@sema-agent/core 7.42.0 → 7.43.0

package/dist/core/skill-grant.js

@@ -3,25 +3,32 @@ import { parsePermissionRule } from "./permission-rules.js";
 import { mountedToolPermissionSeat } from "./mode-policy.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { boundInputHashOf } from "./canonical-json.js";
-import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, judgeAllowEntries } from "./allow-entry.js";
+import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, inertEntryPhrase, judgeAllowEntries } from "./allow-entry.js";
 export const SKILL_GRANT_ORIGINS = Object.freeze(["model", "user", "inherited"]);
 const FROZEN_SKILL_GRANT_ORIGINS = new Set(["model", "inherited"]);
 export function skillNamedBy(args, skills) {
     const named = args?.skill;
     return typeof named === "string" ? skills.find((s) => s.name === named) : undefined;
 }
-export function skillGrantDigest(skill) {
+function skillGrantBinding(skill) {
     const canonical = (entries) => [...new Set((entries ?? []).map((e) => {
             const p = parsePermissionRule(e);
             return p.ruleContent === undefined ? p.toolName : `${p.toolName}(${p.ruleContent})`;
         }))].sort();
-    return boundInputHashOf({ skill: skill?.name ?? null, allowedTools: canonical(skill?.allowedTools), disallowedTools: canonical(skill?.disallowedTools) });
+    const boundGrants = { skill: skill?.name ?? null, allowedTools: canonical(skill?.allowedTools), disallowedTools: canonical(skill?.disallowedTools) };
+    return { boundGrantDigest: boundInputHashOf(boundGrants), boundGrants };
+}
+export function skillGrantDigest(skill) {
+    return skillGrantBinding(skill).boundGrantDigest;
 }
-export function skillCallGrantDigest(call, args, skills, skillToolName) {
-    return skills.length > 0 && wireOf("skillGrant.binding", call) === skillToolName ? skillGrantDigest(skillNamedBy(args, skills)) : undefined;
+export function skillGrantBindingMembers(call, args, skills, skillToolName) {
+    return isSkillActivationCall(call, skills, skillToolName) ? skillGrantBinding(skillNamedBy(args, skills)) : {};
+}
+function isSkillActivationCall(call, skills, skillToolName) {
+    return skills.length > 0 && wireOf("skillGrant.binding", call) === skillToolName;
 }
 export function parkedSkillApprovalRefusal(row, args, skills, skillToolName, site = "claim") {
-    if (row.boundGrantDigest === undefined && skillCallGrantDigest(row, args, skills, skillToolName) === undefined)
+    if (row.boundGrantDigest === undefined && skillGrantBindingMembers(row, args, skills, skillToolName).boundGrantDigest === undefined)
         return undefined;
     if (skillGrantDigest(skillNamedBy(args, skills)) === row.boundGrantDigest)
         return undefined;
@@ -43,18 +50,18 @@ export function detachSkillLists(skills) {
 export function declaresSkillLists(skill) {
     return (skill.allowedTools?.length ?? 0) > 0 || (skill.disallowedTools?.length ?? 0) > 0;
 }
-export function compileSkillGrant(skill, origin) {
+export function compileSkillGrant(skill, origin, roster) {
     const rows = [];
     const inert = [];
     for (const [list, behavior, entries] of [
         ["allowed-tools", "allow", skill.allowedTools ?? []],
         ["disallowed-tools", "deny", skill.disallowedTools ?? []],
     ]) {
-        const compiled = compileAllowList(entries, behavior);
+        const compiled = compileAllowList(entries, behavior, roster);
         for (const r of compiled.rows)
             rows.push({ skill: skill.name, origin, behavior, entry: r.entry, compiled: r.compiled });
         for (const i of compiled.inert)
-            inert.push({ skill: skill.name, list, entry: i.entry, reason: i.reason });
+            inert.push({ skill: skill.name, list, ...i });
     }
     return { rows, inert };
 }
@@ -65,10 +72,15 @@ function judge(rows, req, behavior, ctx) {
 export function skillDenyDecision(hit) {
     return {
         action: "deny",
-        message: `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in disallowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")}) — refused for the rest of this run`,
+        message: hit.readsAsNothing !== undefined
+            ? skillDenyUnreadable(hit.skill, hit.readsAsNothing, "activation").message
+            : `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in disallowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")}) — refused for the rest of this run`,
         decisionReason: "skill",
     };
 }
+function unreadDenyOf(inert) {
+    return inert.filter((i) => i.list === "disallowed-tools");
+}
 export function skillRowRefusal(lane, req) {
     const hit = lane?.denying(req);
     return hit === undefined ? undefined : skillDenyDecision(hit);
@@ -83,21 +95,21 @@ export function skillAllowDecision(hit, updatedInput) {
 }
 const CARD_ENTRIES_MAX = 10;
 const CARD_ENTRY_MAX_CHARS = 120;
-export function skillActivationQuestion(skill, mode) {
+export function skillActivationQuestion(skill, mode, roster) {
     const head = `Execute skill: ${inlineUntrusted(skill.name, 200)}`;
-    const granting = compileSkillGrant(skill, "model").rows.filter((r) => r.behavior === "allow" && !(mode === "auto" && autoStripped(r.compiled, undefined)));
+    const granting = compileSkillGrant(skill, "model", roster).rows.filter((r) => r.behavior === "allow" && !(mode === "auto" && autoStripped(r.compiled, undefined)));
     if (granting.length === 0)
         return head;
     const shown = granting.slice(0, CARD_ENTRIES_MAX).map((r) => inlineUntrusted(r.entry, CARD_ENTRY_MAX_CHARS));
     const rest = granting.length - shown.length;
     return `${head}\nApproving also lets these tools be used without asking for the rest of this run: ${shown.join(", ")}${rest > 0 ? ` and ${rest} more` : ""}`;
 }
-export function skillSeatReader(skills) {
+export function skillSeatReader(skills, mounted) {
     if (skills.length === 0)
         return undefined;
     return (args, mode) => {
         const skill = skillNamedBy(args, skills);
-        return skill !== undefined && declaresSkillLists(skill) ? { seat: "passthrough", question: skillActivationQuestion(skill, mode) } : undefined;
+        return skill !== undefined && declaresSkillLists(skill) ? { seat: "passthrough", question: skillActivationQuestion(skill, mode, mounted?.()) } : undefined;
     };
 }
 export function skillGateWiring(opts) {
@@ -123,27 +135,68 @@ export function seedSkillGrants(table, opts) {
         for (const name of invoked)
             table.activate(named(name), "user");
     }
-    return opts.skills.flatMap((s) => compileSkillGrant(s, "model").inert);
+    const roster = table.mountedNames();
+    return opts.skills.flatMap((s) => compileSkillGrant(s, "model", roster).inert);
+}
+export function screenUserInvokedSkills(config) {
+    if (config.userInvokedSkills === undefined)
+        return;
+    try {
+        seedSkillGrants(new SkillGrantTable(), { skills: config.skills ?? [], userInvokedSkills: config.userInvokedSkills, inherited: [] });
+    }
+    catch (e) {
+        const code = e?.code;
+        if (code === USER_INVOKED_SKILL_UNKNOWN_CODE || code === SKILL_DENY_UNREADABLE_CODE)
+            throw e;
+    }
 }
 export class SkillGrantTable {
     rowsHeld = [];
+    rowKeys = new Set();
+    mounted;
+    activations;
+    bindMountedNames(mounted) {
+        this.mounted = mounted;
+    }
+    bindSkills(skills, skillToolName) {
+        this.activations = { skills, skillToolName };
+    }
+    mountedNames() {
+        return this.mounted?.();
+    }
     hold(row) {
-        if (!this.rowsHeld.some((r) => r.skill === row.skill && r.origin === row.origin && r.behavior === row.behavior && r.entry === row.entry))
-            this.rowsHeld.push(row);
+        const key = JSON.stringify([row.skill, row.origin, row.behavior, row.entry]);
+        if (this.rowKeys.has(key))
+            return;
+        this.rowKeys.add(key);
+        this.rowsHeld.push(row);
     }
     activate(skill, origin) {
-        const { rows, inert } = compileSkillGrant(skill, origin);
+        const { rows, inert } = compileSkillGrant(skill, origin, this.mountedNames());
+        const unreadDeny = unreadDenyOf(inert);
+        if (unreadDeny.length > 0)
+            throw skillDenyUnreadable(skill.name, unreadDeny, "activation");
         for (const row of rows)
             this.hold(row);
         return inert;
     }
     seed(records, origin) {
+        const roster = this.mountedNames();
+        const rows = [];
+        const unreadDeny = [];
         for (const r of records) {
-            const compiled = compileAllowEntry(r.entry, r.behavior);
-            if (typeof compiled === "string")
-                continue;
-            this.hold({ skill: r.skill, origin: r.origin === "model" ? "model" : origin, behavior: r.behavior, entry: r.entry, compiled });
+            const read = compileAllowList([r.entry], r.behavior, roster);
+            const row = read.rows[0];
+            if (row !== undefined)
+                rows.push({ skill: r.skill, origin: r.origin === "model" ? "model" : origin, behavior: r.behavior, entry: r.entry, compiled: row.compiled });
+            else if (r.behavior === "deny")
+                unreadDeny.push(...read.inert.map((i) => ({ skill: r.skill, ...i })));
         }
+        const first = unreadDeny[0];
+        if (first !== undefined)
+            throw skillDenyUnreadable(first.skill, unreadDeny.filter((i) => i.skill === first.skill), "carried");
+        for (const row of rows)
+            this.hold(row);
     }
     records() {
         return this.rowsHeld.map((r) => ({ skill: r.skill, behavior: r.behavior, entry: r.entry, origin: r.origin }));
@@ -151,9 +204,17 @@ export class SkillGrantTable {
     lane(ctx) {
         return {
             allowing: (req, mode) => judge(allowingRows(this.rowsHeld, req, mode), req, "allow", ctx),
-            denying: (req) => judge(this.rowsHeld, req, "deny", ctx),
+            denying: (req) => judge(this.rowsHeld, req, "deny", ctx) ?? this.activationRefused(req),
         };
     }
+    activationRefused(req) {
+        const at = this.activations;
+        if (at === undefined || !isSkillActivationCall(req, at.skills, at.skillToolName))
+            return undefined;
+        const skill = skillNamedBy(req.args, at.skills);
+        const unread = skill === undefined ? [] : unreadDenyOf(compileSkillGrant(skill, "model", this.mountedNames()).inert);
+        return skill === undefined || unread.length === 0 ? undefined : { skill: skill.name, entries: unread.map((i) => i.entry), readsAsNothing: unread };
+    }
 }
 function readCarriedRecords(raw, carrier) {
     if (raw === undefined)
@@ -190,3 +251,15 @@ export function readFrozenSkillGrants(section) {
     return readCarriedRecords(section, "frozen");
 }
 export const USER_INVOKED_SKILL_UNKNOWN_CODE = "config.user_invoked_skill_unknown";
+export const SKILL_DENY_UNREADABLE_CODE = "config.skill_deny_unreadable";
+function skillDenyUnreadable(skill, entries, site) {
+    const listed = entries.map(inertEntryPhrase).join(", ");
+    const one = entries.length === 1;
+    const name = inlineUntrusted(skill, 120);
+    const message = site === "activation"
+        ? `Skill "${name}" was not activated: its disallowed-tools entr${one ? `y ${listed} reads` : `ies ${listed} read`} as nothing — a refusal this engine cannot read is not dropped, so the activation does not happen (its instructions are not loaded and nothing it lists is granted). Spell each entry as the tool is mounted, or remove it, in its definition.`
+        : `the grant rows carried for Skill "${name}" (a park's frozen rows, or a parent's capture) hold the disallowed-tools entr${one ? `y ${listed}, which reads` : `ies ${listed}, which read`} as nothing for this run — a refusal this engine cannot read is not dropped, so this leg does not start without it. A parked task an earlier release wrote can be finished on a worker of that release; otherwise correct the entry in its disallowed-tools and submit the task again.`;
+    const e = new Error(message);
+    e.code = SKILL_DENY_UNREADABLE_CODE;
+    return e;
+}

package/dist/core/task-notification.d.ts

@@ -30,6 +30,12 @@ export declare const SYSTEM_INJECTION_PRIORITIES: readonly SystemInjectionPriori
  *  no-subscriber retain path indexes `queues[priority]` and the park path stores it verbatim, so an
  *  unknown value used to travel until something downstream failed on it (or didn't, and lied). */
 export declare function isSystemInjectionPriority(value: unknown): value is SystemInjectionPriority;
+/** The ONE reading of a steer's priority: a parked row or an accepted input that carries none means `"next"`
+ *  (the default the live admission has always applied) — so a retry that spells the default and a row parked
+ *  without it are the same instruction, whichever side normalized. */
+export declare function steerPriorityOf(x: {
+    readonly priority?: SystemInjectionPriority;
+}): SystemInjectionPriority;
 export interface TaskNotificationPayload {
     task_id: string;
     /** design/144 §2: `"external"` is CORE-MINTED ONLY — `TaskStream.notify()` casts it onto every

package/dist/core/task-notification.js

@@ -10,6 +10,9 @@ export const SYSTEM_INJECTION_PRIORITIES = ["now", "next", "later"];
 export function isSystemInjectionPriority(value) {
     return typeof value === "string" && SYSTEM_INJECTION_PRIORITIES.includes(value);
 }
+export function steerPriorityOf(x) {
+    return x.priority ?? "next";
+}
 const TASK_NOTIFICATION_TAGS = [
     "task-notification",
     "task-id",

package/dist/core/task-spec.d.ts

@@ -110,6 +110,18 @@ export interface TaskSpec {
      * explicit opt-out, which covers both arms.
      */
     interactionPosture?: "interactive" | "headless";
+    /**
+     * The run's declaration that NOBODY on it can be asked to approve a call — read by the approval seat's one resolution
+     * ({@link import("./wiring-manifest.js").resolveAskSeat}). `"none"`: an approver callback the spec or the deployment wires
+     * is not this run's approver (never called; the manifest reports `ask.form: "declared_none"`); with the deployment's park
+     * facility armed an ask parks for a person to answer later (`park_only`), without one it is refused as nobody's. It
+     * approves and releases nothing; a blanket `"allow"` / `"deny"` seat stays a policy; under `dontAsk` the mode refuses
+     * first. Absent = today's reading. Not checkpointed (a resumed leg holds it only when its taskConfig supplies it again);
+     * children inherit it (the clamp seats). `interactionPosture: "interactive"` beside it is refused
+     * (`config.interaction_posture`); a value outside the closed set too (`config.approval_reach_invalid`). Independent of
+     * {@link interactiveTools} — a content question still goes to `onQuestion`.
+     */
+    approvalReach?: import("./wiring-manifest.js").ApprovalReach;
     /**
      * design/173 §8.2 — the EXPLICIT knob (default off) letting a posture-`"interactive"` run
      * CONTINUE with the synthetic self-answer instruction after all on BOTH hardened question arms
@@ -562,7 +574,8 @@ export interface TaskSpec {
      * projections and the deny-narrowing layers still apply regardless).
      */
     basePolicyForResumeEdit?: import("./tool-policy.js").ToolPolicy;
-    /** How `ask` decisions resolve for this task (headless auto-deny by default). Overrides `RunnerDeps.onAsk`. */
+    /** How `ask` decisions resolve for this task (headless auto-deny by default). Overrides `RunnerDeps.onAsk` when present.
+     *  A callback here is set aside when the run declares {@link approvalReach} `"none"`. */
     onAsk?: import("./tool-policy.js").OnAsk;
     /** Content-ask seam (design/64 §5): routes an AskUserQuestion tool call to a real human/UI. When set, the
      *  AskUserQuestion tool is mounted (one of the delivery faces in the criterion — see

package/dist/core/tighten-task-spec.d.ts

@@ -13,6 +13,8 @@ export declare class TaskSpecTightenError extends Error {
  *    would drop the base policy entirely.
  *  - **`handsReadOnly`** — `true` is stricter. `base:true` + `override:false` ⇒ **throw** (loosening). Otherwise
  *    the stricter (`true` if either is true) wins.
+ *  - **`approvalReach`** — `"none"` (nobody can be asked) is the only word; a base declaration survives an override that
+ *    omits it or writes `undefined`.
  *  - **`shellGate`** — one value (`"always"`, the operator floor). Either side set ⇒ the floor stands; it cannot
  *    be loosened because absence is the only other state and an override cannot unset a base value.
  *  - **`onAsk`** — no safe automatic merge (the approver and the policy must be coordinated). Both set to

package/dist/core/tighten-task-spec.js

@@ -47,6 +47,9 @@ export function tightenTaskSpec(base, overrides) {
     if (base.handsReadOnly !== undefined || overrides.handsReadOnly !== undefined) {
         merged.handsReadOnly = base.handsReadOnly === true || overrides.handsReadOnly === true;
     }
+    if (base.approvalReach !== undefined || overrides.approvalReach !== undefined) {
+        merged.approvalReach = base.approvalReach === "none" || overrides.approvalReach === "none" ? "none" : (overrides.approvalReach ?? base.approvalReach);
+    }
     if (base.permissionMode !== undefined && overrides.permissionMode !== undefined) {
         const { effective, clamped } = clampPermissionMode(overrides.permissionMode, base.permissionMode);
         if (clamped) {

package/dist/core/tool-name-aliases.d.ts

@@ -1,3 +1,4 @@
+import { type ProtocolNamespace } from "./protocol-table.js";
 /**
  * RB-476-A stage 2 (ruling 2026-08-02, RB-476 "no compatibility surface survives", replay
  * resolution included) — the durable-name machinery this module used to hold is RETIRED:
@@ -26,17 +27,23 @@
  * wider tool: writing it would deny more than the entry did, so it is no current name), or `removed — `.
  */
 export declare const RETIRED_TOOL_NAMES: ReadonlyMap<string, string>;
-/** The three answers {@link judgeRuleToolName} gives — a closed set. */
-export declare const RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "unprefixed_namespace"];
+/** The four answers {@link judgeRuleToolName} gives — a closed set. */
+export declare const RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "unprefixed_namespace", "unmintable_segment"];
 /**
  * Whether a tool name written in a rule is a stale name — one that, against `roster`, names no tool and never can:
- *  - `current` — not a stale name: the roster mounts it, or it is neither retired nor a prefix-less `__` name. (Whether a
- *    current name matches anything THIS run is a different question — an unknown name is the prepare audit's advisory.)
+ *  - `current` — not a stale name: the roster mounts it, or it is none of the three below. (Whether a current name matches
+ *    anything THIS run is a different question — an unknown name is the prepare audit's advisory.)
  *  - `retired` — a name in {@link RETIRED_TOOL_NAMES} the roster does not mount; `guidance` is that table's line, and
  *    `currentName` the 1:1 successor when there is one (see the module header's grammar).
  *  - `unprefixed_namespace` — carries the `__` namespace separator with no protocol prefix. The roster cannot clear it:
  *    a caller tool name or alias carrying `__` is refused at prepare, every engine tool name is `__`-free, and every
  *    protocol tool is minted with its prefix.
+ *  - `unmintable_segment` — carries a protocol prefix, but its peer segment (the server / remote agent) is not a spelling
+ *    the mint produces for any peer: the name is read as written (peers compare exactly), and every mounted tool carries
+ *    the minted spelling, so the name reaches none of them. `guidance` says so in one line; `currentName` is the whole name
+ *    rewritten with the spelling the mint produces (`mcp__github.com__*` → `mcp__github_com__*`), absent when the peer
+ *    segment is empty and there is nothing to rewrite. The tool segment after the peer is never judged: it is a literal
+ *    tool name or a glob over one, and an unmatched one is the audit's advisory.
  *
  * `roster` = the tool names (aliases included) the reader knows are mounted: a run's assembled roster at prepare, the
  * names a deployment DECLARES it mounts its own tools under at a session-rule store (an empty set when it declares none).
@@ -49,6 +56,29 @@ export type RuleToolNameVerdict = {
     readonly currentName?: string;
 } | {
     readonly kind: "unprefixed_namespace";
+} | {
+    readonly kind: "unmintable_segment";
+    readonly guidance: string;
+    readonly currentName?: string;
 };
-/** See {@link RuleToolNameVerdict}. Pure; the one answer to "is this rule's tool name a retired or prefix-less name". */
+/**
+ * A name in ANY protocol namespace split into its owning namespace, its peer segment and its optional tool segment —
+ * CC `rP` (:70710) verbatim, re-anchored on the {@link protocolOf} lookup instead of CC's literal `"mcp"` first split element.
+ * `undefined` for a name that is not namespaced (no protocol prefix). The peer is the first segment — EMPTY for `mcp____x` and
+ * for the bare prefix, which name no peer; the tool segment is the REST of the split rejoined, so a tool whose minted segment
+ * itself carries the separator (charset normalization maps `get..issue` → `get__issue`) decomposes back to one tool name, and
+ * is absent when the name stops at the peer (`mcp__srv`). The one decomposition: the judgment, the covering matcher and the
+ * allow-entry grammar all read a namespaced name through it.
+ */
+export declare function splitNamespacedName(name: string): {
+    readonly ns: ProtocolNamespace;
+    readonly peer: string;
+    readonly tool?: string;
+} | undefined;
+/** See {@link RuleToolNameVerdict}. Pure; the one answer to "is this rule's tool name a name that reaches no tool". */
 export declare function judgeRuleToolName(name: string, roster: ReadonlySet<string>): RuleToolNameVerdict;
+/** The names a run mounts — every tool's primary name and its aliases: the roster {@link judgeRuleToolName} is given. */
+export declare function mountedToolNames(tools: ReadonlyArray<{
+    readonly name: string;
+    readonly aliases?: readonly string[];
+}>): Set<string>;

package/dist/core/tool-name-aliases.js

@@ -1,4 +1,5 @@
 import { carriesNamespaceSeparator, protocolOf } from "./protocol-table.js";
+import { mintNamespacePrefix } from "./protocol-naming.js";
 export const RETIRED_TOOL_NAMES = new Map([
     ["read_file", 'renamed "Read"'],
     ["edit_file", 'renamed "Edit"'],
@@ -41,9 +42,29 @@ export const RETIRED_TOOL_NAMES = new Map([
     ["Recall", "removed — memory is file-based; read the memory directory with the ordinary file tools"],
     ["recall", "removed — memory is file-based; read the memory directory with the ordinary file tools"],
 ]);
-export const RULE_TOOL_NAME_VERDICTS = Object.freeze(["current", "retired", "unprefixed_namespace"]);
+export const RULE_TOOL_NAME_VERDICTS = Object.freeze(["current", "retired", "unprefixed_namespace", "unmintable_segment"]);
 const CURRENT = Object.freeze({ kind: "current" });
 const UNPREFIXED = Object.freeze({ kind: "unprefixed_namespace" });
+const NAMESPACE_SEPARATOR = "__";
+export function splitNamespacedName(name) {
+    const ns = protocolOf(name);
+    if (ns === undefined)
+        return undefined;
+    const [peer = "", ...rest] = name.slice(ns.prefix.length).split(NAMESPACE_SEPARATOR);
+    return rest.length > 0 ? { ns, peer, tool: rest.join(NAMESPACE_SEPARATOR) } : { ns, peer };
+}
+function unmintableSegmentOf({ ns, peer, tool }) {
+    if (peer === "")
+        return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty peer segment — no tool is minted under it` };
+    const minted = mintNamespacePrefix(ns, peer).slice(ns.prefix.length, -NAMESPACE_SEPARATOR.length);
+    if (minted === peer)
+        return undefined;
+    return {
+        kind: "unmintable_segment",
+        guidance: `the ${ns.id} peer segment ${JSON.stringify(peer)} is not a spelling the engine mints — its tools are named ${ns.prefix}${minted}${NAMESPACE_SEPARATOR}<tool>, and a rule's peer segment must be spelled the way its tools are`,
+        currentName: `${ns.prefix}${minted}${tool !== undefined ? `${NAMESPACE_SEPARATOR}${tool}` : ""}`,
+    };
+}
 export function judgeRuleToolName(name, roster) {
     if (roster.has(name))
         return CURRENT;
@@ -52,7 +73,11 @@ export function judgeRuleToolName(name, roster) {
         const currentName = /^renamed "([^"]+)"/.exec(guidance)?.[1];
         return currentName !== undefined ? { kind: "retired", guidance, currentName } : { kind: "retired", guidance };
     }
-    if (carriesNamespaceSeparator(name) && protocolOf(name) === undefined)
-        return UNPREFIXED;
-    return CURRENT;
+    const split = splitNamespacedName(name);
+    if (split === undefined)
+        return carriesNamespaceSeparator(name) ? UNPREFIXED : CURRENT;
+    return unmintableSegmentOf(split) ?? CURRENT;
+}
+export function mountedToolNames(tools) {
+    return new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
 }

package/dist/core/tool-policy.d.ts

@@ -303,6 +303,9 @@ export type PermissionResult = {
      *  same safe direction as `matchedAskRule`); it cannot state a window of its own, because the
      *  route it would be a window for has not been chosen yet. */
     denialLimitFallback?: import("./auto-mode.js").UnarmedDenialLimitFallback;
+    /** WHY a classifier station handed this call to a person: the classification did not rule (`error` / `timeout` — it could
+     *  not run; `parse_error` — no verdict). Engine-stamped with `requiresRealApproval`; class `classifier_no_ruling`. */
+    classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     /** The allow layer's DISCLOSURE: the members that MATCHED this call and could not clear the ask (it is a class
      *  no allow rule clears — a mandated, governance, hook, ask-rule or mode question — or the call reached the layer
      *  marked), one record per member ({@link AllowRuleShadow}). ENGINE-STAMPED by the allow layer, overwriting a
@@ -1201,6 +1204,10 @@ export interface AskRequest {
      *  mint site added later is covered by construction); optional on the type because a deployment may
      *  invoke its approver function directly. */
     readonly boundInputHash?: string;
+    /** A call to the engine's `Skill` tool: the hash of {@link boundGrants} — the digest a parked approval of the same card is judged by, so a live card reconciles against its parked row by `(toolCallId, boundGrantDigest)` and an answer is remembered by "this tool + this binding". Present exactly on that call (whoever asked, however the question was worded), absent on every other card; `message` renders the same lists narrowed to what releases in the leg's mode. Reconciliation metadata, never adjudication input. */
+    readonly boundGrantDigest?: string;
+    /** The value {@link boundGrantDigest} hashes: `{ skill, allowedTools, disallowedTools }` in canonical spelling (de-duplicated, sorted), `skill: null` when no loaded skill is named; a fresh copy per ask; same presence. Display metadata (deployment text — render with contextual escaping). */
+    readonly boundGrants?: import("./skill-grant-binding.js").BoundSkillGrants;
     /**
      * design/179 §4, re-formed by design/375 §3.1 (BREAKING — this seat REPLACES the retired
      * `ruleSuggestions` key, which is never emitted again; the new name is the safe failure posture for
@@ -1396,6 +1403,9 @@ export interface AskRequest {
      *  that forwards a decision's member here does not compile, which is the point: the window is the
      *  route's fact, and forwarding it silently is how a configured window becomes a wait with none. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** The {@link PermissionResult} ask-arm member of the same name (class `classifier_no_ruling`), carried by the four mint
+     *  stations; the `message`'s second paragraph says the same for a client that does not read this. */
+    readonly classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     /** (additive) WHICH AUTHORITY raised this ask — the wire twin of the {@link PermissionResult} ask-arm
      *  member of the same name, one word from the closed {@link import("./ask-origin.js").AskOrigin} set.
      *  The gate's own mint station copies the engine-stamped word; the three inherited-lane stations

package/dist/core/tool-policy.js

@@ -259,7 +259,7 @@ const ALLOW = Object.freeze({ action: "allow" });
 const ALLOW_BY_RULE = Object.freeze({ action: "allow", decisionReason: "rule" });
 const RETIRED_TEXT_FIELD = "reason";
 export const DECISION_MEMBERS = Object.keys({
-    action: 0, updatedInput: 0, message: 0, decisionReason: 0, requiresRealApproval: 0, denialLimitFallback: 0, allowRuleShadowed: 0, probeReason: 0,
+    action: 0, updatedInput: 0, message: 0, decisionReason: 0, requiresRealApproval: 0, denialLimitFallback: 0, classifierNoRuling: 0, allowRuleShadowed: 0, probeReason: 0,
     probeCause: 0, probeMandated: 0, mandated: 0, mandate: 0, probeReadRootCandidate: 0, matchedAskRule: 0, ruleEvidence: 0, segmentCoverage: 0,
     origin: 0, askClass: 0, classes: 0, guard: 0, ruleUnreadable: 0, authoredBy: 0, foldedAskClasses: 0,
 });
@@ -551,6 +551,7 @@ export function combinePolicies(...policies) {
             let probeMandateSeen = false;
             let mandateSeen = false;
             let fallbackSeen;
+            let noRulingSeen;
             let authoredBySeen = false;
             const contributors = [];
             const settleDeny = (d) => {
@@ -597,6 +598,8 @@ export function combinePolicies(...policies) {
                     mandateSeen = true;
                 if (d.action === "ask" && d.denialLimitFallback !== undefined && fallbackSeen === undefined)
                     fallbackSeen = d.denialLimitFallback;
+                if (d.action === "ask" && d.classifierNoRuling !== undefined && noRulingSeen === undefined)
+                    noRulingSeen = d.classifierNoRuling;
                 if (d.action === "ask" && d.authoredBy === "deployment")
                     authoredBySeen = true;
                 if (d.action === "ask")
@@ -610,12 +613,16 @@ export function combinePolicies(...policies) {
                 const withMark = probeMandateSeen && withRuleAsk.probeMandated !== true ? { ...withRuleAsk, probeMandated: true } : withRuleAsk;
                 const withMandate = mandateSeen && withMark.mandated !== true ? { ...withMark, mandated: true } : withMark;
                 const withFallback = fallbackSeen !== undefined && withMandate.denialLimitFallback === undefined ? { ...withMandate, denialLimitFallback: fallbackSeen, requiresRealApproval: true } : withMandate;
-                const withAuthor = authoredBySeen && withFallback.authoredBy === undefined ? { ...withFallback, authoredBy: "deployment" } : withFallback;
+                const withNoRuling = noRulingSeen !== undefined && withFallback.classifierNoRuling === undefined ? { ...withFallback, classifierNoRuling: noRulingSeen, requiresRealApproval: true } : withFallback;
+                const withAuthor = authoredBySeen && withNoRuling.authoredBy === undefined ? { ...withNoRuling, authoredBy: "deployment" } : withNoRuling;
                 const folded = new Set(withAuthor.foldedAskClasses ?? []);
                 for (const c of contributors)
                     if (c !== asked)
                         for (const k of decisionAskClassesOf(c))
                             folded.add(k);
+                if (withNoRuling !== withMandate)
+                    for (const k of decisionAskClassesOf(asked))
+                        folded.add(k);
                 const withClasses = folded.size > 0 ? { ...withAuthor, foldedAskClasses: [...folded] } : withAuthor;
                 const out = merged !== undefined ? { ...withClasses, updatedInput: merged } : withClasses;
                 if (folded.size > 0)

package/dist/core/tool-spec.d.ts

@@ -952,6 +952,13 @@ export interface ToolExecuteContext {
      * is deliberately NOT inherited).
      */
     interactiveTools?: false;
+    /**
+     * The run's declaration that nobody on it can be asked to approve ({@link TaskSpec.approvalReach} `"none"`),
+     * Runner-filled read-only on the same trusted seat, present ONLY when declared. A delegation tool copies it onto every
+     * child spec (the clamp carrier): the child's own seat resolution would otherwise fall back to the deployment's live
+     * approver, because a declared-none parent hands down no approver of its own ({@link onAsk} is absent on its ctx).
+     */
+    approvalReach?: "none";
     /**
      * Read-only mirror of {@link "./types.js".TaskSpec.oneShot} (same trust tier/seat as
      * `principal`): this RUN has no later turn for an async background notification to land in (a

package/dist/core/wiring-manifest.d.ts

@@ -26,6 +26,7 @@ import { type StoreDurability } from "./checkpoint-store.js";
 import type { WiringManifestHookEntry } from "./hook-seats.js";
 import type { McpDelivered, McpFailureKind, McpServerLiveness } from "./mcp-failure.js";
 import type { WriteProtectionTargetView } from "./write-protect.js";
+import type { OnAsk } from "./tool-policy.js";
 export type { StoreDurability };
 /** The manifest-face projection of {@link StoreDurability}: `"declared_durable"` (the name says it —
  *  a DECLARATION relayed, not a verification) vs `"process_local"` (declared so, or fail-closed
@@ -37,11 +38,29 @@ export type ManifestDurability = "declared_durable" | "process_local";
  *  child's manifest rides the CHILD's event stream and is deliberately not in the parent-forwarding
  *  whitelist — a host that wants a child's assembly evidence subscribes to the child. */
 export type WiringLegKind = "root" | "child" | "resume";
-/** The shape of the resolved permission-ask seat (`spec.onAsk ?? deps.onAsk`): a live approver
- *  callback, a blanket `"allow"`/`"deny"` policy setting, or nothing at all. `"deny"` (a deliberate
- *  policy) and `"absent"` (a degrade to the headless auto-deny default) are DISTINCT on purpose —
- *  design/173 */
-export type AskSeamForm = "callback" | "allow" | "deny" | "absent";
+/** The shape of the resolved permission-ask seat ({@link resolveAskSeat}): a live approver callback, a blanket
+ *  `"allow"`/`"deny"` policy setting, nothing at all, or `"declared_none"` — the run declared that nobody on it can be
+ *  asked (`TaskSpec.approvalReach: "none"`), so a callback beside the declaration is not this run's approver. `"deny"` (a
+ *  deliberate policy) and `"absent"` (no seat supplied a value — a degrade to the headless auto-deny default) are DISTINCT
+ *  on purpose — design/173 — and so are `"absent"` and `"declared_none"`: one says nothing was wired, the other that
+ *  the run said nobody can answer. */
+export type AskSeamForm = "callback" | "allow" | "deny" | "absent" | "declared_none";
+/**
+ * The closed set of a run's approval-reach declaration (`TaskSpec.approvalReach`): `"none"` — nobody on this run can be
+ * asked to approve. It removes the one seat that could be a person (a callback); it never approves or releases anything.
+ * There is no positive word: "a person is reachable" is the `interactionPosture: "interactive"` promise, which has its own
+ * door.
+ */
+export declare const APPROVAL_REACH: readonly ["none"];
+export type ApprovalReach = (typeof APPROVAL_REACH)[number];
+/** Membership test for {@link ApprovalReach}. */
+export declare function isApprovalReach(v: unknown): v is ApprovalReach;
+/**
+ * The declaration's door: absent passes as absent, a member passes, anything else present is refused loudly
+ * (`config.approval_reach_invalid`) — a declaration nobody can read must not fold to "a person may be asked" (or to
+ * "nobody may"). Prepare, the static half and a resume's pre-claim screen call this one function.
+ */
+export declare function screenApprovalReach(v: unknown): ApprovalReach | undefined;
 /** What a policy `ask` actually reaches under this assembly. `"unresolved"` = not computable from
  *  the facts at hand (the static half's park-dependent arm). */
 export type AskEffective = "human_reachable" | "auto_allow" | "auto_deny" | "park_only" | "unresolved";
@@ -178,8 +197,8 @@ export interface WiringManifest {
     peerPresence?: import("../agents/peer-directory.js").PeerPresence;
     ask: {
         form: AskSeamForm;
-        /** Absent iff `form === "absent"` (no seat supplied a value — a fabricated provenance would be
-         *  a false fact). */
+        /** Absent iff no seat supplied a value (`"absent"`, or `"declared_none"` with nothing wired) — a fabricated provenance
+         *  would be a false fact. */
         provenance?: SeamProvenance;
         /** OMITTED on the static half (design/173 §8.4): the absent-form arm depends on the park lane,
          *  which the static half cannot always resolve. Always present on the effective half. */
@@ -556,7 +575,7 @@ export interface WiringFacts {
  *  single-source shapes, no parallel hand-copied interface). */
 export type StaticWiringDeps = Pick<RunnerDeps, "onAsk" | "onQuestion" | "interactionPosture" | "onElicit" | "checkpointStore" | "sessionStore" | "backgroundAgentStore" | "onBackgroundChildEvent" | "lockedConfig" | "compliancePostureResolver" | "memoryScopeAdmission" | "retentionPolicy" | "permissionRuleStore" | "permissionRuleSyncWired">;
 /** Named view of the spec seats the static half reads (a `Pick` of the real {@link TaskSpec}). */
-export type StaticWiringSpec = Pick<TaskSpec, "onAsk" | "onQuestion" | "checkpointStore" | "durableApproval" | "mcp" | "interactiveTools" | "interactionPosture">;
+export type StaticWiringSpec = Pick<TaskSpec, "onAsk" | "approvalReach" | "onQuestion" | "checkpointStore" | "durableApproval" | "mcp" | "interactiveTools" | "interactionPosture">;
 /**
  * Read a store's {@link StoreDurability} declaration: absent ⇒ `"process-local"` (fail-closed —
  * under-promise, never over-promise), a declared value passes through, and an UNPARSEABLE value is
@@ -613,8 +632,9 @@ export declare function resolveSubagentTranscriptTier(agentStoreWired: boolean,
  *    so on an armed park lane the ask parks and the honest report is `park_only` — reporting the
  *    blanket as what the ask "reaches" would be a false fact of exactly the kind this module refuses.
  *    Off the park lane the blanket is what happens: the deliberate auto policies;
- *  - no seat at all ⇒ the park lane decides: armed ⇒ `park_only`, unresolved ⇒ `unresolved`,
- *    else the headless degrade `auto_deny`.
+ *  - no seat at all, or a run that declared nobody can be asked (`declared_none`) ⇒ the park lane decides: armed ⇒
+ *    `park_only` (the deployment's park is its own statement that an answer can wait for a person), unresolved ⇒
+ *    `unresolved`, else the headless degrade `auto_deny`.
  */
 export declare function deriveAskEffective(form: AskSeamForm, parkEffective: boolean | "unresolved", mode?: PermissionMode): AskEffective;
 /**
@@ -637,10 +657,32 @@ export declare function askReachesPerson(ask: {
     readonly effective?: AskEffective;
 }): boolean;
 export declare function deriveWiringManifest(facts: WiringFacts): WiringManifest;
-/** The one ask-seat resolution (`spec` wins over `deps`), shared with the effective half so the
- *  form/provenance read cannot fork. Junk values (a JS caller passing something outside the OnAsk
- *  union) are refused loudly — a manifest must not classify what it cannot name. */
-export declare function resolveAskSeamForm(spec: Pick<TaskSpec, "onAsk">, deps: Pick<RunnerDeps, "onAsk">): {
+/** A run's approval seat as its one resolution froze it: the value every reader that needs the approver itself reads
+ *  (`undefined` when nothing on this run can be asked), the form the manifest reports and every reader of the word derives
+ *  from, the seat that supplied the value, and the declaration when the run made one. */
+export interface AskSeat {
+    readonly value: OnAsk | undefined;
+    readonly form: AskSeamForm;
+    /** Absent iff no seat supplied a value. A callback the declaration set aside still names its seat. */
+    readonly provenance?: SeamProvenance;
+    readonly reach?: ApprovalReach;
+}
+/**
+ * THE approval-seat resolution — the one place a run's `spec.onAsk` / `deps.onAsk` are read. Prepare calls it once, at
+ * its config doors (before any resource is taken), and hands the frozen result down; the static half calls it for its
+ * own self-check. The seat is the spec's when the spec's key is PRESENT, else the deployment's (presence, not `??`: a
+ * spec `null` is a junk value, never a fall-through to the deployment). A value outside the `OnAsk` union is refused
+ * loudly (`config.interaction_wiring`), a declaration outside {@link APPROVAL_REACH} too (`config.approval_reach_invalid`).
+ *
+ * `approvalReach: "none"` is one sentence here: a blanket `"allow"` / `"deny"` stays what it is (a policy setting never
+ * claimed to be a person); a callback, or no seat, becomes `declared_none` with NO value — so the readers of the value
+ * (the approver lane, the park's sync-first decline, the durable-mandate source, a child's inherited seat) and the readers
+ * of the word ({@link deriveAskEffective}) cannot disagree about whether a person is there.
+ */
+export declare function resolveAskSeat(spec: Pick<TaskSpec, "onAsk" | "approvalReach">, deps: Pick<RunnerDeps, "onAsk">): AskSeat;
+/** The form and provenance half of {@link resolveAskSeat} — the projection the manifest's two halves and a server's
+ *  per-leg judgment read (hand it the request's `approvalReach` beside the seat). */
+export declare function resolveAskSeamForm(spec: Pick<TaskSpec, "onAsk" | "approvalReach">, deps: Pick<RunnerDeps, "onAsk">): {
     form: AskSeamForm;
     provenance?: SeamProvenance;
 };