@sema-agent/core 7.41.0 → 7.42.0

package/dist/core/mode-policy.d.ts

@@ -78,9 +78,9 @@ export interface ModeGateSeats {
  *  `readOnlyHint` ({@link AgentTool.mcpReadOnlyHint})? The mode gate's `readOnlyDeclared` seat over the leg's live tools. */
 export declare function mountedToolDeclaresReadOnly(tools: readonly AgentTool[], toolName: string): boolean;
 /** The ONE rule of the unstated question, read at the fold's last station and at the approved-edit round: an allow nobody
- *  stated (no `decisionReason`, and no screening face's own `allow` on these arguments) on a tool that states no permission
- *  of its own, under a mode whose `unstated` answer is `ask`. */
-export declare function asksUnstated(d: PermissionResult, seat: "passthrough" | undefined, mode: PermissionMode | undefined, hookStated: boolean): boolean;
+ *  stated (no `decisionReason`) on a tool that states no permission of its own, under a mode whose `unstated` answer is
+ *  `ask`. Who may answer it is the allow layer's business (a hook's own `allow` is one of its members), not this rule's. */
+export declare function asksUnstated(d: PermissionResult, seat: "passthrough" | undefined, mode: PermissionMode | undefined): boolean;
 /** The unstated question's sentence (the reference implementation's passthrough sentence, without its product name). */
 export declare const unstatedAskMessage: (toolName: string) => string;
 /** One call's permission seat: `passthrough` (an allow nobody stated meets the mode's unstated answer) and the question

package/dist/core/mode-policy.js

@@ -42,8 +42,8 @@ export function modeAcceptsFileCommand(mode, toolName, args) {
 export function mountedToolDeclaresReadOnly(tools, toolName) {
     return tools.findLast((t) => t.name === toolName)?.mcpReadOnlyHint === true;
 }
-export function asksUnstated(d, seat, mode, hookStated) {
-    return d.action === "allow" && d.decisionReason === undefined && !hookStated && seat === "passthrough" && mode !== undefined && modePolicyOf(mode).unstated === "ask";
+export function asksUnstated(d, seat, mode) {
+    return d.action === "allow" && d.decisionReason === undefined && seat === "passthrough" && mode !== undefined && modePolicyOf(mode).unstated === "ask";
 }
 export const unstatedAskMessage = (toolName) => `The agent requested permission to use ${toolName}, but it has not been granted yet.`;
 export function permissionSeatAt(input, args) {

package/dist/core/permission-rules.d.ts

@@ -6,8 +6,11 @@
  * 架构边界(design/127 §0,重判过的「core 不长 rule interpreter」):这是纯函数式、opt-in、零
  * run-loop 介入的「声明式数据→ToolPolicy」工厂(`createCoarseCommandNamePolicy` 同形态先例)。
  * core 不读设置文件、不管 source 层级合并 —— Settings-loader 把各层合并成**单一规则表**后编译
- * **一个** policy(不要按层各编译再组合:combinePolicies 的 fold 里 ask 胜 allow,跨 policy 的
- * 显式 allow 规则会被另一 policy 的 ask 吞掉)。
+ * **一个** policy。
+ *
+ * ## Deny and ask only
+ * A policy fold says `deny` / `ask`. An allow rule is refused (`config.invalid_permission_rules`, one `unsupported.allow`
+ * issue per rule): "this does not need asking" lives on the allow layer (`TaskSpec.allowedTools`, `RunnerDeps.allowedTools`).
  *
  * ## The CONTENT-FORM command lane (the shell tool's own grammar)
  *
@@ -21,9 +24,7 @@
  * a call the lexer cannot read against a rule is a fail-closed ask, never silence).
  * It sits in the field-level tier of the evaluation order — right after the bare deny (resp. ask) — which
  * is upstream's placement (`bs()` whole-tool deny → `AN(…,"deny")` field-level deny → `ph()` whole-tool
- * ask → `AN(…,"ask")` field-level ask → allow). A content-form ALLOW is refused (`unsupported.bash_prefix`):
- * a standing approval is a CONSENT record and lives in the persisted-rule store (the import door carries
- * a settings allow list there); inside a policy fold an allow is "no objection" and would clear nothing.
+ * ask → `AN(…,"ask")` field-level ask).
  *
  * The PATH lane is the same shape for every tool the catalog declares a path target for: a
  * `Edit(~/.sema/settings.json)` / `Write(src/**)` / `Read(//etc/**)` deny or ask compiles through the same
@@ -33,14 +34,12 @@
  * object face's declaration, the catalog's for the name as the floor). The bases a pattern resolves
  * against are the deployment's (`pathBases`); a pattern whose base the policy was not given is refused at
  * compile time (`unsupported.path_base`) rather than left to reach nothing at run time — a deny that
- * silently matches nothing is the failure form this module's header calls the most dangerous one. A
- * path-form ALLOW stays refused (`unsupported.file_glob`): the Read directory allow is the consent store's.
+ * silently matches nothing is the failure form this module's header calls the most dangerous one.
  * A `Read(...)` / `Edit(...)` deny or ask reaches the calls on its behavior's FACES (`PATH_RULE_FACES`), not only
  * its own tool: a `Read` ask asks for a Grep / Glob rooted in its path, judged on that call's own target.
  *
  * 🔴 与 CC 的有意差(design/127 r2):
- *  - CC 参数级 generic 道无 allow lane(gnn 只有 deny/ask)—— 我们同样:`allow` + 参数级 content =
- *    无效规则;auto-allow 只来自裸工具规则。
+ *  - CC 参数级 generic 道无 allow lane(gnn 只有 deny/ask)—— 我们同样,且整个 policy 无 allow 臂。
  *  - CC 对尾缀垃圾静默降级为裸名(Lh `n !== len-1`)—— `parsePermissionRule` 保持 CC parity,但
  *    **工厂 validator strict**:降级即 invalid(fail-fast 世界观,写错的规则不能静默变宽)。
  *  - 已知主字段参数规则(如 `Bash(command:…)`)默认 **reject**:通配是 trim 后**整串 lexical**
@@ -60,7 +59,7 @@ export declare const BASH_GENERIC_PARAMS: ReadonlySet<string>;
 export interface PermissionRule {
     /** CC 语法:`"Tool"` 或 `"Tool(param:pattern)"`。`Tool()`/`Tool(*)` 归一为裸规则;括号可 `\(`/`\)` 转义。 */
     rule: string;
-    behavior: "deny" | "ask" | "allow";
+    behavior: "deny" | "ask";
     /** Provenance:进 deny/ask 的 message 供审计(e.g. `"policySettings"`)。层级
      *  优先级/tighten-only 语义在 Settings-loader,不在这里。 */
     source?: string;
@@ -69,21 +68,25 @@ export interface PermissionRuleIssue {
     rule: string;
     /** `invalid.*` = 语法/语义错;`unsupported.*` = CC 合法但 v1 不支持的 lane(独立
      *  分类,绝不静默 no-op —— `Bash(npm run:*)` 被当 generic 参数规则接受后永不匹配是最危险的失败形态)。 */
-    code: "invalid.empty_tool" | "invalid.paren" | "invalid.param_split" | "invalid.allow_param_rule" | "invalid.primary_field" | "invalid.cap_exceeded"
-    /** A content-form Bash ALLOW rule (`Bash(npm run:*)` in an allow list): a standing approval is a consent
-     *  record and belongs to the persisted-rule store, not to a policy fold. Deny/ask content rules COMPILE. */
-     | "unsupported.bash_prefix"
+    code: "invalid.empty_tool" | "invalid.paren" | "invalid.param_split" | "invalid.primary_field" | "invalid.cap_exceeded"
+    /** An ALLOW rule (any spelling): a policy fold says deny / ask only — "this does not need asking" is the allow
+     *  layer's (`TaskSpec.allowedTools`, `RunnerDeps.allowedTools`). One issue per allow rule. */
+     | "unsupported.allow"
+    /** A `behavior` outside the closed set `deny | ask` (a JS caller's typo, an undefined member, a boxed string): refused —
+     *  a rule that matched nothing because its verb was misspelled would be a deny that silently never fires. */
+     | "invalid.behavior"
     /** A content-form Bash deny/ask rule the ONE rule validator refuses (a redirection, a substitution, a
      *  mid-pattern star, control characters…) — the message carries the validator's own code and sentence. */
      | "invalid.command_rule"
+    /** An `allowedTools` value (the request's `TaskSpec.allowedTools`, the deployment's `RunnerDeps.allowedTools`) that is
+     *  not a list of strings: one issue for a non-list, one per element that is not a string (`rule` is empty — there is
+     *  no rule text to name). */
+     | "invalid.entry_type"
     /** design/388 B15 — the closed rule-lint set over a tool's RULE FACE (derived scalar vocabulary; a
      *  declaration only narrows it): the named parameter is not one the tool carries; it is carried but
      *  is an object/array (a rule on it can never match); the tool is unknown to the resolver a leg
      *  supplied (absent resolver ⇒ the catalog alone judges and an unknown tool stays permissive). */
      | "unsupported.param_unknown" | "unsupported.param_non_scalar" | "unsupported.tool_unknown"
-    /** A path-form ALLOW rule (`Edit(src/**)` / `Read(//x/**)` in an allow list): a standing approval by
-     *  path is the consent store's (the Read directory form imports there); deny/ask path rules COMPILE. */
-     | "unsupported.file_glob"
     /** A path-form deny/ask whose spelling needs a base this policy was not given (`/x` needs
      *  `pathBases.root`; a relative pattern needs `pathBases.cwd` or `root`) — refused rather than compiled
      *  into a rule that reaches nothing. */
@@ -119,9 +122,8 @@ export interface PermissionRulePolicyOptions {
     /** Called once per dropped rule under `"skip"` (audit surface — silent drops are how a deployment
      *  discovers, months later, that its deny never existed). Default: one aggregated `console.warn`. */
     onIssue?: (issue: PermissionRuleIssue) => void;
-    /** What the policy returns when NO rule matches. Default `"allow"` = 本 policy 无意见(组合语义)。
-     *  default-closed 部署用 `"ask"`/`"deny"` —— 必须在这 INSIDE the policy(链尾
-     *  ask policy 会在 fold 里吞掉本 policy 的显式 allow)。 */
+    /** What the policy returns when NO rule matches. Default `"allow"` = 本 policy 无意见(组合语义;不是同意)。
+     *  default-closed 部署用 `"ask"`/`"deny"` —— 必须在这 INSIDE the policy(链尾 ask policy 会改写整条链的答案)。 */
     defaultAction?: "allow" | "ask" | "deny";
     /** 已知主字段参数规则(`Bash(command:…)` 等)的处置。默认 `"reject"`(整串 lexical ≠ 前缀/AST,
      *  假安全感);`"allow-lexical"` 显式接受并按 generic 语义匹配。 */
@@ -214,8 +216,7 @@ export declare function validatePermissionRules(rules: PermissionRule[], opts?:
  * field-level tiers of upstream's arbiter, beside the generic param tiers). `check()` is idempotent and side-effect-free (combinePolicies 契约);
  * all parsing/validation happens HERE, the hot path never re-parses.
  *
- * ⚠️ Composition note: an `allow` from this policy is "no objection", NOT a
- * cross-policy override — another policy's ask/deny still outranks it in the combinePolicies fold.
- * Express default-closed via `defaultAction`, never via a trailing always-ask policy.
+ * ⚠️ This policy states no allow: a call no rule reaches gets `defaultAction`, whose `"allow"` is "no objection" (states
+ * nothing, clears nothing). Express default-closed via `defaultAction`, never via a trailing always-ask policy.
  */
 export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): NamedToolPolicy;

package/dist/core/permission-rules.js

@@ -9,6 +9,21 @@ import { ruleDenialSentence } from "./rule-denial-sentence.js";
 import { heldValues } from "./tool-name-readings.js";
 export { parsePermissionRule };
 export const BASH_GENERIC_PARAMS = new Set(catalogRuleFaceOf("Bash")?.params ?? []);
+function describeBehavior(v) {
+    switch (typeof v) {
+        case "undefined": return "undefined";
+        case "string": {
+            const q = JSON.stringify(v);
+            return q.length > 40 ? q.slice(0, 37) + '..."' : q;
+        }
+        case "number":
+        case "boolean":
+        case "bigint": return String(v);
+        case "symbol": return "a symbol";
+        case "function": return "a function";
+        default: return v === null ? "null" : "an object";
+    }
+}
 const DEFAULT_CAPS = {
     maxRules: 256,
     maxRuleLength: 512,
@@ -115,7 +130,7 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
         return { face, judged: face !== undefined };
     };
     const byTool = new Map();
-    const namespacedCovering = { deny: [], ask: [], allow: [] };
+    const namespacedCovering = { deny: [], ask: [] };
     const issues = [];
     const bad = (rule, code, message) => {
         issues.push({ rule, code, message });
@@ -125,6 +140,15 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
     }
     for (const r of rules) {
         const text = r.rule;
+        const behavior = r.behavior;
+        if (behavior !== "deny" && behavior !== "ask") {
+            if (behavior === "allow")
+                bad(text, "unsupported.allow", "an allow rule does not belong to a policy — allow entries live on the allow layer: put the entry in `TaskSpec.allowedTools` (a request's) or `RunnerDeps.allowedTools` (the deployment's); deny / ask rules stay here");
+            else
+                bad(text, "invalid.behavior", `a rule's behavior is one of "deny" | "ask" — got ${describeBehavior(behavior)}; a misspelled verb would compile to a rule that silently never fires`);
+            continue;
+        }
+        const verb = behavior;
         if (text.length > caps.maxRuleLength) {
             bad(text, "invalid.cap_exceeded", `rule longer than ${caps.maxRuleLength} chars`);
             continue;
@@ -161,10 +185,10 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
         const entry = byTool.get(toolName) ?? { bare: {}, param: { deny: [], ask: [] }, content: { deny: [], ask: [] } };
         if (parsed.ruleContent === undefined) {
             if (isNamespacedCoveringRuleName(toolName)) {
-                namespacedCovering[r.behavior].push({ ruleName: toolName, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
+                namespacedCovering[verb].push({ ruleName: toolName, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
                 continue;
             }
-            entry.bare[r.behavior] = { ruleText: text, source: r.source };
+            entry.bare[verb] = { ruleText: text, source: r.source };
             byTool.set(toolName, entry);
             continue;
         }
@@ -174,16 +198,12 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
             const paramPart = colon > 0 ? content.slice(0, colon).trim() : "";
             const looksLikeParamRule = colon > 0 && /^[A-Za-z_][A-Za-z0-9_]*$/.test(paramPart) && BASH_GENERIC_PARAMS.has(paramPart);
             if (!looksLikeParamRule || content.endsWith(":*")) {
-                if (r.behavior === "allow") {
-                    bad(text, "unsupported.bash_prefix", "a Bash command ALLOW rule (`Bash(npm run:*)`, `Bash(git *)`) is a standing approval and belongs to the persisted-rule store (import it, or approve the command once and keep the rule) — a policy fold compiles command DENY/ASK rules only");
-                    continue;
-                }
-                const parsedCommand = parseRuleText(text, r.behavior);
+                const parsedCommand = parseRuleText(text, verb);
                 if ("reject" in parsedCommand) {
                     bad(text, "invalid.command_rule", `${parsedCommand.reject.code}: ${parsedCommand.reject.message}`);
                     continue;
                 }
-                entry.content[r.behavior].push({ parsed: parsedCommand.rule, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
+                entry.content[verb].push({ parsed: parsedCommand.rule, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
                 byTool.set(toolName, entry);
                 continue;
             }
@@ -196,11 +216,7 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
             }
             const face = resolved.face;
             if (face !== undefined && face.pathTargeting === true && colon <= 0) {
-                if (r.behavior === "allow") {
-                    bad(text, "unsupported.file_glob", "a path-form ALLOW rule (`Edit(src/**)`, `Read(//x/**)`) is a standing approval and belongs to the persisted-rule store (the Read directory form imports there) — a policy fold compiles path DENY/ASK rules only");
-                    continue;
-                }
-                const parsedPath = parseRuleText(text, r.behavior);
+                const parsedPath = parseRuleText(text, verb);
                 if ("reject" in parsedPath) {
                     bad(text, "invalid.command_rule", `${parsedPath.reject.code}: ${parsedPath.reject.message}`);
                     continue;
@@ -213,8 +229,8 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
                 }
                 if (issues.length > 0 && issues[issues.length - 1].rule === text && issues[issues.length - 1].code === "unsupported.path_base")
                     continue;
-                const faces = PATH_RULE_FACES[toolName]?.[r.behavior];
-                entry.content[r.behavior].push({ parsed: parsedPath.rule, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}), ...(faces !== undefined ? { faces } : {}) });
+                const faces = PATH_RULE_FACES[toolName]?.[verb];
+                entry.content[verb].push({ parsed: parsedPath.rule, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}), ...(faces !== undefined ? { faces } : {}) });
                 byTool.set(toolName, entry);
                 continue;
             }
@@ -242,10 +258,6 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
             bad(text, "invalid.param_split", "param and pattern must both be non-empty");
             continue;
         }
-        if (r.behavior === "allow") {
-            bad(text, "invalid.allow_param_rule", "param-level rules cannot `allow` (CC parity: the generic lane is deny/ask only; auto-allow comes from bare-tool rules)");
-            continue;
-        }
         if (pattern.length > caps.maxPatternLength || countStars(pattern) > caps.maxStars) {
             bad(text, "invalid.cap_exceeded", `pattern exceeds maxPatternLength ${caps.maxPatternLength} or maxStars ${caps.maxStars}`);
             continue;
@@ -254,7 +266,7 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
             bad(text, "invalid.primary_field", `"${param}" is ${toolName}'s primary field — the generic matcher is a trim+FULL-STRING lexical match (no shell/path semantics); '${toolName}(${param}:git push*)' would NOT match 'cd /x && git push'. Opt in with primaryFieldGeneric:"allow-lexical" if you understand this.`);
             continue;
         }
-        entry.param[r.behavior].push({ param, pattern, behavior: r.behavior, ruleText: text, source: r.source });
+        entry.param[verb].push({ param, pattern, behavior: verb, ruleText: text, source: r.source });
         byTool.set(toolName, entry);
     }
     return { byTool, namespacedCovering, issues };
@@ -320,21 +332,19 @@ export function createPermissionRulePolicy(rules, opts) {
         }
     }
     const defaultAction = opts?.defaultAction ?? "allow";
-    const nameSets = { deny: [], ask: [], allow: [] };
+    const nameSets = { deny: [], ask: [] };
     for (const [toolName, entry] of byTool) {
         if (entry.bare.deny !== undefined || entry.param.deny.length > 0 || entry.content.deny.length > 0)
             nameSets.deny.push(toolName);
         if (entry.bare.ask !== undefined || entry.param.ask.length > 0 || entry.content.ask.length > 0)
             nameSets.ask.push(toolName);
-        if (entry.bare.allow !== undefined)
-            nameSets.allow.push(toolName);
     }
-    for (const behavior of ["deny", "ask", "allow"]) {
+    for (const behavior of ["deny", "ask"]) {
         for (const r of namespacedCovering[behavior])
             nameSets[behavior].push(r.ruleName);
     }
     const coveringHit = (lane, toolName) => lane.length === 0 ? undefined : lane.find((r) => namespacedRuleNameCovers(r.ruleName, toolName));
-    const hasCovering = namespacedCovering.deny.length > 0 || namespacedCovering.ask.length > 0 || namespacedCovering.allow.length > 0;
+    const hasCovering = namespacedCovering.deny.length > 0 || namespacedCovering.ask.length > 0;
     const faceRules = {
         deny: [...byTool.values()].flatMap((e) => e.content.deny.filter((r) => r.faces !== undefined)),
         ask: [...byTool.values()].flatMap((e) => e.content.ask.filter((r) => r.faces !== undefined)),
@@ -387,7 +397,7 @@ export function createPermissionRulePolicy(rules, opts) {
         if (entries.length <= 1)
             return entries[0];
         const bare = {};
-        for (const b of ["deny", "ask", "allow"]) {
+        for (const b of ["deny", "ask"]) {
             const hit = entries.find((e) => e.bare[b] !== undefined)?.bare[b];
             if (hit !== undefined)
                 bare[b] = hit;
@@ -448,12 +458,6 @@ export function createPermissionRulePolicy(rules, opts) {
                 if (paramAsk) {
                     return { action: "ask", message: ruleAskMessage(paramAsk.ruleText, paramAsk.source), matchedAskRule: paramAsk.ruleText };
                 }
-                if (entry.bare.allow) {
-                    return { action: "allow", decisionReason: "rule" };
-                }
-            }
-            if (covering && coveringHit(namespacedCovering.allow, req.toolName)) {
-                return { action: "allow", decisionReason: "rule" };
             }
             if (defaultAction === "allow")
                 return { action: "allow" };

package/dist/core/reminder-disclosure.d.ts

@@ -150,7 +150,58 @@ export interface ReminderDisclosureOutcome {
     throttled: boolean;
 }
 /**
- * Run the four-step pipeline over one finalized external projection. Pure over its inputs except
- * the throttle window map and the counters (both deliberately mutable per-run state).
+ * What a planned disclosure will say, as a value: which sentences the trailer carries. The Read carrier
+ * renders it with {@link renderReminderDisclosureTrailer} (the bytes the pipeline has always appended);
+ * another carrier renders the same verdict in its own words. Undefined `reminder` and `envelopeTags` ⇒ no
+ * trailer.
+ */
+export interface ReminderDisclosureVerdict {
+    /** The `<system-reminder>`-family sentence: the marked copy (with whether the defuse arm rewrote bytes)
+     *  or the bare copy. */
+    reminder?: {
+        form: "marked";
+        defused: boolean;
+    } | {
+        form: "bare";
+    };
+    /** The envelope-family sentence, with the REGISTRY tag names it names (never matched bytes). */
+    envelopeTags?: readonly string[];
+}
+/** The state a planned disclosure changes — applied by {@link commitReminderDisclosureEffects}, never by
+ *  the plan: the counter keys to bump (one entry per bump, in pipeline order) and the throttle windows to
+ *  advance (key → next-allowed epoch ms). */
+export interface ReminderDisclosureEffects {
+    counts: readonly string[];
+    windows: ReadonlyArray<readonly [string, number]>;
+}
+/** {@link planReminderDisclosure}'s answer: the outcome the pipeline reports, the verdict a carrier renders,
+ *  and the effects a delivery commits. */
+export interface ReminderDisclosurePlan {
+    outcome: Omit<ReminderDisclosureOutcome, "trailer">;
+    verdict: ReminderDisclosureVerdict;
+    effects: ReminderDisclosureEffects;
+}
+/**
+ * Plan the four-step pipeline over one finalized external projection WITHOUT changing anything: the
+ * throttle windows are read (a due bare/envelope sentence is suppressed by a live window) but never
+ * advanced, and the counters are not bumped — both land in `effects`, which the caller commits when the
+ * projection is actually delivered ({@link commitReminderDisclosureEffects}). Two plans over the same key
+ * before either commits both see the window open; that is the defined meaning of "effects ride the
+ * delivery".
+ */
+export declare function planReminderDisclosure(input: ReminderDisclosureInput): ReminderDisclosurePlan;
+/** Apply a plan's effects: bump each counter key, advance each throttle window. `windows` is the map the plan
+ *  read (the outlet's per-closure throttle seat); either seat may be absent (library-direct mounts). */
+export declare function commitReminderDisclosureEffects(effects: ReminderDisclosureEffects, seats: {
+    counts?: ReminderDisclosureCounts;
+    windows?: Map<string, number>;
+}): void;
+/** The trailer a verdict renders to on the tool-result carrier — a full trusted reminder block (self-marked),
+ *  or undefined when the verdict carries no sentence. Byte-identical to the pipeline's historical trailer. */
+export declare function renderReminderDisclosureTrailer(verdict: ReminderDisclosureVerdict, mark: string | undefined): string | undefined;
+/**
+ * Run the four-step pipeline over one finalized external projection and commit its effects at once — the
+ * single-shot outlets (MCP, web) whose projection is delivered in the same breath. Plan + commit + render:
+ * the windows and counters move exactly as they always did.
  */
 export declare function discloseReminderShaped(input: ReminderDisclosureInput): ReminderDisclosureOutcome;

package/dist/core/reminder-disclosure.js

@@ -6,7 +6,7 @@ export function bumpReminderDisclosureCount(counts, key) {
 }
 export function observeReminderMarkEcho(input) {
     const { text, mark, outlet, counts } = input;
-    if (mark === undefined || mark === "" || !text.includes(mark))
+    if (!markEchoed(text, mark))
         return false;
     bumpReminderDisclosureCount(counts, `${outlet}.mark_echo`);
     return true;
@@ -39,21 +39,20 @@ function envelopeTrailerBody(tags) {
 function composeTrailerBody(reminderPart, envelopePart) {
     return [reminderPart, envelopePart].filter((p) => p !== undefined).join(" ");
 }
-export function discloseReminderShaped(input) {
-    const { mark, outlet, counts } = input;
-    const untouched = () => ({
-        segments: [...input.segments],
-        trailer: undefined,
-        form: undefined,
-        defused: false,
-        throttled: false,
-    });
+function markEchoed(text, mark) {
+    return mark !== undefined && mark !== "" && text.includes(mark);
+}
+export function planReminderDisclosure(input) {
+    const { mark, outlet } = input;
+    const counts = [];
+    const windows = [];
+    const effects = () => ({ counts, windows });
+    const untouchedOutcome = { segments: [...input.segments], form: undefined, defused: false, throttled: false };
     if (mark === undefined)
-        return untouched();
+        return { outcome: untouchedOutcome, verdict: {}, effects: effects() };
     const joined = input.segments.join("");
     const scan = scanReminderShaped(joined, mark);
     const envScan = scanEnvelopeShaped(joined);
-    const envelopePart = envScan.hit ? envelopeTrailerBody(envScan.tags) : undefined;
     let segments = [...input.segments];
     let defused = false;
     if (input.defuseExactMark) {
@@ -62,24 +61,21 @@ export function discloseReminderShaped(input) {
         defused = r.changed;
     }
     const marked = scan.hadCurrentMark || defused;
-    if (!marked)
-        observeReminderMarkEcho({ text: joined, mark, outlet, counts });
+    if (!marked && markEchoed(joined, mark))
+        counts.push(`${outlet}.mark_echo`);
     if (!marked && !scan.hit && !envScan.hit) {
-        const clean = untouched();
-        return { ...clean, segments };
+        return { outcome: { ...untouchedOutcome, segments }, verdict: {}, effects: effects() };
     }
     if (marked) {
         if (defused)
-            bumpReminderDisclosureCount(counts, `${outlet}.defused`);
-        bumpReminderDisclosureCount(counts, `${outlet}.marked`);
+            counts.push(`${outlet}.defused`);
+        counts.push(`${outlet}.marked`);
         if (envScan.hit)
-            bumpReminderDisclosureCount(counts, `${outlet}.envelope`);
+            counts.push(`${outlet}.envelope`);
         return {
-            segments,
-            trailer: mintSystemReminder(composeTrailerBody(markedTrailerBody(defused), envelopePart), mark),
-            form: "marked",
-            defused,
-            throttled: false,
+            outcome: { segments, form: "marked", defused, throttled: false },
+            verdict: { reminder: { form: "marked", defused }, ...(envScan.hit ? { envelopeTags: envScan.tags } : {}) },
+            effects: effects(),
         };
     }
     const t = input.throttle;
@@ -96,27 +92,44 @@ export function discloseReminderShaped(input) {
     const bare = verdict(scan.hit, throttleWindowKey("bare", t?.key ?? ""));
     const envelope = verdict(envScan.hit, throttleWindowKey("envelope", t?.key ?? ""));
     if (bare.suppressed)
-        bumpReminderDisclosureCount(counts, `${outlet}.bare_throttled`);
+        counts.push(`${outlet}.bare_throttled`);
     if (envelope.suppressed)
-        bumpReminderDisclosureCount(counts, `${outlet}.envelope_throttled`);
+        counts.push(`${outlet}.envelope_throttled`);
     if (!bare.emit && !envelope.emit) {
-        return { segments, trailer: undefined, form: undefined, defused, throttled: true };
+        return { outcome: { segments, form: undefined, defused, throttled: true }, verdict: {}, effects: effects() };
     }
     if (t !== undefined) {
         if (bare.consume !== undefined)
-            t.windows.set(bare.consume, now + BARE_REMINDER_DISCLOSURE_WINDOW_MS);
+            windows.push([bare.consume, now + BARE_REMINDER_DISCLOSURE_WINDOW_MS]);
         if (envelope.consume !== undefined)
-            t.windows.set(envelope.consume, now + BARE_REMINDER_DISCLOSURE_WINDOW_MS);
+            windows.push([envelope.consume, now + BARE_REMINDER_DISCLOSURE_WINDOW_MS]);
     }
     if (bare.emit)
-        bumpReminderDisclosureCount(counts, `${outlet}.bare`);
+        counts.push(`${outlet}.bare`);
     if (envelope.emit)
-        bumpReminderDisclosureCount(counts, `${outlet}.envelope`);
+        counts.push(`${outlet}.envelope`);
     return {
-        segments,
-        trailer: mintSystemReminder(composeTrailerBody(bare.emit ? bareTrailerBody() : undefined, envelope.emit ? envelopePart : undefined), mark),
-        form: bare.emit ? "bare" : "envelope",
-        defused,
-        throttled: bare.suppressed || envelope.suppressed,
+        outcome: { segments, form: bare.emit ? "bare" : "envelope", defused, throttled: bare.suppressed || envelope.suppressed },
+        verdict: { ...(bare.emit ? { reminder: { form: "bare" } } : {}), ...(envelope.emit ? { envelopeTags: envScan.tags } : {}) },
+        effects: effects(),
     };
 }
+export function commitReminderDisclosureEffects(effects, seats) {
+    for (const key of effects.counts)
+        bumpReminderDisclosureCount(seats.counts, key);
+    if (seats.windows !== undefined)
+        for (const [key, until] of effects.windows)
+            seats.windows.set(key, until);
+}
+export function renderReminderDisclosureTrailer(verdict, mark) {
+    const reminderPart = verdict.reminder === undefined ? undefined : verdict.reminder.form === "marked" ? markedTrailerBody(verdict.reminder.defused) : bareTrailerBody();
+    const envelopePart = verdict.envelopeTags !== undefined ? envelopeTrailerBody(verdict.envelopeTags) : undefined;
+    if (reminderPart === undefined && envelopePart === undefined)
+        return undefined;
+    return mintSystemReminder(composeTrailerBody(reminderPart, envelopePart), mark);
+}
+export function discloseReminderShaped(input) {
+    const plan = planReminderDisclosure(input);
+    commitReminderDisclosureEffects(plan.effects, { counts: input.counts, ...(input.throttle !== undefined ? { windows: input.throttle.windows } : {}) });
+    return { ...plan.outcome, trailer: renderReminderDisclosureTrailer(plan.verdict, input.mark) };
+}

package/dist/core/rule-lane-reads.d.ts

@@ -0,0 +1,84 @@
+/**
+ * The two rule LANES' answers — the org overlay's and the person's persisted rules' — screened and read for one
+ * call, shared by every consumer that judges a call against them (the live gate's lane station, the resumed
+ * execution boundary, the synthetic-Read judge). One normalizer and one bounded read per lane: a second copy of
+ * either would be a second answer to "what did the lane say", and the gate's fail-closed (org) / skip
+ * (persisted store) readings would drift apart between consumers.
+ */
+import type { ToolCallRequest } from "./tool-policy.js";
+import type { OrgGateVerdict, PersistedRuleAnswer, PersistedRuleHit } from "./hooks.js";
+/**
+ * design/252 review r3 — read a foreign {@link OrgGateVerdict} the way the personal-rule answer is read:
+ * OWN DATA properties only, never the prototype chain, never an accessor.
+ *
+ * Unlike the personal-rule normalizer below, this one accepts ANY non-array object as the carrier —
+ * not only a plain record. The two seams tighten in opposite directions when a shape is refused: the
+ * personal lane is a LOOSENING seam, so refusing a class instance degrades toward asking; this answer
+ * carries the org's DENY, and folding a structurally valid `{status:"available", verdict:{behavior:
+ * "deny"}}` class instance into `unavailable` would LOOSEN it — from a deny nobody can approve into a
+ * real-approval ask a person can clear. A class instance's fields are its own data properties, so the
+ * own-data read below already gives the full pollution guarantee (inherited members never authorize);
+ * the prototype test added nothing here but the downgrade.
+ *
+ * The two seams are the same class of trust boundary and were not being read the same way. What that
+ * cost here is worse than on the personal lane, because this answer is GOVERNANCE:
+ *  · an inherited `revision` (a polluted `Object.prototype`) stamped a fabricated snapshot version onto
+ *    a human's approval request — a WRONG record, which is worse than an absent one;
+ *  · an inherited `verdict` invented an org rule, and with it an org ask or deny the lane never gave;
+ *  · an answer that is not a record at all read as "available, nothing to say", i.e. the governance
+ *    fail-open the availability contract exists to prevent.
+ * Anything this function cannot read as a well-formed answer becomes `unavailable` — the fail-CLOSED
+ * word, never the empty one.
+ */
+export declare function normalizeOrgGateVerdict(answer: unknown, unreadable: string): OrgGateVerdict;
+/**
+ * Normalize the accepted {@link ToolGateInput.persistedRules} answers into one reading.
+ *
+ * `{}` = a clean negative (no rule admits this call). `{ unreadable: true }` = the lane could not read
+ * its source. `{ hit }` = a match, whose `rules` is the non-empty coverage set (design/375). An answer
+ * outside every accepted shape — a number, `null`, an object with neither `rules` nor `unreadable`, an
+ * EMPTY `rules` array, the retired pre-375 `{ rule, dots? }` single-rule object — is read as a clean
+ * negative rather than a match: this is a LOOSENING seam, so an answer nobody can name degrades toward
+ * asking, never toward an allow built on it. All-or-nothing across the set's TEXTS for the same
+ * reason: a set with one unreadable member is a different (smaller) claim than the lane made, and a
+ * decision must not stand on a claim nobody made — one bad member drops the whole answer to the clean
+ * negative. Per-member DOTS stay individually optional (identity lost ⇒ `"not_reported"`, exactly the
+ * single-rule contract).
+ *
+ * The hit's dots are COPIED, not aliased. The array travels onto an ask that may sit in front of a
+ * person for a long time; a lane that retains and mutates its own array would otherwise change what the
+ * approver is looking at, and what an audit later reads, after the evidence was stamped.
+ */
+export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
+    hit?: PersistedRuleHit;
+    unreadable?: true;
+    reason?: string;
+    coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
+};
+/**
+ * The ORG lane's one read for one call — every consumer's (the live gate's org layer, the synthetic-Read
+ * judge). The CALL is inside the boundary (a synchronous throw — a non-function face, a revoked proxy —
+ * happens before any `.catch` on its result could be installed), it is invoked directly (a lane that reads
+ * its own state before its first `await` sees the same turn), it is BOUNDED by the dependency timeout and
+ * the signal, and everything that is not a well-formed answer — a throw, a hang, a garbage value — reads
+ * as `unavailable`, the fail-closed word, never as "no org rule spoke".
+ */
+export declare function readOrgRuleLane(org: {
+    adjudicate: (req: ToolCallRequest) => Promise<OrgGateVerdict>;
+}, req: ToolCallRequest, signal: AbortSignal | undefined, timeoutMs?: number): Promise<OrgGateVerdict>;
+/**
+ * The persisted-rule lane's one read for one call — every consumer's (the live gate, the synthetic-Read
+ * judge), normalized once. A lane that throws, hangs past the dependency timeout, or answers something
+ * unreadable is a lane that could not answer: for the DECISION its rows take no part (the tightening arms
+ * do not fire — `applyPersistedTightening` reads `{ unreadable }` without a reason that way), and for
+ * the RECORD it is `"unavailable"`. A call the lane could not read against the rows (`reason`) fails closed
+ * in the arms. Absent lane ⇒ the clean negative.
+ */
+export declare function readPersistedRuleLane(lane: {
+    adjudicate: (req: ToolCallRequest) => PersistedRuleAnswer | Promise<PersistedRuleAnswer>;
+} | undefined, req: ToolCallRequest, signal: AbortSignal | undefined, timeoutMs?: number): Promise<{
+    hit?: PersistedRuleHit;
+    unreadable?: true;
+    reason?: string;
+    coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
+}>;