@sema-agent/core 7.42.1 → 7.44.0

package/dist/core/runner/prepare-project-context.js

@@ -11,6 +11,7 @@ import { deliverEngineNotice } from "../engine-notice.js";
 import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
 import { skillLoadReading } from "./skill-base-dir.js";
 import { RosterBuilder } from "../tool-roster.js";
+import { mountedToolNames } from "../tool-name-aliases.js";
 import { asThrownError } from "../thrown-value.js";
 export async function prepareProjectContext(input) {
     const { deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
@@ -88,7 +89,10 @@ export async function prepareProjectContext(input) {
     const frozenSkillGrants = readFrozenSkillGrants(resume?.seed.skillGrants);
     if (frozenSkillGrants === undefined)
         throw new Error("the resumed checkpoint's skill-grant section does not read as grant rows — refusing to seed the run without the refusals it carries (the resume screen refuses this row before the claim)");
-    const inert = seedAllowEntryTables(allowedToolTables, { skillInert: seedSkillGrants(skillGrants, { skills: skillSpecs, userInvokedSkills: spec.userInvokedSkills, inherited: [...(internals?.inheritedSkillGrants ?? []), ...frozenSkillGrants] }), inherited: internals?.inheritedAllowedTools, request: allowedTools, deployment: deps.allowedTools });
+    const mounted = () => mountedToolNames(tools);
+    skillGrants.bindMountedNames(mounted);
+    skillGrants.bindSkills(skillSpecs, SKILL_TOOL_NAME);
+    const inert = seedAllowEntryTables(allowedToolTables, { skillInert: seedSkillGrants(skillGrants, { skills: skillSpecs, userInvokedSkills: spec.userInvokedSkills, inherited: [...(internals?.inheritedSkillGrants ?? []), ...frozenSkillGrants] }), inherited: internals?.inheritedAllowedTools, request: allowedTools, deployment: deps.allowedTools }, mounted());
     if (inert.length > 0)
         deliverEngineNotice(deps.onNotice, allowedToolsNotGrantedNotice(inert, sessionId));
     if (skillSpecs.length > 0) {
@@ -99,7 +103,7 @@ export async function prepareProjectContext(input) {
         }
         roster.mount(createSkillTool(skillSpecs, skillGrants), { source: "builtin", mountedBy: "optional" });
     }
-    const skillSeatOf = skillSeatReader(skillSpecs);
+    const skillSeatOf = skillSeatReader(skillSpecs, mounted);
     const sharedMemoryProvider = deps.sharedMemoryStores;
     let sharedMemoryPairMounted = false;
     if (sharedMemoryProvider !== undefined) {

package/dist/core/runner/prepare-task.js

@@ -407,7 +407,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         let readDenyAdditionsNormalized = [];
         let handsLessResolvedFace;
         let handsLessResolvedWriteFace;
-        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, skillGrantCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, requestAllowedTools: allowedToolTables.request, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDeciderRef.current, autoModeDenialTracking: () => autoModeDenialTrackingRef.current, autoModeArming: () => autoModeArmingRef.current, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, resolvedWriteFace: () => resolvedWriteFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, handsLessResolvedWriteFace: () => handsLessResolvedWriteFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
+        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, skillGrantCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, askSeat: doors.askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, requestAllowedTools: allowedToolTables.request, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDeciderRef.current, autoModeDenialTracking: () => autoModeDenialTrackingRef.current, autoModeArming: () => autoModeArmingRef.current, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, resolvedWriteFace: () => resolvedWriteFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, handsLessResolvedWriteFace: () => handsLessResolvedWriteFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
         bindPermissionModeSeat(permissionMode);
         const announceRuleStoreSkipped = ruleStoreUnreadableNotice(deps.onNotice, { sessionId, runId });
         const persistedPathRowsRead = persistedPathRowsOfTask({ deps, principal: spec.principal, sessionId, root: taskRootFinal, home: executionEnv.homeDir, taskId: hostTaskId, handsEnabled, signals: [abortController.signal, ...(spec.signal !== undefined ? [spec.signal] : [])], onUnread: announceRuleStoreSkipped });
@@ -415,7 +415,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectivePathDenyRules = [...toolPolicyPathDenyRules([lockedPreflight.toolPolicy, ...(inheritedParentConstraints ?? []).map((c) => c.policy)]), ...persistedPathRows.denyRows];
         const writeProtectionJudgeRef = {};
         const writeGuards = { protection: () => writeProtectionJudgeRef.current, target: toolPolicyWriteTargetGuard([lockedPreflight.toolPolicy, ...(inheritedParentConstraints ?? []).map((c) => c.policy)]) };
-        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDeciderRef, autoModeDenialTrackingRef, autoModeArmingRef, armAutoMode, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, parentSpecSeat, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries: () => ({ entries: readDenyMatcher?.entries ?? [], ruleRows: effectivePathDenyRules }), peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
+        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDeciderRef, autoModeDenialTrackingRef, autoModeArmingRef, armAutoMode, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, askSeat: doors.askSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, parentSpecSeat, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries: () => ({ entries: readDenyMatcher?.entries ?? [], ruleRows: effectivePathDenyRules }), peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
         const tools = roster.tools;
         const pausedRef = {};
         const undeliveredContinuationRef = { current: { parkedSteers: [], orphanTasks: [] } };
@@ -733,8 +733,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
-        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, askSeat: doors.askSeat, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox });
         const writeProtectionCheck = writeProtection?.check;
         writeProtectionJudgeRef.current = writeProtection?.judgeTarget;
         if (fileHistoryBoundary !== undefined) {
@@ -743,10 +743,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return undefined;
             });
         }
-        const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
+        const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
-        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, skillSpecs, now, humanReviewRef, abortController, harness, pausedRef });
+        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef });
         const seatInputsFor = skillGateWiring({ tools, skillToolName: SKILL_TOOL_NAME, seatOf: skillSeatOf, mode: () => permissionMode.current, lane: skillGrantLane, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.skill_allowed", version: 1, taskId: hostTaskId, ...info, entries: [...info.entries], ts: Date.now() })), allowEntries: { deploymentAllows: { ...allowEntryLanes.deployment, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "deployment", ...info, entries: [...info.entries], ts: Date.now() })) }, requestAllows: { ...allowEntryLanes.request, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "request", ...info, entries: [...info.entries], ts: Date.now() })) } } });
         const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.pathDenyRules.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
         const postureFrameRef = { report: (err) => deps.onError?.(err, { phase: "degraded", sessionId }) };

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -36,12 +36,12 @@ import { type AutoModeArmFact, type WiringManifest, type WiringManifestMcpEntry
 import { type PermissionModeController } from "../mode-policy.js";
 import type { AnnounceOnceSink, Prepared, PrepareResume, RunInternals, UsageGovernance } from "./contracts.js";
 export interface PrepareWiringManifestInput {
-    /** borrowed-readonly — the REBOUND spec. Read: `onAsk` (the own seat), `onQuestion` (the question seam), `handsReadOnly` / `tools` (the ungated scan),
+    /** borrowed-readonly — the REBOUND spec. Read: `onQuestion` (the question seam), `handsReadOnly` / `tools` (the ungated scan),
      *  `resourceSuspend` (the task-axis lane), `durableApproval` / `principal` (the synthesis and the notice), `interactiveTools` /
      *  `mcp` / `checkpointStore` (manifest cells and the notice's cause), `enablePlanMode` (the gate-machinery predicate's
      *  plan-mode term). Never mutated. */
-    spec: Pick<TaskSpec, "onAsk" | "onQuestion" | "handsReadOnly" | "tools" | "resourceSuspend" | "durableApproval" | "principal" | "interactiveTools" | "mcp" | "checkpointStore" | "enablePlanMode" | "hooks" | "peerPresence">;
-    /** borrowed-readonly — the deployment seats, whole: `onAsk` (the seat's deps half), `onError` (the warning), `executionEnv`
+    spec: Pick<TaskSpec, "onQuestion" | "handsReadOnly" | "tools" | "resourceSuspend" | "durableApproval" | "principal" | "interactiveTools" | "mcp" | "checkpointStore" | "enablePlanMode" | "hooks" | "peerPresence">;
+    /** borrowed-readonly — the deployment seats, whole: `onError` (the warning), `executionEnv`
      *  (the hook-env predicate), `checkpointStore` (durable infra), the manifest's dozen wiring facts (`backgroundAgentStore`,
      *  `permissionRuleStore`, `permissionRuleSyncWired`, `onBackgroundChildEvent`, `lockedConfig`, `compliancePostureResolver`,
      *  `memoryScopeAdmission`, `retentionPolicy`, `onElicit`), `onNotice`, the write-protection judge's compile seats
@@ -141,8 +141,9 @@ export interface PrepareWiringManifestInput {
     harness: AgentHarness;
     /** borrowed-readonly — the durable-suspend holder; the drain's parked predicate reads `token` at run time. Not written here. */
     pausedRef: Prepared["pausedRef"];
-    /** borrowed-readonly — the FROZEN approver seat (the notice's liveApprover fact). */
-    frozenOnAsk: OnAsk | undefined;
+    /** borrowed-readonly — the run's approval seat as the config doors froze it: the gate's approver and the notice's facts (its
+     *  value), the manifest's ask cell (its form and provenance). */
+    askSeat: import("../wiring-manifest.js").AskSeat;
     /** borrowed-readonly — the LIVE half of the inherited chain (the notice reads its content mandates). */
     liveInheritedGate: RunInternals["inheritedGate"];
     /** borrowed-readonly — the effective delegation facts (the identity's isDelegatedChild). */

package/dist/core/runner/prepare-wiring-manifest.js

@@ -11,7 +11,7 @@ import { inlineUntrusted } from "../untrusted-text.js";
 import { mountWriteProtection } from "./write-protection-station.js";
 import { autoRunOnRecommendationEffective } from "./memory-consolidation-driver.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
-import { LSP_CONTRACT_ID, askSeatEffective, countElicitOptIns, deriveHandsSeam, deriveLspSeam, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
+import { LSP_CONTRACT_ID, askSeatEffective, countElicitOptIns, deriveHandsSeam, deriveLspSeam, deriveWiringManifest, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
 import { modePolicyOf } from "../mode-policy.js";
 import { DEFAULT_IRREVERSIBLE_SCOPE } from "./checkpoint-scope.js";
 export function mcpManifestEntries(entries, statuses) {
@@ -102,9 +102,9 @@ function announceDurableGateUnavailable(args) {
         message: `Durable approval gate mandated but unavailable: ${source === "force_durable_gate" ? "the runtime entitlement forceDurableGate is in force for this principal" : "this task opted into durable approval (durableApproval) with no live approver seat"}, ` +
             `but ${cause === "task_store_disabled" ? 'this task disabled the checkpoint store (checkpointStore: "disabled")' : "this deployment wired no checkpoint store"}, ` +
             `so no interactive ask of this task can be parked for a durable answer. Asks resolve on the live chain instead ` +
-            `(${args.liveApprover ? "a live approver answers permission asks in-stream" : args.blanketAllow ? 'a blanket "allow" posture answers ordinary permission asks without judgment (a mandated ask is refused)' : "permission asks are denied fail-closed — no live approver is wired"}; ` +
+            `(${args.liveApprover ? "a live approver answers permission asks in-stream" : args.blanketAllow ? 'a blanket "allow" posture answers ordinary permission asks without judgment (a mandated ask is refused)' : "permission asks are denied fail-closed — nobody in this run can be asked to approve them"}; ` +
             `${liveQuestionFace ? "a live question face answers AskUserQuestion in-stream" : args.liveQuestionFace ? "AskUserQuestion is withheld from the live face by an inherited durable mandate and refused" : "AskUserQuestion has no live face and is refused"}) ` +
-            `and NO durable approval record is written. ${cause === "task_store_disabled" ? "Run this task with its store" : "Wire a checkpoint store on this deployment"}, or ${source === "force_durable_gate" ? "withdraw the entitlement for principals served here" : "give the task a live approver seat (or drop durableApproval)"}.`,
+            `and NO durable approval record is written. ${cause === "task_store_disabled" ? "Run this task with its store" : "Wire a checkpoint store on this deployment"}, or ${source === "force_durable_gate" ? "withdraw the entitlement for principals served here" : args.declaredNone ? 'run the task where a person can be asked (without approvalReach: "none"), or drop durableApproval' : "give the task a live approver seat (or drop durableApproval)"}.`,
         detail: {
             sessionId: args.sessionId,
             runId: args.runId,
@@ -117,8 +117,8 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, lspDiagnosticsLive, fileHistoryFact } = input;
-    const onAsk = spec.onAsk ?? deps.onAsk;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, lspDiagnosticsLive, fileHistoryFact } = input;
+    const onAsk = askSeat.value;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
     const hasEffectAwareGate = Boolean(policyLayers.length > 0 || (hooks?.preToolUse !== undefined && !preToolUseObservational));
     const peerWriteUngated = modePolicyOf(permissionMode.current).unstated === "ask"
@@ -181,14 +181,13 @@ export function prepareWiringManifest(input) {
     const writeProtection = mountWriteProtection({ deps, env: handsEnabled ? executionEnv : undefined, rootPath: taskRootFinal, roster: toolRoster, sessionId, runId });
     const wiringQuestionSeam = resolveQuestionSeam(spec, deps);
     const wiringQuestionStripped = internals?.questionFaceStripped === true;
-    const wiringAskSeam = resolveAskSeamForm(spec, deps);
     const wiringManifest = deriveWiringManifest({
         half: "effective",
         leg: resume !== undefined ? "resume" : internals?.isDelegatedChild === true ? "child" : "root",
         teamRole: teamRoleOf({ isDelegatedChild: delegation.isDelegatedChild, ...(internals?.explicitAgentName !== undefined ? { spawnName: internals.explicitAgentName } : {}) }),
         ...(spec.peerPresence !== undefined ? { peerPresence: spec.peerPresence } : {}),
-        askForm: wiringAskSeam.form,
-        ...(wiringAskSeam.provenance !== undefined ? { askProvenance: wiringAskSeam.provenance } : {}),
+        askForm: askSeat.form,
+        ...(askSeat.provenance !== undefined ? { askProvenance: askSeat.provenance } : {}),
         questionWired: wiringQuestionSeam.wired,
         ...(wiringQuestionSeam.provenance !== undefined ? { questionProvenance: wiringQuestionSeam.provenance } : {}),
         ...(wiringQuestionStripped ? { questionStrippedByEngine: true } : {}),
@@ -254,7 +253,7 @@ export function prepareWiringManifest(input) {
         resourceSuspendEligible ||
         platformSuspendArmed ||
         spec.enablePlanMode === true;
-    announceDurableGateUnavailable({ onNotice: deps.onNotice, mandate: durableMandateSourceOf({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined, onAsk: frozenOnAsk }), storeWired: checkpointStore !== undefined, taskStoreDisabled: spec.checkpointStore === "disabled", liveApprover: isLiveApproverSeat(frozenOnAsk), blanketAllow: frozenOnAsk === "allow", liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
+    announceDurableGateUnavailable({ onNotice: deps.onNotice, mandate: durableMandateSourceOf({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined, onAsk }), storeWired: checkpointStore !== undefined, taskStoreDisabled: spec.checkpointStore === "disabled", liveApprover: isLiveApproverSeat(onAsk), blanketAllow: onAsk === "allow", declaredNone: askSeat.reach === "none", liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
     const hookIdentity = mintHookInvocationIdentity({
         sessionId,
         taskId: hostTaskId,

package/dist/core/runner/resume-checkpoint-screen.js

@@ -48,7 +48,7 @@ export function resumeCheckpointScreen(input) {
             }
         }
         if (readFrozenSkillGrants(cp.state.skillGrants) === undefined)
-            throw new CheckpointError("checkpoint.invalid_outcome", "this checkpoint carries a skill-grant section (state.skillGrants) that does not read as grant rows — refusing to resume without the grant rows and refusals it carries (corruption guard), the checkpoint stays pending", { reason: "skill_grants_damaged" });
+            throw new CheckpointError("checkpoint.invalid_outcome", "this checkpoint carries a skill-grant section (state.skillGrants) that does not read as grant rows under this engine — a damaged section, or a row an earlier release wrote whose entry this release reads as nothing (an entry with a surrounding space, say) — refusing to resume without the grant rows and refusals it carries; the checkpoint stays pending: finish it on a worker of the release that parked it, or expire it", { reason: "skill_grants_damaged" });
     }
     if (realApprovalOrgFact(preCasGateBit) !== undefined && runner.deps.permissionRuleStore?.partitions.org !== true) {
         throw new CheckpointError("checkpoint.unsupported_version", `this checkpoint's approval was minted under organization governance (org ${String(realApprovalOrgFact(preCasGateBit))}, routed as ${String(preCasGateBit?.origin)}) and this worker has no org adjudication wiring (its permission-rule store carries no org partition) — a governed approval may only be redeemed where governance can be enforced; the checkpoint stays pending, resume it on an org-wired worker`, { reason: "governed_unwired" });

package/dist/core/runner/runtask.js

@@ -40,6 +40,7 @@ import { resumeClaim } from "./resume-claim.js";
 import { streamSettleBackstop } from "./stream-settle-backstop.js";
 import { streamReap } from "./stream-reap.js";
 import { streamSteerVerb } from "./stream-steer-verb.js";
+import { steeringError } from "./steer-admission.js";
 import { streamLifecycleVerbs } from "./stream-lifecycle-verbs.js";
 import { streamHaltVerbs } from "./stream-halt-verbs.js";
 import { streamModeVerb } from "./stream-mode-verb.js";
@@ -411,11 +412,6 @@ export class Runner {
             locallyClaimedTokens: this.locallyClaimedTokens, parentConstraintRegistry: this.parentConstraintRegistry, suspendedEnvReaps: this.suspendedEnvReaps,
         }).onRunRejected);
         void settled.then(() => acceptedSteerInputs.clear(), () => acceptedSteerInputs.clear());
-        const steeringError = (msg, code = "steering.not_running") => {
-            const e = new Error(`cannot steer: ${msg}`);
-            e.code = code;
-            return e;
-        };
         const { reapSuspended } = streamReap({
             live, runner: this.depsSeat,
             locallyClaimedTokens: this.locallyClaimedTokens, parentConstraintRegistry: this.parentConstraintRegistry, suspendedEnvReaps: this.suspendedEnvReaps,

package/dist/core/runner/steer-admission.d.ts

@@ -1,14 +1,15 @@
 /**
- * Admission bookkeeping for HUMAN INPUTS accepted mid-run: the per-leg ordinal an
- * accepted input is stamped with, and the field-for-field "is this repeat the same instruction" test the
- * live steer verb applies under an already-used `inputId`. Two accepting arms share both — the stream's
- * `steer` verb and the run body — which is why the ordinal is keyed on the leg's harness in a module-level
- * WeakMap rather than held by either arm: one counter per leg, one ascending sequence across both.
+ * Admission bookkeeping for HUMAN INPUTS accepted mid-run: the per-leg ordinal an accepted input is stamped
+ * with, and the acceptance frame's once-only seat. Two accepting arms share the ordinal — the stream's `steer`
+ * verb and the run body — which is why it is keyed on the leg's harness in a module-level WeakMap rather than
+ * held by either arm: one counter per leg, one ascending sequence across both. Also the stream verbs' typed
+ * refusal. (Whether a repeat under a used `inputId` is the same instruction is steer-replay.ts's one judgement,
+ * shared with the parked queue.)
  *
  * Run-loop machinery (layer 1), not a driven lane: nothing here takes an Input or hands back a Result, and
  * nothing here reads host state. Named without the `run-` family prefix for that reason.
  */
-import type { AcceptedSteerInput } from "./contracts.js";
+import type { SteerReplayRefusalDetail } from "../steer-replay.js";
 export declare function nextHumanInputSeq(key: object): number;
 /** The identity keys a published `queued` frame carried beyond its own `eventId` (`parentToolCallId`, `sourceTaskId`): one fact, stated
  *  once by the frame's publisher and handed to whoever mints that input's other frames, so two frames of one input are never stamped
@@ -19,8 +20,6 @@ export type AcceptanceIdentity = {
 };
 export declare function armAcceptance(record: object, publish: () => AcceptanceIdentity): void;
 export declare function announceAcceptance(record: object): AcceptanceIdentity | undefined;
-/** Is a repeat under an already-accepted `inputId` the SAME
- *  instruction (an idempotent retry) or a different one wearing a used key? Compared field for field,
- *  exactly like the parked leg's replay check: the key alone is never evidence of a replay, and two
- *  callers colliding on one id must not silently lose the second instruction. */
-export declare function sameAcceptedSteerInput(a: AcceptedSteerInput, b: AcceptedSteerInput): boolean;
+/** The stream verbs' typed refusal: `cannot steer: <msg>`, `code` (`steering.not_running` by default), and the
+ *  refusal's `detail` when the code carries one (`steering.duplicate_input_id` always does). */
+export declare function steeringError(msg: string, code?: string, detail?: SteerReplayRefusalDetail): Error;

package/dist/core/runner/steer-admission.js

@@ -1,4 +1,3 @@
-import { steerPriorityOf } from "../task-notification.js";
 const humanInputOrdinals = new WeakMap();
 export function nextHumanInputSeq(key) {
     let box = humanInputOrdinals.get(key);
@@ -16,11 +15,10 @@ export function armAcceptance(record, publish) {
 export function announceAcceptance(record) {
     return acceptanceSeats.get(record)?.();
 }
-export function sameAcceptedSteerInput(a, b) {
-    return (a.payload === b.payload &&
-        a.trusted === b.trusted &&
-        steerPriorityOf(a) === steerPriorityOf(b) &&
-        a.actor?.id === b.actor?.id &&
-        a.actor?.hostAsserted === b.actor?.hostAsserted &&
-        a.actor?.issuer === b.actor?.issuer);
+export function steeringError(msg, code = "steering.not_running", detail) {
+    const e = new Error(`cannot steer: ${msg}`);
+    e.code = code;
+    if (detail !== undefined)
+        e.detail = detail;
+    return e;
 }

package/dist/core/runner/stream-steer-verb.d.ts

@@ -1,6 +1,7 @@
 import type { PushQueue } from "../push-queue.js";
 import { type TaskEvent, type TaskSpec, type TaskStream } from "../types.js";
-import type { AcceptedSteerInput, LiveHandle, RunInternals, RunnerDepsSeat, TaskStreamLiveSeat } from "./contracts.js";
+import type { LiveHandle, RunInternals, RunnerDepsSeat, TaskStreamLiveSeat } from "./contracts.js";
+import { type SteerReplayRecord, type SteerReplayRefusalDetail } from "../steer-replay.js";
 export interface StreamSteerVerbInput {
     /** borrowed-readonly — the task spec (the hooks seat, `principal`, `taskId`). */
     spec: TaskSpec;
@@ -9,7 +10,7 @@ export interface StreamSteerVerbInput {
     /** borrowed-mutable — the stream's event queue: the `human_input` receipt is pushed here on acceptance. */
     queue: PushQueue<TaskEvent>;
     /** borrowed-mutable — this stream's accepted-input dedup domain (the SAME Map the driver clears when the run settles). */
-    acceptedSteerInputs: Map<string, AcceptedSteerInput>;
+    acceptedSteerInputs: Map<string, SteerReplayRecord>;
     /** borrowed-readonly — the stream's live state: `resultValue` and `handle`, read at each liveness test. */
     live: TaskStreamLiveSeat;
     /** borrowed-readonly — the readiness promise (settles to the live handle, or `undefined` when the run ended first). */
@@ -18,8 +19,8 @@ export interface StreamSteerVerbInput {
     orTimeout: <T>(p: Promise<T>) => Promise<T | undefined>;
     /** borrowed-readonly — the readiness bound in ms; the birth-window poll's deadline reads it too. */
     readyTimeoutMs: number;
-    /** borrowed-readonly — the driver's typed steering refusal (`steering.not_running` by default). */
-    steeringError: (msg: string, code?: string) => Error;
+    /** borrowed-readonly — the driver's typed steering refusal (`steering.not_running` by default; `detail` rides the error). */
+    steeringError: (msg: string, code?: string, detail?: SteerReplayRefusalDetail) => Error;
     /** borrowed-readonly — the Runner's deployment deps, read LIVE (`hooks`, `onError`, `onNotice`, after awaits too). */
     runner: RunnerDepsSeat;
 }

package/dist/core/runner/stream-steer-verb.js

@@ -6,7 +6,8 @@ import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "
 import { isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
-import { announceAcceptance, armAcceptance, nextHumanInputSeq, sameAcceptedSteerInput } from "./steer-admission.js";
+import { announceAcceptance, armAcceptance, nextHumanInputSeq } from "./steer-admission.js";
+import { steerReplayRefusal } from "../steer-replay.js";
 import { asThrownError } from "../thrown-value.js";
 export function streamSteerVerb(input) {
     const { spec, internals, queue, acceptedSteerInputs, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, steeringError, runner } = input;
@@ -43,7 +44,6 @@ export function streamSteerVerb(input) {
         };
         let payload;
         let mintsAFrame;
-        let replay;
         const publishQueued = (h) => {
             const identity = internals?.parentToolCallId !== undefined ? { parentToolCallId: internals.parentToolCallId, ...(spec.taskId !== undefined ? { sourceTaskId: spec.taskId } : {}) } : {};
             queue.push({
@@ -66,7 +66,7 @@ export function streamSteerVerb(input) {
             if (!mintsAFrame)
                 return;
             if (typeof inputId === "string")
-                acceptedSteerInputs.set(inputId, replay);
+                acceptedSteerInputs.set(inputId, parkRecord);
             announceAcceptance(parkRecord);
         };
         const deliver = async () => {
@@ -77,16 +77,14 @@ export function streamSteerVerb(input) {
                 throw steeringError("the task is not running");
             payload = trusted ? formatHookFeedback(projected, h.reminderMark) : frameMidTurnUserInput(projected);
             mintsAFrame = payload.trim().length !== 0;
-            replay = { payload, trusted, priority, ...(actor !== undefined ? { actor } : {}) };
             if (typeof inputId === "string") {
                 const prior = acceptedSteerInputs.get(inputId);
                 if (prior !== undefined) {
                     if (live.resultValue !== undefined || h.loop.ended)
                         throw steeringError("the task is no longer running");
-                    if (!sameAcceptedSteerInput(prior, replay)) {
-                        throw steeringError("a different steering instruction was already accepted under this inputId — re-issue this one with a fresh inputId " +
-                            "(an identical payload would have been an idempotent retry)", "steering.duplicate_input_id");
-                    }
+                    const refusal = steerReplayRefusal(prior, parkRecord, { seat: "accepted" });
+                    if (refusal !== undefined)
+                        throw steeringError(refusal.message, "steering.duplicate_input_id", refusal.detail);
                     return;
                 }
             }

package/dist/core/runner/synthetic-tools.d.ts

@@ -169,9 +169,10 @@ export declare function renderSkillLinesWithin(skills: ReadonlyArray<SkillListin
  *
  * A SUCCESSFUL activation writes the skill's two lists into the run's grant table (`grants`, origin `model`): its
  * `allowed-tools` then run without asking and its `disallowed-tools` are refused for the rest of the run; an unknown skill
- * throws first and writes nothing. Activating a skill that declares a list was itself a question (the gate reads this
+ * throws first and writes nothing, as does one whose `disallowed-tools` holds an entry that reads as nothing (the table
+ * refuses it: the body is not served, nothing is granted). Activating a skill that declares a list was itself a question (the gate reads this
  * tool's seat off the call's arguments — `Execute skill: <name>`), so a write here always follows a statement. The tool
  * runs ALONE in its batch: a call after it in the same message is judged after the rows exist.
  */
-export declare function createSkillTool(skills: SkillLike[], grants?: SkillGrantTable): AgentTool;
+export declare function createSkillTool(skills: SkillLike[], grants: SkillGrantTable): AgentTool;
 export {};

package/dist/core/runner/synthetic-tools.js

@@ -188,7 +188,7 @@ export function createSkillTool(skills, grants) {
                     `(Only skills registered with this deployment are loadable — other products' skills directories are not read. ` +
                     `If the user wants one of those here, read its source file and recreate its content for this deployment instead.)`);
             }
-            grants?.activate(skill, "model");
+            grants.activate(skill, "model");
             const baseDir = skill.baseDir;
             let body = baseDir !== undefined ? substituteSkillRoot(skill.content, baseDir) : skill.content;
             if (skill.files !== undefined && skill.files.length > 0) {

package/dist/core/session-policy-store.d.ts

@@ -53,7 +53,7 @@ export interface PutRulesOptions {
     operator?: boolean;
 }
 /** The {@link SessionPolicyError.detail} of a tool-name refusal: which bucket, which entry, the judgment's word, and the
- *  1:1 successor when the retired name has one. */
+ *  spelling to write instead when the judgment has one (a retired name's 1:1 successor, an unmintable segment's minted name). */
 export interface SessionRuleNameRefusal {
     field: SessionRuleToolNameField;
     name: string;
@@ -63,8 +63,8 @@ export interface SessionRuleNameRefusal {
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`
  *  = a non-operator write tried to relax the rules; `corrupt` = a backend could not read the erase-surviving
  *  rev mark ({@link SessionPolicyStore.deleteBySession}) and refuses rather than stamp an unproven rev; the fourth
- *  code = a tool-name bucket names a retired or prefix-less name ({@link assertSessionRuleNamesCurrent}) — `detail` is
- *  present on that code and only on it. */
+ *  code = a tool-name bucket names a retired name, a prefix-less `__` name or a peer segment no mint spells
+ *  ({@link assertSessionRuleNamesCurrent}) — `detail` is present on that code and only on it. */
 export declare class SessionPolicyError extends Error {
     readonly code: "conflict" | "loosen_forbidden" | "corrupt" | "legacy_tool_name";
     readonly detail?: SessionRuleNameRefusal | undefined;

package/dist/core/session-policy-store.js

@@ -40,10 +40,24 @@ export function assertSessionRuleNamesCurrent(rules, mountedToolNames = NO_DECLA
             if (verdict.kind === "current")
                 continue;
             const quoted = JSON.stringify(name);
-            const successor = verdict.kind === "retired" ? verdict.currentName : undefined;
-            throw new SessionPolicyError("legacy_tool_name", verdict.kind === "retired"
-                ? `session rules ${field} names ${quoted}, a retired tool name (${verdict.guidance}) — with it in place no run of this session could start, so nothing was written.${successor !== undefined ? ` Use the current name ${JSON.stringify(successor)}.` : ""} If this deployment mounts its own tool under ${quoted}, declare it in the store's mountedToolNames.`
-                : `session rules ${field} names ${quoted}, which carries the "__" namespace separator but no protocol prefix — no tool is named that way (protocol tools are named ${NAMESPACED_NAME_SHAPES}), and with it in place no run of this session could start, so nothing was written.`, { field, name, verdict: verdict.kind, ...(successor !== undefined ? { currentName: successor } : {}) });
+            const successor = verdict.kind === "unprefixed_namespace" ? undefined : verdict.currentName;
+            let message;
+            switch (verdict.kind) {
+                case "retired":
+                    message = `session rules ${field} names ${quoted}, a retired tool name (${verdict.guidance}) — with it in place no run of this session could start, so nothing was written.${successor !== undefined ? ` Use the current name ${JSON.stringify(successor)}.` : ""} If this deployment mounts its own tool under ${quoted}, declare it in the store's mountedToolNames.`;
+                    break;
+                case "unprefixed_namespace":
+                    message = `session rules ${field} names ${quoted}, which carries the "__" namespace separator but no protocol prefix — no tool is named that way (protocol tools are named ${NAMESPACED_NAME_SHAPES}), and with it in place no run of this session could start, so nothing was written.`;
+                    break;
+                case "unmintable_segment":
+                    message = `session rules ${field} names ${quoted}, which can match no tool (${verdict.guidance}) — with it in place no run of this session could start, so nothing was written.${successor !== undefined ? ` Write ${JSON.stringify(successor)}.` : ""}`;
+                    break;
+                default: {
+                    const exhaustive = verdict;
+                    return exhaustive;
+                }
+            }
+            throw new SessionPolicyError("legacy_tool_name", message, { field, name, verdict: verdict.kind, ...(successor !== undefined ? { currentName: successor } : {}) });
         }
     }
 }

package/dist/core/skill-grant-binding.d.ts

@@ -0,0 +1,44 @@
+/**
+ * What a Skill card's approval is bound to, as ONE value: the skill the call names and the two lists approving it releases,
+ * in the rule grammar's canonical spelling (de-duplicated, sorted). Its hash is the `boundGrantDigest` a parked approval is
+ * judged by, so a reader holds the list a person approved and the binding that covers it as the same fact — the live
+ * `AskRequest`, the parked row and the inbox projection all carry it (minted by `skillGrantBindingMembers`).
+ *
+ * A leaf on purpose: the checkpoint projection reads it at its boundary and may not import the module that mints it (it imports only
+ * the hash).
+ */
+export interface BoundSkillGrants {
+    /** The skill's name as the loaded table spells it, or `null` when the call names no loaded skill (it grants nothing). */
+    readonly skill: string | null;
+    /** The skill's `allowed-tools` entries — what approving the activation lets be used without asking. */
+    readonly allowedTools: readonly string[];
+    /** The skill's `disallowed-tools` entries — what activating it refuses for the rest of the run. */
+    readonly disallowedTools: readonly string[];
+}
+/**
+ * A stored value read as a {@link BoundSkillGrants}, whole or not at all: a fresh copy of the three members and nothing else,
+ * or `undefined` when any member is not of its type. Every member is read ONCE, so the value screened is the value published.
+ */
+export declare function readBoundSkillGrants(raw: unknown): BoundSkillGrants | undefined;
+/** The card members a call to the engine's `Skill` tool carries on every face its card has — empty for any other call. */
+export interface SkillGrantBindingMembers {
+    /** The hash of {@link boundGrants}: the binding a parked approval of the card is judged by. */
+    boundGrantDigest?: string;
+    boundGrants?: BoundSkillGrants;
+}
+/** The leg's binding factory ({@link SkillGrantBindingMembers} for a call over `args`), the one every ask-mint site spreads. */
+export type GrantBindingOf = (call: {
+    readonly toolName: string;
+}, args: unknown) => SkillGrantBindingMembers;
+/**
+ * The binding members of a stored parked row, as the inbox projection publishes them: the digest when it is a string, and the lists
+ * only as the value that digest hashes — {@link readBoundSkillGrants} whole, and equal to the digest by hash. A pair that
+ * disagrees, or lists beside no digest, would show an approver one list while the approval binds another: the lists read as absent.
+ */
+export declare function readBoundBinding(row: {
+    readonly boundGrantDigest?: unknown;
+    readonly boundGrants?: unknown;
+} | undefined): {
+    boundGrantDigest?: string;
+    boundGrants?: BoundSkillGrants;
+};

package/dist/core/skill-grant-binding.js

@@ -0,0 +1,22 @@
+import { boundInputHashOf } from "./canonical-json.js";
+export function readBoundSkillGrants(raw) {
+    if (typeof raw !== "object" || raw === null)
+        return undefined;
+    const { skill, allowedTools: allowed, disallowedTools: disallowed } = raw;
+    if (skill !== null && typeof skill !== "string")
+        return undefined;
+    const entries = (list) => {
+        if (!Array.isArray(list))
+            return undefined;
+        const copy = Array.from(list);
+        return copy.every((e) => typeof e === "string") ? copy : undefined;
+    };
+    const allowedTools = entries(allowed);
+    const disallowedTools = entries(disallowed);
+    return allowedTools !== undefined && disallowedTools !== undefined ? { skill, allowedTools, disallowedTools } : undefined;
+}
+export function readBoundBinding(row) {
+    const digest = row?.boundGrantDigest;
+    const grants = readBoundSkillGrants(row?.boundGrants);
+    return { ...(typeof digest === "string" ? { boundGrantDigest: digest } : {}), ...(grants !== undefined && typeof digest === "string" && boundInputHashOf(grants) === digest ? { boundGrants: grants } : {}) };
+}