@sema-agent/core 7.42.1 → 7.44.0

package/dist/core/gate-lanes.js

@@ -1,7 +1,7 @@
 import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
 import { arbitrateByMode, classifyAsk, fileCommandOptionsSentence, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
-import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
-import { classifierUnavailableArm } from "./classifier-unavailable-arm.js";
+import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, rungDidNotRule, unarmedWindow } from "./auto-mode.js";
+import { classifierNoRulingArm, settleNoRulingAsk } from "./classifier-unavailable-arm.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "./gate-outcome.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
@@ -228,6 +228,12 @@ export async function runGateLanes(pass) {
             pass.decision = shadows.length > 0 ? { ...standing, allowRuleShadowed: shadows } : standing;
         }
         const originFacts = askOriginFacts(orgAnswer.org, ruleCallUnreadableOf(laneAnswer));
+        let noRulingMinted = false;
+        const fallbackAskOf = (standingAsk, fallback, latestBlockedAction) => {
+            const { classifierNoRuling: _why, ...standing } = standingAsk;
+            const fallbackAsk = { ...standing, message: denialLimitFallbackMessage(fallback, latestBlockedAction), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };
+            return stampAskOrigin(fallbackAsk, originFacts, classifyStanding(fallbackAsk, originFacts));
+        };
         if (pass.decision.action === "ask") {
             const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
             pass.decision = stampAskOrigin(stamped, originFacts, classifyStanding(stamped, originFacts));
@@ -271,36 +277,31 @@ export async function runGateLanes(pass) {
                     ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}),
                 };
             }
-            else if (verdict?.kind === "unavailable") {
-                const arm = classifierUnavailableArm({ ask: pass.decision, req: pass.req, cause: verdict.cause, attribution: verdict.classifier, seat: input.autoMode.unavailable, aborted: classifySignal?.aborted === true });
-                if (arm.kind === "asked") {
+            else if (verdict !== undefined) {
+                const noRuling = rungDidNotRule(verdict);
+                const arm = noRuling !== undefined ? classifierNoRulingArm({ ask: pass.decision, req: pass.req, cause: noRuling, attribution: verdict.classifier, seat: input.autoMode.unavailable, aborted: classifySignal?.aborted === true }) : undefined;
+                if (arm?.kind === "asked") {
+                    noRulingMinted = true;
                     pass.decision = stampAskOrigin(arm.ask, originFacts, classifyStanding(arm.ask, originFacts));
                     pass.classifierRound = undefined;
                 }
-                else
+                else if (arm?.kind === "denied")
                     pass.decision = arm.deny;
-            }
-            else if (verdict !== undefined) {
-                const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
-                const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
-                const tracked = input.autoMode.denialTracking?.recordBlock();
-                if (tracked?.limitReached === true) {
-                    const fallbackAsk = {
-                        ...pass.decision,
-                        message: denialLimitFallbackMessage(tracked.fallback, reason || category || toolName),
-                        decisionReason: "classifier",
-                        requiresRealApproval: true,
-                        denialLimitFallback: tracked.fallback,
-                    };
-                    pass.decision = stampAskOrigin(fallbackAsk, originFacts, classifyStanding(fallbackAsk, originFacts));
-                }
                 else {
-                    const denied = {
-                        action: "deny",
-                        message: verdict.kind === "block" ? `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : reason,
-                        decisionReason: "classifier",
-                    };
-                    pass.decision = verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", pass.req) : denied;
+                    const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
+                    const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
+                    const tracked = input.autoMode.denialTracking?.recordBlock();
+                    if (tracked?.limitReached === true) {
+                        pass.decision = fallbackAskOf(pass.decision, tracked.fallback, reason || category || toolName);
+                    }
+                    else {
+                        const denied = {
+                            action: "deny",
+                            message: verdict.kind === "block" ? `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : reason,
+                            decisionReason: "classifier",
+                        };
+                        pass.decision = verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", pass.req) : denied;
+                    }
                 }
             }
             if (pass.decision.action === "deny") {
@@ -389,6 +390,7 @@ export async function runGateLanes(pass) {
         const carryOf = (d) => ({
             ...(callSignal !== undefined ? { signal: callSignal } : {}),
             ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
+            ...(d.action === "ask" && d.classifierNoRuling !== undefined ? { classifierNoRuling: d.classifierNoRuling } : {}),
             ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
             ...(d.action === "ask" && d.askClass !== undefined && d.classes !== undefined ? { askClass: d.askClass, classes: d.classes } : {}),
             ...(d.action === "ask" && d.mandated === true ? { mandated: true, ...(d.mandate !== undefined ? { mandate: d.mandate } : {}) } : {}),
@@ -444,8 +446,14 @@ export async function runGateLanes(pass) {
             }
         }
         if (pass.decision.action === "ask") {
-            const askBeforeResolve = pass.decision;
-            const resolved = await (callSignal !== undefined ? resolveAsk(pass.decision, pass.req, callSignal) : resolveAsk(pass.decision, pass.req));
+            let askBeforeResolve = pass.decision;
+            const resolveOnce = (d) => (callSignal !== undefined ? resolveAsk(d, pass.req, callSignal) : resolveAsk(d, pass.req));
+            let resolved = await resolveOnce(askBeforeResolve);
+            const refallback = settleNoRulingAsk({ ask: askBeforeResolve, mintedHere: noRulingMinted, resolved, tracker: input.autoMode?.denialTracking });
+            if (refallback !== undefined && askBeforeResolve.action === "ask") {
+                askBeforeResolve = fallbackAskOf(askBeforeResolve, refallback, toolName);
+                resolved = await resolveOnce(askBeforeResolve);
+            }
             ledger.fromResolved(resolved, askBeforeResolve, toolName);
             if (resolved.action === "deny")
                 pass.deniedBy = "ask_resolution";

package/dist/core/governance-codes.d.ts

@@ -259,9 +259,10 @@ export declare function noticeAudienceOf(code: string): NoticeAudience;
  * {@link NOTICE_AUDIENCE} like every other row, and NEVER minted by this package (the catalog gate reds a mint site for
  * one in src/). One code, one minter: a code two processes mint would be two facts under one spelling.
  *
- * Member-level exception, stated where a consumer reads the minter: `task.user_steer_undrained` is an engine row, and
- * its `detail.cause: "crashed"` arm is minted by the server — the engine's process is gone when that loss is counted
- * (see `USER_STEER_UNDRAINED_CAUSES`). The code keeps one row here and one spelling for both arms.
+ * Member-level exception, stated where a consumer reads the minter: `task.user_steer_undrained` and
+ * `task.user_followup_undrained` are engine rows, and their `detail.cause: "crashed"` arm is minted by the server — the
+ * engine's process is gone when that loss is counted (see `USER_INPUT_UNDRAINED_CAUSES`); the server picks the code by the
+ * lane the input was queued on, as this engine does. Each code keeps one row here and one spelling for both arms.
  */
 export type NoticeMinter = "engine" | "server";
 declare const NOTICE_MINTER_TABLE: {

package/dist/core/governance-codes.js

@@ -84,6 +84,7 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.capture_optout_unavailable",
     "memory.capture_optout_sweep_failed",
     "memory.target_outside_store",
+    "memory.scope_home_not_directory",
 ]);
 export function governanceRetryClass(code) {
     if (Object.prototype.hasOwnProperty.call(GOVERNANCE_CODES, code)) {

package/dist/core/hooks.d.ts

@@ -7,7 +7,7 @@ export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./rule-lane-
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
 import { type PermissionMode } from "./ask-origin.js";
-import type { AutoModeDenialTracker } from "./auto-mode.js";
+import { type AutoModeDenialTracker } from "./auto-mode.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
 import { type SafeNotifier } from "./safe-notify.js";
@@ -1464,6 +1464,8 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
      * `autoMode` presence alone as the arming fact.
      */
     permissionMode?: () => import("./ask-origin.js").PermissionMode;
+    /** The leg's approval-seat form (`WiringManifest.ask.form`): the deny exit's way-out clause names a declaration, never a missing approver. */
+    askSeatForm?: import("./wiring-manifest.js").AskSeamForm;
     /** WHO put the tool's egress / irreversibility marks on the seat ({@link import("./ask-origin.js").ToolMarkSource});
      *  absent or empty with a mark present reads as the deployment's own (fail-closed: an operator's mandate). */
     toolMarkSources?: ReadonlySet<import("./ask-origin.js").ToolMarkSource>;
@@ -1764,6 +1766,8 @@ export interface AskCarry {
      *  the `0` a park row shows is written. Persisted on the row so a durable card shows the counts the
      *  synchronous card shows. Absent then means: not a fallback ask. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** The surviving ask's no-ruling member ({@link import("./tool-policy.js").AskRequest.classifierNoRuling}), for the row's twin. */
+    readonly classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     /** The surviving ask's engine-stamped origin word ({@link import("./ask-origin.js").AskOrigin}), persisted
      *  on the row so a durable card is rendered by the same word the synchronous card is. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
@@ -1788,6 +1792,7 @@ export interface AskCarry {
  *  the same screen the summary applies to the word). */
 export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     origin?: import("./ask-origin.js").AskOrigin;
     askClass?: import("./ask-origin.js").AskClass;
     classes?: readonly import("./ask-origin.js").AskClass[];

package/dist/core/hooks.js

@@ -8,6 +8,7 @@ export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./rule-lane-
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { isAskOrigin, screenAskClassMembers } from "./ask-origin.js";
+import { isAutoModeFallbackCause } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -242,9 +243,11 @@ export function askCarryRowMembers(carry) {
     if (carry === undefined)
         return {};
     const origin = carry.origin;
+    const why = carry.classifierNoRuling;
     const classed = screenAskClassMembers(carry.askClass, carry.classes);
     return {
         ...(carry.denialLimitFallback !== undefined ? { denialLimitFallback: { ...carry.denialLimitFallback } } : {}),
+        ...(isAutoModeFallbackCause(why) ? { classifierNoRuling: why } : {}),
         ...(isAskOrigin(origin) ? { origin } : {}),
         ...(classed !== undefined ? classed : {}),
     };

package/dist/core/memory-engine/engine.d.ts

@@ -1789,7 +1789,7 @@ export declare class MemoryEngine {
      */
     private gateDerivedIndex;
     /** The file backend's verdict at an act the engine itself performs on a store path ({@link
-     *  storeTargetEscape}): throws `memory.target_outside_store` when `path` would land outside `root`;
+     *  landsOutsideStore}): throws `memory.target_outside_store` when `path` would land outside `root`;
      *  each caller's existing failure lane reports it. `root` is the mount's canonical root where a
      *  handle exists, so a root re-pointed after the mount is judged against the one it mounted. */
     private refuseOutsideStore;
@@ -1798,7 +1798,7 @@ export declare class MemoryEngine {
      *  is never a supported layout (the harvest scan refuses symlinked entry files outright), and this
      *  site already reports write failures by throwing, so ELOOP joins the failures it already had. A
      *  target whose directory resolves outside `root` (a directory on the path is a link) is refused
-     *  the same way, before anything is read or written ({@link storeTargetEscape}). */
+     *  the same way, before anything is read or written ({@link landsOutsideStore}). */
     private writeIfChanged;
     /** Persist the canonical projection back to the session file (id minting / frontmatter completion).
      *  C-F6 (S2-0): called ONLY after the backend transaction committed — never ahead of the journal

package/dist/core/memory-engine/engine.js

@@ -18,7 +18,7 @@ import { landedUndecided, layerDigest, layerObservationLookup, readOnlyLayerCand
 import { markOriginClearanceTombstoned, openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
 import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, canonicalJsonStringify, captureErasureInput, erasureRequestInvalid, erasureSelectHash, scanEntryFiles, } from "./file-backend.js";
 import { assembleMemoryExportBundle, computeMemoryBundleHash, memoryBundleInvalid, } from "./export-bundle.js";
-import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, restoreContainedBaseline, indexLineIsStale, readIndexRevs, writeIndexRevs, bumpScanFuse, scanFuseKey, canonicalize, landingPathOf, storeTargetEscape, TARGET_OUTSIDE_STORE, adoptRootScopeLayout, clearScanFuse, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, markSessionPolluted, readSessionPollution, fileSessionCaptureRecordStore, recordRetrievedAccount, writeFileNoFollow, withPermissionRemedy, permissionRemedyOf, readRetrievedAccount, registerScope, registeredScopes, resolveMemoryEngineRoot, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, readProjectionDebts, resolveChallengeEvent, settleProjectionDebts, stageLineagePending, stageProjectionDebts, } from "./layout.js";
+import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, restoreContainedBaseline, indexLineIsStale, readIndexRevs, writeIndexRevs, bumpScanFuse, scanFuseKey, canonicalize, landingPathOf, landsOutsideStore, storeActRefusal, storeRootMovedRefusal, adoptRootScopeLayout, clearScanFuse, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, markSessionPolluted, readSessionPollution, fileSessionCaptureRecordStore, recordRetrievedAccount, writeFileNoFollow, withPermissionRemedy, permissionRemedyOf, readRetrievedAccount, registerScope, registeredScopes, resolveMemoryEngineRoot, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, readProjectionDebts, resolveChallengeEvent, settleProjectionDebts, stageLineagePending, stageProjectionDebts, } from "./layout.js";
 import { createSessionIncarnationSeat, recalledForAnyIdentity, recalledForIdentity, rememberForIdentity } from "./session-incarnation.js";
 import { scanMemoryFileName, scanMemoryWrite, scanRemediation } from "./scan.js";
 import { writableRootOf } from "./types.js";
@@ -1416,11 +1416,8 @@ export class MemoryEngine {
         ensureDirExists(this.memoryDir);
         const physicalRoot = landingPathOf(this.memoryDir);
         this.mountedRoot ??= physicalRoot;
-        if (physicalRoot !== this.mountedRoot) {
-            const e = new Error(`${TARGET_OUTSIDE_STORE}: the memory dir ${this.memoryDir} now resolves to ${physicalRoot}, not ${this.mountedRoot} where this engine first mounted it — refused; open a new engine on the directory you mean`);
-            e.code = TARGET_OUTSIDE_STORE;
-            throw e;
-        }
+        if (physicalRoot !== this.mountedRoot)
+            throw storeRootMovedRefusal("engine", this.memoryDir);
         ensureDirExists(this.controlDir);
         await this.adoptLayoutBeforeMount(writeScope);
         const restricted = opts?.adoptionRestricted === true;
@@ -2216,7 +2213,7 @@ export class MemoryEngine {
             if (content === undefined)
                 continue;
             try {
-                this.refuseOutsideStore(handle.memoryDir, m.path, "restoring");
+                this.refuseOutsideStore(handle.memoryDir, m.path, "restoring a memory file");
                 mkdirSync(dirname(m.path), { recursive: true });
                 writeFileNoFollow(m.path, content);
                 report.restored.push(m.relPath);
@@ -4947,15 +4944,11 @@ export class MemoryEngine {
         };
     }
     refuseOutsideStore(root, path, act) {
-        const escape = storeTargetEscape(root, path);
-        if (escape === undefined)
-            return;
-        const e = new Error(`${TARGET_OUTSIDE_STORE}: ${act} ${path} was refused — ${escape}; not performed`);
-        e.code = TARGET_OUTSIDE_STORE;
-        throw e;
+        if (landsOutsideStore(root, path))
+            throw storeActRefusal(act, path);
     }
     writeIfChanged(target, text, root) {
-        this.refuseOutsideStore(root, target, "the projection write of");
+        this.refuseOutsideStore(root, target, "the projection write");
         const current = readNoFollowSafe(target);
         if (current === text)
             return;

package/dist/core/memory-engine/file-backend.d.ts

@@ -682,9 +682,9 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      *  let a transient EIO run the unlocked recovery (and its staged sweep) over a live transaction. */
     private txnInFlight;
     /**
-     * The act gate for store paths ({@link storeTargetEscape}) over `ops`' writes and deletes — shadow
+     * The act gate for store paths ({@link landsOutsideStore}) over `ops`' writes and deletes — shadow
      * ops name control-plane files, not store paths. Refuses with `memory.target_outside_store` at the
-     * first op that would land outside the store, naming the op and where it resolves. Runs over a
+     * first op that would land outside the store, naming the op (its path on `detail.path`). Runs over a
      * whole batch before its commit marker (no journal is written; a caller that staged files removes
      * them) and per op at the act itself; past the marker a refusal keeps the journal, which replays
      * once the path resolves inside the store again.

package/dist/core/memory-engine/file-backend.js

@@ -8,7 +8,7 @@ import { ambiguousOriginRepresentation, committedDistilledOf, committedOriginOf,
 import { convertV1SidecarKeys } from "./delegation-settlement.js";
 import { layerObservationLookup, observedDivergenceNotice } from "./layer-observations.js";
 import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, scanEntryFiles } from "./entry-scan.js";
-import { ControlPlaneCorruptError, CURSORS_FILE, QUARANTINE_DIR, CHALLENGES_FILE, IMPORT_RECEIPTS_DIR, LINEAGE_FILE, SESSION_POLLUTION_DIR, appendChallengeEvents, atomicWriteFileSync, quarantineAndTombstone, captureAndClearLineageForEntries, adoptRootScopeLayout, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, ensureDirExists, enqueueMemoryAnnouncement, importLatchTxnId, importLineageCommitted, importSessionPollution, isContainedIn, permissionRemedyOf, withPermissionRemedy, lineageContributionsOfSession, listSessionPollution, readChallengeEvents, readLineageRecord, registerScope, registeredScopes, releaseImportLatch, layoutNeedsAdoption, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, scopeRegistryShape, stageImportLatch, landingPathOf, storeTargetEscape, TARGET_OUTSIDE_STORE, writeAllSync, } from "./layout.js";
+import { ControlPlaneCorruptError, CURSORS_FILE, QUARANTINE_DIR, CHALLENGES_FILE, IMPORT_RECEIPTS_DIR, LINEAGE_FILE, SESSION_POLLUTION_DIR, appendChallengeEvents, atomicWriteFileSync, quarantineAndTombstone, captureAndClearLineageForEntries, adoptRootScopeLayout, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, ensureDirExists, enqueueMemoryAnnouncement, importLatchTxnId, importLineageCommitted, importSessionPollution, isContainedIn, permissionRemedyOf, withPermissionRemedy, lineageContributionsOfSession, listSessionPollution, readChallengeEvents, readLineageRecord, registerScope, registeredScopes, releaseImportLatch, layoutNeedsAdoption, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, scopeRegistryShape, stageImportLatch, landingPathOf, landsOutsideStore, storeActRefusal, storeRootMovedRefusal, writeAllSync, } from "./layout.js";
 import { screenInboundEntries } from "./data-plane.js";
 import { scanMemoryFileName, scanMemoryWrite } from "./scan.js";
 import { thrownText } from "../thrown-value.js";
@@ -1404,7 +1404,7 @@ export class FileMemoryEngineBackend {
                 }
             }
             this.assertTxnLockOwnership(fenceToken);
-            const replayAt = `the journal replay (journal kept at ${jp})`;
+            const replayAt = "the journal replay (journal kept)";
             this.refuseEscapingTargets(journal.ops, replayAt);
             for (const op of journal.ops) {
                 this.refuseEscapingTargets([op], replayAt);
@@ -1470,10 +1470,8 @@ export class FileMemoryEngineBackend {
             if (op.kind !== "write" && op.kind !== "delete")
                 continue;
             for (const path of op.staged === undefined ? [op.target] : [op.target, op.staged]) {
-                const escape = storeTargetEscape(this.physicalRoot, path);
-                if (escape === undefined)
-                    continue;
-                throw erasureCodedError(`${TARGET_OUTSIDE_STORE}: ${at} refused a ${op.kind} of ${op.target}${path === op.target ? "" : ` (its staged file ${path})`} — ${escape}; not performed`, TARGET_OUTSIDE_STORE);
+                if (landsOutsideStore(this.physicalRoot, path))
+                    throw storeActRefusal(`${path === op.target ? "a" : "the staged file of a"} ${op.kind} at ${at}`, path);
             }
         }
     }
@@ -1481,7 +1479,7 @@ export class FileMemoryEngineBackend {
         const now = landingPathOf(this.directoryRoot);
         if (now === this.physicalRoot)
             return;
-        throw erasureCodedError(`${TARGET_OUTSIDE_STORE}: the store root ${this.directoryRoot} now resolves to ${now}, not ${this.physicalRoot} where this backend opened it — refused; open a new backend on the directory you mean`, TARGET_OUTSIDE_STORE);
+        throw storeRootMovedRefusal("backend", this.directoryRoot);
     }
     sweepStagedFiles() {
         const walk = (d, depth) => {

package/dist/core/memory-engine/layout.d.ts

@@ -259,8 +259,41 @@ export declare function adoptRootScopeLayout(rootPath: string, controlDir: strin
 export declare const canonicalize: typeof physicalPathOfExisting;
 /** True iff `child` (canonicalized) is `root` or inside it. */
 export declare function isContainedIn(root: string, child: string): boolean;
-/** The code an act on a store path is refused with when it would land outside the store ({@link storeTargetEscape}). */
+/** The code an act on a store path is refused with when it would land outside the store ({@link landsOutsideStore}). */
 export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
+/** The code a scope home that is not a real directory is refused with ({@link assertHomePhysicalForm}). */
+export declare const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
+/** What a scope home can be besides a real directory (an `lstat` verdict). */
+export declare const SCOPE_HOME_FORMS: readonly ["symlink", "file", "other"];
+export type ScopeHomeForm = (typeof SCOPE_HOME_FORMS)[number];
+/** How a refusal's sentence names each form. */
+declare const SCOPE_HOME_FORM_PHRASE: {
+    readonly symlink: "a symbolic link";
+    readonly file: "a regular file";
+    readonly other: "a special file";
+};
+export type HomeFormPhraseCoversEveryForm = AssertAllKeysHandled<Exclude<ScopeHomeForm, keyof typeof SCOPE_HOME_FORM_PHRASE>>;
+/** What a store-form refusal carries beside its sentence. The ONE host path lives here and never in the
+ *  sentence; `form` is present on {@link SCOPE_HOME_NOT_DIRECTORY} only. */
+export type StoreFormRefusalDetail = {
+    readonly path: string;
+    readonly form?: ScopeHomeForm;
+};
+/** A refusal the store's physical form earns: a plain `Error` (never the control-plane-damage class —
+ *  the engine's own account is intact, the layout it was handed is not the layout it needs) carrying a
+ *  `code` and a `detail`. */
+export type StoreFormRefusal = Error & {
+    code: typeof TARGET_OUTSIDE_STORE | typeof SCOPE_HOME_NOT_DIRECTORY;
+    detail: StoreFormRefusalDetail;
+};
+/** Seat 1 — an act the store's physical form refuses: `act` names what was refused (no path), `path` is the
+ *  target whose directory resolves outside the store ({@link landsOutsideStore}). */
+export declare function storeActRefusal(act: string, path: string): StoreFormRefusal;
+/** Seat 2 — the store root now resolves to another directory than the one the `holder` first opened; `path` is
+ *  the root's spelling. */
+export declare function storeRootMovedRefusal(holder: "backend" | "engine", path: string): StoreFormRefusal;
+/** Seat 3 — a scope home that is not a real directory. */
+export declare function scopeHomeRefusal(form: ScopeHomeForm, path: string): StoreFormRefusal;
 /** Where an act at `p` lands: the physical path of its normalized spelling (the spelling a child path
  *  joined under it carries), a MISSING tail rejoined under the deepest existing directory (what the act
  *  creates). Any other resolution fault (EACCES, ELOOP, ENOTDIR) is THROWN as itself: an act that
@@ -268,8 +301,8 @@ export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
  *  (a link whose own mode refuses `realpath` is still followed by `unlink` and `rename`). */
 export declare function landingPathOf(p: string): string;
 /**
- * Where a write, rename or delete at `target` would physically LAND, judged against the store's
- * `physicalRoot`: `undefined` = inside, otherwise the reason. The target's directory, resolved through
+ * Whether a write, rename or delete at `target` would physically LAND outside the store, judged against the
+ * store's `physicalRoot` (`true` = outside; the refusal is {@link storeActRefusal}). The target's directory, resolved through
  * every link on its existing prefix (a missing tail is what the act creates, under the deepest existing
  * directory), must be the root or inside it. `physicalRoot` is the root's physical form as the store
  * was opened and is not re-resolved here: a store mounted through a link is judged by what the link
@@ -280,7 +313,7 @@ export declare function landingPathOf(p: string): string;
  * keeps the spelling while the act follows the link out. A directory that cannot be resolved throws its
  * fault ({@link landingPathOf}).
  */
-export declare function storeTargetEscape(physicalRoot: string, target: string): string | undefined;
+export declare function landsOutsideStore(physicalRoot: string, target: string): boolean;
 /** mkdir -p convenience used by the engine/backend (0o700 like the file stores). */
 export declare function ensureDirExists(dir: string): void;
 /** The one remedy every surfaced permission refusal carries — `undefined` unless `err` is a write

package/dist/core/memory-engine/layout.js

@@ -472,11 +472,18 @@ function assertHomePhysicalForm(home) {
         return "absent";
     if (st.isDirectory())
         return "dir";
-    throw new ControlPlaneCorruptError(`scope home ${home} is ${st.isSymbolicLink() ? "a symbolic link" : "not a directory"} — a scope home must be a real directory (fail-closed)`);
+    throw scopeHomeRefusal(st.isSymbolicLink() ? "symlink" : st.isFile() ? "file" : "other", home);
 }
 function ensureScopeHome(home) {
-    if (assertHomePhysicalForm(home) === "absent")
-        mkdirSync(home, { recursive: true });
+    if (assertHomePhysicalForm(home) === "absent") {
+        try {
+            mkdirSync(home, { recursive: true });
+        }
+        catch (err) {
+            assertHomePhysicalForm(home);
+            throw err;
+        }
+    }
     assertHomePhysicalForm(home);
 }
 export function registerScope(memoryDir, controlDir, scope, opts) {
@@ -725,6 +732,28 @@ export function isContainedIn(root, child) {
     return c === r || c.startsWith(`${r}${sep}`);
 }
 export const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
+export const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
+export const SCOPE_HOME_FORMS = Object.freeze(["symlink", "file", "other"]);
+const SCOPE_HOME_FORM_PHRASE = {
+    symlink: "a symbolic link",
+    file: "a regular file",
+    other: "a special file",
+};
+function storeFormRefusal(code, sentence, detail) {
+    const e = new Error(`${code}: ${sentence}`);
+    e.code = code;
+    e.detail = detail;
+    return e;
+}
+export function storeActRefusal(act, path) {
+    return storeFormRefusal(TARGET_OUTSIDE_STORE, `${act} was refused — its directory resolves outside the store root; not performed`, { path });
+}
+export function storeRootMovedRefusal(holder, path) {
+    return storeFormRefusal(TARGET_OUTSIDE_STORE, `the ${holder === "backend" ? "store root" : "memory dir"} now resolves to a different directory than the one this ${holder} ${holder === "backend" ? "opened" : "first mounted"} — refused; open a new ${holder} on the directory you mean`, { path });
+}
+export function scopeHomeRefusal(form, path) {
+    return storeFormRefusal(SCOPE_HOME_NOT_DIRECTORY, `a scope home must be a real directory, but this one is ${SCOPE_HOME_FORM_PHRASE[form]} — refused (fail-closed); put the real directory back`, { path, form });
+}
 export function landingPathOf(p) {
     const normalized = resolve(p);
     try {
@@ -736,9 +765,9 @@ export function landingPathOf(p) {
         return canonicalize(normalized);
     }
 }
-export function storeTargetEscape(physicalRoot, target) {
+export function landsOutsideStore(physicalRoot, target) {
     const dir = landingPathOf(dirname(target));
-    return dir === physicalRoot || dir.startsWith(`${physicalRoot}${sep}`) ? undefined : `its directory resolves to ${dir}, outside the store root ${physicalRoot}`;
+    return dir !== physicalRoot && !dir.startsWith(`${physicalRoot}${sep}`);
 }
 export function ensureDirExists(dir) {
     if (!existsSync(dir))

package/dist/core/mode-policy.d.ts

@@ -163,17 +163,18 @@ export declare function modeRequestAfterResume(seat: PermissionMode | undefined,
 export declare function refusePermissionModeDoors(spec: Pick<TaskSpec, "permissionMode" | "shellGate">): PermissionMode | undefined;
 /**
  * The doors a RESUMED leg's prepare refuses at, read as one screen for the resume ladder to run BEFORE the claim: the mode
- * doors on the re-supplied config ({@link refusePermissionModeDoors}), its output-style seat (`resolveOutputStyleFrame`) and
- * the mode words the checkpoint row recorded (`recordedModeSeed`) — prepare's own functions, so the refusal carries the very
+ * doors on the re-supplied config ({@link refusePermissionModeDoors}), its output-style seat (`resolveOutputStyleFrame`), its
+ * approval-reach declaration (`screenApprovalReach`), the skills it invokes by name (`screenUserInvokedSkills` — the part no
+ * roster changes; a name the leg's roster reads as nothing is prepare's) and the mode words the checkpoint row recorded (`recordedModeSeed`) — prepare's own functions, so the refusal carries the very
  * sentence and code prepare would throw. It leaves by the resume's ONE refusal channel, `CheckpointError`
  * `checkpoint.config_refused` (`message` = prepare's sentence, `detail.code` = prepare's code, `detail.field` = the input that
  * carries it: `"taskConfig"` or `"inheritedGate"`), where prepare itself would end the run `failed` after the claim — a
  * refusal there consumes the row and reopens it as a system retry that replays the recorded decision, which a CONFIG
  * correction cannot reach. Before the claim the row stays `pending` and byte-identical, and the same token is redeemable by a
- * corrected resume. A throw that is not one of prepare's four codes (a caller's accessor failing) is not a refusal and leaves
+ * corrected resume. A throw that is not one of prepare's five codes (a caller's accessor failing) is not a refusal and leaves
  * as it was thrown.
  */
-export declare function refuseResumeDoors(config: Pick<TaskSpec, "permissionMode" | "shellGate" | "outputStyle">, recordedGate: Parameters<typeof recordedModeSeed>[0]): void;
+export declare function refuseResumeDoors(config: Pick<TaskSpec, "permissionMode" | "shellGate" | "outputStyle" | "approvalReach" | "skills" | "userInvokedSkills">, recordedGate: Parameters<typeof recordedModeSeed>[0]): void;
 /** The three-member answer every mode question gets — the manifest member, the steer verb's return value and the
  *  fold notice's detail share it. `requested` is absent when the caller declared nothing (a root inherits `default`,
  *  a child inherits its parent). */

package/dist/core/mode-policy.js

@@ -9,6 +9,8 @@ import { createSafeNotifier } from "./safe-notify.js";
 import { assertNoRetiredKeys, RETIRED_TASK_SPEC_KEYS } from "./retired-keys.js";
 import { resolveOutputStyleFrame } from "./output-style.js";
 import { CheckpointError, isCheckpointConfigRefusalCode, recordedModeSeed } from "./checkpoint-store.js";
+import { screenApprovalReach } from "./wiring-manifest.js";
+import { screenUserInvokedSkills } from "./skill-grant.js";
 export const PERMISSION_MODE_FOLD_REASONS = Object.freeze(["operator_deny", "face_absent", "inherited_ceiling"]);
 export const ACCEPT_EDITS_FILE_COMMANDS = Object.freeze(["mkdir", "touch", "rm", "rmdir", "mv", "cp", "sed"]);
 const MODE_POLICY_TABLE = {
@@ -112,6 +114,8 @@ export function refuseResumeDoors(config, recordedGate) {
     screenAs("taskConfig", () => {
         refusePermissionModeDoors(config);
         resolveOutputStyleFrame(config.outputStyle);
+        screenApprovalReach(config.approvalReach);
+        screenUserInvokedSkills(config);
     });
     screenAs("inheritedGate", () => void recordedModeSeed(recordedGate));
 }

package/dist/core/permission-rule-consent.d.ts

@@ -282,9 +282,10 @@ export declare function prepareCardApproval(opts: {
     principal?: string;
     /** design/182 §4.5 (additive): the structural owner — only the local-owner path needs it. */
     owner?: RuleOwner;
-    /** The tool whose ask this card belongs to. Only the shell tool the rule lane speaks for is accepted. */
+    /** The tool whose ask this card belongs to. Only the shell tool the rule lane speaks for and the name tools (the skill-activation
+     *  card) are accepted. */
     toolName: string;
-    /** The command as adjudicated — the same bytes the ask carried. */
+    /** The command as adjudicated — the same bytes the ask carried; for a name tool (`Skill`), the name its call carried (`args.skill`). */
     command: string;
     /** The ask's call id and argument digest, recorded for reconciliation. */
     toolCallId?: string;

package/dist/core/permission-rule-consent.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { escapeForDisclosure, hasUnrenderableCharacters, parseRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, segmentCoverageOf, suggestRulesForCommand, RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, isRuleBehavior, } from "./permission-rule-model.js";
+import { escapeForDisclosure, hasUnrenderableCharacters, parseRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand, RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, isRuleBehavior, } from "./permission-rule-model.js";
 import { effectiveOrThrow } from "./permission-rule-provider.js";
 import { errText, isValidConsentScope, landRuleAdd, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
@@ -279,7 +279,8 @@ export async function prepareCardApproval(opts) {
         e.code = "config.invalid_argument";
         throw e;
     }
-    if (opts.toolName !== CARD_RULE_TOOL)
+    const nameCard = ruleToolGrammarOf(opts.toolName) === "name";
+    if (opts.toolName !== CARD_RULE_TOOL && !nameCard)
         return undefined;
     const scope = (() => {
         if (opts.scope !== undefined) {
@@ -303,22 +304,26 @@ export async function prepareCardApproval(opts) {
         throw e;
     })();
     let coverage;
-    try {
-        const view = await effectiveOrThrow(storeForOwner(opts.deps.provider, owner), opts.sessionId !== undefined ? { sessionId: opts.sessionId } : undefined);
-        const table = view.rules;
-        coverage = segmentCoverageOf(opts.command, { persisted: table }, { tool: CARD_RULE_TOOL, cwd: opts.cwd, sessionId: opts.sessionId, ...(opts.execCwd !== undefined ? { execCwd: opts.execCwd } : {}) });
-    }
-    catch {
-        coverage = undefined;
-    }
-    const suggested = suggestRulesForCommand(opts.command, {
-        ...(coverage !== undefined ? { coverage } : {}),
-        scope,
-        ...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),
-        ...(opts.execCwd !== undefined ? { execCwd: opts.execCwd } : {}),
-        ...(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : {}),
-        ...(opts.deps.deniesDirectoryRead !== undefined ? { deniesDirectoryRead: opts.deps.deniesDirectoryRead } : {}),
-    });
+    if (!nameCard) {
+        try {
+            const view = await effectiveOrThrow(storeForOwner(opts.deps.provider, owner), opts.sessionId !== undefined ? { sessionId: opts.sessionId } : undefined);
+            const table = view.rules;
+            coverage = segmentCoverageOf(opts.command, { persisted: table }, { tool: CARD_RULE_TOOL, cwd: opts.cwd, sessionId: opts.sessionId, ...(opts.execCwd !== undefined ? { execCwd: opts.execCwd } : {}) });
+        }
+        catch {
+            coverage = undefined;
+        }
+    }
+    const suggested = nameCard
+        ? [suggestRuleForName(opts.toolName, opts.command)].filter((o) => o !== undefined)
+        : suggestRulesForCommand(opts.command, {
+            ...(coverage !== undefined ? { coverage } : {}),
+            scope,
+            ...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),
+            ...(opts.execCwd !== undefined ? { execCwd: opts.execCwd } : {}),
+            ...(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : {}),
+            ...(opts.deps.deniesDirectoryRead !== undefined ? { deniesDirectoryRead: opts.deps.deniesDirectoryRead } : {}),
+        });
     const candidates = [];
     const claimedBy = new Map();
     const claim = (text) => {
@@ -349,7 +354,7 @@ export async function prepareCardApproval(opts) {
         rev: 0,
         candidates,
         offers,
-        command: opts.command,
+        ...(nameCard ? {} : { command: opts.command }),
         createdAt: nowIso(opts.deps),
         ...(opts.toolCallId !== undefined ? { toolCallId: opts.toolCallId } : {}),
         ...(opts.boundInputHash !== undefined ? { boundInputHash: opts.boundInputHash } : {}),
@@ -510,7 +515,7 @@ async function confirmEditedCandidate(rec, edit, deps) {
         return no("edit_rejected", { message: "the record's candidates carry no single common scope — an edited candidate inherits the card's scope, and a record without one is malformed" });
     }
     if (rec.command === undefined) {
-        return no("edit_rejected", { message: "the record does not carry the adjudicated command (minted before card edits existed) — coverage cannot be verified, so the edit is refused" });
+        return no("edit_rejected", { message: "the record does not carry an adjudicated command (a name card, or one minted before card edits existed) — coverage cannot be verified, so the edit is refused" });
     }
     const checked = checkEditedRuleText(edit.text, rec.command);
     if (!checked.ok) {