@sema-agent/core 7.41.0 → 7.42.0

package/dist/core/gate-lanes.js

@@ -1,13 +1,13 @@
-import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, describeThrown, refuseOutOfContractDecision } from "./tool-policy.js";
-import { arbitrateByMode, classifyAsk, fileCommandOptionsSentence, mandateDisclosureOf, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
+import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
+import { arbitrateByMode, classifyAsk, fileCommandOptionsSentence, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
 import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { classifierUnavailableArm } from "./classifier-unavailable-arm.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "./gate-outcome.js";
 import { inlineUntrusted } from "./untrusted-text.js";
-import { isRuleBehavior } from "./permission-rule-model.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { applyPersistedTightening, disclosedRuleSet } from "./persisted-rule-arms.js";
 import { skillAllowDecision, skillRowRefusal } from "./skill-grant.js";
+import { allowRuleShadowOf } from "./allow-entry.js";
 import { CD_GIT_COMPOUND_SENTENCE, changesDirectoryBeforeGit, readOnlyShellVerdict } from "./read-only-shell.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
@@ -15,146 +15,13 @@ import { catalogRuleFaceOf } from "./tool-registry.js";
 import { callFaceSeat } from "./tool-roster.js";
 import { heldBy, wireOf } from "./tool-name-readings.js";
 import { asksUnstated, modeAcceptsFileCommand, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
-import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
+import { ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON } from "./permission-rule-org.js";
 import { exitGate } from "./runner/gate-exit.js";
+import { readOrgRuleLane, readPersistedRuleLane } from "./rule-lane-reads.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
 const QUESTION_TOOL_NAMES = new Set([ASK_USER_QUESTION_TOOL_NAME]);
-function isPlainOwnRecord(x) {
-    try {
-        if (x === null || typeof x !== "object" || Array.isArray(x))
-            return false;
-        const p = Object.getPrototypeOf(x);
-        return p === Object.prototype || p === null;
-    }
-    catch {
-        return false;
-    }
-}
-function ownDataValue(obj, key) {
-    try {
-        const d = Object.getOwnPropertyDescriptor(obj, key);
-        return d && "value" in d ? d.value : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-export function normalizeOrgGateVerdict(answer, unreadable) {
-    const clean = (v) => Object.assign(Object.create(null), v);
-    const readable = (x) => {
-        try {
-            return x !== null && (typeof x === "object" || typeof x === "function") && !Array.isArray(x);
-        }
-        catch {
-            return false;
-        }
-    };
-    if (!readable(answer))
-        return clean({ status: "unavailable", disclosures: [unreadable] });
-    const status = ownDataValue(answer, "status");
-    if (status === "unavailable") {
-        const disclosures = ownDataValue(answer, "disclosures");
-        let lines = [];
-        if (Array.isArray(disclosures)) {
-            try {
-                for (let i = 0; i < disclosures.length; i++) {
-                    const d = disclosures[i];
-                    if (typeof d === "string")
-                        lines.push(d);
-                }
-            }
-            catch {
-                lines = [];
-            }
-        }
-        return clean({ status: "unavailable", disclosures: lines.length > 0 ? lines : [unreadable] });
-    }
-    if (status !== "available")
-        return clean({ status: "unavailable", disclosures: [unreadable] });
-    const revision = ownDataValue(answer, "revision");
-    const revisionCell = typeof revision === "number" && Number.isFinite(revision) ? { revision } : {};
-    const verdict = ownDataValue(answer, "verdict");
-    if (verdict === undefined)
-        return clean({ status: "available", ...revisionCell });
-    if (!readable(verdict))
-        return clean({ status: "unavailable", disclosures: [unreadable] });
-    const behavior = ownDataValue(verdict, "behavior");
-    const rule = ownDataValue(verdict, "rule");
-    if ((behavior !== "deny" && behavior !== "ask") || typeof rule !== "string")
-        return clean({ status: "unavailable", disclosures: [unreadable] });
-    const reason = ownDataValue(verdict, "unreadable");
-    const unreadableCell = behavior === "ask" && typeof reason === "string" ? { unreadable: reason } : {};
-    return clean({ status: "available", verdict: clean({ behavior: behavior, rule, ...unreadableCell }), ...revisionCell });
-}
-function copiedUsableDots(dots) {
-    let copied;
-    try {
-        if (Array.isArray(dots)) {
-            const walked = [];
-            for (let i = 0; i < dots.length; i++) {
-                const d = dots[i];
-                walked.push(isPlainOwnRecord(d) ? { actor: ownDataValue(d, "actor"), counter: ownDataValue(d, "counter") } : { actor: undefined, counter: undefined });
-            }
-            copied = walked;
-        }
-    }
-    catch {
-        copied = undefined;
-    }
-    const usable = copied?.every((d) => typeof d.actor === "string" && typeof d.counter === "number" && Number.isFinite(d.counter)) === true && copied.length > 0;
-    return usable ? { dots: copied } : {};
-}
-export function normalizePersistedRuleHit(hit) {
-    if (!isPlainOwnRecord(hit))
-        return {};
-    if (ownDataValue(hit, "unreadable") === true) {
-        const reason = ownDataValue(hit, "reason");
-        return typeof reason === "string" ? { unreadable: true, reason } : { unreadable: true };
-    }
-    const rulesRaw = ownDataValue(hit, "rules");
-    if (rulesRaw === undefined) {
-        const coverageRaw = ownDataValue(hit, "segmentCoverage");
-        let rows;
-        try {
-            if (Array.isArray(coverageRaw)) {
-                const walked = [];
-                for (let i = 0; i < coverageRaw.length; i++) {
-                    const r = coverageRaw[i];
-                    walked.push(isPlainOwnRecord(r) ? { segment: ownDataValue(r, "segment"), covered: ownDataValue(r, "covered") } : { segment: undefined, covered: undefined });
-                }
-                rows = walked.every((r) => typeof r.segment === "string" && typeof r.covered === "boolean") ? walked : undefined;
-            }
-        }
-        catch {
-            rows = undefined;
-        }
-        return rows !== undefined && rows.length > 0 ? { coverage: rows.map((r) => ({ segment: r.segment, covered: r.covered })) } : {};
-    }
-    let members;
-    try {
-        if (Array.isArray(rulesRaw)) {
-            const walked = [];
-            for (let i = 0; i < rulesRaw.length; i++) {
-                const m = rulesRaw[i];
-                walked.push(isPlainOwnRecord(m) ? { rule: ownDataValue(m, "rule"), dots: ownDataValue(m, "dots") } : { rule: undefined, dots: undefined });
-            }
-            members = walked;
-        }
-    }
-    catch {
-        members = undefined;
-    }
-    if (members === undefined || members.length === 0)
-        return {};
-    if (!members.every((m) => typeof m.rule === "string"))
-        return {};
-    const behavior = ownDataValue(hit, "behavior");
-    if (!isRuleBehavior(behavior))
-        return {};
-    return { hit: { behavior, rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
-}
 function parkWith(suspendAsk, parkArgs, carry) {
     return suspendAsk(...parkArgs, carry);
 }
@@ -200,21 +67,7 @@ export async function runGateLanes(pass) {
         if (wireOf("lanes.orgContentAskExemption", pass.req) === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
             return { decision: current, org: undefined };
         let decided = current;
-        let pending;
-        try {
-            pending = Promise.resolve(input.orgRules.adjudicate({ toolName, args, toolCallId, ...callFaceSeat(pass.req.face) }));
-        }
-        catch (err) {
-            pending = Promise.resolve({ status: "unavailable", disclosures: [`the org adjudication face threw before answering: ${describeThrown(err)}`] });
-        }
-        const raw = await settleOrgVerdictWithin(pending.catch((err) => ({
-            status: "unavailable",
-            disclosures: [`the org adjudication face threw: ${describeThrown(err)}`],
-        })), {
-            status: "unavailable",
-            disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`],
-        }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
-        const answer = normalizeOrgGateVerdict(raw, "the org adjudication face answered something this gate cannot read as a verdict — treated as unreadable governance, never as an empty one");
+        const answer = await readOrgRuleLane(input.orgRules, { toolName, args, toolCallId, ...callFaceSeat(pass.req.face) }, input.abortSignal);
         if (answer.status === "unavailable") {
             orgEvidence = { revisionAbsent: "unavailable", ruleAbsent: "unavailable" };
             orgRealApprovalRequired = true;
@@ -262,16 +115,7 @@ export async function runGateLanes(pass) {
     const orgAnswer = await applyOrgLayer(pass.decision, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput);
     pass.decision = orgAnswer.decision;
     const ruleCallUnreadableOf = (lane) => lane?.unreadable === true && lane.reason !== undefined;
-    const readPersistedRules = async (req) => {
-        let pendingHit;
-        try {
-            pendingHit = Promise.resolve(input.persistedRules?.adjudicate(req));
-        }
-        catch {
-            return { unreadable: true };
-        }
-        return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
-    };
+    const readPersistedRules = (req) => readPersistedRuleLane(input.persistedRules, req, input.abortSignal);
     const laneReq = { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) };
     const laneAnswer = input.persistedRules !== undefined && wireOf("lanes.persistedLaneSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
     {
@@ -294,81 +138,101 @@ export async function runGateLanes(pass) {
             pass.currentInput = pass.policyRewrite;
             pass.req.args = pass.policyRewrite;
         }
-        const persistedRuleMandate = persistedRuleMandateOf({
-            ...mandateMarksNow(),
-            probeMandated: pass.decision.action === "ask" && pass.decision.probeMandated === true,
-        });
         const ruleMayClear = () => ruleClearanceOf(pass.decision.action === "ask" ? pass.decision : undefined, mandateMarksNow()).ruleMayClear;
+        const classMayClear = () => pass.decision.action === "ask" && classifyAsk(pass.decision, askOriginFacts(orgAnswer.org, ruleCallUnreadableOf(laneAnswer))).row.ruleMayClear;
         let personalEvidence = { dotsAbsent: input.persistedRules === undefined ? "not_wired" : "not_adjudicated" };
         if (laneAnswer?.unreadable === true)
             personalEvidence = { dotsAbsent: "unavailable" };
         let laneCoverage;
+        const questionTool = wireOf("lanes.allowLayerQuestionSkip", pass.req) === ASK_USER_QUESTION_TOOL_NAME;
         const allowLayerMayClear = () => !orgRealApprovalRequired &&
             pass.decision.action === "ask" &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
-            wireOf("lanes.allowLayerQuestionSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME &&
+            !questionTool &&
             !markedUnresolvable();
+        const unionDotsOf = (rules) => {
+            const seen = new Set();
+            const union = [];
+            for (const r of rules) {
+                if (r.dots === undefined || r.dots.length === 0)
+                    return { dotsAbsent: "not_reported" };
+                for (const d of r.dots) {
+                    const key = JSON.stringify([d.actor, d.counter]);
+                    if (!seen.has(key))
+                        (seen.add(key), union.push(d));
+                }
+            }
+            return { dots: union };
+        };
         if (input.persistedRules && allowLayerMayClear()) {
             const answer = laneAnswer ?? {};
-            const hitRules = answer.hit?.behavior === "allow" ? answer.hit.rules : undefined;
             laneCoverage = answer.coverage;
-            personalEvidence = { dotsAbsent: answer.unreadable === true ? "unavailable" : "no_match" };
-            const unionDotsOf = (rules) => {
-                const seen = new Set();
-                const union = [];
-                for (const r of rules) {
-                    if (r.dots === undefined || r.dots.length === 0)
-                        return { dotsAbsent: "not_reported" };
-                    for (const d of r.dots) {
-                        const key = JSON.stringify([d.actor, d.counter]);
-                        if (!seen.has(key)) {
-                            seen.add(key);
-                            union.push(d);
-                        }
-                    }
+            personalEvidence = answer.hit?.behavior === "ask" ? unionDotsOf(answer.hit.rules) : { dotsAbsent: answer.unreadable === true ? "unavailable" : "no_match" };
+        }
+        const afterRuleClear = () => {
+            if (input.permissionMode === undefined || input.permissionMode() === "auto")
+                input.autoMode?.denialTracking?.recordAllow();
+        };
+        const mode = input.permissionMode?.();
+        const rewrite = pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {};
+        const listAllow = (decisionReason, whose, entries) => ({
+            action: "allow",
+            message: `${whose} allowedTools (${entries.map((e) => inlineUntrusted(e, 200)).join(", ")}) ${entries.length === 1 ? "covers" : "cover"} this call`,
+            decisionReason,
+            ...rewrite,
+        });
+        const storedAllows = laneAnswer?.hit?.behavior === "allow" ? laneAnswer.hit.rules : undefined;
+        const members = [
+            ["hook", () => (pass.hookAllowed === true && pass.policyRewrite === undefined ? { entries: [], clear: () => ({ action: "allow", message: "a PreToolUse hook allowed this call", decisionReason: "hook" }), afterClear: async () => undefined } : undefined)],
+            ["deployment", () => {
+                    const hit = input.deploymentAllows?.allowing(pass.req, mode);
+                    return hit && { entries: hit.entries, clear: () => listAllow("deployment_rule", "the deployment's", hit.entries), afterClear: () => notifier.notifyAsync(() => input.deploymentAllows?.onAllowed?.({ toolName: pass.req.toolName, toolCallId, entries: hit.entries }), "toolGate.allowedToolsResolved") };
+                }],
+            ["persisted", () => storedAllows && {
+                    entries: storedAllows.map((r) => r.rule),
+                    clear: () => ({ action: "allow", message: storedAllows.length === 1 ? `a persisted allow rule (${disclosedRuleSet(storedAllows)}) covers this call` : `persisted allow rules (${disclosedRuleSet(storedAllows)}) cover every segment of this call`, decisionReason: "persisted_rule", ...rewrite }),
+                    afterClear: () => notifier.notifyAsync(() => input.persistedRules?.onResolved?.({ toolName: pass.req.toolName, toolCallId, rules: storedAllows.map((r) => r.rule) }), "toolGate.persistedRuleResolved"),
+                    shadowed: () => (personalEvidence = unionDotsOf(storedAllows)),
+                }],
+            ["skill", () => {
+                    const hit = input.skillGrants?.allowing(pass.req, mode);
+                    return hit && { entries: hit.entries, clear: () => skillAllowDecision(hit, pass.policyRewrite), afterClear: () => notifier.notifyAsync(() => input.skillGrants?.onAllowed?.({ toolName: pass.req.toolName, toolCallId, ...hit }), "toolGate.skillGrantResolved") };
+                }],
+            ["request", () => {
+                    const hit = input.requestAllows?.allowing(pass.req, mode);
+                    return hit && { entries: hit.entries, clear: () => listAllow("request_rule", "this run's", hit.entries), afterClear: () => notifier.notifyAsync(() => input.requestAllows?.onAllowed?.({ toolName: pass.req.toolName, toolCallId, entries: hit.entries }), "toolGate.allowedToolsResolved") };
+                }],
+        ];
+        const shadows = [];
+        if (!questionTool) {
+            for (const [member, match] of members) {
+                if (pass.decision.action !== "ask")
+                    break;
+                const hit = match();
+                if (hit === undefined)
+                    continue;
+                if (allowLayerMayClear() && ruleMayClear() && classMayClear()) {
+                    pass.decision = hit.clear();
+                    await hit.afterClear();
+                    if (member !== "hook")
+                        afterRuleClear();
+                    break;
                 }
-                return { dots: union };
-            };
-            if (answer.hit?.behavior === "ask")
-                personalEvidence = unionDotsOf(answer.hit.rules);
-            if (hitRules !== undefined && ruleMayClear()) {
-                pass.decision = {
-                    action: "allow",
-                    message: hitRules.length === 1
-                        ? `a persisted allow rule (${disclosedRuleSet(hitRules)}) covers this call`
-                        : `persisted allow rules (${disclosedRuleSet(hitRules)}) cover every segment of this call`,
-                    decisionReason: "persisted_rule",
-                    ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}),
-                };
-                await notifier.notifyAsync(() => input.persistedRules?.onResolved?.({ toolName: pass.req.toolName, toolCallId, rules: hitRules.map((r) => r.rule) }), "toolGate.persistedRuleResolved");
-            }
-            else if (hitRules !== undefined) {
-                personalEvidence = unionDotsOf(hitRules);
-                const shownRule = disclosedRuleSet(hitRules);
-                const mandateNoun = persistedRuleMandate === undefined && pass.decision.matchedAskRule === undefined
-                    ? "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule"
-                    : mandateDisclosureOf(persistedRuleMandate);
-                pass.decision = {
-                    ...pass.decision,
-                    persistedRuleShadowed: shownRule,
-                    message: hitRules.length === 1
-                        ? `${pass.decision.message !== undefined ? `${pass.decision.message} ` : ""}(a persisted allow rule (${shownRule}) matches this call but does not clear the ask — ${mandateNoun})`
-                        : `${pass.decision.message !== undefined ? `${pass.decision.message} ` : ""}(persisted allow rules (${shownRule}) match this call but do not clear the ask — ${mandateNoun})`,
-                };
+                shadows.push(allowRuleShadowOf(member, hit.entries));
+                hit.shadowed?.();
             }
         }
-        const skillHit = allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() ? input.skillGrants?.allowing(pass.req, input.permissionMode?.()) : undefined;
-        if (skillHit !== undefined) {
-            pass.decision = skillAllowDecision(skillHit, pass.policyRewrite);
-            await notifier.notifyAsync(() => input.skillGrants?.onAllowed?.({ toolName: pass.req.toolName, toolCallId, ...skillHit }), "toolGate.skillGrantResolved");
+        if (pass.decision.action === "ask") {
+            const { allowRuleShadowed: _claimed, ...standing } = pass.decision;
+            pass.decision = shadows.length > 0 ? { ...standing, allowRuleShadowed: shadows } : standing;
         }
         const originFacts = askOriginFacts(orgAnswer.org, ruleCallUnreadableOf(laneAnswer));
         if (pass.decision.action === "ask") {
             const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
             pass.decision = stampAskOrigin(stamped, originFacts, classifyStanding(stamped, originFacts));
         }
-        if (allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() && pass.probeBoundaryDeclined !== true && wireOf("lanes.readOnlyShellAllow", pass.req) === COMMAND_RULE_TOOL) {
+        if (allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() && classMayClear() && pass.probeBoundaryDeclined !== true && wireOf("lanes.readOnlyShellAllow", pass.req) === COMMAND_RULE_TOOL) {
             const commandParam = catalogRuleFaceOf(COMMAND_RULE_TOOL)?.primaryParams[0] ?? "command";
             const args = pass.req.args;
             const command = typeof args === "object" && args !== null && !Array.isArray(args) ? args[commandParam] : undefined;
@@ -382,6 +246,7 @@ export async function runGateLanes(pass) {
                     ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}),
                 };
                 await notifier.notifyAsync(() => input.onReadOnlyAllowed?.({ toolName: pass.req.toolName, toolCallId, command }), "toolGate.readOnlyAllowed");
+                afterRuleClear();
             }
             else if (shape !== undefined && pass.tightenedBy === "shell_gate" && changesDirectoryBeforeGit(shape, input.trackedCwd?.())) {
                 pass.decision = { ...pass.decision, message: CD_GIT_COMPOUND_SENTENCE };
@@ -530,7 +395,7 @@ export async function runGateLanes(pass) {
             ...(d.action === "ask" && d.authoredBy === "deployment" ? { authoredBy: "deployment" } : {}),
         });
         if (suspendAsk && pass.decision.action === "ask") {
-            const parkArgs = [pass.req, pass.currentInput, safety, undefined, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.persistedRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
+            const parkArgs = [pass.req, pass.currentInput, safety, undefined, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.allowRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
             const suspended = await parkWith(suspendAsk, parkArgs, carryOf(pass.decision));
             if (suspended) {
                 if ("parkFailed" in suspended)
@@ -550,7 +415,7 @@ export async function runGateLanes(pass) {
                     pass.req.args = outcome.presentedInput;
                 }
                 if (suspendAsk && outcome.parkDeclined && pass.parkFailed === undefined) {
-                    const parkArgs = [pass.req, pass.currentInput, safety, true, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.persistedRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
+                    const parkArgs = [pass.req, pass.currentInput, safety, true, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.allowRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
                     const suspended = await parkWith(suspendAsk, parkArgs, carryOf(pass.decision));
                     if (suspended) {
                         if ("parkFailed" in suspended)
@@ -586,7 +451,7 @@ export async function runGateLanes(pass) {
                 pass.deniedBy = "ask_resolution";
             pass.decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && pass.parkFailed === undefined) {
-                const parkArgs = [pass.req, pass.currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined];
+                const parkArgs = [pass.req, pass.currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.allowRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined];
                 const suspended = await parkWith(suspendAsk, parkArgs, carryOf(askBeforeResolve));
                 if (suspended) {
                     if ("parkFailed" in suspended)
@@ -613,7 +478,6 @@ export async function runGateLanes(pass) {
                 let editArgs = pass.decision.updatedInput;
                 let editDenied;
                 let editRewrittenSinceHuman = false;
-                let editHookAllowed = false;
                 for (let round = 0;; round++) {
                     if (round >= 3) {
                         editDenied = {
@@ -623,7 +487,6 @@ export async function runGateLanes(pass) {
                         pass.deniedBy = "policy";
                         break;
                     }
-                    editHookAllowed = false;
                     if (screening !== undefined) {
                         let hr;
                         let hrUnanswered;
@@ -665,7 +528,6 @@ export async function runGateLanes(pass) {
                                 editArgs = hr.updatedInput;
                                 editRewrittenSinceHuman = true;
                             }
-                            editHookAllowed = hr.action === "allow";
                         }
                     }
                     let recheck = { action: "allow" };
@@ -727,7 +589,7 @@ export async function runGateLanes(pass) {
                             editArgs = recheck.updatedInput;
                             editRewrittenSinceHuman = true;
                         }
-                        if (!editRewrittenSinceHuman || !asksUnstated(recheck, permissionSeatAt(input, editArgs)?.seat, input.permissionMode?.(), editHookAllowed && recheck.updatedInput === undefined))
+                        if (!editRewrittenSinceHuman || !asksUnstated(recheck, permissionSeatAt(input, editArgs)?.seat, input.permissionMode?.()))
                             break;
                         recheck = { action: "ask", message: permissionSeatAt(input, editArgs)?.question ?? unstatedAskMessage(toolName) };
                         pass.tightenedBy = "unstated";

package/dist/core/governance-codes.d.ts

@@ -136,7 +136,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "skills.allowed_tool_not_granted", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.allowed_tool_not_granted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
 /** A catalogued code (see {@link ENGINE_NOTICE_CODES}); {@link NOTICE_MINTER} says who mints it. NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */
@@ -181,6 +181,7 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "permission.ask_released_by_mode": "user";
     readonly "permission.read_deny_unapplied": "user";
     readonly "permission.rule_store_unavailable": "user";
+    readonly "permission.allowed_tool_not_granted": "user";
     readonly "memory.capture_opted_out": "user";
     readonly "memory.capture_optout_unpersisted": "user";
     readonly "memory.consolidation_withheld": "operator";
@@ -233,7 +234,6 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "route.tool_call_id_folded": "operator";
     readonly "context.tool_turn_repaired": "operator";
     readonly "skills.listing_truncated": "operator";
-    readonly "skills.allowed_tool_not_granted": "operator";
     readonly "agents.listing_truncated": "operator";
     readonly "tool_result.offload_put_failed": "operator";
     readonly "config.forward_sink_failed": "operator";
@@ -294,6 +294,7 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "permission.ask_released_by_mode": "engine";
     readonly "permission.read_deny_unapplied": "engine";
     readonly "permission.rule_store_unavailable": "engine";
+    readonly "permission.allowed_tool_not_granted": "engine";
     readonly "peer.inbound_disposition": "engine";
     readonly "peer.held_settled": "engine";
     readonly "peer.idle_subscription": "engine";
@@ -344,7 +345,6 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "memory.capture_opted_out": "engine";
     readonly "memory.capture_optout_unpersisted": "engine";
     readonly "skills.listing_truncated": "engine";
-    readonly "skills.allowed_tool_not_granted": "engine";
     readonly "agents.listing_truncated": "engine";
     readonly "tool_result.offload_put_failed": "engine";
     readonly "instructions.source_changed": "server";

package/dist/core/governance-codes.js

@@ -143,6 +143,7 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "permission.ask_released_by_mode",
     "permission.read_deny_unapplied",
     "permission.rule_store_unavailable",
+    "permission.allowed_tool_not_granted",
     "peer.inbound_disposition",
     "peer.held_settled",
     "peer.idle_subscription",
@@ -193,7 +194,6 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "memory.capture_opted_out",
     "memory.capture_optout_unpersisted",
     "skills.listing_truncated",
-    "skills.allowed_tool_not_granted",
     "agents.listing_truncated",
     "tool_result.offload_put_failed",
     "instructions.source_changed",
@@ -228,6 +228,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "permission.ask_released_by_mode": "user",
     "permission.read_deny_unapplied": "user",
     "permission.rule_store_unavailable": "user",
+    "permission.allowed_tool_not_granted": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
     "memory.consolidation_withheld": "operator",
@@ -280,7 +281,6 @@ const NOTICE_AUDIENCE_TABLE = {
     "route.tool_call_id_folded": "operator",
     "context.tool_turn_repaired": "operator",
     "skills.listing_truncated": "operator",
-    "skills.allowed_tool_not_granted": "operator",
     "agents.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",
     "config.forward_sink_failed": "operator",
@@ -323,6 +323,7 @@ const NOTICE_MINTER_TABLE = {
     "permission.ask_released_by_mode": "engine",
     "permission.read_deny_unapplied": "engine",
     "permission.rule_store_unavailable": "engine",
+    "permission.allowed_tool_not_granted": "engine",
     "peer.inbound_disposition": "engine",
     "peer.held_settled": "engine",
     "peer.idle_subscription": "engine",
@@ -373,7 +374,6 @@ const NOTICE_MINTER_TABLE = {
     "memory.capture_opted_out": "engine",
     "memory.capture_optout_unpersisted": "engine",
     "skills.listing_truncated": "engine",
-    "skills.allowed_tool_not_granted": "engine",
     "agents.listing_truncated": "engine",
     "tool_result.offload_put_failed": "engine",
     "instructions.source_changed": "server",

package/dist/core/hooks.d.ts

@@ -3,7 +3,7 @@ import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../inter
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallFace, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
 import type { GateOutcome } from "./gate-outcome.js";
 import { type PreToolUseScreening } from "./runner/gate-exit.js";
-export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
+export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./rule-lane-reads.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
 import { type PermissionMode } from "./ask-origin.js";
@@ -13,6 +13,7 @@ import type { WiringLegKind } from "./wiring-manifest.js";
 import { type SafeNotifier } from "./safe-notify.js";
 import type { PermissionSeatInputs } from "./mode-policy.js";
 import type { SkillGateSeats } from "./skill-grant.js";
+import type { AllowEntryGateSeats } from "./allow-entry.js";
 /**
  * In-process hook seam (design/37) — a provider-agnostic interception layer modeled on CC's hooks,
  * kept process-internal (no shell/HTTP executors, no settings files). The original tool-call trio:
@@ -834,10 +835,10 @@ export interface HookToolOutput {
  * `updatedInput` rewrite) plus optional `additionalContext` injected into the eventual tool result.
  *
  * **The provenance members are not hook-settable inputs** (#174). `decisionReason` is the ENGINE's account
- * of which layer produced a verdict, and `persistedRuleShadowed` is the gate's own #144 disclosure that a
- * stored rule matched without clearing the ask. The gate stamps both itself — a `decisionReason` on a hook
- * result is DISCARDED (a hook ask always reads `"hook"` downstream), and a `persistedRuleShadowed` is
- * dropped rather than rendered on an approval card as a rule no lane matched.
+ * of which layer produced a verdict, and `allowRuleShadowed` is the allow layer's own disclosure that a
+ * member matched without clearing the ask. The gate stamps both itself — a `decisionReason` on a hook
+ * result is DISCARDED (a hook ask always reads `"hook"` downstream), and an `allowRuleShadowed` is
+ * dropped rather than rendered on an approval card as an entry no member matched.
  *
  * Which of a hook's OTHER members reach the surviving decision depends on which fold arm ran, so read
  * the arm, not a single list: an ask promoted from a policy `allow` is rebuilt from the hook's `message`,
@@ -1132,7 +1133,7 @@ export type PersistedRuleAnswer = PersistedRuleHit | PersistedRuleCoverage | Per
  *  signal; when the caller also supplies {@link ToolGateInput.callSignal}, the Runner's closures
  *  additionally bind their waits to that per-call signal (`AbortSignal.any` of the two), so a turn
  *  interrupt releases a pending ask instead of leaving it hanging on the run's lifetime alone. */
-export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats {
+export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, AllowEntryGateSeats {
     /** RB-473 batch 2b — bounded disclosure for a HOST callback that throws inside this gate call's
      *  isolation scope (onHookError itself, the deny observer, the durable-park observer). The runner
      *  wires this to an `observer.notify_failed` trace event; absent = counted only (unchanged). */
@@ -1250,9 +1251,9 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats {
      *  ASK rule, from the org-unavailable tighten (whose resume semantics differ — see
      *  {@link import("./checkpoint-store.js").RealApprovalGateBit}), or from a policy/hook. */
     realApproval?: import("./checkpoint-store.js").RealApprovalGateBit, 
-    /** The matched-but-outranked persisted rule (the surviving ask's `persistedRuleShadowed`)
+    /** The allow-layer members that matched and could not clear (the surviving ask's `allowRuleShadowed`)
      *  — threaded so the park mint's risk descriptor carries the disclosure on the durable route. */
-    shadowedRule?: string, 
+    allowRuleShadowed?: readonly import("./allow-rule-shadow.js").AllowRuleShadow[], 
     /** The surviving ask's `decisionReason` — threaded so the park mint's rule-suggestion door can
      *  read the ask's origin on the durable route exactly as the synchronous mints read it off the
      *  decision (a hook-raised ask is one no persisted rule may clear, so its parked card must not
@@ -1561,7 +1562,7 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats {
      *  · #144 (ruled): a MANDATED ask is never consumed — an operator's shellGate:"always" tier and a
      *    tool's own egress/irreversibility marks are structural requirements, not classifier hesitation
      *    ("allow rules silence the classifier's questions, never a mandated one"). When a rule matches
-     *    but cannot clear, the surviving ask discloses it (message + `persistedRuleShadowed`).
+     *    but cannot clear, the surviving ask discloses it (`allowRuleShadowed`, member `persisted`).
      *  · #502: an ask the call's own reversibility probe declared STRUCTURAL (`probeMandated`) joins that
      *    family. It is the one PER-CALL member of it, and the reason there has to be one: the built-in
      *    shell probe raises it for a read outside the session's allowed directories, which is a boundary
@@ -1800,7 +1801,9 @@ export declare function askCarryRowMembers(carry: AskCarry | undefined): {
 export declare function createPreToolUseScreening(preToolUse: Hooks["preToolUse"] | undefined, input: Pick<ToolGateInput, "event" | "trackedCwd" | "hookEnv" | "identity" | "onHookError" | "abortSignal">, hookSeatMs: number, notifier: SafeNotifier): PreToolUseScreening | undefined;
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant
- * structural ("a hook's `allow` cannot bypass the policy's `deny`/`ask`"):
+ * structural: a hook's `allow` passes no deny, no ask rule and no mandated question; it is one member of the
+ * allow layer and clears only the questions an allow rule may clear (a deployment that wants a question put to a
+ * person whatever a hook says marks it `authoredBy: "deployment"` or `requiresRealApproval`):
  *
  *  1. **collect** — run the PreToolUse hook, threading any `updatedInput` rewrite into `currentInput`
  *     and collecting `additionalContext`. A hook `deny` short-circuits to a block immediately; a hook

package/dist/core/hooks.js

@@ -1,10 +1,10 @@
-import { decisionText, describeThrown, receiveHookResult, isEngineRefusal } from "./tool-policy.js";
+import { abortedSeatDeny, decisionText, describeThrown, receiveHookResult, isEngineRefusal } from "./tool-policy.js";
 import { asThrownError } from "./thrown-value.js";
 import { createSettlementLedger, engineFailClosedExit, hookDenyExit } from "./runner/gate-exit.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { runGateFold } from "./gate-fold.js";
 import { runGateLanes } from "./gate-lanes.js";
-export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
+export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./rule-lane-reads.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { isAskOrigin, screenAskClassMembers } from "./ask-origin.js";
@@ -194,7 +194,9 @@ function screenPreToolUseResult(r) {
 }
 export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash, timeoutMs) {
     return brandPolicyAskClass({
-        check: async (req) => {
+        check: async (req, signal) => {
+            if (signal?.aborted)
+                return abortedSeatDeny(req, `the inherited PreToolUse screening of "${req.toolName}" was not consulted: the run or turn was already interrupted`, "hook");
             let r;
             const boundMs = resolveHookTimeoutMs(timeoutMs, onCrash);
             try {