@sema-agent/core 7.42.1 → 7.44.0

package/dist/core/skill-grant.d.ts

@@ -2,7 +2,8 @@ import type { PermissionResult, ToolCallRequest } from "./tool-policy.js";
 import type { PermissionMode } from "./ask-origin.js";
 import { type PermissionSeatInputs, type PermissionSeatReading } from "./mode-policy.js";
 import type { AgentTool } from "../internal/harness-types.js";
-import { type AllowEntryGateSeats, type AllowEntryInertReason, type AllowEntryJudgeContext, type CompiledAllowEntry } from "./allow-entry.js";
+import type { SkillGrantBindingMembers } from "./skill-grant-binding.js";
+import { type AllowEntryGateSeats, type AllowEntryInert, type AllowEntryJudgeContext, type CompiledAllowEntry } from "./allow-entry.js";
 /** Who wrote a row: the `Skill` tool on a successful activation, prepare for a skill the person invoked by name, or a
  *  delegated child's seed from its parent. */
 export declare const SKILL_GRANT_ORIGINS: readonly ["model", "user", "inherited"];
@@ -25,12 +26,12 @@ export interface SkillGrantRow {
     readonly compiled: CompiledAllowEntry;
 }
 /** An entry the grammar reads as granting or refusing nothing. */
-export interface SkillInertEntry {
+export type SkillInertEntry = {
     readonly skill: string;
     readonly list: "allowed-tools" | "disallowed-tools";
-    readonly entry: string;
-    readonly reason: AllowEntryInertReason;
-}
+} & AllowEntryInert;
+/** The names the run mounts, read when a list is — a skill is activated later than prepare, and the roster is read as it stands. */
+export type MountedToolNames = () => ReadonlySet<string>;
 /** The two lists a skill declares (the shape of a `SkillSpec`, read by name). */
 export interface SkillGrantSource {
     readonly name: string;
@@ -45,23 +46,19 @@ export interface SkillGrantSource {
  * the person's invoked names are read through it ({@link seedSkillGrants}).
  */
 export declare function skillNamedBy<T extends Pick<SkillGrantSource, "name">>(args: unknown, skills: readonly T[]): T | undefined;
-/**
- * The digest of what a Skill card disclosed — `Execute skill: <name>` and the lists approving it releases: the skill's name
- * as the table spells it ({@link skillNamedBy} resolved it, so it equals the call's `skill` exactly) and its two lists in the
- * rule grammar's canonical spelling (`Tool()` / `Tool(*)` read as the bare name), de-duplicated and sorted, hashed as the
- * approval binding is hashed (`boundInputHashOf`). `undefined` — no skill named — digests as a nameless skill declaring
- * nothing (activating it grants nothing). Any change to the name or to either list changes it; the body does not. The read
- * point a parked Skill approval binds to (stored beside the row's input binding, compared before the resumed activation).
- */
+/** The digest of what a Skill card disclosed — `Execute skill: <name>` and the lists approving it releases ({@link skillGrantBinding}). The read point a parked Skill approval binds to (stored beside the row's input binding, compared before the resumed activation). */
 export declare function skillGrantDigest(skill: Pick<SkillGrantSource, "name" | "allowedTools" | "disallowedTools"> | undefined): string;
 /**
- * The digest a parked call to the engine's `Skill` tool binds — written by the park beside the row's input binding — or
- * undefined for any other call, and when no skill is loaded (no engine `Skill` tool is mounted, so a call by that name is
- * not an activation).
+ * The card members of a call to the engine's `Skill` tool — the ONE factory every ask spreads them from: the live
+ * `AskRequest` an approver is handed, an ancestor's, the parked row and (through the row) the inbox projection.
+ * `boundGrants` is the skill's name and canonical lists, `boundGrantDigest` its hash — the same value, so what a person was
+ * shown and what an approving resume is judged by cannot differ. The binding is a property of the CALL, whoever asked and
+ * however the question was worded. Empty for any other call, and when no skill is loaded (no engine `Skill` tool is
+ * mounted, so a call by that name is not an activation).
  */
-export declare function skillCallGrantDigest(call: {
+export declare function skillGrantBindingMembers(call: {
     readonly toolName: string;
-}, args: unknown, skills: readonly SkillGrantSource[], skillToolName: string): string | undefined;
+}, args: unknown, skills: readonly SkillGrantSource[], skillToolName: string): SkillGrantBindingMembers;
 /**
  * The approving resume of a parked call, judged against the card it was asked under. A row is a `Skill` approval when it
  * carries a digest (the park said so), or when the resume would run the engine's `Skill` tool on it (skills loaded, the
@@ -87,10 +84,10 @@ export declare function declaresSkillLists(skill: Pick<SkillGrantSource, "allowe
 /**
  * Compile one skill's two lists into rows (`origin` stamped on each) and the entries that read as nothing. An allow list
  * holding `*` voids that list whole (every other entry on it is reported too: the list grants nothing — the safe direction).
- * A `*` on the deny list reads as nothing by itself and the rest of that list still refuses: a deny list never loses an
- * entry to a wildcard beside it.
+ * A `*` on the deny list reads as nothing by itself, like any deny entry that does — and a skill whose deny list holds one
+ * is not written at all ({@link SkillGrantTable.activate}).
  */
-export declare function compileSkillGrant(skill: SkillGrantSource, origin: SkillGrantOrigin): {
+export declare function compileSkillGrant(skill: SkillGrantSource, origin: SkillGrantOrigin, roster?: ReadonlySet<string>): {
     rows: SkillGrantRow[];
     inert: SkillInertEntry[];
 };
@@ -98,8 +95,10 @@ export declare function compileSkillGrant(skill: SkillGrantSource, origin: Skill
 export interface SkillGrantHit {
     readonly skill: string;
     readonly entries: readonly string[];
+    /** On a refusal only: the call activates `skill`, whose `disallowed-tools` entries `entries` read as nothing (why, each). */
+    readonly readsAsNothing?: readonly AllowEntryInert[];
 }
-/** The refusal a deny row writes. */
+/** The refusal a deny hit writes: a deny row's, or an activation's whose deny entries read as nothing. */
 export declare function skillDenyDecision(hit: SkillGrantHit): PermissionResult;
 /** The run's deny rows over `req` through `lane` — the refusal they write, or undefined (no lane, no row). The one
  *  reading the gate's regular decision, its approved-edit round and the resumed execution boundary share. */
@@ -111,12 +110,13 @@ export declare function skillAllowDecision(hit: SkillGrantHit, updatedInput: unk
  * releases anything — the entries it releases for the rest of the run in this mode (an entry that grants nothing, or
  * stands down in this mode, is not named). Deployment text, sanitized and capped.
  */
-export declare function skillActivationQuestion(skill: SkillGrantSource, mode: PermissionMode | undefined): string;
+export declare function skillActivationQuestion(skill: SkillGrantSource, mode: PermissionMode | undefined, roster?: ReadonlySet<string>): string;
 /** The face the gate and the resumed execution boundary read the table through, bound to the leg's call facts. */
 export interface SkillGrantLane {
     /** The allow layer's skill member: what grants this call in this mode, or undefined. */
     allowing(req: ToolCallRequest, mode: PermissionMode | undefined): SkillGrantHit | undefined;
-    /** The run's deny rows: what refuses this call, or undefined. */
+    /** What refuses this call, or undefined: the run's deny rows, else — for a call to the `Skill` tool — a named skill whose
+     *  `disallowed-tools` holds an entry that reads as nothing (`readsAsNothing`). */
     denying(req: ToolCallRequest): SkillGrantHit | undefined;
 }
 /** The gate inputs the run's skill rows ride (a member group of `ToolGateInput`). */
@@ -141,7 +141,7 @@ export interface SkillGateSeats {
 /** The `Skill` tool's per-call seat over the loaded skills: a skill that declares a list states no permission of its own. */
 export type SkillSeatReader = (args: unknown, mode: PermissionMode | undefined) => PermissionSeatReading | undefined;
 /** The reader over these skills (`undefined` when none is loaded): `Execute skill: <name>` for a skill declaring a list. */
-export declare function skillSeatReader(skills: readonly SkillGrantSource[]): SkillSeatReader | undefined;
+export declare function skillSeatReader(skills: readonly SkillGrantSource[], mounted?: MountedToolNames): SkillSeatReader | undefined;
 /**
  * The gate's seat inputs for one call, composed in ONE place: the mounted instance's static seat (`calledName`), the `Skill`
  * tool's per-call reader in the leg's live mode (only when the call's wire name is the engine's `Skill` — `skillToolName`),
@@ -162,7 +162,8 @@ export declare function skillGateWiring(opts: {
  * parent's capture, held until this child ends, and a resumed leg's frozen rows, which keep the word `model` where the
  * model wrote them) and the skills the person invoked by name (`user` — the invocation is the statement, so no card). Every invoked
  * name must be one of the loaded skills; anything else (or a value that is not a list of names) refuses the run loudly
- * (`config.user_invoked_skill_unknown`), never dropped. Returns the entries the grammar reads as nothing, across every
+ * (`config.user_invoked_skill_unknown`), never dropped; an invoked skill, or a carried deny record, whose deny entry reads as
+ * nothing refuses it too ({@link SKILL_DENY_UNREADABLE_CODE}). Returns the entries the grammar reads as nothing, across every
  * loaded skill — the start-of-run notice's content.
  */
 export declare function seedSkillGrants(table: SkillGrantTable, opts: {
@@ -170,23 +171,50 @@ export declare function seedSkillGrants(table: SkillGrantTable, opts: {
     userInvokedSkills: unknown;
     inherited: readonly SkillGrantRecord[] | undefined;
 }): readonly SkillInertEntry[];
+/**
+ * The user-invoked half of {@link seedSkillGrants}, read where no roster exists yet — a resume's pre-claim screen, over the
+ * re-supplied config: the invoked names seeded exactly as prepare seeds them, on a table told no mounted names, so only what
+ * every roster refuses alike refuses here (a name the config's skills do not carry; a deny entry the grammar alone reads as
+ * nothing). A name the leg's roster reads as stale or a near miss is prepare's to refuse; any other throw (a value prepare
+ * reports its own way) is left to prepare.
+ */
+export declare function screenUserInvokedSkills(config: {
+    readonly skills?: readonly SkillGrantSource[];
+    readonly userInvokedSkills?: unknown;
+}): void;
 /** The per-task table. Identity is the contract: the `Skill` tool, prepare's seeds, the tool ctx's snapshot and the
  *  lane all hold this one object. */
 export declare class SkillGrantTable {
     private rowsHeld;
+    private readonly rowKeys;
+    private mounted;
+    private activations;
+    /** State where the run's mounted names are read (prepare, once the roster is assembled): a skill's entries are read against
+     *  them when seeded and whenever the skill is activated. A table never told reads the grammar alone. */
+    bindMountedNames(mounted: MountedToolNames): void;
+    /** State the skills the run's `Skill` tool activates (the list it serves) and its wire name, so a call naming one whose deny
+     *  entries read as nothing is refused where the deny rows are read. A table never told refuses such a skill at activation only. */
+    bindSkills(skills: readonly SkillGrantSource[], skillToolName: string): void;
+    /** The names the run mounts as they stand, or undefined when none were stated. */
+    mountedNames(): ReadonlySet<string> | undefined;
     /** The table never holds the same row twice (skill, origin, list, entry) — one rule for both writers: a re-activation, a
      *  capture re-supplied beside the frozen rows that already carry it. Keyed on the ROW, not the skill: a definition that
      *  changed across a park writes its new rows when it is activated again. */
     private hold;
-    /** Write a skill's rows (rows already held are not held twice). Returns the entries that read as nothing. */
+    /** Write a skill's rows (rows already held are not held twice) — or none, refused with {@link SKILL_DENY_UNREADABLE_CODE},
+     *  when its `disallowed-tools` holds an entry that reads as nothing. Returns the allow entries that read as nothing. */
     activate(skill: SkillGrantSource, origin: SkillGrantOrigin): readonly SkillInertEntry[];
     /** Seed portable records (a delegated child's capture, a resumed leg's frozen rows): a record the model wrote keeps that
-     *  word, every other record seeds under `origin` — `user` is written only from this leg's own spec, never seeded. */
+     *  word, every other record seeds under `origin` — `user` is written only from this leg's own spec, never seeded. Each
+     *  record is read as its writer read it, against the leg's roster: an allow record that reads as nothing grants nothing
+     *  (not held); a deny record that does refuses the seed ({@link SKILL_DENY_UNREADABLE_CODE}) and nothing is held. */
     seed(records: readonly SkillGrantRecord[], origin: SkillGrantOrigin): void;
     /** The rows as portable records (a copy). */
     records(): readonly SkillGrantRecord[];
     /** The lane over this table, bound to the leg's call facts. */
     lane(ctx: AllowEntryJudgeContext): SkillGrantLane;
+    /** A call to the `Skill` tool naming a skill whose deny entries read as nothing, read as the activation would read it. */
+    private activationRefused;
 }
 /** Read a delegated child's capture ({@link readCarriedRecords}): `undefined` refuses the delegation. */
 export declare function readSkillGrantCapture(snapshot: readonly unknown[] | undefined): readonly SkillGrantRecord[] | undefined;
@@ -198,3 +226,6 @@ export declare function frozenSkillGrants(table: Pick<SkillGrantTable, "records"
 export declare function readFrozenSkillGrants(section: unknown): readonly SkillGrantRecord[] | undefined;
 /** The refusal for a `TaskSpec.userInvokedSkills` name the run does not carry (or a value that is not a list of names). */
 export declare const USER_INVOKED_SKILL_UNKNOWN_CODE = "config.user_invoked_skill_unknown";
+/** The refusal for a skill whose `disallowed-tools` holds an entry that reads as nothing: the activation, or the leg that
+ *  would carry the skill's deny record, does not happen. */
+export declare const SKILL_DENY_UNREADABLE_CODE = "config.skill_deny_unreadable";

package/dist/core/skill-grant.js

@@ -3,25 +3,32 @@ import { parsePermissionRule } from "./permission-rules.js";
 import { mountedToolPermissionSeat } from "./mode-policy.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { boundInputHashOf } from "./canonical-json.js";
-import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, judgeAllowEntries } from "./allow-entry.js";
+import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, inertEntryPhrase, judgeAllowEntries } from "./allow-entry.js";
 export const SKILL_GRANT_ORIGINS = Object.freeze(["model", "user", "inherited"]);
 const FROZEN_SKILL_GRANT_ORIGINS = new Set(["model", "inherited"]);
 export function skillNamedBy(args, skills) {
     const named = args?.skill;
     return typeof named === "string" ? skills.find((s) => s.name === named) : undefined;
 }
-export function skillGrantDigest(skill) {
+function skillGrantBinding(skill) {
     const canonical = (entries) => [...new Set((entries ?? []).map((e) => {
             const p = parsePermissionRule(e);
             return p.ruleContent === undefined ? p.toolName : `${p.toolName}(${p.ruleContent})`;
         }))].sort();
-    return boundInputHashOf({ skill: skill?.name ?? null, allowedTools: canonical(skill?.allowedTools), disallowedTools: canonical(skill?.disallowedTools) });
+    const boundGrants = { skill: skill?.name ?? null, allowedTools: canonical(skill?.allowedTools), disallowedTools: canonical(skill?.disallowedTools) };
+    return { boundGrantDigest: boundInputHashOf(boundGrants), boundGrants };
+}
+export function skillGrantDigest(skill) {
+    return skillGrantBinding(skill).boundGrantDigest;
 }
-export function skillCallGrantDigest(call, args, skills, skillToolName) {
-    return skills.length > 0 && wireOf("skillGrant.binding", call) === skillToolName ? skillGrantDigest(skillNamedBy(args, skills)) : undefined;
+export function skillGrantBindingMembers(call, args, skills, skillToolName) {
+    return isSkillActivationCall(call, skills, skillToolName) ? skillGrantBinding(skillNamedBy(args, skills)) : {};
+}
+function isSkillActivationCall(call, skills, skillToolName) {
+    return skills.length > 0 && wireOf("skillGrant.binding", call) === skillToolName;
 }
 export function parkedSkillApprovalRefusal(row, args, skills, skillToolName, site = "claim") {
-    if (row.boundGrantDigest === undefined && skillCallGrantDigest(row, args, skills, skillToolName) === undefined)
+    if (row.boundGrantDigest === undefined && skillGrantBindingMembers(row, args, skills, skillToolName).boundGrantDigest === undefined)
         return undefined;
     if (skillGrantDigest(skillNamedBy(args, skills)) === row.boundGrantDigest)
         return undefined;
@@ -43,18 +50,18 @@ export function detachSkillLists(skills) {
 export function declaresSkillLists(skill) {
     return (skill.allowedTools?.length ?? 0) > 0 || (skill.disallowedTools?.length ?? 0) > 0;
 }
-export function compileSkillGrant(skill, origin) {
+export function compileSkillGrant(skill, origin, roster) {
     const rows = [];
     const inert = [];
     for (const [list, behavior, entries] of [
         ["allowed-tools", "allow", skill.allowedTools ?? []],
         ["disallowed-tools", "deny", skill.disallowedTools ?? []],
     ]) {
-        const compiled = compileAllowList(entries, behavior);
+        const compiled = compileAllowList(entries, behavior, roster);
         for (const r of compiled.rows)
             rows.push({ skill: skill.name, origin, behavior, entry: r.entry, compiled: r.compiled });
         for (const i of compiled.inert)
-            inert.push({ skill: skill.name, list, entry: i.entry, reason: i.reason });
+            inert.push({ skill: skill.name, list, ...i });
     }
     return { rows, inert };
 }
@@ -65,10 +72,15 @@ function judge(rows, req, behavior, ctx) {
 export function skillDenyDecision(hit) {
     return {
         action: "deny",
-        message: `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in disallowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")}) — refused for the rest of this run`,
+        message: hit.readsAsNothing !== undefined
+            ? skillDenyUnreadable(hit.skill, hit.readsAsNothing, "activation").message
+            : `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in disallowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")}) — refused for the rest of this run`,
         decisionReason: "skill",
     };
 }
+function unreadDenyOf(inert) {
+    return inert.filter((i) => i.list === "disallowed-tools");
+}
 export function skillRowRefusal(lane, req) {
     const hit = lane?.denying(req);
     return hit === undefined ? undefined : skillDenyDecision(hit);
@@ -83,21 +95,21 @@ export function skillAllowDecision(hit, updatedInput) {
 }
 const CARD_ENTRIES_MAX = 10;
 const CARD_ENTRY_MAX_CHARS = 120;
-export function skillActivationQuestion(skill, mode) {
+export function skillActivationQuestion(skill, mode, roster) {
     const head = `Execute skill: ${inlineUntrusted(skill.name, 200)}`;
-    const granting = compileSkillGrant(skill, "model").rows.filter((r) => r.behavior === "allow" && !(mode === "auto" && autoStripped(r.compiled, undefined)));
+    const granting = compileSkillGrant(skill, "model", roster).rows.filter((r) => r.behavior === "allow" && !(mode === "auto" && autoStripped(r.compiled, undefined)));
     if (granting.length === 0)
         return head;
     const shown = granting.slice(0, CARD_ENTRIES_MAX).map((r) => inlineUntrusted(r.entry, CARD_ENTRY_MAX_CHARS));
     const rest = granting.length - shown.length;
     return `${head}\nApproving also lets these tools be used without asking for the rest of this run: ${shown.join(", ")}${rest > 0 ? ` and ${rest} more` : ""}`;
 }
-export function skillSeatReader(skills) {
+export function skillSeatReader(skills, mounted) {
     if (skills.length === 0)
         return undefined;
     return (args, mode) => {
         const skill = skillNamedBy(args, skills);
-        return skill !== undefined && declaresSkillLists(skill) ? { seat: "passthrough", question: skillActivationQuestion(skill, mode) } : undefined;
+        return skill !== undefined && declaresSkillLists(skill) ? { seat: "passthrough", question: skillActivationQuestion(skill, mode, mounted?.()) } : undefined;
     };
 }
 export function skillGateWiring(opts) {
@@ -123,27 +135,68 @@ export function seedSkillGrants(table, opts) {
         for (const name of invoked)
             table.activate(named(name), "user");
     }
-    return opts.skills.flatMap((s) => compileSkillGrant(s, "model").inert);
+    const roster = table.mountedNames();
+    return opts.skills.flatMap((s) => compileSkillGrant(s, "model", roster).inert);
+}
+export function screenUserInvokedSkills(config) {
+    if (config.userInvokedSkills === undefined)
+        return;
+    try {
+        seedSkillGrants(new SkillGrantTable(), { skills: config.skills ?? [], userInvokedSkills: config.userInvokedSkills, inherited: [] });
+    }
+    catch (e) {
+        const code = e?.code;
+        if (code === USER_INVOKED_SKILL_UNKNOWN_CODE || code === SKILL_DENY_UNREADABLE_CODE)
+            throw e;
+    }
 }
 export class SkillGrantTable {
     rowsHeld = [];
+    rowKeys = new Set();
+    mounted;
+    activations;
+    bindMountedNames(mounted) {
+        this.mounted = mounted;
+    }
+    bindSkills(skills, skillToolName) {
+        this.activations = { skills, skillToolName };
+    }
+    mountedNames() {
+        return this.mounted?.();
+    }
     hold(row) {
-        if (!this.rowsHeld.some((r) => r.skill === row.skill && r.origin === row.origin && r.behavior === row.behavior && r.entry === row.entry))
-            this.rowsHeld.push(row);
+        const key = JSON.stringify([row.skill, row.origin, row.behavior, row.entry]);
+        if (this.rowKeys.has(key))
+            return;
+        this.rowKeys.add(key);
+        this.rowsHeld.push(row);
     }
     activate(skill, origin) {
-        const { rows, inert } = compileSkillGrant(skill, origin);
+        const { rows, inert } = compileSkillGrant(skill, origin, this.mountedNames());
+        const unreadDeny = unreadDenyOf(inert);
+        if (unreadDeny.length > 0)
+            throw skillDenyUnreadable(skill.name, unreadDeny, "activation");
         for (const row of rows)
             this.hold(row);
         return inert;
     }
     seed(records, origin) {
+        const roster = this.mountedNames();
+        const rows = [];
+        const unreadDeny = [];
         for (const r of records) {
-            const compiled = compileAllowEntry(r.entry, r.behavior);
-            if (typeof compiled === "string")
-                continue;
-            this.hold({ skill: r.skill, origin: r.origin === "model" ? "model" : origin, behavior: r.behavior, entry: r.entry, compiled });
+            const read = compileAllowList([r.entry], r.behavior, roster);
+            const row = read.rows[0];
+            if (row !== undefined)
+                rows.push({ skill: r.skill, origin: r.origin === "model" ? "model" : origin, behavior: r.behavior, entry: r.entry, compiled: row.compiled });
+            else if (r.behavior === "deny")
+                unreadDeny.push(...read.inert.map((i) => ({ skill: r.skill, ...i })));
         }
+        const first = unreadDeny[0];
+        if (first !== undefined)
+            throw skillDenyUnreadable(first.skill, unreadDeny.filter((i) => i.skill === first.skill), "carried");
+        for (const row of rows)
+            this.hold(row);
     }
     records() {
         return this.rowsHeld.map((r) => ({ skill: r.skill, behavior: r.behavior, entry: r.entry, origin: r.origin }));
@@ -151,9 +204,17 @@ export class SkillGrantTable {
     lane(ctx) {
         return {
             allowing: (req, mode) => judge(allowingRows(this.rowsHeld, req, mode), req, "allow", ctx),
-            denying: (req) => judge(this.rowsHeld, req, "deny", ctx),
+            denying: (req) => judge(this.rowsHeld, req, "deny", ctx) ?? this.activationRefused(req),
         };
     }
+    activationRefused(req) {
+        const at = this.activations;
+        if (at === undefined || !isSkillActivationCall(req, at.skills, at.skillToolName))
+            return undefined;
+        const skill = skillNamedBy(req.args, at.skills);
+        const unread = skill === undefined ? [] : unreadDenyOf(compileSkillGrant(skill, "model", this.mountedNames()).inert);
+        return skill === undefined || unread.length === 0 ? undefined : { skill: skill.name, entries: unread.map((i) => i.entry), readsAsNothing: unread };
+    }
 }
 function readCarriedRecords(raw, carrier) {
     if (raw === undefined)
@@ -190,3 +251,15 @@ export function readFrozenSkillGrants(section) {
     return readCarriedRecords(section, "frozen");
 }
 export const USER_INVOKED_SKILL_UNKNOWN_CODE = "config.user_invoked_skill_unknown";
+export const SKILL_DENY_UNREADABLE_CODE = "config.skill_deny_unreadable";
+function skillDenyUnreadable(skill, entries, site) {
+    const listed = entries.map(inertEntryPhrase).join(", ");
+    const one = entries.length === 1;
+    const name = inlineUntrusted(skill, 120);
+    const message = site === "activation"
+        ? `Skill "${name}" was not activated: its disallowed-tools entr${one ? `y ${listed} reads` : `ies ${listed} read`} as nothing — a refusal this engine cannot read is not dropped, so the activation does not happen (its instructions are not loaded and nothing it lists is granted). Spell each entry as the tool is mounted, or remove it, in its definition.`
+        : `the grant rows carried for Skill "${name}" (a park's frozen rows, or a parent's capture) hold the disallowed-tools entr${one ? `y ${listed}, which reads` : `ies ${listed}, which read`} as nothing for this run — a refusal this engine cannot read is not dropped, so this leg does not start without it. A parked task an earlier release wrote can be finished on a worker of that release; otherwise correct the entry in its disallowed-tools and submit the task again.`;
+    const e = new Error(message);
+    e.code = SKILL_DENY_UNREADABLE_CODE;
+    return e;
+}

package/dist/core/steer-replay.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Is a repeat under an already-used steer `inputId` the same instruction? ONE answer for both seats that hold a
+ * steer under its key — the parked queue (`appendPendingSteer`) and the live verb's accepted-input domain — and that
+ * one answer feeds the replay decision, the refusal's machine-readable `detail.differs` and its sentence.
+ *
+ * Both seats compare the record the CALLER sent (text, trusted, tier, actor) — never the delivered bytes: the live
+ * delivery folds `trusted` (the framing) and the actor (the speaker label) into its payload, so comparing payloads
+ * would report one changed facet as two.
+ */
+import type { ActorAssertion } from "../internal/llm.js";
+import { type SystemInjectionPriority } from "./task-notification.js";
+/** The facets a steer's replay identity is made of, in the order a refusal lists them. Closed. */
+export declare const STEER_REPLAY_FACETS: readonly ["text", "trusted", "priority", "actor"];
+export type SteerReplayFacet = (typeof STEER_REPLAY_FACETS)[number];
+/** What a seat remembers a steer by: the caller's own statement, as validated. The parked entry and the live park
+ *  record both are this shape. An absent `priority` reads as `"next"` ({@link steerPriorityOf}). */
+export interface SteerReplayRecord {
+    readonly text: string;
+    readonly trusted: boolean;
+    readonly priority?: SystemInjectionPriority;
+    readonly actor?: ActorAssertion;
+}
+/** The facets `repeat` differs from `held` in, in {@link STEER_REPLAY_FACETS} order. Empty = the idempotent replay. */
+export declare function steerReplayDiffers(held: SteerReplayRecord, repeat: SteerReplayRecord): SteerReplayFacet[];
+/** `steering.duplicate_input_id`'s machine-readable half: the facets, by name only (never the values). Always
+ *  present on that code, never empty. */
+export interface SteerReplayRefusalDetail {
+    readonly differs: readonly SteerReplayFacet[];
+}
+/** Which seat refuses: the parked queue names the key it holds; the live verb answers about the caller's own key. */
+export type SteerReplaySeat = {
+    readonly seat: "parked";
+    readonly inputId: string;
+} | {
+    readonly seat: "accepted";
+};
+/**
+ * The refusal for a repeat that is not a replay, or `undefined` for one that is. When `text` differs the repeat is
+ * another instruction and the caller is told to take a fresh key. When only the tier / trust / attribution differ it
+ * is the SAME instruction, already accepted, whose standing receipt those facets do not change — a fresh key would
+ * queue it a second time, so the sentence says so instead of advising one.
+ */
+export declare function steerReplayRefusal(held: SteerReplayRecord, repeat: SteerReplayRecord, where: SteerReplaySeat): {
+    message: string;
+    detail: SteerReplayRefusalDetail;
+} | undefined;

package/dist/core/steer-replay.js

@@ -0,0 +1,22 @@
+import { steerPriorityOf } from "./task-notification.js";
+export const STEER_REPLAY_FACETS = Object.freeze(["text", "trusted", "priority", "actor"]);
+const FACET_IS_SAME = {
+    text: (a, b) => a.text === b.text,
+    trusted: (a, b) => a.trusted === b.trusted,
+    priority: (a, b) => steerPriorityOf(a) === steerPriorityOf(b),
+    actor: (a, b) => a.actor?.id === b.actor?.id && a.actor?.hostAsserted === b.actor?.hostAsserted && a.actor?.issuer === b.actor?.issuer,
+};
+export function steerReplayDiffers(held, repeat) {
+    return STEER_REPLAY_FACETS.filter((facet) => !FACET_IS_SAME[facet](held, repeat));
+}
+export function steerReplayRefusal(held, repeat, where) {
+    const differs = steerReplayDiffers(held, repeat);
+    if (differs.length === 0)
+        return undefined;
+    const seat = where.seat === "parked" ? `parked under inputId "${where.inputId}"` : "accepted under this inputId";
+    const listed = differs.join(", ");
+    const message = differs.includes("text")
+        ? `a different steering instruction is already ${seat} (this repeat differs in: ${listed}) — re-issue this one with a fresh inputId (an identical payload would have been an idempotent retry)`
+        : `the same steering instruction is already ${seat}; this repeat differs only in: ${listed}, which cannot change after acceptance — sending it again under another inputId would queue it a second time; to confirm the standing receipt, replay it with its original values`;
+    return { message, detail: { differs } };
+}

package/dist/core/task-event.d.ts

@@ -94,8 +94,9 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  * {@link BrainStatus.errorStatus}; this bucket is the reason a consumer RENDERS and the only carrier for the
  * transport classes, which have no status at all.) Values are about the SHAPE of the failure, never its
  * provider taxonomy:
- *  - `connect_refused` — the attempt got a definite negative about the target itself (nothing accepts
- *    at that address, or the name has no address). This is the class the SHORT retry lane serves.
+ *  - `connect_refused` — the attempt got a definite negative about the way to the target (nothing accepts
+ *    at that address, the name has no address, or the proxy on the way refused the tunnel). This is the class
+ *    the SHORT retry lane serves.
  *  - `transport`      — any other transport-level failure: a connect timeout, a reset, a mid-stream
  *    tear. No verdict about the target; the full ladder applies.
  *  - `stall`          — no failure was observed on the link at all: THIS process cancelled its own

package/dist/core/task-spec.d.ts

@@ -110,6 +110,18 @@ export interface TaskSpec {
      * explicit opt-out, which covers both arms.
      */
     interactionPosture?: "interactive" | "headless";
+    /**
+     * The run's declaration that NOBODY on it can be asked to approve a call — read by the approval seat's one resolution
+     * ({@link import("./wiring-manifest.js").resolveAskSeat}). `"none"`: an approver callback the spec or the deployment wires
+     * is not this run's approver (never called; the manifest reports `ask.form: "declared_none"`); with the deployment's park
+     * facility armed an ask parks for a person to answer later (`park_only`), without one it is refused as nobody's. It
+     * approves and releases nothing; a blanket `"allow"` / `"deny"` seat stays a policy; under `dontAsk` the mode refuses
+     * first. Absent = today's reading. Not checkpointed (a resumed leg holds it only when its taskConfig supplies it again);
+     * children inherit it (the clamp seats). `interactionPosture: "interactive"` beside it is refused
+     * (`config.interaction_posture`); a value outside the closed set too (`config.approval_reach_invalid`). Independent of
+     * {@link interactiveTools} — a content question still goes to `onQuestion`.
+     */
+    approvalReach?: import("./wiring-manifest.js").ApprovalReach;
     /**
      * design/173 §8.2 — the EXPLICIT knob (default off) letting a posture-`"interactive"` run
      * CONTINUE with the synthetic self-answer instruction after all on BOTH hardened question arms
@@ -562,7 +574,8 @@ export interface TaskSpec {
      * projections and the deny-narrowing layers still apply regardless).
      */
     basePolicyForResumeEdit?: import("./tool-policy.js").ToolPolicy;
-    /** How `ask` decisions resolve for this task (headless auto-deny by default). Overrides `RunnerDeps.onAsk`. */
+    /** How `ask` decisions resolve for this task (headless auto-deny by default). Overrides `RunnerDeps.onAsk` when present.
+     *  A callback here is set aside when the run declares {@link approvalReach} `"none"`. */
     onAsk?: import("./tool-policy.js").OnAsk;
     /** Content-ask seam (design/64 §5): routes an AskUserQuestion tool call to a real human/UI. When set, the
      *  AskUserQuestion tool is mounted (one of the delivery faces in the criterion — see

package/dist/core/task-stream.d.ts

@@ -43,15 +43,20 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      * that arrives while the task is LIVE was the only one that injected twice.
      *  - **Absent ⇒ nothing changes**: a uuidv7 is minted for the event, nothing is recorded for the call,
      *    and the delivered bytes are what they always were. Every pre-existing caller is on this arm.
-     *  - **Replay ⇒ idempotent no-op**: re-steering an id this stream already ACCEPTED, with an identical
-     *    payload (same text, same `trusted`, same `actor`), injects nothing and emits no second
+     *  - **Replay ⇒ idempotent no-op**: re-steering an id this stream already ACCEPTED, with the same
+     *    steer (same text, `trusted`, tier — absent reads `next` — and `actor`), injects nothing and emits no second
      *    `human_input` frame. What is remembered is exactly what QUEUED: a delivery that was refused
      *    (not running) can be retried under its own id, and a call whose DELIVERED payload is
      *    whitespace-only — which the harness discards without minting a frame; note a `trusted` steer is
      *    wrapped first, so it queues even for blank text — reserves nothing, leaving that id usable.
-     *  - **Same id, DIFFERENT instruction ⇒ typed throw** `steering.duplicate_input_id`: a key is not
+     *  - **Same id, not the same steer ⇒ typed throw** `steering.duplicate_input_id`: a key is not
      *    evidence of a replay, and two callers colliding on one id must not silently lose the second
-     *    (the parked leg's `appendPendingSteer` refuses it identically). Re-issue under a fresh id.
+     *    (the parked leg's `appendPendingSteer` judges and refuses it identically). The error carries
+     *    `detail.differs` — the facets that differ (closed `STEER_REPLAY_FACETS`: `text`, `trusted`,
+     *    `priority`, `actor`), compared on what the caller SENT, never on the framed bytes. With `text`
+     *    among them it is another instruction: re-issue it under a fresh id. Without, it is the accepted one
+     *    re-sent at another tier / trust / attribution, which acceptance does not change: a fresh id would
+     *    queue it twice, so replay it with its original values to confirm the receipt.
      *  - **Bad value ⇒ typed throw** `steering.invalid_content`, never a silent fallback to "no id": the
      *    value domain is the parked leg's (a non-empty string of at most `MAX_STEER_INPUT_ID_CHARS`
      *    characters), so one key is accepted or
@@ -107,8 +112,9 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      *    relaying steer must gate this option at its own face — relay IS authorization.
      *  An unknown value throws typed `steering.invalid_content` (bad-value loudness). The replay
      *  identity (`inputId` idempotency) includes the NORMALIZED tier: the same text replayed under
-     *  the same id at a different tier refuses `steering.duplicate_input_id` — an "idempotent
-     *  success" that silently skipped the interrupt would be a disposition lie.
+     *  the same id at a different tier refuses `steering.duplicate_input_id` (`detail.differs:
+     *  ["priority"]`) — an "idempotent success" that silently skipped the interrupt would be a
+     *  disposition lie.
      *
      * design/373 §4.3 (D2, ruling of 2026-08-24) — a deployment `userPromptSubmit` hook SCREENS this verb:
      * the steer face is a SERVICE entrance (third-party callers reach a running run through it), so

package/dist/core/tighten-task-spec.d.ts

@@ -13,6 +13,8 @@ export declare class TaskSpecTightenError extends Error {
  *    would drop the base policy entirely.
  *  - **`handsReadOnly`** — `true` is stricter. `base:true` + `override:false` ⇒ **throw** (loosening). Otherwise
  *    the stricter (`true` if either is true) wins.
+ *  - **`approvalReach`** — `"none"` (nobody can be asked) is the only word; a base declaration survives an override that
+ *    omits it or writes `undefined`.
  *  - **`shellGate`** — one value (`"always"`, the operator floor). Either side set ⇒ the floor stands; it cannot
  *    be loosened because absence is the only other state and an override cannot unset a base value.
  *  - **`onAsk`** — no safe automatic merge (the approver and the policy must be coordinated). Both set to

package/dist/core/tighten-task-spec.js

@@ -47,6 +47,9 @@ export function tightenTaskSpec(base, overrides) {
     if (base.handsReadOnly !== undefined || overrides.handsReadOnly !== undefined) {
         merged.handsReadOnly = base.handsReadOnly === true || overrides.handsReadOnly === true;
     }
+    if (base.approvalReach !== undefined || overrides.approvalReach !== undefined) {
+        merged.approvalReach = base.approvalReach === "none" || overrides.approvalReach === "none" ? "none" : (overrides.approvalReach ?? base.approvalReach);
+    }
     if (base.permissionMode !== undefined && overrides.permissionMode !== undefined) {
         const { effective, clamped } = clampPermissionMode(overrides.permissionMode, base.permissionMode);
         if (clamped) {

package/dist/core/tool-errors.d.ts

@@ -123,8 +123,8 @@ export type WorkerErrorClass = "budget" | "limit" | "output" | "suspend" | "revi
  * The `limits.` namespace splits into the `budget` and `limit` classes by exact code — see
  * {@link EXACT_CODE_CLASS}. Operation-level dotted codes that are surfaced to a *caller* and never become a
  * task outcome are deliberately OUT of scope: `steering.*` (`steering.not_running`/`steering.invalid_content`/
- * `steering.duplicate_input_id`/`steering.blocked_by_hook`, rejected to the `steer()` caller — the fourth also
- * rides the resume face as a `CheckpointError` code) and `mcp.*` (`mcp.server_unavailable`, an `onWarn` warning code) — neither
+ * `steering.duplicate_input_id`/`steering.blocked_by_hook`, rejected to the `steer()` caller — the third also
+ * rides the parked queue's `setPendingSteer` face and the fourth the resume face, as `CheckpointError` codes) and `mcp.*` (`mcp.server_unavailable`, an `onWarn` warning code) — neither
  * reaches `TaskResult.errorCode`, so a caller will never pass them here. A genuinely unmapped code → `"unknown"` (which therefore means
  * "known-but-foreign or no code", e.g. a leaked fs/Node code, NOT "an OUR terminal class we forgot to add").
  */