@sema-agent/core 7.42.0 → 7.43.0

package/dist/core/runner/prepare-config-doors.js

@@ -12,7 +12,7 @@ import { resolveSkillListingBudget } from "../skill-listing-budget.js";
 import { describeRejectedValue } from "../tool-search-setting.js";
 import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
-import { deriveAskEffective, resolveAskSeamForm, resolveQuestionSeam } from "../wiring-manifest.js";
+import { deriveAskEffective, resolveAskSeat, resolveQuestionSeam } from "../wiring-manifest.js";
 import { assertPeerPresenceValue } from "../../agents/peer-directory.js";
 import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
 const TASK_LIMIT_KEY_DICT = {
@@ -286,6 +286,7 @@ export function prepareConfigDoors(input) {
         ],
     });
     const resolvedInteractionPosture = spec.interactionPosture ?? internals?.parentInteractionPosture ?? deps.interactionPosture;
+    const askSeat = resolveAskSeat(spec, deps);
     {
         const interactionPosture = resolvedInteractionPosture;
         const discloseInteractionPostureRefusal = (err) => {
@@ -303,8 +304,7 @@ export function prepareConfigDoors(input) {
             throw e;
         }
         if (interactionPosture === "interactive") {
-            const askDoor = resolveAskSeamForm(spec, deps);
-            const humanReachable = deriveAskEffective(askDoor.form, "unresolved") === "human_reachable";
+            const humanReachable = deriveAskEffective(askSeat.form, "unresolved") === "human_reachable";
             const questionDoor = resolveQuestionSeam(spec, deps);
             const strippedByEngine = internals?.questionFaceStripped === true;
             if (spec.interactiveTools === false) {
@@ -318,9 +318,9 @@ export function prepareConfigDoors(input) {
             if (!humanReachable || !(questionDoor.wired || strippedByEngine)) {
                 const missing = [];
                 if (!humanReachable) {
-                    missing.push(askDoor.form === "absent"
+                    missing.push(askSeat.form === "declared_none" ? 'this run declares approvalReach: "none" — nobody on it can be asked to approve' : askSeat.form === "absent"
                         ? "no onAsk approver is wired (spec.onAsk ?? deps.onAsk is absent — asks would auto-deny or park)"
-                        : `the resolved onAsk seat is the blanket policy "${askDoor.form}" (${askDoor.provenance ?? "?"}) — a policy setting is not a reachable human`);
+                        : `the resolved onAsk seat is the blanket policy "${askSeat.form}" (${askSeat.provenance ?? "?"}) — a policy setting is not a reachable human`);
                 }
                 if (!questionDoor.wired && !strippedByEngine) {
                     missing.push("no content-question channel (spec.onQuestion ?? deps.onQuestion is absent, and this leg is not an engine-stripped background lane)");
@@ -433,6 +433,7 @@ export function prepareConfigDoors(input) {
         promptProfile,
         lockedPreflight,
         resolvedInteractionPosture,
+        askSeat,
         microCompactKnob,
         resolvedRole,
         model,

package/dist/core/runner/prepare-gate-stations.js

@@ -137,7 +137,7 @@ export function prepareGateStations(input) {
                         onHookError: notifyHookError,
                         shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
-                        permissionMode: () => permissionMode.current,
+                        permissionMode: () => permissionMode.current, askSeatForm: askRoute.form,
                         ...(markSources.size > 0 ? { toolMarkSources: markSources } : {}),
                         ...seatInputsFor(e.toolName, wireOf("gate.skillActivationSeat", call)),
                         ...(mountedToolRequiresUserInteraction(tools, e.toolName) ? { requiresUserInteraction: true } : {}),

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -50,19 +50,21 @@ import { type SkillGrantTable } from "../skill-grant.js";
 import type { InheritedGate, Prepared, PrepareResume, RunInternals, StopForDenialLimit, ToolFaceSnapshot, WriteFaceSeat } from "./contracts.js";
 export interface PrepareInheritedGateInput {
     /** borrowed-readonly — the REBOUND spec. Read: `shellGate` (the own doctrine the chain fold tightens), `durableApproval`
-     *  (the mandate tests + the children's copy), `onAsk`/`onQuestion` (the frozen seats), `handsReadOnly` / `interactiveTools`
+     *  (the mandate tests + the children's copy), `onQuestion` (the frozen question seat), `handsReadOnly` / `interactiveTools`
      *  / `oneShot` / `clientContext` / `principal` / `additionalDirectories` / `additionalReadDirectories` / `envFacts` /
      *  `memoryPersistenceCapable` / `getApiKeyAndHeaders` / `backgroundScope` / `enablePlanMode` (the ctx enrichment's
      *  trusted seats). Never mutated. */
-    spec: Pick<TaskSpec, "shellGate" | "durableApproval" | "onAsk" | "onQuestion" | "handsReadOnly" | "interactiveTools" | "oneShot" | "clientContext" | "principal" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "getApiKeyAndHeaders" | "backgroundScope" | "enablePlanMode" | "excludeAllTools">;
+    spec: Pick<TaskSpec, "shellGate" | "durableApproval" | "onQuestion" | "handsReadOnly" | "interactiveTools" | "oneShot" | "clientContext" | "principal" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "getApiKeyAndHeaders" | "backgroundScope" | "enablePlanMode" | "excludeAllTools">;
     /** borrowed-readonly — the seat this run hands its children (`checkpointSeatOf`, minted once by the driver after the config doors): the ctx's `checkpointStoreForChildren`, absent when the run has no seat. */
     checkpointSeat: import("../checkpoint-seat.js").CheckpointSeat | undefined;
     /** borrowed-readonly — the deployment seats: `autoMode.denialLimit` (the rebuilt trackers' bounds), `memoryScopeAdmission` /
      *  `deploymentMemoryScopes` / `compliancePostureResolver` (the governed-provenance bit), `onError` (the screening-face crash
      *  lane), `onNotice` (the stop seat's notice), `executionEnv` (the hook-env identity predicate), `delegationEntryCaps` (resolved
-     *  and validated once here), `rosterStore` / `onBackgroundChildEvent` (ctx seats), `onAsk` / `onQuestion` (the deps half of the
-     *  frozen seats). */
-    deps: Pick<RunnerDeps, "autoMode" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "compliancePostureResolver" | "onError" | "onNotice" | "executionEnv" | "delegationEntryCaps" | "rosterStore" | "onBackgroundChildEvent" | "onAsk" | "onQuestion">;
+     *  and validated once here), `rosterStore` / `onBackgroundChildEvent` (ctx seats), `onQuestion` (the deps half of the
+     *  frozen question seat). */
+    deps: Pick<RunnerDeps, "autoMode" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "compliancePostureResolver" | "onError" | "onNotice" | "executionEnv" | "delegationEntryCaps" | "rosterStore" | "onBackgroundChildEvent" | "onQuestion">;
+    /** borrowed-readonly — the run's approval seat as the config doors froze it: the frozen approver, and this leg's chain view. */
+    askSeat: import("../wiring-manifest.js").AskSeat;
     /** borrowed-readonly — the trusted spawn-side channel: `inheritedGate` (the LIVE half of the chain fold), `ownOrgAdmissionRef`
      *  (the same-session continuation's freeze), `delegationProvenance` (the F-012 stamp), and the identity / peer / notification
      *  seats the ctx enrichment forwards. Never mutated. */

package/dist/core/runner/prepare-inherited-gate.js

@@ -13,7 +13,7 @@ import { frozenSkillGrants } from "../skill-grant.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { asThrownError } from "../thrown-value.js";
 export function prepareInheritedGate(input) {
-    const { spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
+    const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
     const seedInheritedGate = resume?.seed.inheritedGate;
     const inheritedAncestorRules = (() => {
@@ -35,7 +35,8 @@ export function prepareInheritedGate(input) {
     })();
     const modeSeed = recordedModeSeed(seedInheritedGate);
     const inheritedShellGate = liveInheritedGate?.shellGate ?? modeSeed.shellGate;
-    const inheritedParentConstraints = attachRebuiltDenialTrackers(liveInheritedGate?.parentConstraints, deps.autoMode?.denialLimit);
+    const chainView = askSeat.reach === "none" ? liveInheritedGate?.parentConstraints?.map((pc) => (typeof pc.onAsk === "function" ? ((({ onAsk: _person, ...rest }) => rest)(pc)) : pc)) : liveInheritedGate?.parentConstraints;
+    const inheritedParentConstraints = attachRebuiltDenialTrackers(chainView, deps.autoMode?.denialLimit);
     const parentSeat = liveInheritedGate?.permissionModeCeiling;
     const ceiling = parentSeat ?? liveInheritedGate?.permissionMode;
     const announceModeFold = (receipt) => {
@@ -113,7 +114,7 @@ export function prepareInheritedGate(input) {
     const f012CheckpointState = () => (inheritedParentConstraints?.length ?? 0) > 0 ||
         seedInheritedGate?.constraintChain !== undefined ||
         internals?.delegationProvenance !== undefined;
-    const frozenOnAsk = spec.onAsk ?? deps.onAsk;
+    const frozenOnAsk = askSeat.value;
     const hookEnvSource = (ownedEnv ?? deps.executionEnv) != null ? executionEnv : undefined;
     const notifyOwnHookCrash = (err) => {
         try {
@@ -213,6 +214,7 @@ export function prepareInheritedGate(input) {
             thinkingLevel: harnessRef.current?.getThinkingLevel(),
             principal: spec.principal,
             ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
+            ...(askSeat.reach !== undefined ? { approvalReach: askSeat.reach } : {}),
             ...(frozenOnQuestion !== undefined ? { onQuestion: frozenOnQuestion } : {}),
             ...(spec.handsReadOnly === true ? { handsReadOnly: true } : {}),
             ...(carrierReadFace() === "roots" ? { readFace: "roots" } : {}),

package/dist/core/runner/prepare-park-ask.d.ts

@@ -22,6 +22,7 @@
 import type { AgentHarness, AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
 import { type OnQuestion } from "../ask-question.js";
 import { type CheckpointStore } from "../checkpoint-store.js";
+import type { GrantBindingOf } from "../skill-grant-binding.js";
 import type { SessionStore } from "../session.js";
 import { type OnAsk, type ToolCallRequest, type ToolPolicy } from "../tool-policy.js";
 import { type ToolResultStore } from "../tool-result-store.js";
@@ -32,7 +33,6 @@ import { type ContentAskBinding } from "./content-ask-bindings.js";
 import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, SuspendSaga } from "./contracts.js";
 import type { createRuleOffersOf } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
-import { type SkillGrantSource } from "../skill-grant.js";
 export interface PrepareParkAskInput {
     /** borrowed-readonly — the in-stream ask lane, or undefined when the gate machinery is inactive (then both closures are
      *  absent). Read: `composedCallSignal` (the fence and the delivery race), `approvalPreviewOf` (the row's preview). */
@@ -141,9 +141,9 @@ export interface PrepareParkAskInput {
     orgAdmissionCheckpointState: () => boolean;
     /** borrowed-readonly — the policy-chain phase's rule-offer factory (the row's suggestion members). */
     ruleOffersOf: ReturnType<typeof createRuleOffersOf>;
-    /** borrowed-readonly — the leg's loaded skills (what its `Skill` tool serves); a parked `Skill` call's row binds the named
-     *  skill — its name and its lists — from them (`boundGrantDigest`). Empty when the leg loads none. */
-    skillSpecs: readonly SkillGrantSource[];
+    /** borrowed-readonly — the policy-chain phase's Skill-card binding factory: a parked `Skill` call's row carries the named skill and
+     *  its lists (`boundGrants`) and their hash (`boundGrantDigest`) from it, as the live ask does. */
+    grantBindingOf: GrantBindingOf;
     /** borrowed-readonly — the injectable wall clock (the row's `suspendedAt`). */
     now: () => number;
     /** borrowed-readonly — the per-task human-review accumulator; snapshotted onto the row (never written here). */

package/dist/core/runner/prepare-park-ask.js

@@ -17,8 +17,6 @@ import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedT
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
 import { callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
 import { seatOf, wireOf } from "../tool-name-readings.js";
-import { skillCallGrantDigest } from "../skill-grant.js";
-import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
         super(message, options);
@@ -29,7 +27,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, skillSpecs, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -318,7 +316,7 @@ export function prepareParkAsk(input) {
                         ...askCarryRowMembers(carry),
                         ...ruleOffersOf(req, parkedArgs, clearanceFacts),
                         boundInputHash: boundInputHashOf(parkedArgs),
-                        ...((grantDigest) => (grantDigest !== undefined ? { boundGrantDigest: grantDigest } : {}))(skillCallGrantDigest(req, parkedArgs, skillSpecs, SKILL_TOOL_NAME)),
+                        ...grantBindingOf(req, parkedArgs),
                         batchToolCallIds,
                         completedCallIds,
                     }),

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -30,7 +30,8 @@ import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec, ToolEffect } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { ReadDenyMatcher } from "../../tools/fs/read-deny.js";
-import type { SkillGrantLane, SkillGrantTable } from "../skill-grant.js";
+import { type SkillGrantLane, type SkillGrantSource, type SkillGrantTable } from "../skill-grant.js";
+import type { GrantBindingOf } from "../skill-grant-binding.js";
 import { type AllowEntryLane, type AllowEntryTable } from "../allow-entry.js";
 import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, StopForDenialLimit } from "./contracts.js";
 import { type Arbitration } from "../ask-origin.js";
@@ -122,6 +123,8 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — the run's skill grant table; this phase binds its lane to the call facts the person's rule lane
      *  reads (root, session, live cwd, the execution environment's home). Not written here. */
     skillGrants: SkillGrantTable;
+    /** borrowed-readonly — the loaded skills (the table the `Skill` tool activates from); {@link PreparePolicyChainResult.grantBindingOf} reads them. */
+    skillSpecs: readonly SkillGrantSource[];
     /** borrowed-readonly — the request's and the deployment's allow-entry tables (prepare seeded them); this phase binds
      *  their lanes to the same call facts. Not written here. */
     allowedToolTables: {
@@ -218,6 +221,9 @@ export interface PreparePolicyChainResult {
     };
     /** owned — the ONE rule-offer factory for all five ask-mint sites. */
     ruleOffersOf: ReturnType<typeof createRuleOffersOf>;
+    /** owned — the ONE Skill-card binding factory for the same five sites: a call to the engine's `Skill` tool carries the skill and
+     *  its two lists (`boundGrants`) and their hash (`boundGrantDigest`) on the live ask, an ancestor's and the parked row alike. */
+    grantBindingOf: GrantBindingOf;
     /** owned — the personal permission-rule lane, or undefined. */
     permissionRuleLane: PermissionRuleLanes["personal"];
     /** owned — the org permission-rule lane (`Prepared.permissionRuleOrg`), or undefined. */

package/dist/core/runner/prepare-policy-chain.js

@@ -7,14 +7,16 @@ import { assertHookSeatsCallable } from "../hook-seats.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
 import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, wrapToolPolicy, attestAskUnresolvableCause } from "../tool-policy.js";
-import { judgeRuleToolName } from "../tool-name-aliases.js";
+import { judgeRuleToolName, mountedToolNames } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
+import { skillGrantBindingMembers } from "../skill-grant.js";
+import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { autoStrippedRule, cardDisclosureOf } from "../allow-entry.js";
 import { arbitrateByMode, askClassMembersOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
-import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, inheritedAskFallbackMessage, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
+import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, inheritedAskFallbackMessage, judgeInheritedClassifier, lateAskSettlementObserver, resolveInheritedAsk, settleDenialLimitFallback } from "./denial-limit-arms.js";
 import { settleReadRootGrant } from "./read-root-grant.js";
 import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
@@ -22,7 +24,7 @@ import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-
 import { thrownText } from "../thrown-value.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -37,7 +39,7 @@ export async function preparePolicyChain(input) {
     const auditPolicyNames = (auditee) => {
         const nameGroups = toolPolicyNameSets(auditee);
         if (nameGroups.length > 0) {
-            const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
+            const known = mountedToolNames(tools);
             for (const t of harnessTools)
                 known.add(t.name);
             const unmatched = new Set();
@@ -46,9 +48,24 @@ export async function preparePolicyChain(input) {
                     for (const n of list ?? []) {
                         const verdict = judgeRuleToolName(n, known);
                         if (verdict.kind !== "current") {
-                            const err = new Error(verdict.kind === "retired"
-                                ? `tool policy ${kind}-list entry "${n}" is a RETIRED tool name (${verdict.guidance}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`
-                                : `tool policy ${kind}-list entry "${n}" carries the "__" namespace separator but no protocol prefix, and matches nothing in this run's roster — protocol tools are named ${NAMESPACED_NAME_SHAPES}, and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with the owning protocol's marker.`);
+                            const entry = `tool policy ${kind}-list entry "${n}"`;
+                            let message;
+                            switch (verdict.kind) {
+                                case "retired":
+                                    message = `${entry} is a RETIRED tool name (${verdict.guidance}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`;
+                                    break;
+                                case "unprefixed_namespace":
+                                    message = `${entry} carries the "__" namespace separator but no protocol prefix, and matches nothing in this run's roster — protocol tools are named ${NAMESPACED_NAME_SHAPES}, and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with the owning protocol's marker.`;
+                                    break;
+                                case "unmintable_segment":
+                                    message = `${entry} can match no tool, ever (${verdict.guidance}), so it would silently guard nothing.${verdict.currentName !== undefined ? ` Write "${verdict.currentName}".` : ""}`;
+                                    break;
+                                default: {
+                                    const exhaustive = verdict;
+                                    return exhaustive;
+                                }
+                            }
+                            const err = new Error(message);
                             err.code = "config.legacy_tool_name";
                             throw err;
                         }
@@ -285,6 +302,7 @@ export async function preparePolicyChain(input) {
             return {};
         return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
     };
+    const grantBindingOf = (call, args) => skillGrantBindingMembers(call, args, skillSpecs, SKILL_TOOL_NAME);
     const inheritedStationFacts = (call) => {
         const seat = seatMarksOf(call);
         return {
@@ -374,7 +392,7 @@ export async function preparePolicyChain(input) {
             }
             if (judged.kind === "deny")
                 return vetoed(judged.result);
-            const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
+            const { ask: editAsk } = judged;
             re = editAsk;
             const editArbitrated = arbitrateInherited(re, creq.toolCallId, judged);
             if (editArbitrated !== undefined) {
@@ -382,21 +400,22 @@ export async function preparePolicyChain(input) {
                 carryPrecedingSettlement(settledBy, out);
                 return out;
             }
-            const rr = await resolveAsk({
+            const { resolved: rr, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
                 toolName: creq.toolName,
                 toolCallId: creq.toolCallId,
                 args: editArgs,
-                ...ruleOffersOf(creq, editArgs, ancestorFacts(re)),
-                ...cardDisclosureOf(re, inheritedAskFallbackMessage(creq.toolName)),
+                ...ruleOffersOf(creq, editArgs, ancestorFacts(j.ask)),
+                ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
                 ...askSourceIdentity(),
                 ...riskAxesOf(creq),
-                ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                ...askMandateMember(ancestorFacts(re)),
-                ...inheritedAskCarry(judged, isLiveApproverSeat(onAskOf), ancestorTracker),
+                ...grantBindingOf(creq, editArgs),
+                ...(j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                ...askMandateMember(ancestorFacts(j.ask)),
+                ...inheritedAskCarry(j, isLiveApproverSeat(onAskOf), ancestorTracker),
                 ruleEvidence: inheritedAskEvidence,
-            }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
+            }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), ancestorTracker, creq.toolName, inheritedStationFacts(creq));
             void settleReadRootGrant(rr.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
-            settleDenialLimitFallback({ fallback: editFallback, mintedHere: editMintedHere, tracker: ancestorTracker, resolved: rr, headless: headlessDenyAtRecheck, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+            settleDenialLimitFallback({ fallback: settled.fallback, mintedHere: settled.mintedHere, tracker: ancestorTracker, resolved: rr, headless: headlessDenyAtRecheck, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
             if (rr.action !== "allow")
                 return rr;
             settledBy = rr;
@@ -451,7 +470,7 @@ export async function preparePolicyChain(input) {
                         return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
-                    const { ask: inheritedAsk, fallback, mintedHere } = judged;
+                    const { ask: inheritedAsk, fallback } = judged;
                     if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return { action: "allow", decisionReason: "sandbox" };
@@ -461,33 +480,34 @@ export async function preparePolicyChain(input) {
                         return arbitrated;
                     const presentedArgs = creq.args;
                     const askT0 = now();
-                    const resolved = await resolveAsk({
+                    const { resolved, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
-                        ...ruleOffersOf(creq, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                        ...cardDisclosureOf(inheritedAsk, inheritedAskFallbackMessage(creq.toolName)),
+                        ...ruleOffersOf(creq, presentedArgs, ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+                        ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
                         ...askSourceIdentity(),
                         ...riskAxesOf(creq),
-                        ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                        ...askMandateMember(ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                        ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+                        ...grantBindingOf(creq, presentedArgs),
+                        ...(j.ask.action === "ask" && j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                        ...askMandateMember(ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+                        ...inheritedAskCarry(j, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                         ruleEvidence: inheritedAskEvidence,
-                    }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
+                    }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq.toolName, inheritedStationFacts(creq));
                     void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
                     const askWaitMs = Math.max(0, now() - askT0);
                     if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                         if (markInheritedUnavailable(creq.toolCallId))
-                            return inheritedAsk;
+                            return settled.ask;
                         return markerChannelFullDeny(creq);
                     }
-                    settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+                    settleDenialLimitFallback({ fallback: settled.fallback, mintedHere: settled.mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                     if (resolved.action !== "allow")
                         return resolved;
                     if (resolved.updatedInput !== undefined) {
                         return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                     }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(judged.classification).classes);
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(settled.classification).classes);
                     return { action: "allow", decisionReason: "mode" };
                 },
             }
@@ -524,7 +544,7 @@ export async function preparePolicyChain(input) {
                     return judged.result;
                 if (judged.kind === "deny")
                     return judged.result;
-                const { ask: inheritedAsk, fallback, mintedHere } = judged;
+                const { ask: inheritedAsk, fallback } = judged;
                 if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                     recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                     return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput, decisionReason: "sandbox" } : { action: "allow", decisionReason: "sandbox" };
@@ -533,27 +553,28 @@ export async function preparePolicyChain(input) {
                 if (arbitrated !== undefined)
                     return arbitrated;
                 const askT0 = now();
-                const resolved = await resolveAsk({
+                const { resolved, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
                     args: presentedArgs,
-                    ...ruleOffersOf(creq, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                    ...cardDisclosureOf(inheritedAsk, inheritedAskFallbackMessage(creq.toolName)),
+                    ...ruleOffersOf(creq, presentedArgs, ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+                    ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq),
-                    ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                    ...askMandateMember(ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                    ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+                    ...grantBindingOf(creq, presentedArgs),
+                    ...(j.ask.action === "ask" && j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                    ...askMandateMember(ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+                    ...inheritedAskCarry(j, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                     ruleEvidence: inheritedAskEvidence,
-                }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
+                }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq.toolName, inheritedStationFacts(creq));
                 void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
                 const askWaitMs = Math.max(0, now() - askT0);
                 if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                     if (markInheritedUnavailable(creq.toolCallId))
-                        return inheritedAsk;
+                        return settled.ask;
                     return markerChannelFullDeny(creq);
                 }
-                settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+                settleDenialLimitFallback({ fallback: settled.fallback, mintedHere: settled.mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                 if (resolved.action !== "allow")
                     return resolved;
                 if (resolved.updatedInput !== undefined) {
@@ -667,7 +688,7 @@ export async function preparePolicyChain(input) {
             return decision;
         })
         : foldedPolicy;
-    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
+    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
 }
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;

package/dist/core/runner/prepare-project-context.js

@@ -11,6 +11,7 @@ import { deliverEngineNotice } from "../engine-notice.js";
 import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
 import { skillLoadReading } from "./skill-base-dir.js";
 import { RosterBuilder } from "../tool-roster.js";
+import { mountedToolNames } from "../tool-name-aliases.js";
 import { asThrownError } from "../thrown-value.js";
 export async function prepareProjectContext(input) {
     const { deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
@@ -88,7 +89,10 @@ export async function prepareProjectContext(input) {
     const frozenSkillGrants = readFrozenSkillGrants(resume?.seed.skillGrants);
     if (frozenSkillGrants === undefined)
         throw new Error("the resumed checkpoint's skill-grant section does not read as grant rows — refusing to seed the run without the refusals it carries (the resume screen refuses this row before the claim)");
-    const inert = seedAllowEntryTables(allowedToolTables, { skillInert: seedSkillGrants(skillGrants, { skills: skillSpecs, userInvokedSkills: spec.userInvokedSkills, inherited: [...(internals?.inheritedSkillGrants ?? []), ...frozenSkillGrants] }), inherited: internals?.inheritedAllowedTools, request: allowedTools, deployment: deps.allowedTools });
+    const mounted = () => mountedToolNames(tools);
+    skillGrants.bindMountedNames(mounted);
+    skillGrants.bindSkills(skillSpecs, SKILL_TOOL_NAME);
+    const inert = seedAllowEntryTables(allowedToolTables, { skillInert: seedSkillGrants(skillGrants, { skills: skillSpecs, userInvokedSkills: spec.userInvokedSkills, inherited: [...(internals?.inheritedSkillGrants ?? []), ...frozenSkillGrants] }), inherited: internals?.inheritedAllowedTools, request: allowedTools, deployment: deps.allowedTools }, mounted());
     if (inert.length > 0)
         deliverEngineNotice(deps.onNotice, allowedToolsNotGrantedNotice(inert, sessionId));
     if (skillSpecs.length > 0) {
@@ -99,7 +103,7 @@ export async function prepareProjectContext(input) {
         }
         roster.mount(createSkillTool(skillSpecs, skillGrants), { source: "builtin", mountedBy: "optional" });
     }
-    const skillSeatOf = skillSeatReader(skillSpecs);
+    const skillSeatOf = skillSeatReader(skillSpecs, mounted);
     const sharedMemoryProvider = deps.sharedMemoryStores;
     let sharedMemoryPairMounted = false;
     if (sharedMemoryProvider !== undefined) {

package/dist/core/runner/prepare-task.js

@@ -407,7 +407,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         let readDenyAdditionsNormalized = [];
         let handsLessResolvedFace;
         let handsLessResolvedWriteFace;
-        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, skillGrantCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, requestAllowedTools: allowedToolTables.request, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDeciderRef.current, autoModeDenialTracking: () => autoModeDenialTrackingRef.current, autoModeArming: () => autoModeArmingRef.current, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, resolvedWriteFace: () => resolvedWriteFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, handsLessResolvedWriteFace: () => handsLessResolvedWriteFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
+        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, skillGrantCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, askSeat: doors.askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, requestAllowedTools: allowedToolTables.request, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDeciderRef.current, autoModeDenialTracking: () => autoModeDenialTrackingRef.current, autoModeArming: () => autoModeArmingRef.current, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, resolvedWriteFace: () => resolvedWriteFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, handsLessResolvedWriteFace: () => handsLessResolvedWriteFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
         bindPermissionModeSeat(permissionMode);
         const announceRuleStoreSkipped = ruleStoreUnreadableNotice(deps.onNotice, { sessionId, runId });
         const persistedPathRowsRead = persistedPathRowsOfTask({ deps, principal: spec.principal, sessionId, root: taskRootFinal, home: executionEnv.homeDir, taskId: hostTaskId, handsEnabled, signals: [abortController.signal, ...(spec.signal !== undefined ? [spec.signal] : [])], onUnread: announceRuleStoreSkipped });
@@ -415,7 +415,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectivePathDenyRules = [...toolPolicyPathDenyRules([lockedPreflight.toolPolicy, ...(inheritedParentConstraints ?? []).map((c) => c.policy)]), ...persistedPathRows.denyRows];
         const writeProtectionJudgeRef = {};
         const writeGuards = { protection: () => writeProtectionJudgeRef.current, target: toolPolicyWriteTargetGuard([lockedPreflight.toolPolicy, ...(inheritedParentConstraints ?? []).map((c) => c.policy)]) };
-        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDeciderRef, autoModeDenialTrackingRef, autoModeArmingRef, armAutoMode, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, parentSpecSeat, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries: () => ({ entries: readDenyMatcher?.entries ?? [], ruleRows: effectivePathDenyRules }), peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
+        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDeciderRef, autoModeDenialTrackingRef, autoModeArmingRef, armAutoMode, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, askSeat: doors.askSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, parentSpecSeat, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries: () => ({ entries: readDenyMatcher?.entries ?? [], ruleRows: effectivePathDenyRules }), peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
         const tools = roster.tools;
         const pausedRef = {};
         const undeliveredContinuationRef = { current: { parkedSteers: [], orphanTasks: [] } };
@@ -733,8 +733,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
-        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, askSeat: doors.askSeat, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox });
         const writeProtectionCheck = writeProtection?.check;
         writeProtectionJudgeRef.current = writeProtection?.judgeTarget;
         if (fileHistoryBoundary !== undefined) {
@@ -743,10 +743,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return undefined;
             });
         }
-        const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
+        const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
-        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, skillSpecs, now, humanReviewRef, abortController, harness, pausedRef });
+        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef });
         const seatInputsFor = skillGateWiring({ tools, skillToolName: SKILL_TOOL_NAME, seatOf: skillSeatOf, mode: () => permissionMode.current, lane: skillGrantLane, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.skill_allowed", version: 1, taskId: hostTaskId, ...info, entries: [...info.entries], ts: Date.now() })), allowEntries: { deploymentAllows: { ...allowEntryLanes.deployment, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "deployment", ...info, entries: [...info.entries], ts: Date.now() })) }, requestAllows: { ...allowEntryLanes.request, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "request", ...info, entries: [...info.entries], ts: Date.now() })) } } });
         const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.pathDenyRules.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
         const postureFrameRef = { report: (err) => deps.onError?.(err, { phase: "degraded", sessionId }) };

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -36,12 +36,12 @@ import { type AutoModeArmFact, type WiringManifest, type WiringManifestMcpEntry
 import { type PermissionModeController } from "../mode-policy.js";
 import type { AnnounceOnceSink, Prepared, PrepareResume, RunInternals, UsageGovernance } from "./contracts.js";
 export interface PrepareWiringManifestInput {
-    /** borrowed-readonly — the REBOUND spec. Read: `onAsk` (the own seat), `onQuestion` (the question seam), `handsReadOnly` / `tools` (the ungated scan),
+    /** borrowed-readonly — the REBOUND spec. Read: `onQuestion` (the question seam), `handsReadOnly` / `tools` (the ungated scan),
      *  `resourceSuspend` (the task-axis lane), `durableApproval` / `principal` (the synthesis and the notice), `interactiveTools` /
      *  `mcp` / `checkpointStore` (manifest cells and the notice's cause), `enablePlanMode` (the gate-machinery predicate's
      *  plan-mode term). Never mutated. */
-    spec: Pick<TaskSpec, "onAsk" | "onQuestion" | "handsReadOnly" | "tools" | "resourceSuspend" | "durableApproval" | "principal" | "interactiveTools" | "mcp" | "checkpointStore" | "enablePlanMode" | "hooks" | "peerPresence">;
-    /** borrowed-readonly — the deployment seats, whole: `onAsk` (the seat's deps half), `onError` (the warning), `executionEnv`
+    spec: Pick<TaskSpec, "onQuestion" | "handsReadOnly" | "tools" | "resourceSuspend" | "durableApproval" | "principal" | "interactiveTools" | "mcp" | "checkpointStore" | "enablePlanMode" | "hooks" | "peerPresence">;
+    /** borrowed-readonly — the deployment seats, whole: `onError` (the warning), `executionEnv`
      *  (the hook-env predicate), `checkpointStore` (durable infra), the manifest's dozen wiring facts (`backgroundAgentStore`,
      *  `permissionRuleStore`, `permissionRuleSyncWired`, `onBackgroundChildEvent`, `lockedConfig`, `compliancePostureResolver`,
      *  `memoryScopeAdmission`, `retentionPolicy`, `onElicit`), `onNotice`, the write-protection judge's compile seats
@@ -141,8 +141,9 @@ export interface PrepareWiringManifestInput {
     harness: AgentHarness;
     /** borrowed-readonly — the durable-suspend holder; the drain's parked predicate reads `token` at run time. Not written here. */
     pausedRef: Prepared["pausedRef"];
-    /** borrowed-readonly — the FROZEN approver seat (the notice's liveApprover fact). */
-    frozenOnAsk: OnAsk | undefined;
+    /** borrowed-readonly — the run's approval seat as the config doors froze it: the gate's approver and the notice's facts (its
+     *  value), the manifest's ask cell (its form and provenance). */
+    askSeat: import("../wiring-manifest.js").AskSeat;
     /** borrowed-readonly — the LIVE half of the inherited chain (the notice reads its content mandates). */
     liveInheritedGate: RunInternals["inheritedGate"];
     /** borrowed-readonly — the effective delegation facts (the identity's isDelegatedChild). */