@sema-agent/core 7.42.1 → 7.44.0

package/dist/core/runner/permission-rule-lanes.js

@@ -1,6 +1,6 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, faceAskSpeaksFor, laneToolNamesOf, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, faceAskSpeaksFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
 import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
@@ -155,6 +155,8 @@ export function createPermissionRuleLanes(cfg) {
         const liveCwd = cfg.liveCwd();
         if (grammar === "path")
             return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, liveCwd, home: cfg.home });
+        if (grammar === "name")
+            return persistedRuleAnswerOf(adjudicatePersistedNameRules(table, { tool: req.toolName, name: nameRuleSubjectOf(req.toolName, req.args), cwd: cfg.root, sessionId: cfg.sessionId }));
         const command = req.args?.command;
         if (typeof command !== "string")
             return undefined;
@@ -172,7 +174,7 @@ export function createPermissionRuleLanes(cfg) {
 export function createRuleOffersOf(cfg) {
     return (call, args, ask) => {
         const toolName = wireOf("offer.laneTool", call);
-        if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
+        if (!cfg.laneArmed || (toolName !== PERSISTED_RULE_TOOL && ruleToolGrammarOf(toolName) !== "name"))
             return {};
         if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
             return {};
@@ -184,6 +186,10 @@ export function createRuleOffersOf(cfg) {
         }).word;
         if (closedDoor !== undefined)
             return { ruleOffersAbsence: closedDoor };
+        if (ruleToolGrammarOf(toolName) === "name") {
+            const offer = suggestRuleForName(toolName, nameRuleSubjectOf(toolName, args) ?? "");
+            return offer !== undefined ? { ruleOffers: [offer] } : { ruleOffersAbsence: "lane_cannot_speak" };
+        }
         const command = args?.command;
         if (typeof command !== "string")
             return { ruleOffersAbsence: "lane_cannot_speak" };

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -6,6 +6,7 @@ import { type OnAsk, type ToolCallRequest, type ToolPolicy } from "../tool-polic
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AskLane, Prepared } from "./contracts.js";
+import type { GrantBindingOf } from "../skill-grant-binding.js";
 import { consumeInheritedAskGrant } from "./inherited-ask-grants.js";
 import { type GrantReadRoot } from "./read-root-grant.js";
 import type { createRuleOffersOf } from "./permission-rule-lanes.js";
@@ -49,6 +50,8 @@ export interface PrepareAskLaneInput {
     now: () => number;
     /** borrowed-readonly — the policy-chain phase's rule-offer factory (the suggestion members the ask mint threads). */
     ruleOffersOf: ReturnType<typeof createRuleOffersOf>;
+    /** borrowed-readonly — the policy-chain phase's Skill-card binding factory (`boundGrants` / `boundGrantDigest` on the ask). */
+    grantBindingOf: GrantBindingOf;
     /** borrowed-readonly — the policy-chain phase's Runner-filled source identity (one factory, every ask mint site). */
     askSourceIdentity: () => {
         principal?: string;

package/dist/core/runner/prepare-ask-lane.js

@@ -59,7 +59,7 @@ function resolveApprovalPreview(tools, toolName, args) {
     }
 }
 export function prepareAskLane(input) {
-    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
+    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
     if (!gateMachineryActive)
         return { askLane: undefined };
     const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
@@ -98,6 +98,7 @@ export function prepareAskLane(input) {
                 return { ...(p.preview !== undefined ? { preview: p.preview } : {}), ...(p.withheld !== undefined ? { previewWithheld: p.withheld } : {}) };
             })(),
             ...ruleOffersOf(req, req.args, decision.action === "ask" ? decision : undefined),
+            ...grantBindingOf(req, req.args),
             ...cardDisclosureOf(decision, `approval required for "${req.toolName}"`),
             ...askSourceIdentity(),
             ...riskAxesOf(req),

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -30,7 +30,6 @@ import { type CheckpointSeat } from "../checkpoint-seat.js";
 import { type ComplianceCapability } from "../compliance.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { StoredSession } from "../session.js";
-import type { OnAsk } from "../tool-policy.js";
 import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
 import type { AutoModeArmFact } from "../wiring-manifest.js";
 import type { AssertAllKeysHandled } from "../ask-origin.js";
@@ -88,8 +87,8 @@ export interface PrepareCapsAndWorkflowInput {
     harnessRef: {
         current?: AgentHarness;
     };
-    /** borrowed-readonly — the FROZEN approver seat (the Workflow mount's parentOnAsk). */
-    frozenOnAsk: OnAsk | undefined;
+    /** borrowed-readonly — the run's approval seat as the config doors froze it (the Workflow mount's parentOnAsk / parentApprovalReach). */
+    askSeat: import("../wiring-manifest.js").AskSeat;
     /** borrowed-readonly — the parent SPEC seat the children inherit (minted once by the inherited-gate phase; the Workflow mount's dep, the same value the delegation ctx carries). */ parentSpecSeat: ParentSpecSeat;
     /** borrowed-readonly — the ONE read-face carrier expression (the Workflow mount's parentReadFace getter calls it). */
     carrierReadFace: () => ContainmentFace | undefined;

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -114,7 +114,7 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, askSeat, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
@@ -326,7 +326,8 @@ export async function prepareCapsAndWorkflow(input) {
                 return model === undefined ? undefined : { model, ...(typeof ref === "string" ? { modelRef: ref } : {}) };
             },
             ...(spec.getApiKeyAndHeaders !== undefined ? { parentGetApiKeyAndHeaders: spec.getApiKeyAndHeaders } : {}),
-            ...(frozenOnAsk !== undefined ? { parentOnAsk: frozenOnAsk } : {}),
+            ...(askSeat.value !== undefined ? { parentOnAsk: askSeat.value } : {}),
+            ...(askSeat.reach !== undefined ? { parentApprovalReach: askSeat.reach } : {}),
             ...(spec.durableApproval !== undefined ? { parentDurableApproval: { ...spec.durableApproval } } : {}),
             ...(internals?.workflowParkedResume !== undefined
                 ? { parkedResume: (resumeFromRunId) => {

package/dist/core/runner/prepare-config-doors.d.ts

@@ -29,6 +29,7 @@ import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import type { SessionStore } from "../session.js";
 import type { RunnerDeps, TaskLimits, TaskSpec } from "../types.js";
 import { type UsageWindow } from "../usage-window-store.js";
+import { type AskSeat } from "../wiring-manifest.js";
 import type { PrepareResume, RunInternals, ToolFaceSnapshot } from "./contracts.js";
 export declare function limitConfigError(code: string, message: string): Error & {
     code?: string;
@@ -147,6 +148,8 @@ export interface PrepareConfigDoorsResult {
     /** owned — the resolved interaction posture (spec > spawning run > deployment); the
      *  AskUserQuestion mount and the child-ctx injection read this same value. */
     resolvedInteractionPosture: "interactive" | "headless" | undefined;
+    /** owned, frozen — the run's approval seat ({@link resolveAskSeat}), the one read of the seats; later phases read only this. */
+    askSeat: AskSeat;
     /** owned — the validated/resolved microCompact knob ({@link resolveMicroCompactKnob}
      *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
      *  the deps bag is never re-read after this door. */

package/dist/core/runner/prepare-config-doors.js

@@ -12,7 +12,7 @@ import { resolveSkillListingBudget } from "../skill-listing-budget.js";
 import { describeRejectedValue } from "../tool-search-setting.js";
 import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
-import { deriveAskEffective, resolveAskSeamForm, resolveQuestionSeam } from "../wiring-manifest.js";
+import { deriveAskEffective, resolveAskSeat, resolveQuestionSeam } from "../wiring-manifest.js";
 import { assertPeerPresenceValue } from "../../agents/peer-directory.js";
 import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
 const TASK_LIMIT_KEY_DICT = {
@@ -286,6 +286,7 @@ export function prepareConfigDoors(input) {
         ],
     });
     const resolvedInteractionPosture = spec.interactionPosture ?? internals?.parentInteractionPosture ?? deps.interactionPosture;
+    const askSeat = resolveAskSeat(spec, deps);
     {
         const interactionPosture = resolvedInteractionPosture;
         const discloseInteractionPostureRefusal = (err) => {
@@ -303,8 +304,7 @@ export function prepareConfigDoors(input) {
             throw e;
         }
         if (interactionPosture === "interactive") {
-            const askDoor = resolveAskSeamForm(spec, deps);
-            const humanReachable = deriveAskEffective(askDoor.form, "unresolved") === "human_reachable";
+            const humanReachable = deriveAskEffective(askSeat.form, "unresolved") === "human_reachable";
             const questionDoor = resolveQuestionSeam(spec, deps);
             const strippedByEngine = internals?.questionFaceStripped === true;
             if (spec.interactiveTools === false) {
@@ -318,9 +318,9 @@ export function prepareConfigDoors(input) {
             if (!humanReachable || !(questionDoor.wired || strippedByEngine)) {
                 const missing = [];
                 if (!humanReachable) {
-                    missing.push(askDoor.form === "absent"
+                    missing.push(askSeat.form === "declared_none" ? 'this run declares approvalReach: "none" — nobody on it can be asked to approve' : askSeat.form === "absent"
                         ? "no onAsk approver is wired (spec.onAsk ?? deps.onAsk is absent — asks would auto-deny or park)"
-                        : `the resolved onAsk seat is the blanket policy "${askDoor.form}" (${askDoor.provenance ?? "?"}) — a policy setting is not a reachable human`);
+                        : `the resolved onAsk seat is the blanket policy "${askSeat.form}" (${askSeat.provenance ?? "?"}) — a policy setting is not a reachable human`);
                 }
                 if (!questionDoor.wired && !strippedByEngine) {
                     missing.push("no content-question channel (spec.onQuestion ?? deps.onQuestion is absent, and this leg is not an engine-stripped background lane)");
@@ -433,6 +433,7 @@ export function prepareConfigDoors(input) {
         promptProfile,
         lockedPreflight,
         resolvedInteractionPosture,
+        askSeat,
         microCompactKnob,
         resolvedRole,
         model,

package/dist/core/runner/prepare-gate-stations.js

@@ -137,7 +137,7 @@ export function prepareGateStations(input) {
                         onHookError: notifyHookError,
                         shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
-                        permissionMode: () => permissionMode.current,
+                        permissionMode: () => permissionMode.current, askSeatForm: askRoute.form,
                         ...(markSources.size > 0 ? { toolMarkSources: markSources } : {}),
                         ...seatInputsFor(e.toolName, wireOf("gate.skillActivationSeat", call)),
                         ...(mountedToolRequiresUserInteraction(tools, e.toolName) ? { requiresUserInteraction: true } : {}),

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -50,19 +50,21 @@ import { type SkillGrantTable } from "../skill-grant.js";
 import type { InheritedGate, Prepared, PrepareResume, RunInternals, StopForDenialLimit, ToolFaceSnapshot, WriteFaceSeat } from "./contracts.js";
 export interface PrepareInheritedGateInput {
     /** borrowed-readonly — the REBOUND spec. Read: `shellGate` (the own doctrine the chain fold tightens), `durableApproval`
-     *  (the mandate tests + the children's copy), `onAsk`/`onQuestion` (the frozen seats), `handsReadOnly` / `interactiveTools`
+     *  (the mandate tests + the children's copy), `onQuestion` (the frozen question seat), `handsReadOnly` / `interactiveTools`
      *  / `oneShot` / `clientContext` / `principal` / `additionalDirectories` / `additionalReadDirectories` / `envFacts` /
      *  `memoryPersistenceCapable` / `getApiKeyAndHeaders` / `backgroundScope` / `enablePlanMode` (the ctx enrichment's
      *  trusted seats). Never mutated. */
-    spec: Pick<TaskSpec, "shellGate" | "durableApproval" | "onAsk" | "onQuestion" | "handsReadOnly" | "interactiveTools" | "oneShot" | "clientContext" | "principal" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "getApiKeyAndHeaders" | "backgroundScope" | "enablePlanMode" | "excludeAllTools">;
+    spec: Pick<TaskSpec, "shellGate" | "durableApproval" | "onQuestion" | "handsReadOnly" | "interactiveTools" | "oneShot" | "clientContext" | "principal" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "getApiKeyAndHeaders" | "backgroundScope" | "enablePlanMode" | "excludeAllTools">;
     /** borrowed-readonly — the seat this run hands its children (`checkpointSeatOf`, minted once by the driver after the config doors): the ctx's `checkpointStoreForChildren`, absent when the run has no seat. */
     checkpointSeat: import("../checkpoint-seat.js").CheckpointSeat | undefined;
     /** borrowed-readonly — the deployment seats: `autoMode.denialLimit` (the rebuilt trackers' bounds), `memoryScopeAdmission` /
      *  `deploymentMemoryScopes` / `compliancePostureResolver` (the governed-provenance bit), `onError` (the screening-face crash
      *  lane), `onNotice` (the stop seat's notice), `executionEnv` (the hook-env identity predicate), `delegationEntryCaps` (resolved
-     *  and validated once here), `rosterStore` / `onBackgroundChildEvent` (ctx seats), `onAsk` / `onQuestion` (the deps half of the
-     *  frozen seats). */
-    deps: Pick<RunnerDeps, "autoMode" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "compliancePostureResolver" | "onError" | "onNotice" | "executionEnv" | "delegationEntryCaps" | "rosterStore" | "onBackgroundChildEvent" | "onAsk" | "onQuestion">;
+     *  and validated once here), `rosterStore` / `onBackgroundChildEvent` (ctx seats), `onQuestion` (the deps half of the
+     *  frozen question seat). */
+    deps: Pick<RunnerDeps, "autoMode" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "compliancePostureResolver" | "onError" | "onNotice" | "executionEnv" | "delegationEntryCaps" | "rosterStore" | "onBackgroundChildEvent" | "onQuestion">;
+    /** borrowed-readonly — the run's approval seat as the config doors froze it: the frozen approver, and this leg's chain view. */
+    askSeat: import("../wiring-manifest.js").AskSeat;
     /** borrowed-readonly — the trusted spawn-side channel: `inheritedGate` (the LIVE half of the chain fold), `ownOrgAdmissionRef`
      *  (the same-session continuation's freeze), `delegationProvenance` (the F-012 stamp), and the identity / peer / notification
      *  seats the ctx enrichment forwards. Never mutated. */

package/dist/core/runner/prepare-inherited-gate.js

@@ -13,7 +13,7 @@ import { frozenSkillGrants } from "../skill-grant.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { asThrownError } from "../thrown-value.js";
 export function prepareInheritedGate(input) {
-    const { spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
+    const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
     const seedInheritedGate = resume?.seed.inheritedGate;
     const inheritedAncestorRules = (() => {
@@ -35,7 +35,8 @@ export function prepareInheritedGate(input) {
     })();
     const modeSeed = recordedModeSeed(seedInheritedGate);
     const inheritedShellGate = liveInheritedGate?.shellGate ?? modeSeed.shellGate;
-    const inheritedParentConstraints = attachRebuiltDenialTrackers(liveInheritedGate?.parentConstraints, deps.autoMode?.denialLimit);
+    const chainView = askSeat.reach === "none" ? liveInheritedGate?.parentConstraints?.map((pc) => (typeof pc.onAsk === "function" ? ((({ onAsk: _person, ...rest }) => rest)(pc)) : pc)) : liveInheritedGate?.parentConstraints;
+    const inheritedParentConstraints = attachRebuiltDenialTrackers(chainView, deps.autoMode?.denialLimit);
     const parentSeat = liveInheritedGate?.permissionModeCeiling;
     const ceiling = parentSeat ?? liveInheritedGate?.permissionMode;
     const announceModeFold = (receipt) => {
@@ -113,7 +114,7 @@ export function prepareInheritedGate(input) {
     const f012CheckpointState = () => (inheritedParentConstraints?.length ?? 0) > 0 ||
         seedInheritedGate?.constraintChain !== undefined ||
         internals?.delegationProvenance !== undefined;
-    const frozenOnAsk = spec.onAsk ?? deps.onAsk;
+    const frozenOnAsk = askSeat.value;
     const hookEnvSource = (ownedEnv ?? deps.executionEnv) != null ? executionEnv : undefined;
     const notifyOwnHookCrash = (err) => {
         try {
@@ -213,6 +214,7 @@ export function prepareInheritedGate(input) {
             thinkingLevel: harnessRef.current?.getThinkingLevel(),
             principal: spec.principal,
             ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
+            ...(askSeat.reach !== undefined ? { approvalReach: askSeat.reach } : {}),
             ...(frozenOnQuestion !== undefined ? { onQuestion: frozenOnQuestion } : {}),
             ...(spec.handsReadOnly === true ? { handsReadOnly: true } : {}),
             ...(carrierReadFace() === "roots" ? { readFace: "roots" } : {}),

package/dist/core/runner/prepare-park-ask.d.ts

@@ -22,6 +22,7 @@
 import type { AgentHarness, AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
 import { type OnQuestion } from "../ask-question.js";
 import { type CheckpointStore } from "../checkpoint-store.js";
+import type { GrantBindingOf } from "../skill-grant-binding.js";
 import type { SessionStore } from "../session.js";
 import { type OnAsk, type ToolCallRequest, type ToolPolicy } from "../tool-policy.js";
 import { type ToolResultStore } from "../tool-result-store.js";
@@ -32,7 +33,6 @@ import { type ContentAskBinding } from "./content-ask-bindings.js";
 import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, SuspendSaga } from "./contracts.js";
 import type { createRuleOffersOf } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
-import { type SkillGrantSource } from "../skill-grant.js";
 export interface PrepareParkAskInput {
     /** borrowed-readonly — the in-stream ask lane, or undefined when the gate machinery is inactive (then both closures are
      *  absent). Read: `composedCallSignal` (the fence and the delivery race), `approvalPreviewOf` (the row's preview). */
@@ -141,9 +141,9 @@ export interface PrepareParkAskInput {
     orgAdmissionCheckpointState: () => boolean;
     /** borrowed-readonly — the policy-chain phase's rule-offer factory (the row's suggestion members). */
     ruleOffersOf: ReturnType<typeof createRuleOffersOf>;
-    /** borrowed-readonly — the leg's loaded skills (what its `Skill` tool serves); a parked `Skill` call's row binds the named
-     *  skill — its name and its lists — from them (`boundGrantDigest`). Empty when the leg loads none. */
-    skillSpecs: readonly SkillGrantSource[];
+    /** borrowed-readonly — the policy-chain phase's Skill-card binding factory: a parked `Skill` call's row carries the named skill and
+     *  its lists (`boundGrants`) and their hash (`boundGrantDigest`) from it, as the live ask does. */
+    grantBindingOf: GrantBindingOf;
     /** borrowed-readonly — the injectable wall clock (the row's `suspendedAt`). */
     now: () => number;
     /** borrowed-readonly — the per-task human-review accumulator; snapshotted onto the row (never written here). */

package/dist/core/runner/prepare-park-ask.js

@@ -17,8 +17,6 @@ import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedT
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
 import { callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
 import { seatOf, wireOf } from "../tool-name-readings.js";
-import { skillCallGrantDigest } from "../skill-grant.js";
-import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
         super(message, options);
@@ -29,7 +27,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, skillSpecs, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -318,7 +316,7 @@ export function prepareParkAsk(input) {
                         ...askCarryRowMembers(carry),
                         ...ruleOffersOf(req, parkedArgs, clearanceFacts),
                         boundInputHash: boundInputHashOf(parkedArgs),
-                        ...((grantDigest) => (grantDigest !== undefined ? { boundGrantDigest: grantDigest } : {}))(skillCallGrantDigest(req, parkedArgs, skillSpecs, SKILL_TOOL_NAME)),
+                        ...grantBindingOf(req, parkedArgs),
                         batchToolCallIds,
                         completedCallIds,
                     }),

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -30,7 +30,8 @@ import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec, ToolEffect } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { ReadDenyMatcher } from "../../tools/fs/read-deny.js";
-import type { SkillGrantLane, SkillGrantTable } from "../skill-grant.js";
+import { type SkillGrantLane, type SkillGrantSource, type SkillGrantTable } from "../skill-grant.js";
+import type { GrantBindingOf } from "../skill-grant-binding.js";
 import { type AllowEntryLane, type AllowEntryTable } from "../allow-entry.js";
 import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, StopForDenialLimit } from "./contracts.js";
 import { type Arbitration } from "../ask-origin.js";
@@ -122,6 +123,8 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — the run's skill grant table; this phase binds its lane to the call facts the person's rule lane
      *  reads (root, session, live cwd, the execution environment's home). Not written here. */
     skillGrants: SkillGrantTable;
+    /** borrowed-readonly — the loaded skills (the table the `Skill` tool activates from); {@link PreparePolicyChainResult.grantBindingOf} reads them. */
+    skillSpecs: readonly SkillGrantSource[];
     /** borrowed-readonly — the request's and the deployment's allow-entry tables (prepare seeded them); this phase binds
      *  their lanes to the same call facts. Not written here. */
     allowedToolTables: {
@@ -218,6 +221,9 @@ export interface PreparePolicyChainResult {
     };
     /** owned — the ONE rule-offer factory for all five ask-mint sites. */
     ruleOffersOf: ReturnType<typeof createRuleOffersOf>;
+    /** owned — the ONE Skill-card binding factory for the same five sites: a call to the engine's `Skill` tool carries the skill and
+     *  its two lists (`boundGrants`) and their hash (`boundGrantDigest`) on the live ask, an ancestor's and the parked row alike. */
+    grantBindingOf: GrantBindingOf;
     /** owned — the personal permission-rule lane, or undefined. */
     permissionRuleLane: PermissionRuleLanes["personal"];
     /** owned — the org permission-rule lane (`Prepared.permissionRuleOrg`), or undefined. */

package/dist/core/runner/prepare-policy-chain.js

@@ -7,14 +7,16 @@ import { assertHookSeatsCallable } from "../hook-seats.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
 import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, wrapToolPolicy, attestAskUnresolvableCause } from "../tool-policy.js";
-import { judgeRuleToolName } from "../tool-name-aliases.js";
+import { judgeRuleToolName, mountedToolNames } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
+import { skillGrantBindingMembers } from "../skill-grant.js";
+import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { autoStrippedRule, cardDisclosureOf } from "../allow-entry.js";
 import { arbitrateByMode, askClassMembersOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
-import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, inheritedAskFallbackMessage, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
+import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, inheritedAskFallbackMessage, judgeInheritedClassifier, lateAskSettlementObserver, resolveInheritedAsk, settleDenialLimitFallback } from "./denial-limit-arms.js";
 import { settleReadRootGrant } from "./read-root-grant.js";
 import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
@@ -22,7 +24,7 @@ import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-
 import { thrownText } from "../thrown-value.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -37,7 +39,7 @@ export async function preparePolicyChain(input) {
     const auditPolicyNames = (auditee) => {
         const nameGroups = toolPolicyNameSets(auditee);
         if (nameGroups.length > 0) {
-            const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
+            const known = mountedToolNames(tools);
             for (const t of harnessTools)
                 known.add(t.name);
             const unmatched = new Set();
@@ -46,9 +48,24 @@ export async function preparePolicyChain(input) {
                     for (const n of list ?? []) {
                         const verdict = judgeRuleToolName(n, known);
                         if (verdict.kind !== "current") {
-                            const err = new Error(verdict.kind === "retired"
-                                ? `tool policy ${kind}-list entry "${n}" is a RETIRED tool name (${verdict.guidance}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`
-                                : `tool policy ${kind}-list entry "${n}" carries the "__" namespace separator but no protocol prefix, and matches nothing in this run's roster — protocol tools are named ${NAMESPACED_NAME_SHAPES}, and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with the owning protocol's marker.`);
+                            const entry = `tool policy ${kind}-list entry "${n}"`;
+                            let message;
+                            switch (verdict.kind) {
+                                case "retired":
+                                    message = `${entry} is a RETIRED tool name (${verdict.guidance}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`;
+                                    break;
+                                case "unprefixed_namespace":
+                                    message = `${entry} carries the "__" namespace separator but no protocol prefix, and matches nothing in this run's roster — protocol tools are named ${NAMESPACED_NAME_SHAPES}, and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with the owning protocol's marker.`;
+                                    break;
+                                case "unmintable_segment":
+                                    message = `${entry} can match no tool, ever (${verdict.guidance}), so it would silently guard nothing.${verdict.currentName !== undefined ? ` Write "${verdict.currentName}".` : ""}`;
+                                    break;
+                                default: {
+                                    const exhaustive = verdict;
+                                    return exhaustive;
+                                }
+                            }
+                            const err = new Error(message);
                             err.code = "config.legacy_tool_name";
                             throw err;
                         }
@@ -285,6 +302,7 @@ export async function preparePolicyChain(input) {
             return {};
         return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
     };
+    const grantBindingOf = (call, args) => skillGrantBindingMembers(call, args, skillSpecs, SKILL_TOOL_NAME);
     const inheritedStationFacts = (call) => {
         const seat = seatMarksOf(call);
         return {
@@ -374,7 +392,7 @@ export async function preparePolicyChain(input) {
             }
             if (judged.kind === "deny")
                 return vetoed(judged.result);
-            const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
+            const { ask: editAsk } = judged;
             re = editAsk;
             const editArbitrated = arbitrateInherited(re, creq.toolCallId, judged);
             if (editArbitrated !== undefined) {
@@ -382,21 +400,22 @@ export async function preparePolicyChain(input) {
                 carryPrecedingSettlement(settledBy, out);
                 return out;
             }
-            const rr = await resolveAsk({
+            const { resolved: rr, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
                 toolName: creq.toolName,
                 toolCallId: creq.toolCallId,
                 args: editArgs,
-                ...ruleOffersOf(creq, editArgs, ancestorFacts(re)),
-                ...cardDisclosureOf(re, inheritedAskFallbackMessage(creq.toolName)),
+                ...ruleOffersOf(creq, editArgs, ancestorFacts(j.ask)),
+                ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
                 ...askSourceIdentity(),
                 ...riskAxesOf(creq),
-                ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                ...askMandateMember(ancestorFacts(re)),
-                ...inheritedAskCarry(judged, isLiveApproverSeat(onAskOf), ancestorTracker),
+                ...grantBindingOf(creq, editArgs),
+                ...(j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                ...askMandateMember(ancestorFacts(j.ask)),
+                ...inheritedAskCarry(j, isLiveApproverSeat(onAskOf), ancestorTracker),
                 ruleEvidence: inheritedAskEvidence,
-            }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
+            }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), ancestorTracker, creq.toolName, inheritedStationFacts(creq));
             void settleReadRootGrant(rr.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
-            settleDenialLimitFallback({ fallback: editFallback, mintedHere: editMintedHere, tracker: ancestorTracker, resolved: rr, headless: headlessDenyAtRecheck, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+            settleDenialLimitFallback({ fallback: settled.fallback, mintedHere: settled.mintedHere, tracker: ancestorTracker, resolved: rr, headless: headlessDenyAtRecheck, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
             if (rr.action !== "allow")
                 return rr;
             settledBy = rr;
@@ -451,7 +470,7 @@ export async function preparePolicyChain(input) {
                         return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
-                    const { ask: inheritedAsk, fallback, mintedHere } = judged;
+                    const { ask: inheritedAsk, fallback } = judged;
                     if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return { action: "allow", decisionReason: "sandbox" };
@@ -461,33 +480,34 @@ export async function preparePolicyChain(input) {
                         return arbitrated;
                     const presentedArgs = creq.args;
                     const askT0 = now();
-                    const resolved = await resolveAsk({
+                    const { resolved, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
-                        ...ruleOffersOf(creq, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                        ...cardDisclosureOf(inheritedAsk, inheritedAskFallbackMessage(creq.toolName)),
+                        ...ruleOffersOf(creq, presentedArgs, ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+                        ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
                         ...askSourceIdentity(),
                         ...riskAxesOf(creq),
-                        ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                        ...askMandateMember(ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                        ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+                        ...grantBindingOf(creq, presentedArgs),
+                        ...(j.ask.action === "ask" && j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                        ...askMandateMember(ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+                        ...inheritedAskCarry(j, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                         ruleEvidence: inheritedAskEvidence,
-                    }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
+                    }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq.toolName, inheritedStationFacts(creq));
                     void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
                     const askWaitMs = Math.max(0, now() - askT0);
                     if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                         if (markInheritedUnavailable(creq.toolCallId))
-                            return inheritedAsk;
+                            return settled.ask;
                         return markerChannelFullDeny(creq);
                     }
-                    settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+                    settleDenialLimitFallback({ fallback: settled.fallback, mintedHere: settled.mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                     if (resolved.action !== "allow")
                         return resolved;
                     if (resolved.updatedInput !== undefined) {
                         return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                     }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(judged.classification).classes);
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(settled.classification).classes);
                     return { action: "allow", decisionReason: "mode" };
                 },
             }
@@ -524,7 +544,7 @@ export async function preparePolicyChain(input) {
                     return judged.result;
                 if (judged.kind === "deny")
                     return judged.result;
-                const { ask: inheritedAsk, fallback, mintedHere } = judged;
+                const { ask: inheritedAsk, fallback } = judged;
                 if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                     recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                     return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput, decisionReason: "sandbox" } : { action: "allow", decisionReason: "sandbox" };
@@ -533,27 +553,28 @@ export async function preparePolicyChain(input) {
                 if (arbitrated !== undefined)
                     return arbitrated;
                 const askT0 = now();
-                const resolved = await resolveAsk({
+                const { resolved, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
                     args: presentedArgs,
-                    ...ruleOffersOf(creq, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                    ...cardDisclosureOf(inheritedAsk, inheritedAskFallbackMessage(creq.toolName)),
+                    ...ruleOffersOf(creq, presentedArgs, ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+                    ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq),
-                    ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                    ...askMandateMember(ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                    ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+                    ...grantBindingOf(creq, presentedArgs),
+                    ...(j.ask.action === "ask" && j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                    ...askMandateMember(ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+                    ...inheritedAskCarry(j, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                     ruleEvidence: inheritedAskEvidence,
-                }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
+                }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq.toolName, inheritedStationFacts(creq));
                 void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
                 const askWaitMs = Math.max(0, now() - askT0);
                 if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                     if (markInheritedUnavailable(creq.toolCallId))
-                        return inheritedAsk;
+                        return settled.ask;
                     return markerChannelFullDeny(creq);
                 }
-                settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+                settleDenialLimitFallback({ fallback: settled.fallback, mintedHere: settled.mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                 if (resolved.action !== "allow")
                     return resolved;
                 if (resolved.updatedInput !== undefined) {
@@ -667,7 +688,7 @@ export async function preparePolicyChain(input) {
             return decision;
         })
         : foldedPolicy;
-    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
+    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
 }
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;