@sema-agent/core 7.42.1 → 7.43.0

package/dist/core/allow-entry.js

@@ -1,6 +1,7 @@
 import { heldBy } from "./tool-name-readings.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
-import { protocolOf } from "./protocol-table.js";
+import { judgeRuleToolName, splitNamespacedName } from "./tool-name-aliases.js";
+import { catalogToolNames } from "./tool-registry.js";
 import { COARSE_SHELL_TOOLS } from "./tool-policy.js";
 import { ALLOW_RULE_MEMBERS } from "./allow-rule-shadow.js";
 import { COMMAND_RULE_TOOL, READ_RULE_TOOL, findAdmittingRule, laneToolNamesOf, parseRuleText, programRunReachOf, ruleToolGrammarOf } from "./permission-rule-model.js";
@@ -9,66 +10,95 @@ import { splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier
 import { mandateDisclosureOf } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { deliverEngineNotice } from "./engine-notice.js";
-export const ALLOW_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar"]);
+export const ALLOW_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"]);
 function ruleRowOf(parsed) {
     return { ...parsed, scope: { kind: "global" }, adds: [{ dot: { actor: "list", counter: 1 }, origin: "user", createdAt: "" }] };
 }
 const TOOL_NAME_SPELLING = /^[^\s()]+$/;
-export function compileAllowEntry(raw, behavior) {
+function mountedSpellingOf(name, roster) {
+    const folded = name.toLowerCase();
+    for (const mounted of roster)
+        if (mounted.toLowerCase() === folded)
+            return mounted;
+    return undefined;
+}
+function toolNameReading(name, roster) {
+    const verdict = judgeRuleToolName(name, roster);
+    if (verdict.kind !== "current") {
+        const currentName = verdict.kind === "unprefixed_namespace" ? undefined : verdict.currentName;
+        return { inert: "tool_name", detail: { verdict: verdict.kind, ...(currentName !== undefined ? { currentName } : {}) } };
+    }
+    if (roster.has(name) || catalogToolNames().has(name) || splitNamespacedName(name) !== undefined)
+        return undefined;
+    const mounted = mountedSpellingOf(name, roster);
+    return mounted === undefined ? undefined : { inert: "near_miss", detail: { currentName: mounted } };
+}
+function readAllowEntry(raw, behavior, roster) {
+    const inert = (reason) => ({ inert: reason });
+    const row = (compiled) => ({ compiled });
     if (raw !== raw.trim())
-        return "grammar";
+        return inert("grammar");
     const parsed = parsePermissionRule(raw);
     const name = parsed.toolName;
     if (!TOOL_NAME_SPELLING.test(name))
-        return "grammar";
+        return inert("grammar");
     if (name === "*")
-        return "wildcard_all";
+        return inert("wildcard_all");
+    if (roster !== undefined) {
+        const stale = toolNameReading(name, roster);
+        if (stale !== undefined)
+            return stale;
+    }
     if (parsed.ruleContent === undefined) {
-        const ns = protocolOf(name);
-        if (ns !== undefined) {
-            if (name.slice(ns.prefix.length).split("__")[0]?.includes("*") === true)
-                return "namespace_wildcard";
+        const split = splitNamespacedName(name);
+        if (split !== undefined) {
+            if (split.peer.includes("*"))
+                return inert("namespace_wildcard");
             if (isNamespacedCoveringRuleName(name))
-                return { kind: "namespace", pattern: name };
-            return { kind: "tool", name };
+                return row({ kind: "namespace", pattern: name });
+            return row({ kind: "tool", name });
         }
-        return COARSE_SHELL_TOOLS.includes(name) ? { kind: "shell", name } : { kind: "tool", name };
+        return row(COARSE_SHELL_TOOLS.includes(name) ? { kind: "shell", name } : { kind: "tool", name });
     }
     if (name === COMMAND_RULE_TOOL) {
         const allowRead = parseRuleText(raw, behavior);
         if ("rule" in allowRead)
-            return { kind: "command", rule: ruleRowOf(allowRead.rule) };
+            return row({ kind: "command", rule: ruleRowOf(allowRead.rule) });
         if (behavior === "allow" && allowRead.reject.code === "invalid.bare_interpreter_prefix") {
             const wide = parseRuleText(raw, "deny");
             if ("rule" in wide)
-                return { kind: "command", rule: ruleRowOf({ ...wide.rule, behavior: "allow" }) };
+                return row({ kind: "command", rule: ruleRowOf({ ...wide.rule, behavior: "allow" }) });
         }
-        return "grammar";
+        return inert("grammar");
     }
     if (ruleToolGrammarOf(name) === "path") {
         const read = parseRuleText(raw, behavior);
         if ("rule" in read) {
             if (read.rule.match === "subpath" && read.rule.tool === READ_RULE_TOOL && behavior === "allow")
-                return { kind: "read_dir", rule: ruleRowOf(read.rule) };
+                return row({ kind: "read_dir", rule: ruleRowOf(read.rule) });
             if (behavior === "deny")
-                return { kind: "path", rule: ruleRowOf(read.rule) };
+                return row({ kind: "path", rule: ruleRowOf(read.rule) });
         }
-        return "path_pattern";
+        return inert("path_pattern");
     }
     if (/^domain:/.test(parsed.ruleContent))
-        return "domain";
-    return "content_unsupported";
+        return inert("domain");
+    return inert("content_unsupported");
 }
-export function compileAllowList(entries, behavior) {
+export function compileAllowEntry(raw, behavior, roster) {
+    const read = readAllowEntry(raw, behavior, roster);
+    return "compiled" in read ? read.compiled : read.inert;
+}
+export function compileAllowList(entries, behavior, roster) {
     const voided = behavior === "allow" && entries.some((e) => compileAllowEntry(e, behavior) === "wildcard_all");
     const rows = [];
     const inert = [];
     for (const entry of entries) {
-        const compiled = voided ? "wildcard_all" : compileAllowEntry(entry, behavior);
-        if (typeof compiled === "string")
-            inert.push({ entry, reason: compiled });
+        const read = voided ? { inert: "wildcard_all" } : readAllowEntry(entry, behavior, roster);
+        if ("compiled" in read)
+            rows.push({ entry, compiled: read.compiled });
         else
-            rows.push({ entry, compiled });
+            inert.push({ entry, reason: read.inert, ...read.detail });
     }
     return { rows, inert };
 }
@@ -179,11 +209,15 @@ export function allowingRows(rows, req, mode) {
 }
 export class AllowEntryTable {
     held = [];
-    seed(entries) {
-        const { rows, inert } = compileAllowList(entries, "allow");
-        for (const r of rows)
-            if (!this.held.some((h) => h.entry === r.entry))
-                this.held.push({ behavior: "allow", entry: r.entry, compiled: r.compiled });
+    heldEntries = new Set();
+    seed(entries, roster) {
+        const { rows, inert } = compileAllowList(entries, "allow", roster);
+        for (const r of rows) {
+            if (this.heldEntries.has(r.entry))
+                continue;
+            this.heldEntries.add(r.entry);
+            this.held.push({ behavior: "allow", entry: r.entry, compiled: r.compiled });
+        }
         return inert;
     }
     entries() {
@@ -198,11 +232,15 @@ export class AllowEntryTable {
         };
     }
 }
-export function seedAllowEntryTables(tables, lists) {
+export function seedAllowEntryTables(tables, lists, roster) {
     tables.request.seed(lists.inherited ?? []);
-    const requestInert = tables.request.seed(lists.request ?? []);
-    tables.deployment.seed(lists.deployment ?? []);
-    return [...lists.skillInert.map((e) => ({ source: "skill", ...e })), ...requestInert.map((e) => ({ source: "request", ...e }))];
+    const requestInert = tables.request.seed(lists.request ?? [], roster);
+    const deploymentInert = tables.deployment.seed(lists.deployment ?? [], roster).filter((e) => e.reason === "tool_name" || e.reason === "near_miss");
+    return [
+        ...lists.skillInert.map((e) => ({ source: "skill", ...e })),
+        ...requestInert.map((e) => ({ source: "request", ...e })),
+        ...deploymentInert.map((e) => ({ source: "deployment", ...e })),
+    ];
 }
 export function withDeploymentAllowedTools(deps) {
     if (deps.allowedTools === undefined)
@@ -276,6 +314,7 @@ const SHADOW_REASON = {
     rule_unreadable: "this call could not be read against a deny or ask rule, so whether one forbids it is unknown",
     ask_rule: mandateDisclosureOf(undefined),
     denial_limit_fallback: "the auto-mode classifier refused too many calls in a row, so a person decides",
+    classifier_no_ruling: "the auto-mode classifier could not judge this call, so a person decides",
     requires_user_interaction: "this tool's server declares that a call must be put to a person",
     operator_forced: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
     shell_floor: mandateDisclosureOf("operator_always"),
@@ -327,14 +366,38 @@ export function cardDisclosureOf(decision, fallbackMessage) {
 }
 export const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";
 const NOTICE_ENTRIES_SHOWN = 5;
+export function inertEntryPhrase(e) {
+    const spelling = e.currentName !== undefined ? inlineUntrusted(e.currentName, 120) : undefined;
+    const why = (() => {
+        if (e.reason === "near_miss")
+            return `near_miss: the mounted spelling is "${spelling}"`;
+        if (e.reason !== "tool_name" || e.verdict === undefined)
+            return e.reason;
+        switch (e.verdict) {
+            case "retired":
+                return `tool_name: a retired tool name${spelling !== undefined ? `, now "${spelling}"` : ""}`;
+            case "unprefixed_namespace":
+                return 'tool_name: a "__" name with no protocol prefix';
+            case "unmintable_segment":
+                return `tool_name: a peer segment the engine never mints${spelling !== undefined ? `, write "${spelling}"` : ""}`;
+            default: {
+                const exhaustive = e.verdict;
+                return exhaustive;
+            }
+        }
+    })();
+    return `${inlineUntrusted(JSON.stringify(e.entry), 122)} (${why})`;
+}
 export function allowedToolsNotGrantedNotice(inert, sessionId) {
     const where = (e) => (e.source === "skill" ? `skill ${inlineUntrusted(e.skill, 80)} ${e.list}` : e.source === "request" ? "this run's allowedTools" : "the deployment's allowedTools");
-    const shown = inert.slice(0, NOTICE_ENTRIES_SHOWN).map((e) => `${where(e)} "${inlineUntrusted(e.entry, 120)}" (${e.reason})`);
+    const shown = inert.slice(0, NOTICE_ENTRIES_SHOWN).map((e) => `${where(e)} ${inertEntryPhrase(e)}`);
     const rest = inert.length - shown.length;
+    const refusing = inert.some((e) => "list" in e && e.list === "disallowed-tools");
     return {
         code: ALLOWED_TOOL_NOT_GRANTED_CODE,
         message: `${inert.length} allowed-tools entr${inert.length === 1 ? "y grants" : "ies grant"} or refuse${inert.length === 1 ? "s" : ""} nothing — ${shown.join("; ")}${rest > 0 ? `; and ${rest} more` : ""}. ` +
-            "A list holding `*` voids the list, `mcp__*` names no server, and a write-path or domain entry has no allow reading; name the tools (or `mcp__<server>`) instead.",
+            "A list holding `*` voids the list, `mcp__*` names no server, a write-path or domain entry has no allow reading, and a tool name must be spelled as the tool is mounted; name the tools (or `mcp__<server>`) instead." +
+            (refusing ? " Such an entry in a disallowed-tools list keeps its Skill from activating: a refusal that reads as nothing is not dropped." : ""),
         detail: { ...(sessionId !== undefined ? { sessionId } : {}), entries: inert.map((e) => ({ ...e })) },
     };
 }

package/dist/core/ask-origin.d.ts

@@ -445,8 +445,11 @@ export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
  * row cell by cell, because the reference implementation judges the declaration ahead of its allow-rule lookup and its bypass release.
  * `unstated` is the mode's answer for a call nobody stated: a tool whose permission seat is `passthrough` (it states no
  * permission of its own — a remote peer's tool) reached the end of the fold with an allow no layer stated.
+ * `classifier_no_ruling` is a classifier station's question to a person because the auto-mode classification did not rule
+ * (`classifierNoRuling` — it could not run, or replied with no verdict): the denial-limit fallback's row (only a person
+ * answers it; the classifier is never asked again).
  */
-export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
+export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
 export type AskClass = (typeof ASK_CLASSES)[number];
 /** Membership test for {@link AskClass} — the word crosses the wire on `tool_end.gate.disposition`. */
 export declare function isAskClass(v: unknown): v is AskClass;
@@ -549,6 +552,13 @@ export declare const MODE_ARBITRATION: {
         readonly ruleMayClear: false;
         readonly hookAskFloor: false;
     };
+    readonly classifier_no_ruling: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
     readonly requires_user_interaction: {
         readonly bypassImmune: true;
         readonly classifierEligible: false;
@@ -725,9 +735,10 @@ export declare function classifyAsk(d: Extract<PermissionResult, {
  *  and the ask's prompt as what was requested. The gate appends the caller-side remedy. */
 export declare function headlessDenialMessage(toolName: string, askMessage: string): string;
 /** The state of the approver seat a remedy is written for: `absent` — no approver is wired for the leg; `unavailable` — one is
- *  wired and answered that nobody is reachable for this ask. Absent in the input reads as `absent` (the posture the
- *  function was written for). */
-export type HeadlessApproverSeat = "absent" | "unavailable";
+ *  wired and answered that nobody is reachable for this ask; `declared_none` — the run declared that nobody on it can be
+ *  asked (`approvalReach: "none"`), whatever is wired. Absent in the input reads as `absent` (the posture the function was
+ *  written for). */
+export type HeadlessApproverSeat = "absent" | "unavailable" | "declared_none";
 /**
  * The ONE sentence a headless auto-deny (an ask that reached its final deny because no approver is wired) adds
  * after its refusal: the caller-side change that would have let this call run. Read off the effective mode, the
@@ -741,7 +752,7 @@ export type HeadlessApproverSeat = "absent" | "unavailable";
  *  · any other releasable ask — `bypassPermissions` releases it (disclosed on the call).
  * Every arm also names the approver, in the clause of the seat's own state ({@link HeadlessApproverSeat}): none wired ⇒
  * wire one; one wired that answered `unavailable` for this ask ⇒ make a person reachable through it (a wired approver is
- * never told to be wired). The refusal's tool text and the `delegation.ask_unresolvable` notice both carry this sentence —
+ * never told to be wired); the run declared nobody can be asked ⇒ run it where a person can be, or park it. The refusal's tool text and the `delegation.ask_unresolvable` notice both carry this sentence —
  * they call this function, neither spells it.
  */
 export declare function headlessApprovalRemedy(input: {

package/dist/core/ask-origin.js

@@ -177,6 +177,7 @@ export const ASK_CLASSES = Object.freeze([
     "rule_unreadable",
     "ask_rule",
     "denial_limit_fallback",
+    "classifier_no_ruling",
     "requires_user_interaction",
     "operator_forced",
     "shell_floor",
@@ -206,6 +207,7 @@ export const MODE_ARBITRATION = {
     rule_unreadable: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     ask_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     denial_limit_fallback: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    classifier_no_ruling: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     requires_user_interaction: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     operator_forced: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
     shell_floor: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
@@ -220,7 +222,7 @@ export const MODE_ARBITRATION = {
     unstated: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: true, hookAskFloor: false },
     ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true, hookAskFloor: false },
 };
-export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
+export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
 export const RELEASABLE_ASK_CLASSES = ASK_CLASSES.filter((c) => !MODE_ARBITRATION[c].bypassImmune);
 export const MODE_RELEASE_REASONS = Object.freeze(["rule_unreadable"]);
 const MODE_RELEASE_REASON_SET = new Set(MODE_RELEASE_REASONS);
@@ -253,6 +255,8 @@ export function decisionAskClassesOf(d) {
         out.add("ask_rule");
     if (d.denialLimitFallback !== undefined)
         out.add("denial_limit_fallback");
+    if (d.classifierNoRuling !== undefined)
+        out.add("classifier_no_ruling");
     if (d.authoredBy === "deployment")
         out.add("operator_forced");
     if (d.probeMandated === true)
@@ -333,10 +337,14 @@ export function classifyAsk(d, facts) {
     return { classes, askClass, row: foldArbitrationRow(classes) };
 }
 export function headlessDenialMessage(toolName, askMessage) {
-    return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (no approver is wired for "${toolName}" — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;
+    return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (nobody can be asked to approve "${toolName}" in this run — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;
 }
 export function headlessApprovalRemedy(input) {
-    const approver = input.approverSeat === "unavailable" ? "make a person reachable through the approver that is wired (it answered `unavailable` for this ask)" : "wire an approver (`onAsk`) to put it to a person";
+    const approver = input.approverSeat === "unavailable"
+        ? "make a person reachable through the approver that is wired (it answered `unavailable` for this ask)"
+        : input.approverSeat === "declared_none"
+            ? 'run it where a person can be asked — this run declares `approvalReach: "none"` (nobody on it can be asked) — or arm a durable approval park so the ask waits for a person'
+            : "wire an approver (`onAsk`) to put it to a person";
     const c = input.classification;
     if (input.mode === "acceptEdits" && input.unplacedOptions !== undefined && (c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"))))
         return `${fileCommandOptionsSentence(input.unplacedOptions.program)} Spell the ${input.unplacedOptions.program} without option words for the mode to answer it, or ${approver}`;

package/dist/core/ask-unresolvable-notice.d.ts

@@ -5,8 +5,9 @@
  *  · `approver_unavailable` — the approver consulted for the call (the run's own seat, or an ancestor's
  *    frozen seat on a delegated child) answered the ROUTING question `unavailable` and no durable park
  *    took the call afterwards (`tool_end.gate.settlement.kind:"approver_unavailable"`);
- *  · `no_approver_wired` — no approver (or, for a question, no question face) is wired for this run, or
- *    the seat is the deny posture string: the headless auto-deny (`settlement.kind:"no_approver"`);
+ *  · `no_approver_wired` — nobody in this run can be asked: no approver (or, for a question, no question face) is
+ *    wired, the seat is the deny posture string, or the run declared that nobody on it can be asked
+ *    (`approvalReach: "none"`): the headless auto-deny (`settlement.kind:"no_approver"`);
  *  · `mandate_unreconstructible` — an inherited durable-approval mandate binds the ask and THIS leg has no
  *    park facility to honor it, so the delegated child refuses in-fold rather than let a synchronous layer
  *    resolve what its ancestor bound to a park (an in-fold deny; no settlement rides the frame).

package/dist/core/ask-unresolvable-notice.js

@@ -6,7 +6,7 @@ export function isAskUnresolvableCause(v) {
 }
 const CAUSE_CLAUSE = {
     approver_unavailable: "the approver reported that nobody is reachable for this ask",
-    no_approver_wired: "no approver (or question face) is wired for this run — the headless posture",
+    no_approver_wired: "nobody in this run can be asked to answer it — the headless posture",
     mandate_unreconstructible: "an inherited durable-approval mandate binds this ask and this leg has no park facility to honor it",
 };
 const CAUSE_REMEDY_SEAT = {

package/dist/core/auto-mode.d.ts

@@ -166,11 +166,12 @@ export declare function rungDidNotRule(v: AutoModeVerdict): AutoModeFallbackCaus
  */
 export declare function classifierUnavailableDenyMessage(toolName: string, cause: AutoModeUnavailableCause, attribution?: AutoModeClassifierRound): string;
 /**
- * The text an ask carries to a person when the classifier could not rule on it and the leg has an approval seat
- * (the gate's classifier station and the inherited station): the ask's own text first — the card still says what
- * is being asked — then why auto mode is asking at all. One writer for both stations.
+ * The text an ask carries to a person when the classifier did not rule on it ({@link rungDidNotRule}) and the leg has an
+ * approval seat (the gate's classifier station and the inherited station): the ask's own text first — the card still
+ * says what is being asked — then why auto mode is asking at all, read off the same cause the ask's `classifierNoRuling`
+ * member carries (a client that does not read the member reads this). One writer for both stations.
  */
-export declare function classifierUnavailableAskMessage(askText: string, cause: AutoModeUnavailableCause): string;
+export declare function classifierNoRulingAskMessage(askText: string, cause: AutoModeFallbackCause): string;
 /**
  * The model-facing deny text for a `parse_error` verdict — CC 2.1.259 `i7t` stem ("Auto mode could not evaluate
  * this action and is blocking it for safety"; 2.1.250 `Ure`): the classifier answered, but not with a verdict,

package/dist/core/auto-mode.js

@@ -84,7 +84,9 @@ export function classifierUnavailableDenyMessage(toolName, cause, attribution) {
         "If it keeps failing, continue with other tasks that don't require this action and come back to it later. " +
         "Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.");
 }
-export function classifierUnavailableAskMessage(askText, cause) {
+export function classifierNoRulingAskMessage(askText, cause) {
+    if (cause === "parse_error")
+        return `${askText}\n\nThe auto-mode classifier replied without a verdict, so auto mode could not judge this call; it needs an approval instead of the classifier's verdict.`;
     const parenthetical = cause === "timeout" ? " (timed out)" : "";
     return `${askText}\n\nThe auto-mode classifier is temporarily unavailable${parenthetical}, so auto mode could not judge this call; it needs an approval instead of the classifier's verdict.`;
 }

package/dist/core/checkpoint-store.d.ts

@@ -816,6 +816,8 @@ export type PendingAction = {
      *  its settlement never reads as the fallback's auto-deny (see `tool_end.autoDenied`). A durable
      *  card renders the counts and the limit; it has no countdown to render. Echo-only. */
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** (additive) The PARK twin of `AskRequest.classifierNoRuling`, written only as a member of its closed set. Display metadata. */
+    classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     /** (additive, same precedent) — the PARK twin of `AskRequest.origin`: WHICH AUTHORITY raised the
      *  parked ask, one word from the closed {@link import("./ask-origin.js").AskOrigin} set, the same
      *  word the synchronous card is rendered by (engine-stamped at the gate, never a policy's claim).
@@ -843,6 +845,8 @@ export type PendingAction = {
     boundInputHash: string;
     /** A parked `Skill` call's binding to its card — the skill's name and its two lists ({@link import("./skill-grant.js").skillGrantDigest}, judged by {@link import("./skill-grant.js").parkedSkillApprovalRefusal}); only that row carries it. */
     boundGrantDigest?: string;
+    /** The value {@link boundGrantDigest} hashes — the card's twin of `AskRequest.boundGrants`, minted by the same factory; written exactly when the digest is. Display metadata (additive, no version bump): the resume judges the digest alone. */
+    boundGrants?: import("./skill-grant-binding.js").BoundSkillGrants;
     /**
      * design/388 §2.5 boundary ② (B18; additive — no checkpoint-version bump, the `previewWithheld`
      * precedent: an optional group an older reader ignores): the IDENTITY of the row the park minted
@@ -1955,6 +1959,12 @@ export interface CheckpointSummary {
      *  the row to learn them (`autoDenyAfterMs` is `0` on every row — see the row member). Pure echo;
      *  OMITTED when the row carries none. */
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** The row's `PendingAction.tool_approval.classifierNoRuling`, echoed ONLY as a member of its closed set (else omitted). */
+    classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
+    /** The row's `boundGrantDigest`, echoed (a string; else omitted): the hash of {@link boundGrants}. ECHO-ONLY. */
+    boundGrantDigest?: string;
+    /** The row's `boundGrants` — a fresh copy of the skill and its two lists, published only when it hashes to {@link boundGrantDigest} (never a list beside a digest that binds another). Deployment text: render with contextual escaping. ECHO-ONLY. */
+    boundGrants?: import("./skill-grant-binding.js").BoundSkillGrants;
     /** The row's `PendingAction.tool_approval.origin`, projected for the same one-call reason: a card
      *  rendered by the ask's origin word must not re-open the row to learn it. Echoed ONLY when the stored
      *  value is a member of the closed set ({@link import("./ask-origin.js").isAskOrigin}) — a bad value
@@ -2034,14 +2044,15 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  *  fabricated "open" still needs the LIVE resolution to say open too. */
  | "write_face_damaged" | "skill_grants_damaged" | "constraint_chain_missing";
 /**
- * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the four
- * words prepare's mode, output-style and recorded-mode doors throw, held unchanged so one refusal reads the same on a fresh
- * run (`TaskResult.errorCode`) and on a resume (this member). `config.spec_retired_key`: a retired spec key is present;
- * `config.output_style_invalid`: the output-style seat is malformed; `config.permission_mode_invalid`: a mode word is outside
- * the closed set (the config's `permissionMode`, or a mode the row recorded); `config.shell_gate_value_retired`: the shell
- * floor is a retired doctrine word.
+ * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the seven
+ * words prepare's mode, output-style, approval-reach, invoked-skill and recorded-mode doors throw, held unchanged so one refusal
+ * reads the same on a fresh run (`TaskResult.errorCode`) and on a resume. `config.spec_retired_key`: a retired spec key;
+ * `config.output_style_invalid`: a malformed output-style seat; `config.permission_mode_invalid`: a mode word outside the closed
+ * set (the config's `permissionMode`, or one the row recorded); `config.shell_gate_value_retired`: a retired shell-floor word;
+ * `config.approval_reach_invalid`: an `approvalReach` outside its set; `config.user_invoked_skill_unknown` / `skill_deny_unreadable`:
+ * `userInvokedSkills` names a skill the config does not carry / one whose `disallowed-tools` entry the grammar reads as nothing.
  */
-export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired"];
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable"];
 export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
 export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */

package/dist/core/checkpoint-store.js

@@ -2,8 +2,9 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, PROBE_REASON_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
-import { readDenialLimitFallback } from "./auto-mode.js";
+import { isAutoModeFallbackCause, readDenialLimitFallback } from "./auto-mode.js";
 import { isAskOrigin, isPersistedRuleMandate } from "./ask-origin.js";
+import { readBoundBinding } from "./skill-grant-binding.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
@@ -309,12 +310,14 @@ export function summarizeCheckpoint(cp) {
         ...(() => {
             const origin = tool?.origin;
             const mandate = tool?.mandate;
-            return { ...(isAskOrigin(origin) ? { origin } : {}), ...(isPersistedRuleMandate(mandate) ? { mandate } : {}) };
+            const why = tool?.classifierNoRuling;
+            return { ...(isAskOrigin(origin) ? { origin } : {}), ...(isPersistedRuleMandate(mandate) ? { mandate } : {}), ...(isAutoModeFallbackCause(why) ? { classifierNoRuling: why } : {}) };
         })(),
+        ...readBoundBinding(tool),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;

package/dist/core/child-clamp-seats.d.ts

@@ -28,7 +28,7 @@ import type { TaskSpec } from "./types.js";
  * The clamp seats, as string literals (the closed set the scan and the wire-manifest reader both parse —
  * a spread or an identifier here reads as an empty set).
  */
-export declare const CHILD_CLAMP_SEATS: readonly ["handsReadOnly", "interactiveTools", "readFace", "writeFace", "readDenyPatterns"];
+export declare const CHILD_CLAMP_SEATS: readonly ["handsReadOnly", "interactiveTools", "approvalReach", "readFace", "writeFace", "readDenyPatterns"];
 /** One clamp seat's name. */
 export type ChildClampSeat = (typeof CHILD_CLAMP_SEATS)[number];
 /**
@@ -58,6 +58,8 @@ export interface ChildClampSource {
     handsReadOnly: boolean | undefined;
     /** The hard-headless clamp: only `false` travels. */
     interactiveTools: boolean | undefined;
+    /** The declaration that nobody on the run can be asked to approve: only `"none"` travels. */
+    approvalReach: TaskSpec["approvalReach"] | undefined;
     /** The read containment face: only `"roots"` travels. */
     readFace: TaskSpec["readFace"] | undefined;
     /** The write containment face: only `"roots"` travels. */
@@ -77,6 +79,18 @@ export interface ChildClampSource {
  * — so a clamp can never end one level deep, and a new seat cannot reach some constructors and not others.
  */
 export declare function childClampSeats(source: ChildClampSource): Partial<TaskSpec>;
+/**
+ * The interaction posture a leg keeps under the clamps it inherited: `"interactive"` promises a person on the leg, and a
+ * leg that inherited the hard-headless clamp (`interactiveTools: false`) or the declaration that nobody can be asked
+ * (`approvalReach: "none"`) cannot keep that promise — the clamp is the tightening value, so the posture becomes
+ * `"headless"` (stated, so the leg's own resolution does not fall through to a deployment default of `"interactive"`);
+ * every other posture is returned as it is. Read where an inherited posture meets inherited clamps: the workflow lane
+ * (a baseline's posture beside the host's clamps) and the revival fold (the spawn's posture beside the waker's clamps).
+ */
+export declare function postureUnderClamps(posture: "interactive" | "headless" | undefined, clamps: {
+    readonly interactiveTools: boolean | undefined;
+    readonly approvalReach: TaskSpec["approvalReach"] | undefined;
+}): "interactive" | "headless" | undefined;
 /**
  * The OWN posture of an engine-built leg that never asks the person (the observer sidecar, the verifier): no
  * human-facing tool is mounted AND the leg declares itself headless. Both, always together — the spec's posture

package/dist/core/child-clamp-seats.js

@@ -1,9 +1,9 @@
-export const CHILD_CLAMP_SEATS = Object.freeze(["handsReadOnly", "interactiveTools", "readFace", "writeFace", "readDenyPatterns"]);
+export const CHILD_CLAMP_SEATS = Object.freeze(["handsReadOnly", "interactiveTools", "approvalReach", "readFace", "writeFace", "readDenyPatterns"]);
 export const CHILD_CLAMP_SEATS_NOT_CARRIED = Object.freeze({
     toolPolicy: "not a clamp a child spec copies: a parent's denies reach its children through the ancestor-constraint chain the child's own prepare folds, not by putting the parent's policy object on the child seat",
     shellGate: "travels on the inherited-gate lane (`InheritedGate.shellGate`, a trusted internals seat), not on the child spec — a spec-level copy would be a second source for the same clamp",
     permissionMode: "travels on the inherited-gate lane (`InheritedGate.permissionMode` / `permissionModeCeiling` — the parent's declared word and its LIVE seat): a child with no word of its own inherits that ceiling on every read, and a word it does declare is clamped under it; a spec-level copy would freeze the parent's word at spawn and be a second source for the same clamp",
-    onAsk: "per-lane by construction: the delegation lane wraps the parent's approver with spawn provenance before it becomes the child's seat, and a lane with no approver must hand down none",
+    onAsk: "per-lane by construction: the delegation lane wraps the parent's approver with spawn provenance before it becomes the child's seat, and a lane with no approver must hand down none (a parent that declared nobody can be asked hands down no approver — its frozen seat is empty — and the declaration rides `approvalReach`)",
     hooks: "a deployment seat, not an inherited clamp — `tightenTaskSpec` refuses to merge two hook sets rather than composing them, so there is no tightening value to carry",
     excludeTools: "roster control rather than containment: the lanes that copy a parent's roster do so beside these seats, and the workflow lane authors its child roster from the governance baseline instead of the host's",
     deferTools: "roster control, same reading as `excludeTools` above",
@@ -21,6 +21,7 @@ export function childClampSeats(source) {
     return {
         ...(source.handsReadOnly === true ? { handsReadOnly: true } : {}),
         ...(source.interactiveTools === false ? { interactiveTools: false } : {}),
+        ...(source.approvalReach === "none" ? { approvalReach: "none" } : {}),
         ...(source.readFace === "roots" ? { readFace: "roots" } : {}),
         ...(source.writeFace === "roots" ? { writeFace: "roots" } : {}),
         ...(source.readDenyPatterns !== undefined && source.readDenyPatterns.length > 0
@@ -28,6 +29,9 @@ export function childClampSeats(source) {
             : {}),
     };
 }
+export function postureUnderClamps(posture, clamps) {
+    return posture === "interactive" && (clamps.interactiveTools === false || clamps.approvalReach === "none") ? "headless" : posture;
+}
 export function engineHeadlessLegSeats() {
     return { interactiveTools: false, interactionPosture: "headless" };
 }