@sema-agent/core 7.42.1 → 7.43.0

package/dist/core/classifier-unavailable-arm.d.ts

@@ -1,30 +1,31 @@
 /**
- * The ONE exit for an auto-mode classification that could not RULE (`unavailable`: the classifier leg failed, or its
- * per-level budget ran out) — shared by both classifier stations, the leg's gate and an ancestor's frozen classifier
- * in the policy fold, so the rule is written once.
+ * The ONE exit for an auto-mode classification that did not RULE ({@link rungDidNotRule}: the classifier leg failed or its
+ * budget ran out — `error` / `timeout` — or it replied with no verdict at all — `parse_error`) — shared by both classifier
+ * stations, the leg's gate and an ancestor's frozen classifier in the policy fold, so the rule is written once.
  *
- * ONE fork, on the APPROVAL SEAT (does an ask this station hands on reach a person — a live approver, or a durable
- * park): with one, the ask goes on, its text saying why auto mode is asking, and a person decides; without one, the
- * call is refused with CC's `x1t` sentence and the classification's FORM (`unavailable`) is attested on the deny. The seat is
- * the only input to the fork — not the cause, not the mode. The handed-on ask carries `requiresRealApproval`: no
- * automatic lane may answer it in the classifier's stead — not a blanket `onAsk:"allow"`, not the sandbox admission, not a
- * budget resolver over its park (the park mints the non-budgetable kind). CC refuses either way; asking where a person can be
- * asked is a declared departure (a classifier that is slow or down must not turn an attended session into a string
- * of refusals). Neither arm is a block: the denial limit counts classifier RULINGS, and a person's refusal of the
- * handed-on ask is a person's, not the classifier's.
+ * ONE fork, on the APPROVAL SEAT (does an ask this station hands on reach a person — a live approver, or a durable park):
+ * with one, the ask goes on carrying why (`classifierNoRuling`, its text saying it too), and a person decides — never
+ * counted (a person's refusal of it is a person's); without one, an unavailable classification is refused with CC's `x1t`
+ * sentence (its FORM, `unavailable`, attested on the deny) and is never counted, while a reply with no verdict goes back to
+ * the station's ruling path (`counted`): refused with its own sentence and counted on the denial limit, so the bound falls
+ * back to a person (CC: `Cr` excludes unavailable; failureMode is counted). The handed-on ask carries `requiresRealApproval`:
+ * no automatic lane may answer it in the classifier's stead — not a blanket `onAsk:"allow"`, not the sandbox admission, not a
+ * budget resolver over its park. Asking where a person can be asked is a declared departure (CC refuses).
  *
  * The observer hears every such classification with where the call went, except while the call is being aborted — a halt,
- * or the run's end (the classifier did not fail; the call ended). It is observe-only: a throw never changes the arm.
+ * or the run's end. It is observe-only: a throw never changes the arm.
  */
-import { type AutoModeClassifierRound, type AutoModeUnavailableCause } from "./auto-mode.js";
-import { type PermissionResult, type ToolCallRequest } from "./tool-policy.js";
-/** Where an `unavailable` classification sent the call: `asked` = on to the approval seat, `denied` = refused. */
+import { type AutoModeClassifierRound, type AutoModeDenialTracker, type AutoModeFallbackCause, type UnarmedDenialLimitFallback } from "./auto-mode.js";
+import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "./tool-policy.js";
+/** Where a classification that did not rule sent the call: `asked` = on to the approval seat, `denied` = refused. */
 export type ClassifierUnavailableDisposition = "asked" | "denied";
-/** What the stations' observer receives — the facts the `classifier.unavailable` notice is composed from. */
+/** What the stations' observer receives — the facts the `classifier.unavailable` notice is composed from. `cause` is why
+ *  the classification did not rule ({@link AutoModeFallbackCause}: `error` / `timeout`, or `parse_error` for a reply with no
+ *  verdict). */
 export interface ClassifierUnavailableInfo {
     toolName: string;
     toolCallId: string;
-    cause: AutoModeUnavailableCause;
+    cause: AutoModeFallbackCause;
     disposition: ClassifierUnavailableDisposition;
 }
 export type ClassifierUnavailableObserver = (info: ClassifierUnavailableInfo) => void;
@@ -34,24 +35,42 @@ export interface ClassifierUnavailableSeat {
     approvalSeat?: boolean;
     onUnavailable?: ClassifierUnavailableObserver;
 }
-/** The arm the fork chose: the ask to hand on, or the refusal. */
-export type ClassifierUnavailableArm<A> = {
+/** The arm the fork chose: the ask to hand on, the refusal, or — a reply with no verdict and no seat — the station's own
+ *  counted ruling path. */
+export type ClassifierNoRulingArm<A> = {
     kind: "asked";
     ask: A;
 } | {
     kind: "denied";
     deny: PermissionResult;
+} | {
+    kind: "counted";
 };
-export declare function classifierUnavailableArm<A extends Extract<PermissionResult, {
+export declare function classifierNoRulingArm<A extends Extract<PermissionResult, {
     action: "ask";
 }>>(args: {
     ask: A;
     req: ToolCallRequest;
-    cause: AutoModeUnavailableCause;
+    cause: AutoModeFallbackCause;
     /** The ladder's attribution, for the refusal's sentence (it names both rungs when the ladder moved). */
     attribution?: AutoModeClassifierRound;
     seat: ClassifierUnavailableSeat | undefined;
     /** The call is being aborted (its per-call signal — a halt, or the run's end): the observer is not told (the arm is chosen
      *  as ever). */
     aborted: boolean;
-}): ClassifierUnavailableArm<A>;
+}): ClassifierNoRulingArm<A>;
+/**
+ * The no-ruling card's settlement (both stations): a card THIS station's no-ruling arm handed on for this call (`mintedHere` —
+ * a policy's own `classifierNoRuling`, or a card another station minted, is not this station's classification and counts
+ * nothing here) that the seat's deployment POLICY refused (settlement `policy_refused` — a machine settled it, not a person)
+ * counts on the denial limit like a ruling refusal, because "handed to a person" means a person settled it. Returns the fallback the count minted when it reached the
+ * bound — the station then puts the same call to the same seat as the denial-limit fallback, and a deny nobody judged there
+ * stops the run through the existing headless arm. A person's answer (allow or refusal), a fallback card, and every other
+ * settlement count nothing.
+ */
+export declare function settleNoRulingAsk(opts: {
+    ask: PermissionResult;
+    mintedHere: boolean;
+    resolved: Pick<ResolvedAsk, "action" | "settlement">;
+    tracker: AutoModeDenialTracker | undefined;
+}): UnarmedDenialLimitFallback | undefined;

package/dist/core/classifier-unavailable-arm.js

@@ -1,6 +1,6 @@
-import { classifierUnavailableAskMessage, classifierUnavailableDenyMessage } from "./auto-mode.js";
+import { classifierNoRulingAskMessage, classifierUnavailableDenyMessage } from "./auto-mode.js";
 import { attestClassifierDenyCause, carryEngineAttestations } from "./tool-policy.js";
-export function classifierUnavailableArm(args) {
+export function classifierNoRulingArm(args) {
     const { ask, req, cause } = args;
     const seated = args.seat?.approvalSeat === true;
     if (!args.aborted) {
@@ -11,7 +11,18 @@ export function classifierUnavailableArm(args) {
         }
     }
     if (seated)
-        return { kind: "asked", ask: carryEngineAttestations(ask, { ...ask, message: classifierUnavailableAskMessage(ask.message ?? `approval required for "${req.toolName}"`, cause), requiresRealApproval: true }) };
+        return { kind: "asked", ask: carryEngineAttestations(ask, { ...ask, message: classifierNoRulingAskMessage(ask.message ?? `approval required for "${req.toolName}"`, cause), requiresRealApproval: true, classifierNoRuling: cause }) };
+    if (cause === "parse_error")
+        return { kind: "counted" };
     const deny = { action: "deny", message: classifierUnavailableDenyMessage(req.toolName, cause, args.attribution), decisionReason: "classifier" };
     return { kind: "denied", deny: attestClassifierDenyCause(deny, "unavailable", req) };
 }
+export function settleNoRulingAsk(opts) {
+    const { ask, resolved } = opts;
+    if (!opts.mintedHere || ask.action !== "ask" || ask.classifierNoRuling === undefined || ask.denialLimitFallback !== undefined)
+        return undefined;
+    if (resolved.action !== "deny" || resolved.settlement?.kind !== "policy_refused")
+        return undefined;
+    const tracked = opts.tracker?.recordBlock();
+    return tracked?.limitReached === true ? tracked.fallback : undefined;
+}

package/dist/core/decision-receipt.js

@@ -1,5 +1,6 @@
 import { types } from "node:util";
 import { ASK_CLASSES, ASK_ORIGINS, isAskClass, isAskOrigin, isPersistedRuleMandate, PERSISTED_RULE_MANDATES } from "./ask-origin.js";
+import { AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause } from "./auto-mode.js";
 import { thrownText } from "./thrown-value.js";
 const ENGINE_REFUSALS = new WeakSet();
 export const refusedOutOfContract = (message) => {
@@ -28,6 +29,7 @@ const CLOSED_MEMBERS = [
     { member: "guard", words: GUARDS, has: memberOf(GUARDS) },
     { member: "ruleUnreadable", words: RULE_UNREADABLE_WORDS, has: memberOf(RULE_UNREADABLE_WORDS) },
     { member: "authoredBy", words: AUTHORED_BY_WORDS, has: memberOf(AUTHORED_BY_WORDS) },
+    { member: "classifierNoRuling", words: AUTO_MODE_FALLBACK_CAUSES, has: isAutoModeFallbackCause },
     { member: "requiresRealApproval", words: [true, false], has: (v) => v === true || v === false },
     { member: "probeMandated", words: [true], has: (v) => v === true },
     { member: "mandated", words: [true], has: (v) => v === true },

package/dist/core/gate-lanes.js

@@ -1,7 +1,7 @@
 import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
 import { arbitrateByMode, classifyAsk, fileCommandOptionsSentence, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
-import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
-import { classifierUnavailableArm } from "./classifier-unavailable-arm.js";
+import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, rungDidNotRule, unarmedWindow } from "./auto-mode.js";
+import { classifierNoRulingArm, settleNoRulingAsk } from "./classifier-unavailable-arm.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "./gate-outcome.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
@@ -228,6 +228,12 @@ export async function runGateLanes(pass) {
             pass.decision = shadows.length > 0 ? { ...standing, allowRuleShadowed: shadows } : standing;
         }
         const originFacts = askOriginFacts(orgAnswer.org, ruleCallUnreadableOf(laneAnswer));
+        let noRulingMinted = false;
+        const fallbackAskOf = (standingAsk, fallback, latestBlockedAction) => {
+            const { classifierNoRuling: _why, ...standing } = standingAsk;
+            const fallbackAsk = { ...standing, message: denialLimitFallbackMessage(fallback, latestBlockedAction), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };
+            return stampAskOrigin(fallbackAsk, originFacts, classifyStanding(fallbackAsk, originFacts));
+        };
         if (pass.decision.action === "ask") {
             const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
             pass.decision = stampAskOrigin(stamped, originFacts, classifyStanding(stamped, originFacts));
@@ -271,36 +277,31 @@ export async function runGateLanes(pass) {
                     ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}),
                 };
             }
-            else if (verdict?.kind === "unavailable") {
-                const arm = classifierUnavailableArm({ ask: pass.decision, req: pass.req, cause: verdict.cause, attribution: verdict.classifier, seat: input.autoMode.unavailable, aborted: classifySignal?.aborted === true });
-                if (arm.kind === "asked") {
+            else if (verdict !== undefined) {
+                const noRuling = rungDidNotRule(verdict);
+                const arm = noRuling !== undefined ? classifierNoRulingArm({ ask: pass.decision, req: pass.req, cause: noRuling, attribution: verdict.classifier, seat: input.autoMode.unavailable, aborted: classifySignal?.aborted === true }) : undefined;
+                if (arm?.kind === "asked") {
+                    noRulingMinted = true;
                     pass.decision = stampAskOrigin(arm.ask, originFacts, classifyStanding(arm.ask, originFacts));
                     pass.classifierRound = undefined;
                 }
-                else
+                else if (arm?.kind === "denied")
                     pass.decision = arm.deny;
-            }
-            else if (verdict !== undefined) {
-                const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
-                const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
-                const tracked = input.autoMode.denialTracking?.recordBlock();
-                if (tracked?.limitReached === true) {
-                    const fallbackAsk = {
-                        ...pass.decision,
-                        message: denialLimitFallbackMessage(tracked.fallback, reason || category || toolName),
-                        decisionReason: "classifier",
-                        requiresRealApproval: true,
-                        denialLimitFallback: tracked.fallback,
-                    };
-                    pass.decision = stampAskOrigin(fallbackAsk, originFacts, classifyStanding(fallbackAsk, originFacts));
-                }
                 else {
-                    const denied = {
-                        action: "deny",
-                        message: verdict.kind === "block" ? `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : reason,
-                        decisionReason: "classifier",
-                    };
-                    pass.decision = verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", pass.req) : denied;
+                    const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
+                    const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
+                    const tracked = input.autoMode.denialTracking?.recordBlock();
+                    if (tracked?.limitReached === true) {
+                        pass.decision = fallbackAskOf(pass.decision, tracked.fallback, reason || category || toolName);
+                    }
+                    else {
+                        const denied = {
+                            action: "deny",
+                            message: verdict.kind === "block" ? `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : reason,
+                            decisionReason: "classifier",
+                        };
+                        pass.decision = verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", pass.req) : denied;
+                    }
                 }
             }
             if (pass.decision.action === "deny") {
@@ -389,6 +390,7 @@ export async function runGateLanes(pass) {
         const carryOf = (d) => ({
             ...(callSignal !== undefined ? { signal: callSignal } : {}),
             ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
+            ...(d.action === "ask" && d.classifierNoRuling !== undefined ? { classifierNoRuling: d.classifierNoRuling } : {}),
             ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
             ...(d.action === "ask" && d.askClass !== undefined && d.classes !== undefined ? { askClass: d.askClass, classes: d.classes } : {}),
             ...(d.action === "ask" && d.mandated === true ? { mandated: true, ...(d.mandate !== undefined ? { mandate: d.mandate } : {}) } : {}),
@@ -444,8 +446,14 @@ export async function runGateLanes(pass) {
             }
         }
         if (pass.decision.action === "ask") {
-            const askBeforeResolve = pass.decision;
-            const resolved = await (callSignal !== undefined ? resolveAsk(pass.decision, pass.req, callSignal) : resolveAsk(pass.decision, pass.req));
+            let askBeforeResolve = pass.decision;
+            const resolveOnce = (d) => (callSignal !== undefined ? resolveAsk(d, pass.req, callSignal) : resolveAsk(d, pass.req));
+            let resolved = await resolveOnce(askBeforeResolve);
+            const refallback = settleNoRulingAsk({ ask: askBeforeResolve, mintedHere: noRulingMinted, resolved, tracker: input.autoMode?.denialTracking });
+            if (refallback !== undefined && askBeforeResolve.action === "ask") {
+                askBeforeResolve = fallbackAskOf(askBeforeResolve, refallback, toolName);
+                resolved = await resolveOnce(askBeforeResolve);
+            }
             ledger.fromResolved(resolved, askBeforeResolve, toolName);
             if (resolved.action === "deny")
                 pass.deniedBy = "ask_resolution";

package/dist/core/hooks.d.ts

@@ -7,7 +7,7 @@ export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./rule-lane-
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
 import { type PermissionMode } from "./ask-origin.js";
-import type { AutoModeDenialTracker } from "./auto-mode.js";
+import { type AutoModeDenialTracker } from "./auto-mode.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
 import { type SafeNotifier } from "./safe-notify.js";
@@ -1464,6 +1464,8 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
      * `autoMode` presence alone as the arming fact.
      */
     permissionMode?: () => import("./ask-origin.js").PermissionMode;
+    /** The leg's approval-seat form (`WiringManifest.ask.form`): the deny exit's way-out clause names a declaration, never a missing approver. */
+    askSeatForm?: import("./wiring-manifest.js").AskSeamForm;
     /** WHO put the tool's egress / irreversibility marks on the seat ({@link import("./ask-origin.js").ToolMarkSource});
      *  absent or empty with a mark present reads as the deployment's own (fail-closed: an operator's mandate). */
     toolMarkSources?: ReadonlySet<import("./ask-origin.js").ToolMarkSource>;
@@ -1764,6 +1766,8 @@ export interface AskCarry {
      *  the `0` a park row shows is written. Persisted on the row so a durable card shows the counts the
      *  synchronous card shows. Absent then means: not a fallback ask. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** The surviving ask's no-ruling member ({@link import("./tool-policy.js").AskRequest.classifierNoRuling}), for the row's twin. */
+    readonly classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     /** The surviving ask's engine-stamped origin word ({@link import("./ask-origin.js").AskOrigin}), persisted
      *  on the row so a durable card is rendered by the same word the synchronous card is. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
@@ -1788,6 +1792,7 @@ export interface AskCarry {
  *  the same screen the summary applies to the word). */
 export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     origin?: import("./ask-origin.js").AskOrigin;
     askClass?: import("./ask-origin.js").AskClass;
     classes?: readonly import("./ask-origin.js").AskClass[];

package/dist/core/hooks.js

@@ -8,6 +8,7 @@ export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./rule-lane-
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { isAskOrigin, screenAskClassMembers } from "./ask-origin.js";
+import { isAutoModeFallbackCause } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -242,9 +243,11 @@ export function askCarryRowMembers(carry) {
     if (carry === undefined)
         return {};
     const origin = carry.origin;
+    const why = carry.classifierNoRuling;
     const classed = screenAskClassMembers(carry.askClass, carry.classes);
     return {
         ...(carry.denialLimitFallback !== undefined ? { denialLimitFallback: { ...carry.denialLimitFallback } } : {}),
+        ...(isAutoModeFallbackCause(why) ? { classifierNoRuling: why } : {}),
         ...(isAskOrigin(origin) ? { origin } : {}),
         ...(classed !== undefined ? classed : {}),
     };

package/dist/core/mode-policy.d.ts

@@ -163,17 +163,18 @@ export declare function modeRequestAfterResume(seat: PermissionMode | undefined,
 export declare function refusePermissionModeDoors(spec: Pick<TaskSpec, "permissionMode" | "shellGate">): PermissionMode | undefined;
 /**
  * The doors a RESUMED leg's prepare refuses at, read as one screen for the resume ladder to run BEFORE the claim: the mode
- * doors on the re-supplied config ({@link refusePermissionModeDoors}), its output-style seat (`resolveOutputStyleFrame`) and
- * the mode words the checkpoint row recorded (`recordedModeSeed`) — prepare's own functions, so the refusal carries the very
+ * doors on the re-supplied config ({@link refusePermissionModeDoors}), its output-style seat (`resolveOutputStyleFrame`), its
+ * approval-reach declaration (`screenApprovalReach`), the skills it invokes by name (`screenUserInvokedSkills` — the part no
+ * roster changes; a name the leg's roster reads as nothing is prepare's) and the mode words the checkpoint row recorded (`recordedModeSeed`) — prepare's own functions, so the refusal carries the very
  * sentence and code prepare would throw. It leaves by the resume's ONE refusal channel, `CheckpointError`
  * `checkpoint.config_refused` (`message` = prepare's sentence, `detail.code` = prepare's code, `detail.field` = the input that
  * carries it: `"taskConfig"` or `"inheritedGate"`), where prepare itself would end the run `failed` after the claim — a
  * refusal there consumes the row and reopens it as a system retry that replays the recorded decision, which a CONFIG
  * correction cannot reach. Before the claim the row stays `pending` and byte-identical, and the same token is redeemable by a
- * corrected resume. A throw that is not one of prepare's four codes (a caller's accessor failing) is not a refusal and leaves
+ * corrected resume. A throw that is not one of prepare's five codes (a caller's accessor failing) is not a refusal and leaves
  * as it was thrown.
  */
-export declare function refuseResumeDoors(config: Pick<TaskSpec, "permissionMode" | "shellGate" | "outputStyle">, recordedGate: Parameters<typeof recordedModeSeed>[0]): void;
+export declare function refuseResumeDoors(config: Pick<TaskSpec, "permissionMode" | "shellGate" | "outputStyle" | "approvalReach" | "skills" | "userInvokedSkills">, recordedGate: Parameters<typeof recordedModeSeed>[0]): void;
 /** The three-member answer every mode question gets — the manifest member, the steer verb's return value and the
  *  fold notice's detail share it. `requested` is absent when the caller declared nothing (a root inherits `default`,
  *  a child inherits its parent). */

package/dist/core/mode-policy.js

@@ -9,6 +9,8 @@ import { createSafeNotifier } from "./safe-notify.js";
 import { assertNoRetiredKeys, RETIRED_TASK_SPEC_KEYS } from "./retired-keys.js";
 import { resolveOutputStyleFrame } from "./output-style.js";
 import { CheckpointError, isCheckpointConfigRefusalCode, recordedModeSeed } from "./checkpoint-store.js";
+import { screenApprovalReach } from "./wiring-manifest.js";
+import { screenUserInvokedSkills } from "./skill-grant.js";
 export const PERMISSION_MODE_FOLD_REASONS = Object.freeze(["operator_deny", "face_absent", "inherited_ceiling"]);
 export const ACCEPT_EDITS_FILE_COMMANDS = Object.freeze(["mkdir", "touch", "rm", "rmdir", "mv", "cp", "sed"]);
 const MODE_POLICY_TABLE = {
@@ -112,6 +114,8 @@ export function refuseResumeDoors(config, recordedGate) {
     screenAs("taskConfig", () => {
         refusePermissionModeDoors(config);
         resolveOutputStyleFrame(config.outputStyle);
+        screenApprovalReach(config.approvalReach);
+        screenUserInvokedSkills(config);
     });
     screenAs("inheritedGate", () => void recordedModeSeed(recordedGate));
 }

package/dist/core/permission-rule-consent.d.ts

@@ -282,9 +282,10 @@ export declare function prepareCardApproval(opts: {
     principal?: string;
     /** design/182 §4.5 (additive): the structural owner — only the local-owner path needs it. */
     owner?: RuleOwner;
-    /** The tool whose ask this card belongs to. Only the shell tool the rule lane speaks for is accepted. */
+    /** The tool whose ask this card belongs to. Only the shell tool the rule lane speaks for and the name tools (the skill-activation
+     *  card) are accepted. */
     toolName: string;
-    /** The command as adjudicated — the same bytes the ask carried. */
+    /** The command as adjudicated — the same bytes the ask carried; for a name tool (`Skill`), the name its call carried (`args.skill`). */
     command: string;
     /** The ask's call id and argument digest, recorded for reconciliation. */
     toolCallId?: string;

package/dist/core/permission-rule-consent.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { escapeForDisclosure, hasUnrenderableCharacters, parseRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, segmentCoverageOf, suggestRulesForCommand, RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, isRuleBehavior, } from "./permission-rule-model.js";
+import { escapeForDisclosure, hasUnrenderableCharacters, parseRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand, RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, isRuleBehavior, } from "./permission-rule-model.js";
 import { effectiveOrThrow } from "./permission-rule-provider.js";
 import { errText, isValidConsentScope, landRuleAdd, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
@@ -279,7 +279,8 @@ export async function prepareCardApproval(opts) {
         e.code = "config.invalid_argument";
         throw e;
     }
-    if (opts.toolName !== CARD_RULE_TOOL)
+    const nameCard = ruleToolGrammarOf(opts.toolName) === "name";
+    if (opts.toolName !== CARD_RULE_TOOL && !nameCard)
         return undefined;
     const scope = (() => {
         if (opts.scope !== undefined) {
@@ -303,22 +304,26 @@ export async function prepareCardApproval(opts) {
         throw e;
     })();
     let coverage;
-    try {
-        const view = await effectiveOrThrow(storeForOwner(opts.deps.provider, owner), opts.sessionId !== undefined ? { sessionId: opts.sessionId } : undefined);
-        const table = view.rules;
-        coverage = segmentCoverageOf(opts.command, { persisted: table }, { tool: CARD_RULE_TOOL, cwd: opts.cwd, sessionId: opts.sessionId, ...(opts.execCwd !== undefined ? { execCwd: opts.execCwd } : {}) });
-    }
-    catch {
-        coverage = undefined;
-    }
-    const suggested = suggestRulesForCommand(opts.command, {
-        ...(coverage !== undefined ? { coverage } : {}),
-        scope,
-        ...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),
-        ...(opts.execCwd !== undefined ? { execCwd: opts.execCwd } : {}),
-        ...(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : {}),
-        ...(opts.deps.deniesDirectoryRead !== undefined ? { deniesDirectoryRead: opts.deps.deniesDirectoryRead } : {}),
-    });
+    if (!nameCard) {
+        try {
+            const view = await effectiveOrThrow(storeForOwner(opts.deps.provider, owner), opts.sessionId !== undefined ? { sessionId: opts.sessionId } : undefined);
+            const table = view.rules;
+            coverage = segmentCoverageOf(opts.command, { persisted: table }, { tool: CARD_RULE_TOOL, cwd: opts.cwd, sessionId: opts.sessionId, ...(opts.execCwd !== undefined ? { execCwd: opts.execCwd } : {}) });
+        }
+        catch {
+            coverage = undefined;
+        }
+    }
+    const suggested = nameCard
+        ? [suggestRuleForName(opts.toolName, opts.command)].filter((o) => o !== undefined)
+        : suggestRulesForCommand(opts.command, {
+            ...(coverage !== undefined ? { coverage } : {}),
+            scope,
+            ...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),
+            ...(opts.execCwd !== undefined ? { execCwd: opts.execCwd } : {}),
+            ...(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : {}),
+            ...(opts.deps.deniesDirectoryRead !== undefined ? { deniesDirectoryRead: opts.deps.deniesDirectoryRead } : {}),
+        });
     const candidates = [];
     const claimedBy = new Map();
     const claim = (text) => {
@@ -349,7 +354,7 @@ export async function prepareCardApproval(opts) {
         rev: 0,
         candidates,
         offers,
-        command: opts.command,
+        ...(nameCard ? {} : { command: opts.command }),
         createdAt: nowIso(opts.deps),
         ...(opts.toolCallId !== undefined ? { toolCallId: opts.toolCallId } : {}),
         ...(opts.boundInputHash !== undefined ? { boundInputHash: opts.boundInputHash } : {}),
@@ -510,7 +515,7 @@ async function confirmEditedCandidate(rec, edit, deps) {
         return no("edit_rejected", { message: "the record's candidates carry no single common scope — an edited candidate inherits the card's scope, and a record without one is malformed" });
     }
     if (rec.command === undefined) {
-        return no("edit_rejected", { message: "the record does not carry the adjudicated command (minted before card edits existed) — coverage cannot be verified, so the edit is refused" });
+        return no("edit_rejected", { message: "the record does not carry an adjudicated command (a name card, or one minted before card edits existed) — coverage cannot be verified, so the edit is refused" });
     }
     const checked = checkEditedRuleText(edit.text, rec.command);
     if (!checked.ok) {

package/dist/core/permission-rule-model.d.ts

@@ -156,14 +156,27 @@ export declare function callPathFaceOf(call: ToolCallLike): DenyFace | undefined
 /** Does some {@link PATH_RULE_FACES} ask column hold `face` — may a face-keyed ask row speak for a call on it, whatever
  *  the call's tool is called (a caller's tool declaring a read path target is on the read face too)? */
 export declare function faceAskSpeaksFor(face: DenyFace | undefined): boolean;
+/**
+ * The tools whose rule content NAMES THE VALUE of one parameter instead of a command or a path — the reference's `Skill(<name>)`
+ * form, one row per tool: `param` is the argument the rule's content is read against, `params` every scalar argument the tool
+ * carries (the parameter spelling `Tool(<param>:<pattern>)` those names used to reach is retired for such a tool, see
+ * {@link parseNameRuleContent}). The tool's real schema keys are pinned equal to `params` (test/backlog1318).
+ */
+export declare const NAME_RULE_FACES: Readonly<Record<string, {
+    readonly param: string;
+    readonly params: readonly string[];
+}>>;
 /**
  * Which tools a rule may name — the model's tool set is DERIVED, never a hand-kept list: the shell tool
  * takes the COMMAND grammar; every tool the catalog declares a path target for (Read / Edit / Write /
- * Glob / NotebookEdit / …, `pathTargetOf`) takes the PATH grammar. A rule on any other tool has no
- * content this model can judge and is refused (`unsupported.tool`). The tool set therefore moves with the
- * catalog's declarations, exactly as the protective fences' covered set does.
+ * Glob / NotebookEdit / …, `pathTargetOf`) takes the PATH grammar; the tools of {@link NAME_RULE_FACES} take the NAME grammar.
+ * A rule on any other tool has no content this model can judge and is refused (`unsupported.tool`). The tool set therefore
+ * moves with the catalog's declarations, exactly as the protective fences' covered set does.
  */
-export declare function ruleToolGrammarOf(toolName: string): "command" | "path" | undefined;
+export declare function ruleToolGrammarOf(toolName: string): "command" | "path" | "name" | undefined;
+/** The value a name-grammar tool's call carries in its name argument — the string every NAME rule is read against, the one a
+ *  `Skill` call is resolved by — or undefined (not a name-grammar tool; no such argument; not a string). */
+export declare function nameRuleSubjectOf(toolName: string, args: unknown): string | undefined;
 /** The names the persisted grammar judges a call under: every name the call answers to (the model's spelling, the wire
  *  name, the other aliases that resolve to it) the grammar speaks for, so a stored `Bash(…)` or `Edit(…)` row reaches a
  *  tool that answers to that name under another wire name, as a policy's rule does. Empty ⇒ the grammar speaks for none. */
@@ -191,7 +204,7 @@ export declare function laneToolNamesOf(req: Pick<import("./tool-policy.js").Too
  *    otherwise the working directory). Its predicate is {@link pathRuleReaches}. Not an allow form: a
  *    standing approval by path pattern would be a wider grant than any card ever shows a person.
  */
-export type PersistedRuleMatch = "exact" | "prefix" | "wildcard" | "subpath" | "path";
+export type PersistedRuleMatch = "exact" | "prefix" | "wildcard" | "subpath" | "path" | "name" | "name_prefix";
 /**
  * Where a rule applies — design/382 §4.1, the THREE consent dimensions.
  *
@@ -525,6 +538,9 @@ export declare function parseRuleText(text: string, behavior: RuleBehavior): {
  *  `subpath` the command is the lexical-normal absolute directory (one leading slash), re-spelled in the
  *  double-slash directory form; for `path` it is the pattern as spelled. */
 export declare function formatRuleText(command: string, match: PersistedRuleMatch, tool: PersistedRuleTool): string;
+/** Does a name rule reach this name? `name`: equal; `name_prefix`: begins with it (no boundary — the reference's `startsWith`).
+ *  A rule of any other family reaches no name. */
+export declare function nameRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, name: string): boolean;
 /**
  * The closed set of BASES a path-form pattern resolves against — facts of the CALL (its execution
  * environment and its task), never of the rule:
@@ -675,8 +691,8 @@ export type ProgramRunReachOutcome = {
  * other segment already reached.
  *
  * A rule body the lexer cannot read (foreign store bytes; every entrance validates against exactly
- * this) reaches nothing. A path-family rule (`subpath` / `path`) reaches no command: its predicates are
- * {@link directoryRuleAdmits} and {@link pathRuleReaches}.
+ * this) reaches nothing. A rule of another family (path: `subpath` / `path`; name: `name` / `name_prefix`) reaches no
+ * command: its predicates are {@link directoryRuleAdmits}, {@link pathRuleReachOf} and {@link nameRuleAdmits}.
  */
 export declare function programRunReachOf(rule: Pick<PersistedRule, "match" | "command">, command: string): ProgramRunReachOutcome;
 /** The boolean face of {@link programRunReachOf}: `reached` only. The shadow view and the pins that
@@ -926,6 +942,30 @@ export declare function adjudicatePersistedPathRules(rules: readonly PersistedRu
     readonly tighten?: PathTargetReading;
     readonly allow?: PathTargetReading;
 }, bases: PathRuleBases): PersistedRuleVerdict | undefined;
+/**
+ * The name-family sibling of {@link adjudicatePersistedRules}: the same precedence walk over the rules of one name tool
+ * ({@link NAME_RULE_FACES}), judged on the one string the call names (`nameRuleSubjectOf`). A rule of the tool speaks for the call
+ * when it is live, of this behavior, in scope ({@link eligiblePersisted}, the one predicate) and {@link nameRuleAdmits} the name; the
+ * first behavior in {@link RULE_BEHAVIORS_BY_PRECEDENCE} whose rules speak decides, the first table-order rule of it is the answer.
+ * Every behavior is judged with the one predicate — a name has no "program run" the tightening direction could read wider — and
+ * there is nothing unreadable: a name is a string.
+ */
+export declare function adjudicatePersistedNameRules(rules: readonly PersistedRule[], call: {
+    tool: string;
+    name: string | undefined;
+    cwd: string | undefined;
+    sessionId?: string;
+}): PersistedRuleVerdict | undefined;
+/**
+ * The ONE offer a name tool's approval card carries: the exact rule for the name the call carries (`Skill(<name>)`, the reference's
+ * "don't ask again for <skill>" row), or undefined when no rule spells exactly that name (the round-trip law: the canonical text,
+ * parsed back as an allow, must be the exact name rule over the very name — a leading slash, an interior star or an unreadable
+ * spelling offers nothing rather than a rule that would not clear the ask it was minted on). The reference's second row, the first
+ * word as a prefix, is offered only for a name containing a space; it is not minted here (it would widen past the name shown).
+ */
+export declare function suggestRuleForName(tool: string, name: string): Extract<RuleOffer, {
+    kind: "single";
+}> | undefined;
 /**
  * design/375 §5.2 — the per-segment coverage table for `command`: which segments an eligible rule
  * already admits, judged with the SAME split and the same eligibility predicates as the gate's