@sema-agent/core 7.40.1 → 7.41.0

package/dist/core/runner/prepare-gate-stations.js

@@ -1,7 +1,7 @@
 import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
-import { mountedToolPermissionSeat } from "../mode-policy.js";
+import { mountedToolRequiresUserInteraction } from "../mode-policy.js";
 import { complianceCallDenial } from "../compliance.js";
-import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, runHookSeat, runToolGate } from "../hooks.js";
+import { cloneObserverInput, formatHookFeedback, runToolGate } from "../hooks.js";
 import { screenGateOutcome } from "../gate-outcome.js";
 import { directDeny } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
@@ -12,7 +12,7 @@ import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
 import { callFaceSeat, rosterToolName, toolCallFaceOf } from "../tool-roster.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
-import { noteHostRewrite } from "../frame-settlement.js";
+import { createApprovedCallScreen, createToolResultStation } from "./call-hook-stations.js";
 const PEER_MESSAGE_NAMES = new Set([SEND_MESSAGE_TOOL_NAME]);
 function screenGateResult(result) {
     if (result.suspend !== undefined)
@@ -46,7 +46,8 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement, seatInputsFor } = input;
+    const gatePreToolUse = ownGatePreToolUse !== undefined ? (name, args, ctx) => ownGatePreToolUse(name, args, { ...ctx, permissionMode: permissionMode.observed }) : undefined;
     const releasesAnnounced = new Map();
     const onModeReleased = (info) => {
         const table = info.readUnestablished === true ? input.readDenyInForce() : undefined;
@@ -116,7 +117,7 @@ export function prepareGateStations(input) {
                         ...(e.signal !== undefined ? { callSignal: e.signal } : {}),
                         identity: hookIdentity,
                         reminderMark,
-                        ...(ownGatePreToolUse !== undefined ? { preToolUse: (name, args, ctx) => ownGatePreToolUse(name, args, { ...ctx, permissionMode: permissionMode.observed }) } : {}),
+                        ...(gatePreToolUse !== undefined ? { preToolUse: gatePreToolUse } : {}),
                         hookTimeoutMs,
                         ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
                         ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
@@ -138,7 +139,8 @@ export function prepareGateStations(input) {
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
                         permissionMode: () => permissionMode.current,
                         ...(markSources.size > 0 ? { toolMarkSources: markSources } : {}),
-                        ...(mountedToolPermissionSeat(tools, e.toolName) === "passthrough" ? { permissionSeat: "passthrough" } : {}),
+                        ...seatInputsFor(e.toolName, wireOf("gate.skillActivationSeat", call)),
+                        ...(mountedToolRequiresUserInteraction(tools, e.toolName) ? { requiresUserInteraction: true } : {}),
                         ...(a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
                         onModeReleased,
                         ancestorArbitrationOf: (toolCallId) => ancestorArbitrations.get(toolCallId),
@@ -239,68 +241,9 @@ export function prepareGateStations(input) {
             });
         }
     }
-    const toolResultStationArmed = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure);
-    if (toolResultStationArmed) {
-        harness.on("tool_result", async (e) => {
-            if (blockedToolCalls.delete(e.toolCallId)) {
-                return undefined;
-            }
-            let content = e.content;
-            let changed = false;
-            const post = { toolName: rosterToolName(toolRosterDeltas.current, e.toolName) };
-            if (e.isError) {
-                if (hooks?.postToolUseFailure) {
-                    let clonedDetails = e.details;
-                    try {
-                        clonedDetails = structuredClone(e.details);
-                    }
-                    catch {
-                    }
-                    const failedName = wireOf("hook.postToolUseFailure", post);
-                    const failureSeat = await runHookSeat("postToolUseFailure", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUseFailure(failedName, e.input, {
-                        error: e.content
-                            .filter((c) => c.type === "text")
-                            .map((c) => c.text)
-                            .join("\n"),
-                        isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
-                        content: e.content.map((c) => ({ ...c })),
-                        details: clonedDetails,
-                    }, { toolCallId: e.toolCallId, toolName: failedName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity, permissionMode: permissionMode.observed }));
-                    if (failureSeat.expired) {
-                        notifyOwnHookCrash(hookSeatExpiredError("postToolUseFailure", hookTimeoutMs, failureSeat.cause, "the observation was abandoned and its additionalContext dropped; the failure result itself is unchanged"));
-                    }
-                    const patch = failureSeat.expired ? undefined : failureSeat.value;
-                    if (patch?.additionalContext) {
-                        content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext, reminderMark) }];
-                        changed = true;
-                    }
-                }
-            }
-            else if (hooks?.postToolUse) {
-                const ranName = wireOf("hook.postToolUse", post);
-                const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(ranName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: ranName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity, permissionMode: permissionMode.observed }));
-                if (successSeat.expired) {
-                    notifyOwnHookCrash(hookSeatExpiredError("postToolUse", hookTimeoutMs, successSeat.cause, "the seat was abandoned; the tool result is delivered to the model UNMODIFIED (no updatedOutput, no additionalContext)"));
-                }
-                const patch = successSeat.expired ? undefined : successSeat.value;
-                if (patch?.updatedOutput) {
-                    content = patch.updatedOutput;
-                    changed = true;
-                    noteHostRewrite(frameSettlement, e.toolCallId);
-                }
-                if (patch?.additionalContext) {
-                    content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext, reminderMark) }];
-                    changed = true;
-                }
-            }
-            const pre = preToolContexts.get(e.toolCallId);
-            if (pre) {
-                preToolContexts.delete(e.toolCallId);
-                content = [...content, ...pre.map((t) => ({ type: "text", text: formatHookFeedback(t, reminderMark) }))];
-                changed = true;
-            }
-            return changed ? { content } : undefined;
-        });
-    }
-    return { toolCallStationArmed: toolCallGateArmedRef.armed, toolResultStationArmed };
+    const toolResultStation = createToolResultStation({ hooks, blockedToolCalls, toolRosterDeltas, preToolContexts, hookTimeoutMs, abortController, spec, handsCwdRef, hookEnvFace, hookIdentity, permissionMode, notifyOwnHookCrash, reminderMark, frameSettlement });
+    if (toolResultStation !== undefined)
+        harness.on("tool_result", toolResultStation);
+    const approvedCallScreen = createApprovedCallScreen({ preToolUse: gatePreToolUse, hookTimeoutMs, abortController, handsCwdRef, hookEnvFace, hookIdentity, notifyOwnHookCrash, preToolContexts });
+    return { toolCallStationArmed: toolCallGateArmedRef.armed, toolResultStationArmed: toolResultStation !== undefined, ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) };
 }

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -46,7 +46,7 @@ import type { SessionStore } from "../session.js";
 import { type OnAsk } from "../tool-policy.js";
 import type { PermissionMode, RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskEvent, TaskSpec, ToolExecuteContext, ToolSpec } from "../types.js";
 import { PermissionModeController } from "../mode-policy.js";
-import type { ActiveSkillScope } from "./active-skill-scope.js";
+import { type SkillGrantTable } from "../skill-grant.js";
 import type { InheritedGate, Prepared, PrepareResume, RunInternals, StopForDenialLimit, ToolFaceSnapshot, WriteFaceSeat } from "./contracts.js";
 export interface PrepareInheritedGateInput {
     /** borrowed-readonly — the REBOUND spec. Read: `shellGate` (the own doctrine the chain fold tightens), `durableApproval`
@@ -107,8 +107,8 @@ export interface PrepareInheritedGateInput {
     harnessRef: {
         current?: AgentHarness;
     };
-    /** borrowed-readonly — the per-task skill scope (the ctx's `activeSkillScope` snapshot reads it call-time). Not written here. */
-    skillScope: ActiveSkillScope;
+    /** borrowed-readonly — the per-task skill grant table (the ctx's `activeSkillGrants` capture and the checkpoint section read it call-time). Not written here. */
+    skillGrants: SkillGrantTable;
     /** borrowed-readonly — the filtered display-forwarding wrapper (ctx seat; absent ⇒ no key). */
     forwardEvent: ((e: TaskEvent) => void) | undefined;
     /** borrowed-readonly — the retain ledger (ctx seat; absent ⇒ no key). */
@@ -276,6 +276,9 @@ export interface PrepareInheritedGateResult {
     writeFaceCheckpointSection: () => {
         face: "open" | "roots";
     } | undefined;
+    /** owned — the SKILL-GRANT checkpoint section builder: the rows this run's table grew (the model's activations, a
+     *  delegated child's capture), read off the live table at mint time; absent when there are none. */
+    skillGrantCheckpointSection: () => import("../skill-grant.js").SkillGrantRecord[] | undefined;
     /** owned — the F-012 stamp predicate (opaque constraints present ∨ seed frozen chain ∨ provenance-armed). */
     f012CheckpointState: () => boolean;
     /** owned — the FROZEN approver seat (spec over deps) every station of this leg and its children's chain resolve at. */

package/dist/core/runner/prepare-inherited-gate.js

@@ -9,10 +9,11 @@ import { deliverEngineNotice } from "../types.js";
 import { PermissionModeController, modeRequestAfterResume } from "../mode-policy.js";
 import { SessionModeSeats } from "./session-mode-seats.js";
 import { recordedModeSeed } from "../checkpoint-store.js";
+import { frozenSkillGrants } from "../skill-grant.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { asThrownError } from "../thrown-value.js";
 export function prepareInheritedGate(input) {
-    const { spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
+    const { spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
     const seedInheritedGate = resume?.seed.inheritedGate;
     const inheritedAncestorRules = (() => {
@@ -108,6 +109,7 @@ export function prepareInheritedGate(input) {
         const seat = input.resolvedWriteFace() ?? input.handsLessResolvedWriteFace();
         return seat === undefined ? undefined : seat.inForce() === "open" ? { face: "open" } : seat.fenced ? { face: "roots" } : undefined;
     };
+    const skillGrantCheckpointSection = () => frozenSkillGrants(skillGrants);
     const f012CheckpointState = () => (inheritedParentConstraints?.length ?? 0) > 0 ||
         seedInheritedGate?.constraintChain !== undefined ||
         internals?.delegationProvenance !== undefined;
@@ -247,7 +249,7 @@ export function prepareInheritedGate(input) {
             reminderDisclosureCounts,
             ...(centerAdoption !== undefined ? { centerArtifactDigest: centerAdoption.artifact.artifactDigest } : {}),
             ...(centerAdoption?.sourceRevision !== undefined ? { centerSourceRevision: centerAdoption.sourceRevision } : {}),
-            activeSkillScope: () => skillScope.active(),
+            activeSkillGrants: () => skillGrants.records(),
             inheritedGateForChildren,
             delegationProvenanceForChildren,
             delegationSettlement: delegationSettlementForChildren,
@@ -294,5 +296,5 @@ export function prepareInheritedGate(input) {
             ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
         };
     };
-    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
+    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, skillGrantCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
 }

package/dist/core/runner/prepare-park-ask.d.ts

@@ -32,6 +32,7 @@ import { type ContentAskBinding } from "./content-ask-bindings.js";
 import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, SuspendSaga } from "./contracts.js";
 import type { createRuleOffersOf } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
+import { type SkillGrantSource } from "../skill-grant.js";
 export interface PrepareParkAskInput {
     /** borrowed-readonly — the in-stream ask lane, or undefined when the gate machinery is inactive (then both closures are
      *  absent). Read: `composedCallSignal` (the fence and the delivery race), `approvalPreviewOf` (the row's preview). */
@@ -140,6 +141,9 @@ export interface PrepareParkAskInput {
     orgAdmissionCheckpointState: () => boolean;
     /** borrowed-readonly — the policy-chain phase's rule-offer factory (the row's suggestion members). */
     ruleOffersOf: ReturnType<typeof createRuleOffersOf>;
+    /** borrowed-readonly — the leg's loaded skills (what its `Skill` tool serves); a parked `Skill` call's row binds the named
+     *  skill — its name and its lists — from them (`boundGrantDigest`). Empty when the leg loads none. */
+    skillSpecs: readonly SkillGrantSource[];
     /** borrowed-readonly — the injectable wall clock (the row's `suspendedAt`). */
     now: () => number;
     /** borrowed-readonly — the per-task human-review accumulator; snapshotted onto the row (never written here). */

package/dist/core/runner/prepare-park-ask.js

@@ -17,6 +17,8 @@ import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedT
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
 import { callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
 import { seatOf, wireOf } from "../tool-name-readings.js";
+import { skillCallGrantDigest } from "../skill-grant.js";
+import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
         super(message, options);
@@ -27,7 +29,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, skillSpecs, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -316,6 +318,7 @@ export function prepareParkAsk(input) {
                         ...askCarryRowMembers(carry),
                         ...ruleOffersOf(req, parkedArgs, clearanceFacts),
                         boundInputHash: boundInputHashOf(parkedArgs),
+                        ...((grantDigest) => (grantDigest !== undefined ? { boundGrantDigest: grantDigest } : {}))(skillCallGrantDigest(req, parkedArgs, skillSpecs, SKILL_TOOL_NAME)),
                         batchToolCallIds,
                         completedCallIds,
                     }),

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -30,7 +30,7 @@ import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec, ToolEffect } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { ReadDenyMatcher } from "../../tools/fs/read-deny.js";
-import { type ActiveSkillScope } from "./active-skill-scope.js";
+import type { SkillGrantLane, SkillGrantTable } from "../skill-grant.js";
 import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, StopForDenialLimit } from "./contracts.js";
 import { type Arbitration } from "../ask-origin.js";
 import { type ModeGateSeats, type PermissionModeController } from "../mode-policy.js";
@@ -118,10 +118,9 @@ export interface PreparePolicyChainInput {
     inheritedParentConstraints: NonNullable<InheritedGate["parentConstraints"]>[number][] | undefined;
     /** borrowed-readonly — the resumed leg's SEED half; only `constraintChain` (the frozen deny projections). */
     seedInheritedGate: Pick<NonNullable<PrepareResume["seed"]["inheritedGate"]>, "constraintChain"> | undefined;
-    /** borrowed-readonly — whether any skill carries a manifest or the task inherited a frame (the skill-scope layer). */
-    hasSkillManifest: boolean;
-    /** borrowed-readonly — the live skill scope the Gate-3 layer judges over. */
-    skillScope: ActiveSkillScope;
+    /** borrowed-readonly — the run's skill grant table; this phase binds its lane to the call facts the person's rule lane
+     *  reads (root, session, live cwd, the execution environment's home). Not written here. */
+    skillGrants: SkillGrantTable;
     /** borrowed-readonly — the FROZEN approver seat (the pass-through test's approver identity). */
     frozenOnAsk: OnAsk | undefined;
     /** borrowed-readonly — the identity of this task's hook-env source (the pass-through test's environment term). */
@@ -172,6 +171,8 @@ export interface PreparePolicyChainResult {
     basePolicyForResumeEdit: ToolPolicy | undefined;
     /** owned — the deny-narrowing fold (`Prepared.denyNarrowingPolicy`), or undefined when no layer exists. */
     denyNarrowingPolicy: ToolPolicy | undefined;
+    /** owned — the skill grant lane (`Prepared.skillGrants`; the gate's skill member and deny rows read it). */
+    skillGrantLane: SkillGrantLane;
     /** owned — the caller-facing policy layers (the wiring manifest reads their COUNT). */
     policyLayers: ToolPolicy[];
     /** owned — THE effective policy the gate station adjudicates with (the fold plus its final-form re-check), or undefined. */

package/dist/core/runner/prepare-policy-chain.js

@@ -7,10 +7,9 @@ import { assertHookSeatsCallable } from "../hook-seats.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
 import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, wrapToolPolicy, attestAskUnresolvableCause } from "../tool-policy.js";
-import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
-import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
+import { judgeRuleToolName } from "../tool-name-aliases.js";
+import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
-import { createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { arbitrateByMode, askClassMembersOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
@@ -22,7 +21,7 @@ import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-
 import { thrownText } from "../thrown-value.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -44,21 +43,18 @@ export async function preparePolicyChain(input) {
             for (const g of nameGroups) {
                 for (const [kind, list] of [["deny", g.deny], ["ask", g.ask], ["allow", g.allow]]) {
                     for (const n of list ?? []) {
+                        const verdict = judgeRuleToolName(n, known);
+                        if (verdict.kind !== "current") {
+                            const err = new Error(verdict.kind === "retired"
+                                ? `tool policy ${kind}-list entry "${n}" is a RETIRED tool name (${verdict.guidance}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`
+                                : `tool policy ${kind}-list entry "${n}" carries the "__" namespace separator but no protocol prefix, and matches nothing in this run's roster — protocol tools are named ${NAMESPACED_NAME_SHAPES}, and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with the owning protocol's marker.`);
+                            err.code = "config.legacy_tool_name";
+                            throw err;
+                        }
                         if (known.has(n))
                             continue;
                         if (isNamespacedCoveringRuleName(n) && [...known].some((k) => namespacedRuleNameCovers(n, k)))
                             continue;
-                        const retired = RETIRED_TOOL_NAMES.get(n);
-                        if (retired !== undefined) {
-                            const err = new Error(`tool policy ${kind}-list entry "${n}" is a RETIRED tool name (${retired}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`);
-                            err.code = "config.legacy_tool_name";
-                            throw err;
-                        }
-                        if (n.includes("__") && protocolOf(n) === undefined) {
-                            const err = new Error(`tool policy ${kind}-list entry "${n}" carries the "__" namespace separator but no protocol prefix, and matches nothing in this run's roster — protocol tools are named ${NAMESPACED_NAME_SHAPES}, and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with the owning protocol's marker.`);
-                            err.code = "config.legacy_tool_name";
-                            throw err;
-                        }
                         unmatched.add(`"${n}" (${kind})`);
                     }
                 }
@@ -131,20 +127,12 @@ export async function preparePolicyChain(input) {
                 : {}),
         }, { env: executionEnv, rootPath: taskRootFinal, toolEffects }));
     }
-    const skillScopePolicy = hasSkillManifest
-        ? createActiveSkillScopePolicy({
-            scope: skillScope,
-            env: executionEnv,
-            rootPath: taskRootFinal,
-            toolEffects,
-        })
-        : undefined;
     const frozenConstraintLayers = (seedInheritedGate?.constraintChain ?? [])
         .filter((e) => !("opaque" in e))
         .map((entry) => ({
         check: (creq) => checkToolPolicyProjection(entry, creq) ?? { action: "allow" },
     }));
-    const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, ...frozenConstraintLayers, skillScopePolicy].filter((p) => p !== undefined);
+    const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, ...frozenConstraintLayers].filter((p) => p !== undefined);
     for (const layer of narrowingLayers)
         auditPolicyNames(layer);
     const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
@@ -306,6 +294,7 @@ export async function preparePolicyChain(input) {
         };
     };
     const inheritedAskEvidence = inheritedAskRuleEvidence(deps.permissionRuleStore);
+    const skillGrantLane = skillGrants.lane({ root: taskRootFinal, sessionId, liveCwd: () => handsCwdRef?.current, home: executionEnv.homeDir });
     const { personal: permissionRuleLane, org: permissionRuleOrgLane } = createPermissionRuleLanes({
         provider: deps.permissionRuleStore,
         localOwnerDeclared: deps.localOwnerRules === true,
@@ -677,7 +666,7 @@ export async function preparePolicyChain(input) {
             return decision;
         })
         : foldedPolicy;
-    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
+    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
 }
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;

package/dist/core/runner/prepare-project-context.d.ts

@@ -1,7 +1,7 @@
 import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import { type StoredSession } from "../session.js";
 import type { RunnerDeps, TaskSpec, ToolSpec } from "../types.js";
-import type { ActiveSkillScope } from "./active-skill-scope.js";
+import { type SkillGrantTable, type SkillSeatReader } from "../skill-grant.js";
 import type { AnnounceOnceSink, Prepared, PrepareResume, RunInternals, ToolFaceSnapshot } from "./contracts.js";
 import { normalizeSkills } from "./synthetic-tools.js";
 import { RosterBuilder } from "../tool-roster.js";
@@ -11,12 +11,12 @@ export interface PrepareProjectContextInput {
      *  (the shared-memory pair's switch: wired ⇒ mount). Receiver preserved (`deps.onError?.(…)`). */
     deps: Pick<RunnerDeps, "loadProjectMemory" | "onError" | "sharedMemoryStores" | "onNotice">;
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `sessionId` (phase derivation + the
-     *  continuation projections), `skills` (the roster), `principal` (the shared-memory tools' trusted
-     *  identity). Never mutated. */
-    spec: Pick<TaskSpec, "sessionId" | "skills" | "principal">;
-    /** borrowed-readonly — trusted internals: `agentName` (seam ctx), `inheritedManifestScope` (the
-     *  parent's active skill frames, seeded as the base of the LIFO). `undefined` on a standalone prepare. */
-    internals: Pick<RunInternals, "agentName" | "inheritedManifestScope"> | undefined;
+     *  continuation projections), `skills` (the roster), `userInvokedSkills` (the person's invoked skills — their
+     *  rows are written here), `principal` (the shared-memory tools' trusted identity). Never mutated. */
+    spec: Pick<TaskSpec, "sessionId" | "skills" | "userInvokedSkills" | "principal">;
+    /** borrowed-readonly — trusted internals: `agentName` (seam ctx), `inheritedSkillGrants` (the parent's captured
+     *  skill grant rows, seeded as `inherited`). `undefined` on a standalone prepare. */
+    internals: Pick<RunInternals, "agentName" | "inheritedSkillGrants"> | undefined;
     /** borrowed-readonly — the acquired session; only `getBranch()` is read (phase derivation walk).
      *  The read is best-effort: a throw keeps the provisional phase. */
     session: Pick<StoredSession, "getBranch">;
@@ -43,10 +43,10 @@ export interface PrepareProjectContextInput {
      *  files). This phase APPENDS the project layer and hands the result back as
      *  {@link PrepareProjectContextResult.memoryBlock}; the input value itself is never mutated. */
     memoryBlockFromEngine: string | undefined;
-    /** borrowed-mutable — the run's LIFO skill-scope stack (identity is the contract: the scope policy
-     *  and the `skill` tool alias this exact object). Mutated here: `push` of every inherited parent
-     *  frame; after this phase only the `skill` tool's execute pushes/pops. */
-    skillScope: ActiveSkillScope;
+    /** borrowed-mutable — the run's skill grant table (identity is the contract: the `skill` tool, the gate's lane and the
+     *  ctx capture alias this exact object). Mutated here: the parent's captured rows (`inherited`) and the person's invoked
+     *  skills (`user`); after this phase only the `skill` tool writes (on activation). */
+    skillGrants: SkillGrantTable;
     /** borrowed-mutable — the run's roster builder (later refs alias its read face; in-place contract). Mutated
      *  here: `mount` of the `skill` tool, the shared-memory pair and the engine-memory pair. Occupancy
      *  is judged on the ALREADY-MOUNTED read face (names + aliases). */
@@ -67,8 +67,8 @@ export interface PrepareProjectContextInput {
     memoryPairExcludedName: string | undefined;
     /** borrowed-readonly — the engine-pair name a declared tool already occupies, if any (disclosure text). */
     memoryPairOccupiedName: string | undefined;
-    /** borrowed-readonly — the durable-resume carrier; read for `!== undefined` (seedAnnounced) and
-     *  `seed.announcedListings.skills` (the removal-to-zero projection's gate). */
+    /** borrowed-readonly — the durable-resume carrier; read for `!== undefined` (seedAnnounced),
+     *  `seed.announcedListings.skills` (the removal-to-zero projection's gate) and `seed.skillGrants` (the frozen grant rows). */
     resume: Pick<PrepareResume, "seed"> | undefined;
     /** borrowed-readonly — the lowered listing-budget seats from the config door. The listing projection
      *  carries it to the boundary renderer, and the over-budget disclosure below is priced against it. */
@@ -91,9 +91,8 @@ export interface PrepareProjectContextResult {
     /** owned — the normalized, load-gated skills (first-wins dedupe, name-sorted). Consumed inside this
      *  phase (tool + listing); exposed as the phase's own product. */
     skillSpecs: ReturnType<typeof normalizeSkills>;
-    /** owned — whether THIS task carries a manifested skill or inherits a parent frame (the skill-scope
-     *  policy's activation predicate). */
-    hasSkillManifest: boolean;
+    /** owned — the `Skill` tool's per-call seat over the loaded skills (`Execute skill: <name>`); `undefined` with no skill. */
+    skillSeatOf: SkillSeatReader | undefined;
     /** owned — the skills-listing projection the run loop's announce lane consumes (`Prepared.skillsListing`). */
     skillsListing: Prepared["skillsListing"];
     /** owned — whether the shared-memory pair mounted here (the support-name pre-check reads it). */

package/dist/core/runner/prepare-project-context.js

@@ -5,12 +5,14 @@ import { hasConversationContent } from "../session.js";
 import { createSharedMemoryTools } from "../shared-memory/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
 import { defineTool } from "../tools.js";
+import { readFrozenSkillGrants, seedSkillGrants, skillEntriesNotGrantedNotice, skillSeatReader } from "../skill-grant.js";
+import { deliverEngineNotice } from "../engine-notice.js";
 import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
-import { substitutedSkillLength } from "./skill-base-dir.js";
+import { skillLoadReading } from "./skill-base-dir.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { asThrownError } from "../thrown-value.js";
 export async function prepareProjectContext(input) {
-    const { deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillScope, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
+    const { deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
     const tools = roster.tools;
     let memoryBlock = memoryBlockFromEngine;
     let instructionSources;
@@ -76,25 +78,27 @@ export async function prepareProjectContext(input) {
         if (!declaredSkillRank.has(s.name))
             declaredSkillRank.set(s.name, declaredSkillRank.size);
     const skillSpecs = normalizeSkills(spec.skills ?? []).filter((s) => {
-        const delivered = substitutedSkillLength(s.content, s.baseDir);
-        if (delivered <= SKILL_CONTENT_MAX_CHARS)
+        const { loads, delivered } = skillLoadReading(s, SKILL_CONTENT_MAX_CHARS);
+        if (loads)
             return true;
         deps.onError?.(new Error(`Skill "${s.name}" content is ${delivered} chars${delivered === s.content.length ? "" : ` once its base directory resolves (${s.content.length} as written)`}, over the ${SKILL_CONTENT_MAX_CHARS}-char load limit — skill not loaded (skills are never truncated; shrink the body or move material to attachments/files).`), { phase: "config", sessionId });
         return false;
     });
-    const inheritedFrames = internals?.inheritedManifestScope ?? [];
-    for (const frame of inheritedFrames) {
-        skillScope.push(frame);
-    }
-    const hasSkillManifest = skillSpecs.some((s) => s.manifest !== undefined) || inheritedFrames.length > 0;
+    const frozenSkillGrants = readFrozenSkillGrants(resume?.seed.skillGrants);
+    if (frozenSkillGrants === undefined)
+        throw new Error("the resumed checkpoint's skill-grant section does not read as grant rows — refusing to seed the run without the refusals it carries (the resume screen refuses this row before the claim)");
+    const inert = seedSkillGrants(skillGrants, { skills: skillSpecs, userInvokedSkills: spec.userInvokedSkills, inherited: [...(internals?.inheritedSkillGrants ?? []), ...frozenSkillGrants] });
+    if (inert.length > 0)
+        deliverEngineNotice(deps.onNotice, skillEntriesNotGrantedNotice(inert, sessionId));
     if (skillSpecs.length > 0) {
         if (tools.some((t) => t.name === SKILL_TOOL_NAME)) {
             const e = new Error(`Tool name "${SKILL_TOOL_NAME}" is reserved when spec.skills is present.`);
             e.code = "config.reserved_tool_name";
             throw e;
         }
-        roster.mount(createSkillTool(skillSpecs, skillScope), { source: "builtin", mountedBy: "optional" });
+        roster.mount(createSkillTool(skillSpecs, skillGrants), { source: "builtin", mountedBy: "optional" });
     }
+    const skillSeatOf = skillSeatReader(skillSpecs);
     const sharedMemoryProvider = deps.sharedMemoryStores;
     let sharedMemoryPairMounted = false;
     if (sharedMemoryProvider !== undefined) {
@@ -150,5 +154,5 @@ export async function prepareProjectContext(input) {
                 ?
                     { entries: [], seedAnnounced: true, budget: skillListingBudget }
                 : undefined;
-    return { memoryBlock, instructionSources, projectInstructionContent, skillSpecs, hasSkillManifest, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted };
+    return { memoryBlock, instructionSources, projectInstructionContent, skillSpecs, skillSeatOf, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted };
 }

package/dist/core/runner/prepare-run-refs.d.ts

@@ -1,6 +1,6 @@
 /**
  * PrepareTask's RUN-REFS phase, verbatim from the driver: the run's own edited-files
- * ledger, the harness ref, the per-task skill scope, the display-forwarding wrapper, the three run-local refs
+ * ledger, the harness ref, the per-task skill grant table, the display-forwarding wrapper, the three run-local refs
  * (review request / stop-after-turn / plan mode) with the ctx primitives that write them, the subagent-retain
  * ledger and the worktree-isolation helper. Nothing here has behavior of its own: the phase MINTS SEATS —
  * mutable cells and the closures bound to them — that later phases, the tool ctx and the run loop read and
@@ -11,15 +11,15 @@
  * await is extracted as a sync function — an `async` wrapper would open a microtask window).
  *
  * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member:
- * the closures minted here, the driver's harness build, the project-context phase's inherited-skill
- * seed, the skill tool, and the run loop's two writes — nothing else writes them. Read-stability of the host
+ * the closures minted here, the driver's harness build, the project-context phase's skill-grant
+ * seeds, the skill tool, and the run loop's two writes — nothing else writes them. Read-stability of the host
  * handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  */
 import type { AgentHarness, ExecutionEnv } from "../../internal/harness.js";
 import type { SubagentWorktreeIsolation } from "../../agents/subagent.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { TaskEvent, TaskSpec } from "../types.js";
-import { ActiveSkillScope } from "./active-skill-scope.js";
+import { SkillGrantTable } from "../skill-grant.js";
 import type { Prepared, RunInternals, ToolProgressLane } from "./contracts.js";
 import type { PermissionModeController } from "../mode-policy.js";
 import { type EditedFilesLedger } from "./edited-files-ledger.js";
@@ -63,10 +63,10 @@ export interface PrepareRunRefsResult {
     toolProgressRef: {
         current?: ToolProgressLane;
     };
-    /** borrowed-mutable — the per-task LIFO skill scope. Writers: the project-context phase (the inherited-
-     *  from-parent seed frame, `push`) and the `skill` tool minted over it (`push` on a manifest load; a frame
-     *  closes by `pop`). Readers: the tool ctx's `activeSkillScope()` snapshot and the skill-scope policy layer. */
-    skillScope: ActiveSkillScope;
+    /** borrowed-mutable — the per-task skill grant table (its rows live for this run). Writers: the project-context phase (the
+     *  parent's captured rows, the person's invoked skills) and the `Skill` tool minted over it (a successful activation).
+     *  Readers: the tool ctx's `activeSkillGrants()` capture and the gate's skill lane. */
+    skillGrants: SkillGrantTable;
     /** owned — the FILTERED display-forwarding wrapper, or undefined when the deployment wired no sink (the
      *  tool ctx then carries no `forwardEvent` key). */
     forwardEvent: ((e: TaskEvent) => void) | undefined;

package/dist/core/runner/prepare-run-refs.js

@@ -1,6 +1,6 @@
 import { createSubagentWorktreeHelper } from "../../agents/subagent.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { ActiveSkillScope } from "./active-skill-scope.js";
+import { SkillGrantTable } from "../skill-grant.js";
 import { forwardSafely } from "./forward-sink.js";
 import { createEditedFilesLedger } from "./edited-files-ledger.js";
 export function forwardsSubagentEvents(spec) {
@@ -14,7 +14,7 @@ export function prepareRunRefs(input) {
     const { note: noteFileEdited, snapshot: editedFilesSnapshot } = createEditedFilesLedger();
     const harnessRef = {};
     const toolProgressRef = {};
-    const skillScope = new ActiveSkillScope();
+    const skillGrants = new SkillGrantTable();
     const sinkWired = internals?.onForwardEvent !== undefined;
     const forwardEvent = sinkWired
         ? (e) => {
@@ -48,5 +48,5 @@ export function prepareRunRefs(input) {
     };
     const subagentRetain = spec.retainSubagentSessions ? new SubagentRetainLedger(spec.retainSubagentSessions) : undefined;
     const worktreeIsolation = spec.handsReadOnly !== true ? createSubagentWorktreeHelper(executionEnv, taskRootFinal) : undefined;
-    return { noteFileEdited, editedFilesSnapshot, harnessRef, toolProgressRef, skillScope, forwardEvent, reviewRequestRef, requestReview, stopRequestedRef, requestStopAfterTurn, bindPermissionModeSeat, enterPlanMode, subagentRetain, worktreeIsolation };
+    return { noteFileEdited, editedFilesSnapshot, harnessRef, toolProgressRef, skillGrants, forwardEvent, reviewRequestRef, requestReview, stopRequestedRef, requestStopAfterTurn, bindPermissionModeSeat, enterPlanMode, subagentRetain, worktreeIsolation };
 }

package/dist/core/runner/prepare-safety-scan.js

@@ -1,4 +1,4 @@
-import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
+import { NAMESPACED_NAME_SHAPES, carriesNamespaceSeparator } from "../protocol-table.js";
 import { engineCardTypes, handBandEffects } from "../tool-registry.js";
 import { callerCardIdOf, offendingResultCard, rosterMemberBoundProblem, schemaKeyBoundProblem } from "../tool-roster.js";
 import { toolFaceProblem } from "./tool-face-overlay.js";
@@ -64,13 +64,13 @@ export function prepareSafetyScan(input) {
                 throw e;
             }
         }
-        if (t.name.includes("__")) {
+        if (carriesNamespaceSeparator(t.name)) {
             const e = new Error(`Tool name "${t.name}" is invalid: "__" is reserved for the engine's protocol tool namespaces (${NAMESPACED_NAME_SHAPES}) and must not appear in a caller tool name.`);
             e.code = "config.tool_name_invalid";
             throw e;
         }
         for (const alias of t.aliases ?? []) {
-            if (alias.includes("__")) {
+            if (carriesNamespaceSeparator(alias)) {
                 const e = new Error(`Tool alias "${alias}" (of "${t.name}") is invalid: "__" is reserved for the engine's protocol tool namespaces (${NAMESPACED_NAME_SHAPES}) and must not appear in a caller tool alias.`);
                 e.code = "config.tool_name_invalid";
                 throw e;

package/dist/core/runner/prepare-suspend-saga.d.ts

@@ -112,6 +112,8 @@ export interface PrepareSuspendSagaInput {
     faceCheckpointSection: () => SerializedCheckpointState["readFace"];
     /** borrowed-readonly — the inherited-gate phase's WRITE-face section builder (the row's `writeFace`). */
     writeFaceCheckpointSection: () => SerializedCheckpointState["writeFace"];
+    /** borrowed-readonly — the inherited-gate phase's SKILL-GRANT section builder (the row's `skillGrants`). */
+    skillGrantCheckpointSection: () => SerializedCheckpointState["skillGrants"];
     /** borrowed-readonly — the leg's reminder provenance mark (travels with the row). */
     reminderMark: string;
     /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read at mint time. Not written here. */
@@ -136,7 +138,6 @@ export interface PrepareSuspendSagaInput {
     /** borrowed-readonly — the leg's live permission-mode seat; the DECLARED mode (request clamped under the chain's ceiling,
      *  before the deployment's fold) is what the row records — the resume leg re-judges the fold for its own deployment. */
     permissionMode: PermissionModeController;
-    /** borrowed-readonly — the auto-mode decider, or undefined (the latch-health reading only). */
     /** borrowed-readonly — the inherited admitted org scopes, or undefined (copied onto the row). */
     inheritedAdmittedOrgScopes: readonly string[] | undefined;
     /** borrowed-readonly — this leg's OWN org verdict seat; `current` is read at mint time. Not written here. */