@sema-agent/core 7.40.1 → 7.41.0

package/dist/core/ask-origin.d.ts

@@ -282,7 +282,7 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  * the ask's CLASS SET ({@link classifyAsk}, {@link MODE_ARBITRATION}) — never by this one word.
  *
  *  - `operator_always` — the operator's `always` floor: per-call confirmation for shell commands.
- *  - `tool_marks` — the tool's own egress / irreversibility declaration.
+ *  - `tool_marks` — the tool's own egress / irreversibility / interaction declaration.
  *  - `probe_mandate` — this call's reversibility probe declared the demotion STRUCTURAL.
  *  - `probe_unanswered` — the probe was consulted and did not answer: the boundary is UNKNOWN.
  *  - `write_protection` — the table covers this write's target. A write onto load-executed configuration
@@ -300,7 +300,7 @@ declare const MANDATE_DISCLOSURE: {
     readonly probe_mandate: "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule";
     readonly probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call reads outside the directories allowed for this session is unknown — it is cleared by confirming this call, never by a standing allow rule";
     readonly operator_always: "this deployment mandates per-call confirmation for shell commands (shellGate: always)";
-    readonly tool_marks: "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)";
+    readonly tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)";
     readonly write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule";
     readonly write_protection_unresolved: "the write-protection judge could not resolve this write's target, so whether it lands on the protected table is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can";
 };
@@ -346,6 +346,10 @@ export declare function persistedRuleMandateOf(marks: MandateMarks): PersistedRu
  *  `irreversibility`) beside the two per-call facts the gate stamps. */
 export interface MandateMarks {
     egress?: boolean;
+    /** The tool's server declared that a call must be put to a person
+     *  ({@link import("../engine/loop/types.js").AgentTool.mcpRequiresUserInteraction}): a mark of the tool's own, like `egress` — no
+     *  persisted allow rule or standing grant clears the ask, and the class `requires_user_interaction` rides every ask on the call. */
+    requiresUserInteraction?: boolean;
     shellGated?: boolean;
     irreversibility?: "never" | "maybe" | "always";
     /** The surviving ask's engine-stamped `probeMandated` — see
@@ -436,10 +440,13 @@ export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
  * most-immune-first order; every lane reads the folded row ({@link foldArbitrationRow}), never the word.
  * `shell_floor` is the operator's `shellGate: "always"` floor on a shell-running seat — the question the `operator_always`
  * mandate word discloses, as a class of its own so a set that holds another forced question still holds it.
+ * `requires_user_interaction` is the SERVER's declaration on the called tool (`_meta["anthropic/requiresUserInteraction"] === true`): a
+ * permission question, unlike `content_question` (the reserved question tool's content-routing signal) — it carries that class's arbitration
+ * row cell by cell, because the reference implementation judges the declaration ahead of its allow-rule lookup and its bypass release.
  * `unstated` is the mode's answer for a call nobody stated: a tool whose permission seat is `passthrough` (it states no
  * permission of its own — a remote peer's tool) reached the end of the fold with an allow no layer stated.
  */
-export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
+export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
 export type AskClass = (typeof ASK_CLASSES)[number];
 /** Membership test for {@link AskClass} — the word crosses the wire on `tool_end.gate.disposition`. */
 export declare function isAskClass(v: unknown): v is AskClass;
@@ -542,6 +549,13 @@ export declare const MODE_ARBITRATION: {
         readonly ruleMayClear: false;
         readonly hookAskFloor: false;
     };
+    readonly requires_user_interaction: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
     readonly operator_forced: {
         readonly bypassImmune: true;
         readonly classifierEligible: true;
@@ -631,7 +645,8 @@ export declare const MODE_ARBITRATION: {
 export type ArbitrationTableCoversEveryClass = AssertAllKeysHandled<Exclude<AskClass, keyof typeof MODE_ARBITRATION>>;
 /** The classes whose own mint puts the `requiresRealApproval` bit on the ask — a bit one of them explains is not
  *  the bare bit `policy_rra` names. The mark classes (probe / write protection / tool marks / operator forced / the
- *  shell floor) mint no bit and explain none. */
+ *  shell floor) mint no bit and explain none — except `requires_user_interaction`, whose declaration the origin stamp
+ *  turns into the bit on every ask of the tool. */
 export declare const RRA_EXPLAINERS: ReadonlySet<AskClass>;
 /** The classes a permission mode can RELEASE (the `bypassImmune: false` rows) — the only words that can appear on
  *  `GateDisposition.released.askClass`; every other class reaches a person under every mode. */
@@ -709,6 +724,10 @@ export declare function classifyAsk(d: Extract<PermissionResult, {
  *  (2.1.280) — the call did NOT run because this session has no approval surface — with the run's own fact beside it
  *  and the ask's prompt as what was requested. The gate appends the caller-side remedy. */
 export declare function headlessDenialMessage(toolName: string, askMessage: string): string;
+/** The state of the approver seat a remedy is written for: `absent` — no approver is wired for the leg; `unavailable` — one is
+ *  wired and answered that nobody is reachable for this ask. Absent in the input reads as `absent` (the posture the
+ *  function was written for). */
+export type HeadlessApproverSeat = "absent" | "unavailable";
 /**
  * The ONE sentence a headless auto-deny (an ask that reached its final deny because no approver is wired) adds
  * after its refusal: the caller-side change that would have let this call run. Read off the effective mode, the
@@ -720,8 +739,10 @@ export declare function headlessDenialMessage(toolName: string, askMessage: stri
  *  · the same ask under `acceptEdits` — the target lies outside the working directories: add its directory to
  *    `additionalDirectories`;
  *  · any other releasable ask — `bypassPermissions` releases it (disclosed on the call).
- * Every arm also names the approver seat. The refusal's tool text and the `delegation.ask_unresolvable` notice
- * both carry this sentence — they call this function, neither spells it.
+ * Every arm also names the approver, in the clause of the seat's own state ({@link HeadlessApproverSeat}): none wired ⇒
+ * wire one; one wired that answered `unavailable` for this ask ⇒ make a person reachable through it (a wired approver is
+ * never told to be wired). The refusal's tool text and the `delegation.ask_unresolvable` notice both carry this sentence —
+ * they call this function, neither spells it.
  */
 export declare function headlessApprovalRemedy(input: {
     readonly mode: PermissionMode | undefined;
@@ -730,6 +751,7 @@ export declare function headlessApprovalRemedy(input: {
     readonly unplacedOptions?: {
         readonly program: "cp" | "mv";
     };
+    readonly approverSeat?: HeadlessApproverSeat;
 }): string;
 /** The reference implementation's sentence (2.1.280) for a `cp` / `mv` the mode will not answer because it carries option
  *  words — the approval card's message under `acceptEdits` and the head of the headless remedy. */

package/dist/core/ask-origin.js

@@ -16,7 +16,7 @@ export function stampAskOrigin(decision, facts, classification) {
     const classed = askClassMembersOf(classification);
     const { mandate: _selfDeclared, ...unstamped } = decision;
     const clearance = ruleClearanceOf(unstamped, facts.mandateMarks);
-    const mandated = { ...unstamped, ...(clearance.mandated ? { mandated: true } : {}), ...(clearance.mandate !== undefined ? { mandate: clearance.mandate } : {}) };
+    const mandated = { ...unstamped, ...(clearance.mandated ? { mandated: true } : {}), ...(clearance.mandate !== undefined ? { mandate: clearance.mandate } : {}), ...(facts.mandateMarks.requiresUserInteraction === true ? { requiresRealApproval: true } : {}) };
     if (mandated.probeReadRootCandidate === undefined || TIGHTEN_ONLY_ORIGINS.has(origin))
         return { ...mandated, origin, ...classed };
     const { probeReadRootCandidate: _withdrawn, ...kept } = mandated;
@@ -112,7 +112,7 @@ const MANDATE_DISCLOSURE = {
     probe_mandate: "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule",
     probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call reads outside the directories allowed for this session is unknown — it is cleared by confirming this call, never by a standing allow rule",
     operator_always: "this deployment mandates per-call confirmation for shell commands (shellGate: always)",
-    tool_marks: "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)",
+    tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)",
     write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule",
     write_protection_unresolved: "the write-protection judge could not resolve this write's target, so whether it lands on the protected table is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can",
 };
@@ -127,7 +127,7 @@ export function persistedRuleMandateOf(marks) {
         return "write_protection_unresolved";
     if (marks.writeProtected === true)
         return "write_protection";
-    return marks.egress === true ? "tool_marks" : word;
+    return marks.egress === true || marks.requiresUserInteraction === true ? "tool_marks" : word;
 }
 function irreversibilityMandateOf(marks) {
     return marks.probeMandated === true
@@ -177,6 +177,7 @@ export const ASK_CLASSES = Object.freeze([
     "rule_unreadable",
     "ask_rule",
     "denial_limit_fallback",
+    "requires_user_interaction",
     "operator_forced",
     "shell_floor",
     "write_protection_unresolved",
@@ -205,6 +206,7 @@ export const MODE_ARBITRATION = {
     rule_unreadable: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     ask_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     denial_limit_fallback: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    requires_user_interaction: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     operator_forced: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
     shell_floor: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
     write_protection_unresolved: { bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true },
@@ -218,7 +220,7 @@ export const MODE_ARBITRATION = {
     unstated: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: true, hookAskFloor: false },
     ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true, hookAskFloor: false },
 };
-export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "ancestor", "artifact_shared_read"]);
+export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
 export const RELEASABLE_ASK_CLASSES = ASK_CLASSES.filter((c) => !MODE_ARBITRATION[c].bypassImmune);
 export const MODE_RELEASE_REASONS = Object.freeze(["rule_unreadable"]);
 const MODE_RELEASE_REASON_SET = new Set(MODE_RELEASE_REASONS);
@@ -295,6 +297,8 @@ export function classifyAsk(d, facts) {
     if (facts.ruleCallUnreadable === true)
         classes.add("rule_unreadable");
     const marks = facts.mandateMarks;
+    if (marks.requiresUserInteraction === true)
+        classes.add("requires_user_interaction");
     if (marks.shellGated === true && marks.irreversibility === "always")
         classes.add("shell_floor");
     const toolMarked = marks.shellGated !== true && (marks.egress === true || marks.irreversibility === "always" || marks.irreversibility === "maybe");
@@ -332,7 +336,7 @@ export function headlessDenialMessage(toolName, askMessage) {
     return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (no approver is wired for "${toolName}" — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;
 }
 export function headlessApprovalRemedy(input) {
-    const approver = "wire an approver (`onAsk`) to put it to a person";
+    const approver = input.approverSeat === "unavailable" ? "make a person reachable through the approver that is wired (it answered `unavailable` for this ask)" : "wire an approver (`onAsk`) to put it to a person";
     const c = input.classification;
     if (input.mode === "acceptEdits" && input.unplacedOptions !== undefined && (c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"))))
         return `${fileCommandOptionsSentence(input.unplacedOptions.program)} Spell the ${input.unplacedOptions.program} without option words for the mode to answer it, or ${approver}`;

package/dist/core/ask-unresolvable-notice.d.ts

@@ -27,6 +27,7 @@
  * is pure.
  */
 import type { EngineNotice } from "./engine-notice.js";
+import type { AssertAllKeysHandled, HeadlessApproverSeat } from "./ask-origin.js";
 /** WHY the ask could not be resolved — the closed set (see the module note for each word). */
 export declare const ASK_UNRESOLVABLE_CAUSES: readonly ["approver_unavailable", "no_approver_wired", "mandate_unreconstructible"];
 export type AskUnresolvableCause = (typeof ASK_UNRESOLVABLE_CAUSES)[number];
@@ -45,10 +46,31 @@ export interface AskUnresolvableFacts {
     /** Whether a durable approval park lane was ARMED for this run (`true`: the park had its one attempt and
      *  did not take the call — it declined or failed; `false`: no park lane at all, the usual shape). */
     readonly parkLaneExisted: boolean;
-    /** `no_approver_wired` only: the caller-side change that would have let the call run, as the gate minted it for the
-     *  refusal's tool text (`headlessApprovalRemedy`, ask-origin.ts) — carried verbatim, never re-composed here. */
+    /** Present for the causes that say nobody could be asked ({@link askUnresolvableRemedySeat}): the caller-side change that
+     *  would have let the call run, as the gate minted it for the refusal's tool text (`headlessApprovalRemedy`, ask-origin.ts)
+     *  — carried verbatim, never re-composed here. */
     readonly remedy?: string;
 }
+/**
+ * Which causes take the caller-side remedy (`headlessApprovalRemedy`, ask-origin.ts), and in which seat's clause — the table IS
+ * the rule, and it is total over the closed set (a cause with no row is a red build: {@link CauseRemedySeatCoversEveryCause}).
+ * The two causes that say NOBODY COULD BE ASKED take it — no approver is wired (`absent`: the clause says to wire one), or the
+ * wired approver reported nobody reachable (`unavailable`: the clause says to make a person reachable through it, never to
+ * wire what is wired): one fact, one sentence about the way out, whichever way nobody was there. The inherited-mandate cause
+ * takes none (`undefined`): its recovery is a park facility on this leg, which neither a permission mode nor an `onAsk` here
+ * supplies, so the remedy's arms would name a change that does not release the call. (The settlement-axis table
+ * `SETTLEMENT_NOBODY_JUDGED` keeps `approver_unavailable` false because there a park route may still take the ask; this table is
+ * read at the deny exit, where every park route has had its attempt.)
+ */
+declare const CAUSE_REMEDY_SEAT: {
+    readonly approver_unavailable: "unavailable";
+    readonly no_approver_wired: "absent";
+    readonly mandate_unreconstructible: undefined;
+};
+export type CauseRemedySeatCoversEveryCause = AssertAllKeysHandled<Exclude<AskUnresolvableCause, keyof typeof CAUSE_REMEDY_SEAT>>;
+/** The seat whose clause the refusal for `cause` carries its remedy in, or `undefined` when the cause takes no remedy
+ *  ({@link CAUSE_REMEDY_SEAT}); read once at the deny exit, which hands the sentence to the tool text and the notice alike. */
+export declare function askUnresolvableRemedySeat(cause: AskUnresolvableCause): HeadlessApproverSeat | undefined;
 /**
  * Compose the `delegation.ask_unresolvable` notice from the gate's deny-exit facts.
  *
@@ -58,7 +80,8 @@ export interface AskUnresolvableFacts {
  * an empty session or tool name, or a cause outside the closed set, is refused at the mint with a
  * `TypeError` rather than shaped into a notice that would route nowhere or say nothing.
  *
- * `detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted, remedy? }` — `remedy` rides a headless
- * auto-deny only (the sentence the refusal's tool text carries); `sessionId` is lifted onto the typed key by {@link import("./engine-notice.js").deliverEngineNotice}, the one throat.
+ * `detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted, remedy? }` — `remedy` rides the causes that say nobody
+ * could be asked ({@link askUnresolvableRemedySeat}: the sentence the refusal's tool text carries); `sessionId` is lifted onto the typed key by {@link import("./engine-notice.js").deliverEngineNotice}, the one throat.
  */
 export declare function askUnresolvableNotice(facts: AskUnresolvableFacts): EngineNotice;
+export {};

package/dist/core/ask-unresolvable-notice.js

@@ -9,6 +9,14 @@ const CAUSE_CLAUSE = {
     no_approver_wired: "no approver (or question face) is wired for this run — the headless posture",
     mandate_unreconstructible: "an inherited durable-approval mandate binds this ask and this leg has no park facility to honor it",
 };
+const CAUSE_REMEDY_SEAT = {
+    approver_unavailable: "unavailable",
+    no_approver_wired: "absent",
+    mandate_unreconstructible: undefined,
+};
+export function askUnresolvableRemedySeat(cause) {
+    return CAUSE_REMEDY_SEAT[cause];
+}
 export function askUnresolvableNotice(facts) {
     const { sessionId, toolName, toolCallId, cause, parkLaneExisted, remedy } = facts;
     if (typeof sessionId !== "string" || sessionId.length === 0) {

package/dist/core/auto-promote.d.ts

@@ -1,39 +1,25 @@
 import type { OracleIsolationVerdict } from "./oracle-isolation.js";
-import type { SkillManifest } from "./types.js";
+import type { SkillSpec } from "./types.js";
 /**
  * The terminal of {@link decideAutoPromote}.
  * - `"auto_promote"` — the ONLY exit that skips human review. Reachable only when all four prior guards
- *   (tripwire / irreversible / statistics / concurrence) clear AND all four gates are present+passing.
+ *   (tripwire / irreversible / statistics / concurrence) clear AND all three gates are present+passing.
  * - `"candidate_only"` — surface the artifact as a candidate; the SOLE shortfall is the oracle isolation class
  *   being downgraded to `in_process_probe_only` (oracle-isolation.ts:34) with everything else passing.
  * - `"needs_human"` — fail-closed default: escalate to a human (any guard tripped, any other gate failing).
  */
 export type AutoPromoteTerminal = "auto_promote" | "candidate_only" | "needs_human";
 /**
- * Gate-2 + Gate-3 lineage-bound handle (裁决净增③ / P0#3 / P1 lineage-bind). `gate2Verdict` and `manifest`
- * MUST come from the SAME atomic `appendPromotable` write (memory.ts:295) — this struct bundles them into one
- * handle so the decision can never pair a verdict with a divergent manifest ("assume two booleans are
- * co-sourced" is the bug this prevents). `lineageId` keys the active-skill-scope frame (active-skill-scope.ts).
+ * Gate-2 handle (裁决净增③): the verdict the promoted artifact's OWN promotable write landed with, held in one place
+ * so the decision reads one verdict and never a loose boolean. (It used to carry the artifact's lineage id as the scope
+ * key of the retired per-skill narrowing; with that gone the lineage keys nothing the fold reads.)
  */
 export interface PromotedRecord {
-    /** Stable lineage id of the promoted artifact; the Gate-3 scope key. */
-    lineageId: string;
     /**
      * Gate-2 chokepoint result: the promotable write landed WITH a positive utility verdict (memory.ts:240),
      * or it was absent/ungated. Only `"present_positive"` is gate-passing; `"absent_or_ungated"` ⇒ needs_human.
      */
     gate2Verdict: "present_positive" | "absent_or_ungated";
-    /** Gate-3 capability manifest — co-located with `gate2Verdict` in the same store record, never diverging. */
-    manifest: SkillManifest;
-    /**
-     * Gate-3 scope is armed AND has propagated across the subagent boundary (design/79 §4, design/77 §3/§7).
-     * `true` ONLY when either (a) the manifest lists NO subagent-spawn tool, or (b) its scope has propagated to
-     * spawned children. The skill→subagent manifest-scope propagation just landed in this branch (commit
-     * `04f5104`); for an artifact that lists a subagent-spawn tool whose scope has NOT propagated, this is
-     * `false` → the decision falls to `needs_human` (裁决净增⑤ / P1). A bare in-process `gate4Armed`-style
-     * boolean is intentionally NOT enough here: the propagation hole is encoded structurally into this flag.
-     */
-    gate3Scoped: boolean;
 }
 /**
  * Inputs to {@link decideAutoPromote}. Every field is a PRESENCE/boolean/set the profile has already computed —
@@ -44,7 +30,7 @@ export interface PromotedRecord {
 export interface AutoPromoteInputs {
     /** Gate-1 verdict (oracle-isolation.ts:37); the caller re-asserted it before calling this function. */
     oracle: OracleIsolationVerdict;
-    /** Gate-2 + Gate-3 lineage-bound single handle (净增③). */
+    /** Gate-2 lineage-bound single handle (净增③). */
     record: PromotedRecord;
     /** Gate-4: the irreversibility tighten is in place (or the artifact touches no irreversible tool). */
     gate4Armed: boolean;
@@ -79,9 +65,9 @@ export interface AutoPromoteInputs {
  *  2. `touchesIrreversibleTool` → needs_human (§6 permanent human door — 净增①; even if all else passes)
  *  3. `!statisticsPresent` → needs_human (statistics must have RAN — core-required; thresholds are profile)
  *  4. `concurringSignals.size < 2` → needs_human (≥2 DISTINCT KIND mechanical signals concur — 净增②)
- *  5. the four-gate present-passing check; if not all pass, the SOLE-shortfall arm:
+ *  5. the three-gate present-passing check; if not all pass, the SOLE-shortfall arm:
  *     `in_process_probe_only` oracle (and every other gate passing) → `candidate_only`; otherwise needs_human.
- *  6. all four gates present+passing (with guards clear) → `auto_promote` (the only auto exit).
+ *  6. all three gates present+passing (with guards clear) → `auto_promote` (the only auto exit).
  */
 export declare function decideAutoPromote(i: AutoPromoteInputs): AutoPromoteTerminal;
 /**
@@ -104,13 +90,13 @@ export declare const FROZEN_DENYLIST_FLOOR: ReadonlySet<string>;
 /**
  * Build a tripwire verdict over a promoted artifact's text. **ESCALATE-ONLY** (design/79 §3,守 design/76
  * §5.1 r3): it can ONLY ever raise `escalate:true`; a clean artifact yields `{escalate:false, reasons:[]}` and
- * NEVER clears anything — the REAL containment is Gate-3 runtime deny-narrowing (exhaustive at call time), not
- * this advisory. Two mechanical scans, both escalate-only:
+ * NEVER clears anything — it contains nothing itself: the real protection is the out-of-process boundary and the
+ * permission gate at call time, not this advisory. Two mechanical scans, both escalate-only:
  *
  *  1. **symbol-mention drift** via {@link extractSymbols} (repo-map.ts). extractSymbols is a v1 heuristic:
  *     column-0 / source-only, it skips indented lines and is structurally INCAPABLE of being a containment
  *     proof (it can't enumerate everything the artifact can call). So it is used ONLY to ESCALATE — if a
- *     surfaced top-level symbol names a tool/capability that is NOT in `declared.allowTools`, escalate.
+ *     surfaced top-level symbol names a tool/capability that is NOT in `declared.allowedTools`, escalate.
  *  2. **raw-byte denylist** over the artifact's RAW bytes INCLUDING markdown bytes — {@link FROZEN_DENYLIST_FLOOR}
  *     UNIONed with `profileTokens` (add-only). A substring hit → escalate, with the matched token in `reasons`.
  *
@@ -119,7 +105,8 @@ export declare const FROZEN_DENYLIST_FLOOR: ReadonlySet<string>;
  * contribution, never block" case, which is the caller's concern, not a throw inside the scan.)
  *
  * @param artifactText the artifact's raw text (markdown body included).
- * @param declared the artifact's declared manifest — its `allowTools` is the symbol-drift baseline.
+ * @param declared the artifact's declared tool list (the `SkillSpec` member the loader copies) — its `allowedTools`
+ *   entries, each read as a permission rule for the tool it names, are the symbol-drift baseline.
  * @param profileTokens optional ADD-ONLY extra denylist tokens (UNIONed onto the frozen floor; cannot remove).
  */
-export declare function deriveTripwire(artifactText: string, declared: SkillManifest, profileTokens?: ReadonlySet<string>): TripwireResult;
+export declare function deriveTripwire(artifactText: string, declared: Pick<SkillSpec, "allowedTools">, profileTokens?: ReadonlySet<string>): TripwireResult;

package/dist/core/auto-promote.js

@@ -1,5 +1,5 @@
 import { extractSymbols } from "../tools/fs/repo-map.js";
-import { parseSkillToolEntry } from "./skill-tool-specifier.js";
+import { parsePermissionRule } from "./permission-rules.js";
 import { thrownText } from "./thrown-value.js";
 export function decideAutoPromote(i) {
     if (i.tripwire.escalate)
@@ -12,10 +12,10 @@ export function decideAutoPromote(i) {
         return "needs_human";
     const g1ok = i.oracle.protected && i.oracle.isolationClass === "out_of_process";
     const g2ok = i.record.gate2Verdict === "present_positive";
-    const allGatesPresentPassing = g1ok && g2ok && i.record.gate3Scoped && i.gate4Armed;
+    const allGatesPresentPassing = g1ok && g2ok && i.gate4Armed;
     if (!allGatesPresentPassing) {
         return (i.oracle.protected && i.oracle.isolationClass === "in_process_probe_only"
-            && g2ok && i.record.gate3Scoped && i.gate4Armed)
+            && g2ok && i.gate4Armed)
             ? "candidate_only"
             : "needs_human";
     }
@@ -60,12 +60,12 @@ export function deriveTripwire(artifactText, declared, profileTokens) {
     const reasons = [];
     let escalate = false;
     try {
-        const allow = new Set((declared.allowTools ?? []).map((entry) => parseSkillToolEntry(entry).name));
+        const allow = new Set((declared.allowedTools ?? []).map((entry) => parsePermissionRule(entry).toolName));
         const symbols = extractSymbols(artifactText);
         for (const sym of symbols) {
             if (!allow.has(sym)) {
                 escalate = true;
-                reasons.push(`symbol-drift: surfaced symbol "${sym}" not in declared.allowTools`);
+                reasons.push(`symbol-drift: surfaced symbol "${sym}" not in declared.allowedTools`);
             }
         }
     }

package/dist/core/checkpoint-store.d.ts

@@ -56,12 +56,6 @@ export declare function mintCheckpointId(): string;
  * that {@link ResumeOutcome} must match at the resume entry (council #3: prevents a `task_done` gate
  * being resumed with a `policy_ask` outcome → type confusion / corruption).
  */
-/** design/74: why a resource-slice suspend fired. `"budget"` covers cost OR tokens (both are checked by
- *  `overBudget`); `"walltime"` is the soft slice deadline; `"turns"` the slice turn cap.
- *  design/80 Seam #2: `"preempt"` is NOT a resource limit — it is an EXTERNAL scheduler yield (the scheduler
- *  raised `spec.preemptSignal` to free resources for a higher-priority task). It rides the SAME durable-suspend
- *  mechanism: the gate.kind stays `resource_limit` (the mechanism), so the resume path is byte-identical to a
- *  budget/turns/walltime resume (continue the work, no decision); `"preempt"` is only the CAUSE. */
 /**
  * Why a `resource_limit` suspend was minted. design/164 split the single `budget` member: a token
  * window and a $ window are different allowances with different owners, and a scheduler reading a
@@ -80,6 +74,7 @@ export declare function mintCheckpointId(): string;
  * turn boundary the attribution order is
  * `preempt > env_lifetime > usage_window > budget_tokens > budget_cost > turns > walltime`
  * (external causes above self-chosen allowances; preempt keeps the top seat it always had).
+ * `"preempt"` is a scheduler's yield (`spec.preemptSignal`), not a limit, riding the same suspend: its resume continues the work.
  *
  * **Consumers pinning the closed set again**: a `switch` that was exhaustive over the five 5.x members
  * now falls through on these two.
@@ -854,6 +849,8 @@ export type PendingAction = {
      * pre-1a.2 checkpoint (deserialized without it), in which case the resume skips the hash check.
      */
     boundInputHash: string;
+    /** A parked `Skill` call's binding to its card — the skill's name and its two lists ({@link import("./skill-grant.js").skillGrantDigest}, judged by {@link import("./skill-grant.js").parkedSkillApprovalRefusal}); only that row carries it. */
+    boundGrantDigest?: string;
     /**
      * design/388 §2.5 boundary ② (B18; additive — no checkpoint-version bump, the `previewWithheld`
      * precedent: an optional group an older reader ignores): the IDENTITY of the row the park minted
@@ -1014,6 +1011,8 @@ export interface CheckpointState {
     writeFace?: {
         face: "open" | "roots";
     };
+    /** The grant rows the run grew ({@link import("./skill-grant.js").frozenSkillGrants}); absent = none, damaged = refused pre-CAS. */
+    skillGrants?: import("./skill-grant.js").SkillGrantRecord[];
     /**
      * design/319 (A ticket) — the session's reminder provenance mark
      * ({@link import("./reminder-mint.js").mintReminderMark}), persisted so a durable resume keeps
@@ -2034,14 +2033,14 @@ export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
  *    steer seat, which no worker version reads and the host decides itself, or a retired mode-seed member of
  *    `inheritedGate`, which an engine at 7.38.x or earlier still reads once).
  *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
- *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"constraint_chain_missing"` (all terminal for the row's
+ *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"constraint_chain_missing"` (all terminal for the row's
  *    current bytes — no worker version redeems a damaged row).
  */
 export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "seat_retired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged"
 /** `state.writeFace` is present but not a well-formed section. No `_forged` twin: the section is
  *  legal-and-absent at every version, so there is no version to judge a fabrication against — and a
  *  fabricated "open" still needs the LIVE resolution to say open too. */
- | "write_face_damaged" | "constraint_chain_missing";
+ | "write_face_damaged" | "skill_grants_damaged" | "constraint_chain_missing";
 /**
  * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the four
  * words prepare's mode, output-style and recorded-mode doors throw, held unchanged so one refusal reads the same on a fresh
@@ -2219,7 +2218,7 @@ export declare class CheckpointError extends Error {
      *  members. `field` names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
-     *  action: re-review), or `"answer"` (the content-ask answer is missing, or was attached to a
+     *  action: re-review), `"boundGrantDigest"` (a parked `Skill` approval does not cover the skill the decision selects — another skill, or the card's with other lists: deny, re-activate), or `"answer"` (the content-ask answer is missing, or was attached to a
      *  decision that cannot carry one: re-decide with a well-formed answer — ruled 2026-08-04), or
      *  `"hostDecision"` (the decision facts are missing, name a decider outside `person`/`sla_timeout`/`policy`,
      *  pair the sweep's `sla_timeout` with an allow, or try to supply the minted word), or — design/252 G-7 — `"approver"` (the attribution is not a
@@ -2231,7 +2230,7 @@ export declare class CheckpointError extends Error {
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     readonly detail?: {
-        field?: "boundCallId" | "boundInputHash" | "answer" | "hostDecision" | "approver" | "taskConfig" | "inheritedGate";
+        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "inheritedGate";
         /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
          *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
         code?: CheckpointConfigRefusalCode;
@@ -2411,7 +2410,7 @@ export declare class CheckpointError extends Error {
      *  members. `field` names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
-     *  action: re-review), or `"answer"` (the content-ask answer is missing, or was attached to a
+     *  action: re-review), `"boundGrantDigest"` (a parked `Skill` approval does not cover the skill the decision selects — another skill, or the card's with other lists: deny, re-activate), or `"answer"` (the content-ask answer is missing, or was attached to a
      *  decision that cannot carry one: re-decide with a well-formed answer — ruled 2026-08-04), or
      *  `"hostDecision"` (the decision facts are missing, name a decider outside `person`/`sla_timeout`/`policy`,
      *  pair the sweep's `sla_timeout` with an allow, or try to supply the minted word), or — design/252 G-7 — `"approver"` (the attribution is not a
@@ -2423,7 +2422,7 @@ export declare class CheckpointError extends Error {
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     detail?: {
-        field?: "boundCallId" | "boundInputHash" | "answer" | "hostDecision" | "approver" | "taskConfig" | "inheritedGate";
+        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "inheritedGate";
         /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
          *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
         code?: CheckpointConfigRefusalCode;

package/dist/core/decision-receipt.d.ts

@@ -4,8 +4,11 @@ export declare const refusedOutOfContract: (message: string) => PermissionResult
  *  `receiveHookResult` is one of two things, and this tells them apart. */
 export declare const isEngineRefusal: (d: unknown) => boolean;
 /** A decision's `decisionReason` — the closed set; the type is derived FROM this list, so a word added to either side is a
- *  compile error rather than a drift between the type and the screen. Module-private (the package publishes the type). */
-declare const DECISION_REASONS: readonly ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only"];
+ *  compile error rather than a drift between the type and the screen. Module-private (the package publishes the type).
+ *  `skill`: an active skill's list spoke — the allow layer's skill member cleared the call (`allowed-tools`), or this
+ *  run's deny row refused it (`disallowed-tools`); distinct from `rule` (a deployment policy) and `persisted_rule` (a
+ *  person's stored row) because the authority is the skill the run activated. */
+declare const DECISION_REASONS: readonly ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill"];
 export type DecisionReason = (typeof DECISION_REASONS)[number];
 export declare const RETIRED_WINDOW_MEMBER_DENY_MESSAGE: string;
 export declare const carriesRetiredWindow: (fallback: unknown) => boolean;

package/dist/core/decision-receipt.js

@@ -8,7 +8,7 @@ export const refusedOutOfContract = (message) => {
     return refused;
 };
 export const isEngineRefusal = (d) => typeof d === "object" && d !== null && ENGINE_REFUSALS.has(d);
-const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only"]);
+const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill"]);
 const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
 const GUARDS = Object.keys({ unverifiable_delete: 0, transcript_write: 0, artifact_shared_read: 0 });
 const RULE_UNREADABLE_WORDS = Object.keys({ content_deny: 0, content_ask: 0, persisted_call: 0 });

package/dist/core/engine-notice.d.ts

@@ -57,6 +57,11 @@ export interface EngineNotice {
      *    at least one type is listed name-only (`nameOnly`) or not at all (`dropped`). Audience `operator`.
      *    `detail: { budgetBytes, total, kept, nameOnly: [name], dropped: [name], sessionId }`; the same
      *    firing rule as its skills sibling below (once per delivered frame, on the carrying message's receipt).
+     *  - `"skills.allowed_tool_not_granted"` — a loaded skill's `allowed-tools` / `disallowed-tools` holds entries that grant
+     *    (or refuse) nothing: `*` (it voids an allow list; on a deny list it reads as nothing and the rest still refuses), `mcp__*` (no server named), a write-path or domain
+     *    entry, a shape the rule grammar does not read. The run goes on and asks for those tools as usual. Audience
+     *    `operator`; once per prepared task, only when such an entry exists. `detail: { sessionId, entries: [{ skill, list,
+     *    entry, reason }] }` (`reason` ∈ `wildcard_all` / `namespace_wildcard` / `path_pattern` / `domain` / `content_unsupported` / `grammar`).
      *  - `"skills.listing_truncated"` — the `<skills>` disclosure block did not fit its byte budget, so
      *    at least one skill is listed without its description (`nameOnly`) or, in the pathological case,
      *    not listed at all (`dropped`); the `Skill` tool still serves every one of them. Audience
@@ -775,7 +780,8 @@ export interface EngineNotice {
      *    fail-closed sentence as the tool result); this is its person-facing half, minted at the gate's ONE
      *    deny exit, once per tool call, by `ask-unresolvable-notice.ts`. `detail: { sessionId, toolName,
      *    toolCallId, cause, parkLaneExisted, remedy? }` — `parkLaneExisted` says whether a park lane was armed and
-     *    declined/failed (`true`) or none existed (`false`, the usual shape); `remedy` (the headless auto-deny only)
+     *    declined/failed (`true`) or none existed (`false`, the usual shape); `remedy` (the two causes that say nobody
+     *    could be asked — `approver_unavailable` and `no_approver_wired`; never `mandate_unreconstructible`)
      *    is the one sentence naming the caller-side change that would have let the call run, as the tool text carries it. Audience `"user"`: the refused
      *    work is the session user's own; the operator hears it through the sink like every code.
      *

package/dist/core/gate-crash-trace.d.ts

@@ -4,4 +4,4 @@ import type { SafeNotifier } from "./safe-notify.js";
  *  throwing sink alter the fail-closed outcome — the same swallow posture as every other observer here.
  *  Shared by the gate's dispatch (the phase-1 crash arm, the seat-bound refusal), the reversibility probe's
  *  two failure arms, the approved-edit re-screen and the bounded-await deadline. */
-export declare function traceHookCrash(input: ToolGateInput, err: unknown, notifier: SafeNotifier): void;
+export declare function traceHookCrash(input: Pick<ToolGateInput, "onHookError">, err: unknown, notifier: SafeNotifier): void;

package/dist/core/gate-fold.js

@@ -8,7 +8,7 @@ import { writeProtectionMandated, writeProtectionTightenDecision, writeProtectio
 import { createGateDeadline, awaitWriteProtectionJudgment, gateWaitFailureOf, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
 import { refuseOutOfContractDecision } from "./tool-policy.js";
-import { asksUnstated, unstatedAskMessage } from "./mode-policy.js";
+import { asksUnstated, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
 export async function runGateFold(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, adjudicate } = pass;
     const boundedAwaitDeadlineMs = createGateDeadline(input, notifier);
@@ -69,6 +69,10 @@ export async function runGateFold(pass) {
             applyShellReadVerdict(pass, verdict, toolName, input.shellGated === true);
         }
     }
+    if (input.requiresUserInteraction === true && pass.decision.action === "allow") {
+        pass.decision = { action: "ask", message: markTightenMessage(toolName, "interaction"), decisionReason: "safety" };
+        pass.tightenedBy = "safety";
+    }
     if (input.egress && pass.decision.action === "allow") {
         pass.decision = {
             action: "ask",
@@ -169,8 +173,8 @@ export async function runGateFold(pass) {
                 pass.deniedBy = "write_protection";
         }
     }
-    if (asksUnstated(pass.decision, input.permissionSeat, input.permissionMode?.(), pass.hookAllowed === true && pass.decision.updatedInput === undefined)) {
-        pass.decision = { action: "ask", message: unstatedAskMessage(toolName), ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}) };
+    if (asksUnstated(pass.decision, permissionSeatAt(input, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput)?.seat, input.permissionMode?.(), pass.hookAllowed === true && pass.decision.updatedInput === undefined)) {
+        pass.decision = { action: "ask", message: permissionSeatAt(input, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput)?.question ?? unstatedAskMessage(toolName), ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}) };
         pass.tightenedBy = "unstated";
     }
     return await pass.afterFold(pass);