOrgRulePartition(cfg.org) : undefined;
+    const session = cfg.session;
+    if (session !== undefined && (typeof session.read !== "function" || typeof session.apply !== "function")) {
+        throw new Error("the session partition must implement read(sessionId) and apply(sessionId, add) — refusing a partial face rather than serving a session source that cannot answer");
+    }
+    const partitions = Object.freeze({ durable: durable !== undefined, org: org !== undefined, session: session !== undefined });
+    const storeOver = (partition) => new UnifiedPermissionRuleStore(partition, org, session);
+    const provider = {
+        partitions,
+        forPrincipal: (principal) => storeOver(durable?.forPrincipal(principal)),
+        ...(durable?.forLocalOwner !== undefined ? { forLocalOwner: () => storeOver(durable.forLocalOwner()) } : {}),
+    };
+    return provider;
+}
+class UnifiedPermissionRuleStore {
+    durable;
+    org;
+    session;
+    durability;
+    fidelity;
+    constructor(durable, org, session) {
+        this.durable = durable;
+        this.org = org;
+        this.session = session;
+        this.durability = durable?.durability ?? "process-local";
+        this.fidelity = durable?.fidelity;
+        if (durable?.quarantined !== undefined) {
+            this.quarantined = () => durable.quarantined();
+        }
+        if (durable !== undefined) {
+            Object.defineProperty(this, PERMISSION_RULE_WRITER, {
+                get: () => {
+                    const w = writerOf(durable);
+                    return w === undefined ? undefined : routingWriter(w, session);
+                },
+                enumerable: false,
+            });
+        }
+    }
+    quarantined;
+    async effective(query) {
+        const disclosures = [];
+        const [orgSettled, durableSettled, sessionRows] = await Promise.all([
+            this.org !== undefined ? this.org.resolve() : Promise.resolve({ ...UNGOVERNED_ORG_RESOLUTION, rules: [], disclosures: [] }),
+            this.durable !== undefined ? this.durable.list().then((v) => ({ ok: true, v }), (e) => ({ ok: false, e })) : Promise.resolve({ ok: true, v: EMPTY_DURABLE }),
+            this.readSessionRows(usableSessionId(query?.sessionId), disclosures),
+        ]);
+        const orgResolution = orgSettled;
+        if (!durableSettled.ok) {
+            return { rules: [], removed: [], org: orgResolution, rev: 0, disclosures, unreadable: errText(durableSettled.e) };
+        }
+        const durableRead = durableSettled.v;
+        const shadowed = compileOrgShadowPredicate(orgResolution.rules);
+        const rules = [];
+        for (const r of [...sessionRows, ...durableRead.rules]) {
+            rules.push({ ...r, source: ruleSourceOf(r.scope), status: shadowed(r) ? "shadowed-by-org" : "live" });
+        }
+        const removed = [];
+        for (const t of durableRead.tombstones) {
+            if (durableRead.rules.some((r) => r.rule === t.rule && sameScope(r.scope, t.scope)))
+                continue;
+            if (removed.some((e) => e.rule === t.rule && sameScope(e.scope, t.scope)))
+                continue;
+            if (t.scope.kind === "session")
+                continue;
+            removed.push({ rule: t.rule, scope: t.scope, source: ruleSourceOf(t.scope), status: "removed" });
+        }
+        return { rules, removed, org: orgResolution, rev: durableRead.rev, disclosures };
+    }
+    async readSessionRows(sessionId, disclosures) {
+        if (this.session === undefined || sessionId === undefined)
+            return [];
+        try {
+            const served = structuredClone(await this.session.read(sessionId));
+            const rows = served.filter((r) => {
+                const scope = r?.scope;
+                return scope?.kind === "session" && scope.sessionId === sessionId && !("reject" in normalizePersistedRule(r));
+            });
+            if (rows.length < served.length) {
+                disclosures.push(`the session rule partition served ${served.length - rows.length} row(s) that are not canonical session rows of this session — dropped, not adjudicated`);
+            }
+            return rows;
+        }
+        catch (err) {
+            disclosures.push(`the session rule partition could not be read: ${escapeForDisclosure(errText(err))}`);
+            return [];
+        }
+    }
+}
+function routingWriter(durable, session) {
+    return {
+        nextDot: () => durable.nextDot(),
+        readRaw: () => durable.readRaw(),
+        apply: async (delta, opts) => {
+            const scope = delta.kind === "redemption-add" ? structuredClone(delta.scope) : undefined;
+            if (delta.kind !== "redemption-add" || scope?.kind !== "session")
+                return durable.apply(delta, opts);
+            if (session === undefined) {
+                const e = new Error("a session-scope rule has nowhere to land — this deployment configured no session rule partition (createPermissionRuleStoreProvider({ session })); refusing the redemption-add");
+                e.code = "unsupported.session_scope_store";
+                throw e;
+            }
+            const outcome = await session.apply(scope.sessionId, { rule: delta.rule, tool: delta.tool, match: delta.match, command: delta.command, add: delta.add });
+            return "refused" in outcome ? { refused: "session_ended", rev: opts.expectedRev } : { rev: opts.expectedRev };
+        },
+    };
+}
+export async function effectiveOrThrow(store, query) {
+    const view = await store.effective(query);
+    if (view.unreadable !== undefined)
+        throw new Error(view.unreadable);
+    return view;
+}
+export async function effectivePermissionRules(opts) {
+    return await resolveOwnerStore(opts).effective(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : undefined);
+}
+export function resolveOwnerStore(opts) {
+    if (opts.owner !== undefined && opts.owner.kind === "local-owner") {
+        if (opts.principal !== undefined) {
+            throw new Error("pass either a principal or a local-owner, not both — a bucket has one owner");
+        }
+        const store = opts.provider.forLocalOwner?.();
+        if (store === undefined) {
+            throw new Error("this provider has no local-owner bucket (forLocalOwner is not implemented)");
+        }
+        return store;
+    }
+    if (opts.owner !== undefined && opts.owner.kind === "principal" && opts.principal !== undefined && opts.owner.principal !== opts.principal) {
+        throw new Error(`contradictory identity: principal "${escapeForDisclosure(opts.principal)}" and owner principal "${escapeForDisclosure(opts.owner.principal)}" disagree`);
+    }
+    const principal = opts.owner?.kind === "principal" ? opts.owner.principal : opts.principal;
+    return opts.provider.forPrincipal(principal);
+}

package/dist/core/permission-rule-session.d.ts

@@ -1,12 +1,14 @@
 /**
- * design/382 §4.3 — the SESSION-RULE OVERLAY: where a `{kind:"session"}` scoped allow rule lives.
+ * design/382 §4.3 / design/389 — the SESSION partition of the permission-rule store: where a
+ * `{kind:"session"}` scoped allow rule lives.
  *
- * A session authorization's home is the session's own state — never the persisted store. The rows are
- * ordinary {@link PersistedAllowRule}s (scope `session`), so every read-side consumer — the gate's
- * conjunction arm, the coverage table, the consent prepare — takes them through the ONE eligibility
- * predicate with zero second judges: the merge point splices overlay rows IN FRONT of the persisted
- * `list()` (the §4.1 narrowest-first reporting order: session > project > global), and everything
- * downstream is unchanged.
+ * A session authorization's home is the session's own lifetime — never the durable CRDT partition. The
+ * rows are ordinary {@link PersistedAllowRule}s (scope `session`), and the unified store's ONE read
+ * query (`PermissionRuleStore.effective({ sessionId })`) splices this partition's rows IN FRONT of the
+ * durable partition's (the §4.1 narrowest-first reporting order: session > project > global), so every
+ * read-side consumer — the gate's conjunction arm, the coverage table, the consent prepare — takes them
+ * through the ONE eligibility predicate with zero second judges. The store's routing writer lands a
+ * session-scope `redemption-add` here; the durable partition never sees one.
  *
  * ## The contract (design/382 §8-Q6, settled here)
  *
@@ -20,7 +22,7 @@
  *
  * There is deliberately NO delete verb: a session row is not individually deletable — it dies with
  * its session (design/382 §10, ruled). Termination is the HOST's act on its own implementation (see
- * {@link InMemorySessionRuleOverlay.endSession}), not an engine verb.
+ * {@link InMemorySessionRulePartition.endSession}), not an engine verb.
  *
  * ## Lifecycle and durability
  *
@@ -32,7 +34,7 @@
  *
  * ## What this is NOT
  *
- * Not a store backend: no dots are minted here (the redemption leg mints the audit dot exactly as the
+ * Not a durable backend: no dots are minted here (the redemption leg mints the audit dot exactly as the
  * store leg does), no tombstones exist here, nothing here syncs. Every durable entrance — write
  * deltas, sync in both directions, at-rest bytes — refuses or drops a session row
  * (`permission-rule-store.ts`, the durable two-member face); this module is the OTHER side of that
@@ -43,7 +45,7 @@ import type { PersistedAllowRule, RuleAdd, PersistedRuleMatch, PersistedRuleTool
  *  redemption's own add (dot + provenance) — the same fields a `redemption-add` delta carries, minus
  *  the scope (the verb's `sessionId` IS the scope, constructed here so a caller cannot land a row
  *  whose scope names a different session than the one it addressed). */
-export interface SessionRuleOverlayAdd {
+export interface SessionRuleAdd {
     rule: string;
     tool: PersistedRuleTool;
     match: PersistedRuleMatch;
@@ -52,21 +54,23 @@ export interface SessionRuleOverlayAdd {
 }
 /** What one overlay apply answered. `session_ended` is the epoch fence speaking: the write arrived at
  *  (or after) termination and landed nothing — the redemption reports the member `refused`. */
-export type SessionRuleOverlayApplyResult = {
+export type SessionRuleApplyResult = {
     landed: true;
 } | {
     refused: "session_ended";
 };
 /**
- * The host-provided seam the consent lane and the gate's rule lane consume
- * (`RuleConsentDeps.sessionRules`, `RunnerDeps.sessionPermissionRules`). See the module doc for the
- * contract; {@link InMemorySessionRuleOverlay} is the reference implementation and the semantics.
+ * The session partition a deployment hands to `createPermissionRuleStoreProvider({ session })`. See the
+ * module doc for the contract; {@link InMemorySessionRulePartition} is the reference implementation and
+ * the semantics. A backend that keeps a session's rows beside its own session record (a host whose
+ * sessions are durable) may implement this over that storage — the law is LIFETIME-bound, not
+ * medium-bound: no tombstones, no sync, nothing outlives the session.
  */
-export interface SessionRuleOverlay {
+export interface SessionRulePartition {
     /** The live session-scoped rows of ONE session. An ended (or never-written) session reads as `[]`. */
     read(sessionId: string): Promise<readonly PersistedAllowRule[]>;
     /** Land one redeemed authorization — idempotent by dot, refused once the session ended. */
-    apply(sessionId: string, add: SessionRuleOverlayAdd): Promise<SessionRuleOverlayApplyResult>;
+    apply(sessionId: string, add: SessionRuleAdd): Promise<SessionRuleApplyResult>;
 }
 /**
  * The reference overlay — in-memory, per-process, the semantics every host implementation must keep:
@@ -85,7 +89,7 @@ export interface SessionRuleOverlay {
  *    checkpoint is host-owned bytes, and a global row smuggled through this door would ride the
  *    merge point straight into adjudication).
  */
-export declare class InMemorySessionRuleOverlay implements SessionRuleOverlay {
+export declare class InMemorySessionRulePartition implements SessionRulePartition {
     private readonly rows;
     private readonly sealed;
     /** How many times one session's row set has CHANGED. Reading a caller-owned value runs caller code,
@@ -96,7 +100,7 @@ export declare class InMemorySessionRuleOverlay implements SessionRuleOverlay {
     private readonly epochs;
     private bumpEpoch;
     read(sessionId: string): Promise<readonly PersistedAllowRule[]>;
-    apply(sessionId: string, add: SessionRuleOverlayAdd): Promise<SessionRuleOverlayApplyResult>;
+    apply(sessionId: string, add: SessionRuleAdd): Promise<SessionRuleApplyResult>;
     /**
      * The termination transfer: SEAL the lifetime epoch first (one atomic membership flip — after this
      * line every in-flight `apply` holding this id answers `session_ended`), THEN drop the rows. The
@@ -116,7 +120,7 @@ export declare class InMemorySessionRuleOverlay implements SessionRuleOverlay {
      * rows (rule text parses, canonical spelling, stored tool/match/command agree with the text): this
      * door takes host-owned checkpoint bytes with no redemption validator in front of them, and a row
      * the engine could not re-project would otherwise sit one merge away from adjudication. Rows this
-     * overlay landed itself always pass — {@link InMemorySessionRuleOverlay.apply} runs the same screen,
+     * overlay landed itself always pass — {@link InMemorySessionRulePartition.apply} runs the same screen,
      * so the two doors agree on what a session row is and a snapshot of this overlay always restores —
      * which is what makes a refusal here foreign damage, refused whole.
      */

package/dist/core/permission-rule-session.js

@@ -7,7 +7,7 @@ function isValidOverlayAdd(add) {
         return false;
     return typeof a.createdAt === "string";
 }
-export class InMemorySessionRuleOverlay {
+export class InMemorySessionRulePartition {
     rows = new Map();
     sealed = new Set();
     epochs = new Map();
@@ -24,15 +24,15 @@ export class InMemorySessionRuleOverlay {
         if (this.sealed.has(sessionId))
             return { refused: "session_ended" };
         if (!isValidOverlayAdd(add?.add)) {
-            throw new Error("SessionRuleOverlay.apply was handed a malformed add (dot/origin/createdAt) — evidence this shape cannot vouch for must not install");
+            throw new Error("SessionRulePartition.apply was handed a malformed add (dot/origin/createdAt) — evidence this shape cannot vouch for must not install");
         }
         const scope = { kind: "session", sessionId };
         if (!isValidConsentScope(scope)) {
-            throw new Error("SessionRuleOverlay.apply was addressed with an unusable session id — a session nobody can name is not a scope a grant can live under");
+            throw new Error("SessionRulePartition.apply was addressed with an unusable session id — a session nobody can name is not a scope a grant can live under");
         }
         const projected = { rule: add.rule, tool: add.tool, match: add.match, command: add.command, scope, adds: [add.add] };
         if ("reject" in normalizePersistedRule(projected)) {
-            throw new Error("SessionRuleOverlay.apply was handed a row whose text/metadata do not survive the canonical re-projection — a row the engine cannot re-project can never adjudicate, and would refuse its own restore");
+            throw new Error("SessionRulePartition.apply was handed a row whose text/metadata do not survive the canonical re-projection — a row the engine cannot re-project can never adjudicate, and would refuse its own restore");
         }
         const rows = this.rows.get(sessionId) ?? [];
         if (!this.rows.has(sessionId))
@@ -41,7 +41,7 @@ export class InMemorySessionRuleOverlay {
         for (const [heldSession, heldRows] of this.rows) {
             const holder = heldRows.find((r) => r.adds.some(sameDotAs));
             if (holder !== undefined && (heldSession !== sessionId || holder.rule !== add.rule)) {
-                throw new Error(`SessionRuleOverlay.apply: dot ${add.add.dot.actor}#${add.add.dot.counter} already vouches for another grant — a dot identifies one add of one (rule, session), ever`);
+                throw new Error(`SessionRulePartition.apply: dot ${add.add.dot.actor}#${add.add.dot.counter} already vouches for another grant — a dot identifies one add of one (rule, session), ever`);
             }
         }
         const existing = rows.find((r) => r.rule === add.rule);

package/dist/core/permission-rule-store.d.ts

@@ -1,5 +1,13 @@
 /**
- * design/179 §8 — the persisted allow-rule store seam, its backend write face, and the removal entry.
+ * design/179 §8 / design/389 — the DURABLE partition of the permission-rule store (the OR-Set CRDT that
+ * holds the `user` and `project` sources), its backend write face, the pure fold/join law every backend
+ * shares, and the removal entry.
+ *
+ * The host-visible STORE is `permission-rule-provider.ts` (`PermissionRuleStore` — one read query over
+ * the four source partitions). What lives here is the partition a backend implements: `list()` over one
+ * owner's bucket, the writer handle, and the delta semantics. A backend author implements
+ * {@link DurableRulePartitionProvider}; the engine composes it into the store with
+ * `createPermissionRuleStoreProvider`.
  *
  * ## Two faces, deliberately unequal
  *
@@ -47,13 +55,15 @@ export interface StoredAllowRules {
     checksum?: string;
 }
 /**
- * The host-visible store face: read-only, already anchored to a single principal.
+ * The durable partition's read face: read-only, already anchored to a single owner. Rows carry the two
+ * durable scopes only (`global` = the `user` source, `project` = the `project` source); a session row
+ * never lives here (design/382 §4.3 — the durable two-member face).
  *
  * A backend that fails to read must not silently report an empty set as if it were an empty store — it
- * throws, and the lane's caller turns that into zero rules PLUS a loud disclosure. Both outcomes deny
+ * throws, and the store's caller turns that into zero rules PLUS a loud disclosure. Both outcomes deny
  * more than they allow; only one of them is honest about why.
  */
-export interface PermissionRuleStore {
+export interface DurableRulePartition {
     list(): Promise<StoredAllowRules>;
     /**
      * design/182 §5.2/§8.3 — the quarantine area, for introspection. Rows a sync round moved out of the
@@ -83,16 +93,18 @@ export type RuleOwner = {
 };
 /** Do two owners name the same bucket? */
 export declare function sameRuleOwner(a: RuleOwner, b: RuleOwner): boolean;
-/** Resolves a store for one verified principal. `undefined` ⇒ a store that reports zero rules. */
-export interface PermissionRuleStoreProvider {
-    forPrincipal(principal: string | undefined): PermissionRuleStore;
+/** Resolves one owner's durable partition. `undefined` ⇒ a partition that reports zero rules. This is
+ *  the BACKEND contract (file, in-memory, an out-of-repo SQL twin); the engine never consumes it
+ *  directly — `createPermissionRuleStoreProvider({ durable })` composes it into the unified store. */
+export interface DurableRulePartitionProvider {
+    forPrincipal(principal: string | undefined): DurableRulePartition;
     /**
      * design/182 §4.5 (F-011) — the identity-less LOCAL bucket, for a deployment that explicitly declared
      * local-owner rules. Optional and additive: a provider without it simply has no local-owner form.
      * A file backend resolves a FIXED file name (never a principal-hash path), and after an adoption
      * completed it resolves the ADOPTED principal's bucket forever — the retired bucket never revives.
      */
-    forLocalOwner?(): PermissionRuleStore;
+    forLocalOwner?(): DurableRulePartition;
 }
 /** The outcome of one accepted write. `sync` is present only on a `sync-join` delta — the landing
  *  report the disclosure layer reads (design/182 §8.1: quarantine/fence details ride the PutResult). */
@@ -100,6 +112,21 @@ export interface PutResult {
     rev: number;
     sync?: RuleSyncLandingReport;
 }
+/**
+ * What one `apply` answers. `conflict` is the durable partition's compare-and-set losing; `refused` is
+ * the SESSION partition's epoch fence speaking (design/382 §4.3, carried through the unified store's
+ * routing writer): a `redemption-add` whose scope names a session that has ended lands nothing — the
+ * redemption reports the member `refused`, never a silent success and never a resurrected row. A
+ * durable backend never answers `refused` (it holds no session partition); the member exists on the
+ * union so the ONE write path the consent protocol takes has one result vocabulary.
+ */
+export type RuleWriteOutcome = PutResult | {
+    conflict: true;
+    rev: number;
+} | {
+    refused: "session_ended";
+    rev: number;
+};
 /** Authorization accompanying an add: the redemption that produced it. Carrying the record id makes the
  *  add's logical operation identity checkable at the backend, not just at the caller. A v1 caller
  *  carries `principal`; the local-owner path (design/182 §4.5) carries `owner` instead — never both
@@ -179,10 +206,7 @@ export interface PermissionRuleWriter {
     nextDot(): Promise<RuleDot>;
     apply(delta: RuleWriteDelta, opts: {
         expectedRev: number;
-    }): Promise<PutResult | {
-        conflict: true;
-        rev: number;
-    }>;
+    }): Promise<RuleWriteOutcome>;
     /**
      * design/182 §4.2 — the RAW state a sync round exchanges: adds with tombstoned dots NOT pre-filtered
      * (list() filters; a join must not), plus the replica identity, the minted-counter high water and the
@@ -209,12 +233,14 @@ export interface RawRuleSyncState {
  * the consent boundary lives in the engine's wiring, not in this key's visibility).
  */
 export declare const PERMISSION_RULE_WRITER = "__semaPermissionRuleWriter";
-/** A store that also carries the backend write face. */
-export interface WritablePermissionRuleStore extends PermissionRuleStore {
+/** A partition that also carries the backend write face. */
+export interface WritableDurableRulePartition extends DurableRulePartition {
     readonly [PERMISSION_RULE_WRITER]: PermissionRuleWriter;
 }
-/** The writer of a store, or `undefined` when the backend is read-only from the engine's side. */
-export declare function writerOf(store: PermissionRuleStore): PermissionRuleWriter | undefined;
+/** The writer of a store or partition, or `undefined` when the backend is read-only from the engine's
+ *  side. Duck-typed on the handle, so it answers for the unified `PermissionRuleStore` (whose writer
+ *  routes by scope) exactly as for a bare durable partition. */
+export declare function writerOf(store: DurableRulePartition | import("./permission-rule-provider.js").PermissionRuleStore): PermissionRuleWriter | undefined;
 /** Do two scopes name the same place? Three members (design/382 §4.1): global, project-by-root,
  *  session-by-sessionId. */
 export declare function sameScope(a: RuleScope, b: RuleScope): boolean;
@@ -494,17 +520,16 @@ export declare function removePersistedRule(opts: {
      *  `forLocalOwner()` face existed, but removal could not name it, so a local-owner rule was
      *  unrevokable through this entry). Same observed-remove/add-wins/stillLive semantics either way. */
     principal: string | RuleOwner;
-    provider: PermissionRuleStoreProvider;
+    provider: import("./permission-rule-provider.js").PermissionRuleStoreProvider;
 }): Promise<RemoveResult>;
 export declare function errText(err: unknown): string;
-/** A store that always reports zero rules — what an unauthenticated principal resolves to, and the shape a
- *  failed read degrades to at the consumption site. */
-export declare const EMPTY_RULE_STORE: PermissionRuleStore;
+/** A durable partition that always reports zero rules — what an unauthenticated principal resolves to. */
+export declare const EMPTY_DURABLE_RULE_PARTITION: DurableRulePartition;
 /**
  * In-memory backend — the reference implementation of the delta semantics, and the one the tests drive.
  * `process-local` by declaration: it makes no durability promise it cannot keep.
  */
-export declare class InMemoryPermissionRuleStore implements WritablePermissionRuleStore {
+export declare class InMemoryDurableRulePartition implements WritableDurableRulePartition {
     private readonly actor;
     private readonly now;
     readonly durability: StoreDurability;

package/dist/core/permission-rule-store.js

@@ -394,11 +394,13 @@ export async function removePersistedRule(opts) {
     }
     let snapshot;
     try {
-        snapshot = await store.list();
+        snapshot = await store.effective();
     }
     catch (err) {
         return { status: "failed", error: `could not read the permission-rule store: ${errText(err)}` };
     }
+    if (snapshot.unreadable !== undefined)
+        return { status: "failed", error: `could not read the permission-rule store: ${snapshot.unreadable}` };
     const live = snapshot.rules.filter((r) => r.rule === rule && sameScope(r.scope, scope));
     const removedDots = live.flatMap((r) => r.adds.map((a) => a.dot));
     if (removedDots.length === 0)
@@ -409,10 +411,15 @@ export async function removePersistedRule(opts) {
     for (let attempt = 0; attempt < REMOVE_MAX_ATTEMPTS; attempt++) {
         try {
             const res = await writer.apply({ kind: "tighten-delete", tombstone }, { expectedRev });
+            if ("refused" in res) {
+                return { status: "failed", error: `the store refused the tombstone (${res.refused}) — nothing was removed` };
+            }
             if (!("conflict" in res)) {
                 let stillLive = false;
                 try {
-                    const after = await store.list();
+                    const after = await store.effective();
+                    if (after.unreadable !== undefined)
+                        throw new Error(after.unreadable);
                     stillLive = after.rules.some((r) => r.rule === rule && sameScope(r.scope, scope) && isRuleLive(r));
                 }
                 catch {
@@ -429,10 +436,10 @@ export async function removePersistedRule(opts) {
     }
     const reason = lastError !== "" ? lastError : `optimistic-concurrency retries exhausted after ${REMOVE_MAX_ATTEMPTS} attempts`;
     try {
-        const after = await store.list();
+        const after = await writer.readRaw();
         const landed = after.tombstones.some((t) => t.deletedBy.actor === tombstone.deletedBy.actor && t.deletedBy.counter === tombstone.deletedBy.counter);
         return landed
-            ? { status: "removed", rev: after.rev, stillLive: after.rules.some((r) => r.rule === rule && sameScope(r.scope, scope) && isRuleLive(r)) }
+            ? { status: "removed", rev: after.rev, stillLive: applyTombstones(after.rules, after.tombstones).some((r) => r.rule === rule && sameScope(r.scope, scope) && isRuleLive(r)) }
             : { status: "failed", error: `${reason} (read-back confirms no tombstone was written)` };
     }
     catch (err) {
@@ -442,11 +449,11 @@ export async function removePersistedRule(opts) {
 export function errText(err) {
     return err instanceof Error ? err.message : String(err);
 }
-export const EMPTY_RULE_STORE = {
+export const EMPTY_DURABLE_RULE_PARTITION = {
     list: async () => ({ rules: [], tombstones: [], rev: 0 }),
     durability: "process-local",
 };
-export class InMemoryPermissionRuleStore {
+export class InMemoryDurableRulePartition {
     actor;
     now;
     durability = "process-local";

package/dist/core/permission-rule-sync.d.ts

@@ -26,7 +26,8 @@
  * level they are buying.
  */
 import type { PersistedAllowRule, RuleDot, RuleRejectCode, RuleScope, RuleTombstone } from "./permission-rule-model.js";
-import type { PermissionRuleStoreProvider, RuleOwner, RuleSyncDrop, RuleSyncFrontier, RuleSyncState } from "./permission-rule-store.js";
+import type { PermissionRuleStoreProvider } from "./permission-rule-provider.js";
+import type { RuleOwner, RuleSyncDrop, RuleSyncFrontier, RuleSyncState } from "./permission-rule-store.js";
 import { type TracerHook } from "./trace.js";
 /** The injected HTTP seam — core never bundles a fetch. The deployment owns base URL, auth, TLS and
  *  retries; a non-2xx / network failure should THROW (the round then aborts with zero local effects —

package/dist/core/permission-rule-sync.js

@@ -178,6 +178,17 @@ export async function syncPermissionRules(opts) {
             current = await writer.readRaw();
             continue;
         }
+        if ("refused" in res) {
+            return disclose({
+                ok: false,
+                pushed: { addDots: raw.rules.reduce((n, r) => n + r.adds.length, 0), tombstones: raw.tombstones.length },
+                landed: { newAdds: 0, newTombstones: 0 },
+                resurrected: [],
+                dropped,
+                rev: current.rev,
+                warnings: [...warnings, `the store refused the sync landing (${res.refused}) — nothing landed, the local state is unchanged`],
+            });
+        }
         const landedRaw = await writer.readRaw();
         const postLive = applyTombstones(landedRaw.rules, landedRaw.tombstones);
         const resurrected = [];

package/dist/core/runner/assemble-result.d.ts

@@ -83,8 +83,9 @@ export interface Stats {
         llmRootMicroUsd: number;
         /** Delegated sub-agent (nested) LLM cost (micro-USD) = `stats.nested?.costMicroUsd ?? 0`. */
         nestedSubagentMicroUsd: number;
-        /** Post-task memory-consolidation LLM cost (micro-USD) = `stats.memory?.costMicroUsd ?? 0`. Filled in
-         *  runtask AFTER the (async) consolidation pass sets `stats.memory`; 0 at assembleResult time. */
+        /** Post-task memory-consolidation LLM cost (micro-USD) = `stats.memory?.costMicroUsd ?? 0`. Permanently
+         *  0: the runner-integrated consolidation pass is retired (the public `TaskStats` doc is the one home
+         *  for what would fill it again). */
         memoryConsolidationMicroUsd: number;
         /** Within-task compaction LLM cost (micro-USD) = the running `compactionMicroUsd` accumulator (the
          *  category Framing-4 missed). This IS part of `costMicroUsd`, so it is subtracted from `llmRoot`. */

package/dist/core/runner/checkpoint-scope.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The durable-suspend checkpoint SCOPE vocabulary — the default isolation scope and the ONE derivation of a row's scope —
+ * moved whole out of the orchestrator so the wiring-manifest phase (the synthesized durableApproval) and the driver's
+ * park-lane mint sites reach DOWN for the same two names. Pure: a constant and a string function over two spec fields.
+ */
+/** design/77 §4.4: the multi-tenant scope used when a durable suspend fires for an IRREVERSIBLE tool in an
+ *  unattended deployment that did NOT opt into `durableApproval` (so there is no caller-supplied scope). The
+ *  checkpoint carries this scope; resume reads it back from the checkpoint (`cp.scope`), so it is
+ *  self-consistent without needing the original `TaskSpec`. Kept distinct from any tenant key to make an
+ *  unattended irreversible suspend auditable as such. */
+export declare const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
+/**
+ * design/153 §7.1 — the SINGLE derivation of a durable-suspend checkpoint's scope (both gate mint
+ * sites + the bg-watcher park lane's expire compensation/arbitration consume THIS; a re-derived copy
+ * that drifted was the exact bug the park tests caught — expire against the wrong scope silently
+ * no-ops). `|| DEFAULT` (not `??`): an EMPTY-string principal must not become a shared scope bucket.
+ *
+ * RB-75 (2026-07-25, red probe): that rule is stated twice in this file and was enforced on ONE of the two
+ * inputs — the principal half used `||`, the `durableApproval.scope` half used `??`, so an empty string
+ * arriving through the scope field (a config-centre / env lookup that came back blank is the realistic
+ * source) sailed through as the literal scope `""`. Two different tenants both landed in that one bucket,
+ * where `listByScope("")` reads BOTH their pending approvals — including each summary's `toolInput`
+ * preview of the raw arguments — and `reap("")` / `resolve(token, "")` act across both. `durableApproval.
+ * scope` is documented as "Multi-tenant isolation key … Required"; a blank string is the absence of an
+ * isolation key wearing its clothes, so both halves now fall through to the default isolation scope.
+ */
+export declare function checkpointScopeOf(spec: {
+    durableApproval?: {
+        scope?: string;
+    };
+    principal?: string;
+}): string;

package/dist/core/runner/checkpoint-scope.js

@@ -0,0 +1,4 @@
+export const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
+export function checkpointScopeOf(spec) {
+    return spec.durableApproval?.scope || spec.principal || DEFAULT_IRREVERSIBLE_SCOPE;
+}