@sema-agent/core 7.42.1 → 7.44.0

package/dist/core/tool-name-aliases.d.ts

@@ -1,3 +1,4 @@
+import { type ProtocolNamespace } from "./protocol-table.js";
 /**
  * RB-476-A stage 2 (ruling 2026-08-02, RB-476 "no compatibility surface survives", replay
  * resolution included) — the durable-name machinery this module used to hold is RETIRED:
@@ -26,17 +27,23 @@
  * wider tool: writing it would deny more than the entry did, so it is no current name), or `removed — `.
  */
 export declare const RETIRED_TOOL_NAMES: ReadonlyMap<string, string>;
-/** The three answers {@link judgeRuleToolName} gives — a closed set. */
-export declare const RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "unprefixed_namespace"];
+/** The four answers {@link judgeRuleToolName} gives — a closed set. */
+export declare const RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "unprefixed_namespace", "unmintable_segment"];
 /**
  * Whether a tool name written in a rule is a stale name — one that, against `roster`, names no tool and never can:
- *  - `current` — not a stale name: the roster mounts it, or it is neither retired nor a prefix-less `__` name. (Whether a
- *    current name matches anything THIS run is a different question — an unknown name is the prepare audit's advisory.)
+ *  - `current` — not a stale name: the roster mounts it, or it is none of the three below. (Whether a current name matches
+ *    anything THIS run is a different question — an unknown name is the prepare audit's advisory.)
  *  - `retired` — a name in {@link RETIRED_TOOL_NAMES} the roster does not mount; `guidance` is that table's line, and
  *    `currentName` the 1:1 successor when there is one (see the module header's grammar).
  *  - `unprefixed_namespace` — carries the `__` namespace separator with no protocol prefix. The roster cannot clear it:
  *    a caller tool name or alias carrying `__` is refused at prepare, every engine tool name is `__`-free, and every
  *    protocol tool is minted with its prefix.
+ *  - `unmintable_segment` — carries a protocol prefix, but its peer segment (the server / remote agent) is not a spelling
+ *    the mint produces for any peer: the name is read as written (peers compare exactly), and every mounted tool carries
+ *    the minted spelling, so the name reaches none of them. `guidance` says so in one line; `currentName` is the whole name
+ *    rewritten with the spelling the mint produces (`mcp__github.com__*` → `mcp__github_com__*`), absent when the peer
+ *    segment is empty and there is nothing to rewrite. The tool segment after the peer is never judged: it is a literal
+ *    tool name or a glob over one, and an unmatched one is the audit's advisory.
  *
  * `roster` = the tool names (aliases included) the reader knows are mounted: a run's assembled roster at prepare, the
  * names a deployment DECLARES it mounts its own tools under at a session-rule store (an empty set when it declares none).
@@ -49,6 +56,29 @@ export type RuleToolNameVerdict = {
     readonly currentName?: string;
 } | {
     readonly kind: "unprefixed_namespace";
+} | {
+    readonly kind: "unmintable_segment";
+    readonly guidance: string;
+    readonly currentName?: string;
 };
-/** See {@link RuleToolNameVerdict}. Pure; the one answer to "is this rule's tool name a retired or prefix-less name". */
+/**
+ * A name in ANY protocol namespace split into its owning namespace, its peer segment and its optional tool segment —
+ * CC `rP` (:70710) verbatim, re-anchored on the {@link protocolOf} lookup instead of CC's literal `"mcp"` first split element.
+ * `undefined` for a name that is not namespaced (no protocol prefix). The peer is the first segment — EMPTY for `mcp____x` and
+ * for the bare prefix, which name no peer; the tool segment is the REST of the split rejoined, so a tool whose minted segment
+ * itself carries the separator (charset normalization maps `get..issue` → `get__issue`) decomposes back to one tool name, and
+ * is absent when the name stops at the peer (`mcp__srv`). The one decomposition: the judgment, the covering matcher and the
+ * allow-entry grammar all read a namespaced name through it.
+ */
+export declare function splitNamespacedName(name: string): {
+    readonly ns: ProtocolNamespace;
+    readonly peer: string;
+    readonly tool?: string;
+} | undefined;
+/** See {@link RuleToolNameVerdict}. Pure; the one answer to "is this rule's tool name a name that reaches no tool". */
 export declare function judgeRuleToolName(name: string, roster: ReadonlySet<string>): RuleToolNameVerdict;
+/** The names a run mounts — every tool's primary name and its aliases: the roster {@link judgeRuleToolName} is given. */
+export declare function mountedToolNames(tools: ReadonlyArray<{
+    readonly name: string;
+    readonly aliases?: readonly string[];
+}>): Set<string>;

package/dist/core/tool-name-aliases.js

@@ -1,4 +1,5 @@
 import { carriesNamespaceSeparator, protocolOf } from "./protocol-table.js";
+import { mintNamespacePrefix } from "./protocol-naming.js";
 export const RETIRED_TOOL_NAMES = new Map([
     ["read_file", 'renamed "Read"'],
     ["edit_file", 'renamed "Edit"'],
@@ -41,9 +42,29 @@ export const RETIRED_TOOL_NAMES = new Map([
     ["Recall", "removed — memory is file-based; read the memory directory with the ordinary file tools"],
     ["recall", "removed — memory is file-based; read the memory directory with the ordinary file tools"],
 ]);
-export const RULE_TOOL_NAME_VERDICTS = Object.freeze(["current", "retired", "unprefixed_namespace"]);
+export const RULE_TOOL_NAME_VERDICTS = Object.freeze(["current", "retired", "unprefixed_namespace", "unmintable_segment"]);
 const CURRENT = Object.freeze({ kind: "current" });
 const UNPREFIXED = Object.freeze({ kind: "unprefixed_namespace" });
+const NAMESPACE_SEPARATOR = "__";
+export function splitNamespacedName(name) {
+    const ns = protocolOf(name);
+    if (ns === undefined)
+        return undefined;
+    const [peer = "", ...rest] = name.slice(ns.prefix.length).split(NAMESPACE_SEPARATOR);
+    return rest.length > 0 ? { ns, peer, tool: rest.join(NAMESPACE_SEPARATOR) } : { ns, peer };
+}
+function unmintableSegmentOf({ ns, peer, tool }) {
+    if (peer === "")
+        return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty peer segment — no tool is minted under it` };
+    const minted = mintNamespacePrefix(ns, peer).slice(ns.prefix.length, -NAMESPACE_SEPARATOR.length);
+    if (minted === peer)
+        return undefined;
+    return {
+        kind: "unmintable_segment",
+        guidance: `the ${ns.id} peer segment ${JSON.stringify(peer)} is not a spelling the engine mints — its tools are named ${ns.prefix}${minted}${NAMESPACE_SEPARATOR}<tool>, and a rule's peer segment must be spelled the way its tools are`,
+        currentName: `${ns.prefix}${minted}${tool !== undefined ? `${NAMESPACE_SEPARATOR}${tool}` : ""}`,
+    };
+}
 export function judgeRuleToolName(name, roster) {
     if (roster.has(name))
         return CURRENT;
@@ -52,7 +73,11 @@ export function judgeRuleToolName(name, roster) {
         const currentName = /^renamed "([^"]+)"/.exec(guidance)?.[1];
         return currentName !== undefined ? { kind: "retired", guidance, currentName } : { kind: "retired", guidance };
     }
-    if (carriesNamespaceSeparator(name) && protocolOf(name) === undefined)
-        return UNPREFIXED;
-    return CURRENT;
+    const split = splitNamespacedName(name);
+    if (split === undefined)
+        return carriesNamespaceSeparator(name) ? UNPREFIXED : CURRENT;
+    return unmintableSegmentOf(split) ?? CURRENT;
+}
+export function mountedToolNames(tools) {
+    return new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
 }

package/dist/core/tool-policy.d.ts

@@ -303,6 +303,9 @@ export type PermissionResult = {
      *  same safe direction as `matchedAskRule`); it cannot state a window of its own, because the
      *  route it would be a window for has not been chosen yet. */
     denialLimitFallback?: import("./auto-mode.js").UnarmedDenialLimitFallback;
+    /** WHY a classifier station handed this call to a person: the classification did not rule (`error` / `timeout` — it could
+     *  not run; `parse_error` — no verdict). Engine-stamped with `requiresRealApproval`; class `classifier_no_ruling`. */
+    classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     /** The allow layer's DISCLOSURE: the members that MATCHED this call and could not clear the ask (it is a class
      *  no allow rule clears — a mandated, governance, hook, ask-rule or mode question — or the call reached the layer
      *  marked), one record per member ({@link AllowRuleShadow}). ENGINE-STAMPED by the allow layer, overwriting a
@@ -1201,6 +1204,10 @@ export interface AskRequest {
      *  mint site added later is covered by construction); optional on the type because a deployment may
      *  invoke its approver function directly. */
     readonly boundInputHash?: string;
+    /** A call to the engine's `Skill` tool: the hash of {@link boundGrants} — the digest a parked approval of the same card is judged by, so a live card reconciles against its parked row by `(toolCallId, boundGrantDigest)` and an answer is remembered by "this tool + this binding". Present exactly on that call (whoever asked, however the question was worded), absent on every other card; `message` renders the same lists narrowed to what releases in the leg's mode. Reconciliation metadata, never adjudication input. */
+    readonly boundGrantDigest?: string;
+    /** The value {@link boundGrantDigest} hashes: `{ skill, allowedTools, disallowedTools }` in canonical spelling (de-duplicated, sorted), `skill: null` when no loaded skill is named; a fresh copy per ask; same presence. Display metadata (deployment text — render with contextual escaping). */
+    readonly boundGrants?: import("./skill-grant-binding.js").BoundSkillGrants;
     /**
      * design/179 §4, re-formed by design/375 §3.1 (BREAKING — this seat REPLACES the retired
      * `ruleSuggestions` key, which is never emitted again; the new name is the safe failure posture for
@@ -1396,6 +1403,9 @@ export interface AskRequest {
      *  that forwards a decision's member here does not compile, which is the point: the window is the
      *  route's fact, and forwarding it silently is how a configured window becomes a wait with none. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** The {@link PermissionResult} ask-arm member of the same name (class `classifier_no_ruling`), carried by the four mint
+     *  stations; the `message`'s second paragraph says the same for a client that does not read this. */
+    readonly classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     /** (additive) WHICH AUTHORITY raised this ask — the wire twin of the {@link PermissionResult} ask-arm
      *  member of the same name, one word from the closed {@link import("./ask-origin.js").AskOrigin} set.
      *  The gate's own mint station copies the engine-stamped word; the three inherited-lane stations

package/dist/core/tool-policy.js

@@ -259,7 +259,7 @@ const ALLOW = Object.freeze({ action: "allow" });
 const ALLOW_BY_RULE = Object.freeze({ action: "allow", decisionReason: "rule" });
 const RETIRED_TEXT_FIELD = "reason";
 export const DECISION_MEMBERS = Object.keys({
-    action: 0, updatedInput: 0, message: 0, decisionReason: 0, requiresRealApproval: 0, denialLimitFallback: 0, allowRuleShadowed: 0, probeReason: 0,
+    action: 0, updatedInput: 0, message: 0, decisionReason: 0, requiresRealApproval: 0, denialLimitFallback: 0, classifierNoRuling: 0, allowRuleShadowed: 0, probeReason: 0,
     probeCause: 0, probeMandated: 0, mandated: 0, mandate: 0, probeReadRootCandidate: 0, matchedAskRule: 0, ruleEvidence: 0, segmentCoverage: 0,
     origin: 0, askClass: 0, classes: 0, guard: 0, ruleUnreadable: 0, authoredBy: 0, foldedAskClasses: 0,
 });
@@ -551,6 +551,7 @@ export function combinePolicies(...policies) {
             let probeMandateSeen = false;
             let mandateSeen = false;
             let fallbackSeen;
+            let noRulingSeen;
             let authoredBySeen = false;
             const contributors = [];
             const settleDeny = (d) => {
@@ -597,6 +598,8 @@ export function combinePolicies(...policies) {
                     mandateSeen = true;
                 if (d.action === "ask" && d.denialLimitFallback !== undefined && fallbackSeen === undefined)
                     fallbackSeen = d.denialLimitFallback;
+                if (d.action === "ask" && d.classifierNoRuling !== undefined && noRulingSeen === undefined)
+                    noRulingSeen = d.classifierNoRuling;
                 if (d.action === "ask" && d.authoredBy === "deployment")
                     authoredBySeen = true;
                 if (d.action === "ask")
@@ -610,12 +613,16 @@ export function combinePolicies(...policies) {
                 const withMark = probeMandateSeen && withRuleAsk.probeMandated !== true ? { ...withRuleAsk, probeMandated: true } : withRuleAsk;
                 const withMandate = mandateSeen && withMark.mandated !== true ? { ...withMark, mandated: true } : withMark;
                 const withFallback = fallbackSeen !== undefined && withMandate.denialLimitFallback === undefined ? { ...withMandate, denialLimitFallback: fallbackSeen, requiresRealApproval: true } : withMandate;
-                const withAuthor = authoredBySeen && withFallback.authoredBy === undefined ? { ...withFallback, authoredBy: "deployment" } : withFallback;
+                const withNoRuling = noRulingSeen !== undefined && withFallback.classifierNoRuling === undefined ? { ...withFallback, classifierNoRuling: noRulingSeen, requiresRealApproval: true } : withFallback;
+                const withAuthor = authoredBySeen && withNoRuling.authoredBy === undefined ? { ...withNoRuling, authoredBy: "deployment" } : withNoRuling;
                 const folded = new Set(withAuthor.foldedAskClasses ?? []);
                 for (const c of contributors)
                     if (c !== asked)
                         for (const k of decisionAskClassesOf(c))
                             folded.add(k);
+                if (withNoRuling !== withMandate)
+                    for (const k of decisionAskClassesOf(asked))
+                        folded.add(k);
                 const withClasses = folded.size > 0 ? { ...withAuthor, foldedAskClasses: [...folded] } : withAuthor;
                 const out = merged !== undefined ? { ...withClasses, updatedInput: merged } : withClasses;
                 if (folded.size > 0)

package/dist/core/tool-spec.d.ts

@@ -952,6 +952,13 @@ export interface ToolExecuteContext {
      * is deliberately NOT inherited).
      */
     interactiveTools?: false;
+    /**
+     * The run's declaration that nobody on it can be asked to approve ({@link TaskSpec.approvalReach} `"none"`),
+     * Runner-filled read-only on the same trusted seat, present ONLY when declared. A delegation tool copies it onto every
+     * child spec (the clamp carrier): the child's own seat resolution would otherwise fall back to the deployment's live
+     * approver, because a declared-none parent hands down no approver of its own ({@link onAsk} is absent on its ctx).
+     */
+    approvalReach?: "none";
     /**
      * Read-only mirror of {@link "./types.js".TaskSpec.oneShot} (same trust tier/seat as
      * `principal`): this RUN has no later turn for an async background notification to land in (a

package/dist/core/types.d.ts

@@ -29,6 +29,6 @@ export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js"
 export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegation-frames.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";
-export type { EngineNotice, OwedUserInputAccount, UserSteerUndrainedCause } from "./engine-notice.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_STEER_UNDRAINED_CAUSES } from "./engine-notice.js";
+export type { EngineNotice, OwedUserInputAccount, UserInputUndrainedCause } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES } from "./engine-notice.js";
 export type { AgentTool, Model, StreamFn, ThinkingLevel, ToolInputValidationContext, ToolInputVerdict };

package/dist/core/types.js

@@ -1,4 +1,4 @@
 export { MODEL_ROLES } from "./model-seat.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_STEER_UNDRAINED_CAUSES } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES } from "./engine-notice.js";

package/dist/core/wiring-manifest.d.ts

@@ -26,6 +26,7 @@ import { type StoreDurability } from "./checkpoint-store.js";
 import type { WiringManifestHookEntry } from "./hook-seats.js";
 import type { McpDelivered, McpFailureKind, McpServerLiveness } from "./mcp-failure.js";
 import type { WriteProtectionTargetView } from "./write-protect.js";
+import type { OnAsk } from "./tool-policy.js";
 export type { StoreDurability };
 /** The manifest-face projection of {@link StoreDurability}: `"declared_durable"` (the name says it —
  *  a DECLARATION relayed, not a verification) vs `"process_local"` (declared so, or fail-closed
@@ -37,11 +38,29 @@ export type ManifestDurability = "declared_durable" | "process_local";
  *  child's manifest rides the CHILD's event stream and is deliberately not in the parent-forwarding
  *  whitelist — a host that wants a child's assembly evidence subscribes to the child. */
 export type WiringLegKind = "root" | "child" | "resume";
-/** The shape of the resolved permission-ask seat (`spec.onAsk ?? deps.onAsk`): a live approver
- *  callback, a blanket `"allow"`/`"deny"` policy setting, or nothing at all. `"deny"` (a deliberate
- *  policy) and `"absent"` (a degrade to the headless auto-deny default) are DISTINCT on purpose —
- *  design/173 */
-export type AskSeamForm = "callback" | "allow" | "deny" | "absent";
+/** The shape of the resolved permission-ask seat ({@link resolveAskSeat}): a live approver callback, a blanket
+ *  `"allow"`/`"deny"` policy setting, nothing at all, or `"declared_none"` — the run declared that nobody on it can be
+ *  asked (`TaskSpec.approvalReach: "none"`), so a callback beside the declaration is not this run's approver. `"deny"` (a
+ *  deliberate policy) and `"absent"` (no seat supplied a value — a degrade to the headless auto-deny default) are DISTINCT
+ *  on purpose — design/173 — and so are `"absent"` and `"declared_none"`: one says nothing was wired, the other that
+ *  the run said nobody can answer. */
+export type AskSeamForm = "callback" | "allow" | "deny" | "absent" | "declared_none";
+/**
+ * The closed set of a run's approval-reach declaration (`TaskSpec.approvalReach`): `"none"` — nobody on this run can be
+ * asked to approve. It removes the one seat that could be a person (a callback); it never approves or releases anything.
+ * There is no positive word: "a person is reachable" is the `interactionPosture: "interactive"` promise, which has its own
+ * door.
+ */
+export declare const APPROVAL_REACH: readonly ["none"];
+export type ApprovalReach = (typeof APPROVAL_REACH)[number];
+/** Membership test for {@link ApprovalReach}. */
+export declare function isApprovalReach(v: unknown): v is ApprovalReach;
+/**
+ * The declaration's door: absent passes as absent, a member passes, anything else present is refused loudly
+ * (`config.approval_reach_invalid`) — a declaration nobody can read must not fold to "a person may be asked" (or to
+ * "nobody may"). Prepare, the static half and a resume's pre-claim screen call this one function.
+ */
+export declare function screenApprovalReach(v: unknown): ApprovalReach | undefined;
 /** What a policy `ask` actually reaches under this assembly. `"unresolved"` = not computable from
  *  the facts at hand (the static half's park-dependent arm). */
 export type AskEffective = "human_reachable" | "auto_allow" | "auto_deny" | "park_only" | "unresolved";
@@ -178,8 +197,8 @@ export interface WiringManifest {
     peerPresence?: import("../agents/peer-directory.js").PeerPresence;
     ask: {
         form: AskSeamForm;
-        /** Absent iff `form === "absent"` (no seat supplied a value — a fabricated provenance would be
-         *  a false fact). */
+        /** Absent iff no seat supplied a value (`"absent"`, or `"declared_none"` with nothing wired) — a fabricated provenance
+         *  would be a false fact. */
         provenance?: SeamProvenance;
         /** OMITTED on the static half (design/173 §8.4): the absent-form arm depends on the park lane,
          *  which the static half cannot always resolve. Always present on the effective half. */
@@ -556,7 +575,7 @@ export interface WiringFacts {
  *  single-source shapes, no parallel hand-copied interface). */
 export type StaticWiringDeps = Pick<RunnerDeps, "onAsk" | "onQuestion" | "interactionPosture" | "onElicit" | "checkpointStore" | "sessionStore" | "backgroundAgentStore" | "onBackgroundChildEvent" | "lockedConfig" | "compliancePostureResolver" | "memoryScopeAdmission" | "retentionPolicy" | "permissionRuleStore" | "permissionRuleSyncWired">;
 /** Named view of the spec seats the static half reads (a `Pick` of the real {@link TaskSpec}). */
-export type StaticWiringSpec = Pick<TaskSpec, "onAsk" | "onQuestion" | "checkpointStore" | "durableApproval" | "mcp" | "interactiveTools" | "interactionPosture">;
+export type StaticWiringSpec = Pick<TaskSpec, "onAsk" | "approvalReach" | "onQuestion" | "checkpointStore" | "durableApproval" | "mcp" | "interactiveTools" | "interactionPosture">;
 /**
  * Read a store's {@link StoreDurability} declaration: absent ⇒ `"process-local"` (fail-closed —
  * under-promise, never over-promise), a declared value passes through, and an UNPARSEABLE value is
@@ -613,8 +632,9 @@ export declare function resolveSubagentTranscriptTier(agentStoreWired: boolean,
  *    so on an armed park lane the ask parks and the honest report is `park_only` — reporting the
  *    blanket as what the ask "reaches" would be a false fact of exactly the kind this module refuses.
  *    Off the park lane the blanket is what happens: the deliberate auto policies;
- *  - no seat at all ⇒ the park lane decides: armed ⇒ `park_only`, unresolved ⇒ `unresolved`,
- *    else the headless degrade `auto_deny`.
+ *  - no seat at all, or a run that declared nobody can be asked (`declared_none`) ⇒ the park lane decides: armed ⇒
+ *    `park_only` (the deployment's park is its own statement that an answer can wait for a person), unresolved ⇒
+ *    `unresolved`, else the headless degrade `auto_deny`.
  */
 export declare function deriveAskEffective(form: AskSeamForm, parkEffective: boolean | "unresolved", mode?: PermissionMode): AskEffective;
 /**
@@ -637,10 +657,32 @@ export declare function askReachesPerson(ask: {
     readonly effective?: AskEffective;
 }): boolean;
 export declare function deriveWiringManifest(facts: WiringFacts): WiringManifest;
-/** The one ask-seat resolution (`spec` wins over `deps`), shared with the effective half so the
- *  form/provenance read cannot fork. Junk values (a JS caller passing something outside the OnAsk
- *  union) are refused loudly — a manifest must not classify what it cannot name. */
-export declare function resolveAskSeamForm(spec: Pick<TaskSpec, "onAsk">, deps: Pick<RunnerDeps, "onAsk">): {
+/** A run's approval seat as its one resolution froze it: the value every reader that needs the approver itself reads
+ *  (`undefined` when nothing on this run can be asked), the form the manifest reports and every reader of the word derives
+ *  from, the seat that supplied the value, and the declaration when the run made one. */
+export interface AskSeat {
+    readonly value: OnAsk | undefined;
+    readonly form: AskSeamForm;
+    /** Absent iff no seat supplied a value. A callback the declaration set aside still names its seat. */
+    readonly provenance?: SeamProvenance;
+    readonly reach?: ApprovalReach;
+}
+/**
+ * THE approval-seat resolution — the one place a run's `spec.onAsk` / `deps.onAsk` are read. Prepare calls it once, at
+ * its config doors (before any resource is taken), and hands the frozen result down; the static half calls it for its
+ * own self-check. The seat is the spec's when the spec's key is PRESENT, else the deployment's (presence, not `??`: a
+ * spec `null` is a junk value, never a fall-through to the deployment). A value outside the `OnAsk` union is refused
+ * loudly (`config.interaction_wiring`), a declaration outside {@link APPROVAL_REACH} too (`config.approval_reach_invalid`).
+ *
+ * `approvalReach: "none"` is one sentence here: a blanket `"allow"` / `"deny"` stays what it is (a policy setting never
+ * claimed to be a person); a callback, or no seat, becomes `declared_none` with NO value — so the readers of the value
+ * (the approver lane, the park's sync-first decline, the durable-mandate source, a child's inherited seat) and the readers
+ * of the word ({@link deriveAskEffective}) cannot disagree about whether a person is there.
+ */
+export declare function resolveAskSeat(spec: Pick<TaskSpec, "onAsk" | "approvalReach">, deps: Pick<RunnerDeps, "onAsk">): AskSeat;
+/** The form and provenance half of {@link resolveAskSeat} — the projection the manifest's two halves and a server's
+ *  per-leg judgment read (hand it the request's `approvalReach` beside the seat). */
+export declare function resolveAskSeamForm(spec: Pick<TaskSpec, "onAsk" | "approvalReach">, deps: Pick<RunnerDeps, "onAsk">): {
     form: AskSeamForm;
     provenance?: SeamProvenance;
 };

package/dist/core/wiring-manifest.js

@@ -5,6 +5,22 @@ import { canonicalize } from "./canonical-json.js";
 import { resolveCheckpointStore } from "./checkpoint-store.js";
 import { isLiveQuestionFace } from "./ask-question.js";
 import { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
+import { describeRejectedValue } from "./tool-search-setting.js";
+export const APPROVAL_REACH = Object.freeze(["none"]);
+const APPROVAL_REACH_SET = new Set(APPROVAL_REACH);
+export function isApprovalReach(v) {
+    return APPROVAL_REACH_SET.has(v);
+}
+export function screenApprovalReach(v) {
+    if (v === undefined)
+        return undefined;
+    if (isApprovalReach(v))
+        return v;
+    const e = new Error(`approvalReach ${describeRejectedValue(v)} is not a recognized declaration (${APPROVAL_REACH.map((w) => JSON.stringify(w)).join(" | ")}) — ` +
+        `omit it when a person may be asked; an unreadable declaration is refused, never folded to either reading.`);
+    e.code = "config.approval_reach_invalid";
+    throw e;
+}
 export const AUTO_MODE_ARM_REASONS = Object.freeze(["armed", "no_intent", "no_face", "denied", "resolver_fault"]);
 export const LSP_LANES = Object.freeze(["tool", "diagnostics", "tool_and_diagnostics"]);
 export function deriveHandsSeam(handsMounted) {
@@ -53,6 +69,7 @@ export function deriveAskEffective(form, parkEffective, mode) {
         case "deny":
             return parkEffective === true ? "park_only" : parkEffective === "unresolved" ? "unresolved" : "auto_deny";
         case "absent":
+        case "declared_none":
             return parkEffective === true ? "park_only" : parkEffective === "unresolved" ? "unresolved" : "auto_deny";
         default: {
             const _exhaustive = form;
@@ -211,10 +228,12 @@ export function deriveWiringManifest(facts) {
     }
     return manifest;
 }
-export function resolveAskSeamForm(spec, deps) {
-    const seat = spec.onAsk !== undefined ? { value: spec.onAsk, provenance: "spec" } : deps.onAsk !== undefined ? { value: deps.onAsk, provenance: "deps" } : undefined;
+export function resolveAskSeat(spec, deps) {
+    const specValue = spec.onAsk;
+    const seat = specValue !== undefined ? { value: specValue, provenance: "spec" } : ((v) => (v !== undefined ? { value: v, provenance: "deps" } : undefined))(deps.onAsk);
+    const reach = screenApprovalReach(spec.approvalReach);
     if (seat === undefined)
-        return { form: "absent" };
+        return Object.freeze(reach === undefined ? { value: undefined, form: "absent" } : { value: undefined, form: "declared_none", reach });
     const v = seat.value;
     const form = typeof v === "function" ? "callback" : v === "allow" ? "allow" : v === "deny" ? "deny" : undefined;
     if (form === undefined) {
@@ -223,7 +242,13 @@ export function resolveAskSeamForm(spec, deps) {
         e.code = "config.interaction_wiring";
         throw e;
     }
-    return { form, provenance: seat.provenance };
+    if (reach !== undefined && form === "callback")
+        return Object.freeze({ value: undefined, form: "declared_none", provenance: seat.provenance, reach });
+    return Object.freeze({ value: v, form, provenance: seat.provenance, ...(reach !== undefined ? { reach } : {}) });
+}
+export function resolveAskSeamForm(spec, deps) {
+    const seat = resolveAskSeat(spec, deps);
+    return { form: seat.form, ...(seat.provenance !== undefined ? { provenance: seat.provenance } : {}) };
 }
 export function resolveQuestionSeam(spec, deps) {
     const seat = spec.onQuestion !== undefined ? { value: spec.onQuestion, provenance: "spec" } : deps.onQuestion !== undefined ? { value: deps.onQuestion, provenance: "deps" } : undefined;

package/dist/index.d.ts

@@ -42,7 +42,7 @@ export { StdioLspTransport, type LspChildProcess } from "./engine/lsp/stdio-lsp-
 export { encodeFrame, createFrameDecoder } from "./engine/lsp/frame-decoder.js";
 export { resolveModel, resolveTaskModel, parseModelMention, expandTiers, DEFAULT_TIER_ORDER, CC_MODEL_TIER_ALIASES, ROLE_TIER_DEFAULTS, MODEL_ROLES, type ModelRole, type RoleSpec, type ModelRoles, type ResolvedRole, type ModelMention, } from "./core/roles.js";
 export { selectModel, selectModelOrThrow, type ModelCriteria, type ModelTier } from "./core/select-model.js";
-export { BrainError, classifyHttp, isProviderEchoShape, PROVIDER_ECHO_SHAPE, type BrainErrorCode } from "./brain/errors.js";
+export { BrainError, classifyHttp, isProviderEchoShape, PROVIDER_ECHO_SHAPE, PROXY_TUNNEL_REFUSED, type BrainErrorCode } from "./brain/errors.js";
 export { looksDegenerate, inspectDegenerate, trimDegenerateTail } from "./brain/repetition.js";
 export type { RepetitionEvent, RepetitionInspection } from "./brain/repetition.js";
 export { computeCostMicroUsd, isModelPriced, modelCostToPricing, type ModelPricing, type TokenCounts, } from "./core/pricing.js";
@@ -63,7 +63,8 @@ export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classify
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice, type AskUnresolvableFacts } from "./core/ask-unresolvable-notice.js";
 export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
-export { USER_STEER_UNDRAINED_CAUSES, type UserSteerUndrainedCause } from "./core/engine-notice.js";
+export { USER_INPUT_UNDRAINED_CAUSES, type UserInputUndrainedCause } from "./core/engine-notice.js";
+export { STEER_REPLAY_FACETS, type SteerReplayFacet } from "./core/steer-replay.js";
 export { TOOL_TURN_INCOMPLETE_CAUSES, type ToolTurnIncompleteCause } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
 export { TERMINAL_CAUSE_IS_REPLAYABLE, type TerminalFailureDetail, type TerminalBlockedDetail, PROMPT_BLOCK_CAUSES, type PromptBlockCause, isPromptBlockCause } from "./core/terminal-cause.js";
@@ -162,7 +163,7 @@ export { parkedToolIdentity } from "./core/tool-roster.js";
 export { type ToolCallIdentity } from "./core/fs-write-gate-policy.js";
 export { type RuleFaceView, catalogRuleFaceView } from "./core/permission-rules.js";
 export { DURABLE_HISTORY_NAMES } from "./engine/compaction/utils.js";
-export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, type AutoModeArmReason, type AutoModeArmFact, type WiringManifest, type WiringManifestMcpEntry, LSP_LANES, type LspLane, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, type AutoModeArmReason, type AutoModeArmFact, type WiringManifest, type WiringManifestMcpEntry, LSP_LANES, type LspLane, type WiringFacts, type WiringLegKind, type AskSeamForm, APPROVAL_REACH, type ApprovalReach, isApprovalReach, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
@@ -192,7 +193,7 @@ export { createAllowDenyPolicy, createApprovalPolicy,
  *  members that seat has no lane for (`"unavailable"`, a routing answer; `updatedInput`, an operator edit a
  *  policy verdict cannot get re-adjudicated). Exported so a host can NAME it instead of deriving it through
  *  `Parameters<typeof createApprovalPolicy>[0]["approve"]`. */
-type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, abortedSeatDeny, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { type ReadRootGrantScreen } from "./core/read-root-grant-screen.js";
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, type PersistedRuleMandate, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, type ModeReleaseReason, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
@@ -200,6 +201,7 @@ export { modePolicyOf, type ModePolicy, PERMISSION_MODE_FOLD_REASONS, type Permi
 export type { PermissionSeatInputs, PermissionSeatReading } from "./core/mode-policy.js";
 export type { SkillGateSeats, SkillGrantHit, SkillGrantLane, SkillGrantOrigin, SkillGrantRecord } from "./core/skill-grant.js";
 export { SKILL_GRANT_ORIGINS } from "./core/skill-grant.js";
+export type { BoundSkillGrants } from "./core/skill-grant-binding.js";
 export { ALLOW_ENTRY_INERT_REASONS, compileAllowEntry, compileAllowList, type AllowEntryInertReason, type CompiledAllowEntry, type AllowEntryGateSeats, type AllowEntryLane, type AllowEntryHit } from "./core/allow-entry.js";
 export { ALLOW_RULE_MEMBERS, type AllowRuleMember, type AllowRuleShadow } from "./core/allow-rule-shadow.js";
 export { mintNamespacePrefix } from "./core/protocol-naming.js";

package/dist/index.js

@@ -29,7 +29,7 @@ export { StdioLspTransport } from "./engine/lsp/stdio-lsp-transport.js";
 export { encodeFrame, createFrameDecoder } from "./engine/lsp/frame-decoder.js";
 export { resolveModel, resolveTaskModel, parseModelMention, expandTiers, DEFAULT_TIER_ORDER, CC_MODEL_TIER_ALIASES, ROLE_TIER_DEFAULTS, MODEL_ROLES, } from "./core/roles.js";
 export { selectModel, selectModelOrThrow } from "./core/select-model.js";
-export { BrainError, classifyHttp, isProviderEchoShape, PROVIDER_ECHO_SHAPE } from "./brain/errors.js";
+export { BrainError, classifyHttp, isProviderEchoShape, PROVIDER_ECHO_SHAPE, PROXY_TUNNEL_REFUSED } from "./brain/errors.js";
 export { looksDegenerate, inspectDegenerate, trimDegenerateTail } from "./brain/repetition.js";
 export { computeCostMicroUsd, isModelPriced, modelCostToPricing, } from "./core/pricing.js";
 export { cacheFamilyOf, promptTokensOf, uncachedInputTokensOf } from "./core/runner/usage-accounting.js";
@@ -49,7 +49,8 @@ export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classify
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice } from "./core/ask-unresolvable-notice.js";
 export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
-export { USER_STEER_UNDRAINED_CAUSES } from "./core/engine-notice.js";
+export { USER_INPUT_UNDRAINED_CAUSES } from "./core/engine-notice.js";
+export { STEER_REPLAY_FACETS } from "./core/steer-replay.js";
 export { TOOL_TURN_INCOMPLETE_CAUSES } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
 export { TERMINAL_CAUSE_IS_REPLAYABLE, PROMPT_BLOCK_CAUSES, isPromptBlockCause } from "./core/terminal-cause.js";
@@ -134,7 +135,7 @@ export { parkedToolIdentity } from "./core/tool-roster.js";
 export {} from "./core/fs-write-gate-policy.js";
 export { catalogRuleFaceView } from "./core/permission-rules.js";
 export { DURABLE_HISTORY_NAMES } from "./engine/compaction/utils.js";
-export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, LSP_LANES, } from "./core/wiring-manifest.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, LSP_LANES, APPROVAL_REACH, isApprovalReach, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, } from "./core/park-selfcheck.js";
 export {} from "./core/checkpoint-store.js";
 export {} from "./core/checkpoint-store.js";
@@ -157,7 +158,7 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, abortedSeatDeny, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export {} from "./core/read-root-grant-screen.js";
 export { ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -293,6 +293,10 @@ export interface RunWorkflowToolDeps {
      *  `ToolExecuteContext.interactiveTools` seat — without it a headless-clamped host's workflow
      *  children could re-mount the interactive tool the host run disabled. */
     parentInteractiveTools?: false;
+    /** The HOST task's declaration that nobody on it can be asked to approve (`TaskSpec.approvalReach: "none"`), same
+     *  carriage rules as the two clamps above: only `"none"` travels, and the auto-mount's minimal ctx makes this dep its one
+     *  carrier — without it a declared-none host's workflow children fell back to the deployment's live approver. */
+    parentApprovalReach?: "none";
     /** Call-time getter for the HOST task's RESOLVED model AND the word that chose it: a spawned agent whose
      *  fold chain produced no model inherits the object on its spec and the word on its trusted channel
      *  (the subagent lane's `ctx.model` / `ctx.modelRef` pair). Word-less ⇒ the object alone, i.e. a pin. */

package/dist/orchestration/run-workflow-tool.js

@@ -509,7 +509,7 @@ export async function createRunWorkflowTool(d) {
             const childParkSeat = ctx.checkpointStoreForChildren ?? d.parentCheckpointStore;
             const parkStore = checkpointStoreOfSeat(childParkSeat);
             const scriptFn = (wfCtx) => {
-                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, childParkSeat, parentFaceSeat(ctx.readFace, d.parentReadFace), parentFaceSeat(ctx.writeFace, d.parentWriteFace), d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false);
+                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, childParkSeat, parentFaceSeat(ctx.readFace, d.parentReadFace), parentFaceSeat(ctx.writeFace, d.parentWriteFace), d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false, ctx.approvalReach === "none" || d.parentApprovalReach === "none");
                 return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
             };
             if (ctx.signal?.aborted) {

package/dist/orchestration/workflow-primitives.d.ts

@@ -60,4 +60,6 @@ parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"],
 parentHandsReadOnly?: boolean, 
 /** #345 ③ — the HOST task's hard-headless clamp is ON (`spec.interactiveTools === false`).
  *  Same tighten-only injection; only the disabling value ever arrives here as `true`. */
-parentInteractiveToolsOff?: boolean): WorkflowPrimitives;
+parentInteractiveToolsOff?: boolean, 
+/** The HOST task declared that nobody on it can be asked (`approvalReach: "none"`). Same tighten-only injection. */
+parentApprovalReachNone?: boolean): WorkflowPrimitives;

package/dist/orchestration/workflow-primitives.js

@@ -1,5 +1,5 @@
 import { assertSupportedAgentIsolation } from "./workflow.js";
-import { childClampSeats } from "../core/child-clamp-seats.js";
+import { childClampSeats, postureUnderClamps } from "../core/child-clamp-seats.js";
 import { WorkflowScriptError } from "./workflow-meta.js";
 import { buildGovernedChildSpec, emitIgnoredAgentOptionsNotice, overlayWorktreeBaseline, MAX_ANNOUNCED_KEYS, SPEC_KEY_ALIASES, WHITELIST_KEYS, } from "./workflow-governance.js";
 const ACCEPTED_AGENT_OPTION_KEYS = ["label", "phase", "schema", "agentType", "isolation"];
@@ -66,7 +66,7 @@ function formatResourceClampNote(notes) {
     const parts = notes.map((n) => `${n.field}: requested ${n.requested === undefined ? "unset" : n.requested} → applied ${n.applied}`);
     return `workflow governance tightened this agent's resource limits (${parts.join("; ")})`;
 }
-export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentCheckpointStore, parentReadFace, parentWriteFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
+export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentCheckpointStore, parentReadFace, parentWriteFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff, parentApprovalReachNone) {
     const agent = (spec, opts) => {
         if (typeof spec === "string")
             spec = { objective: spec };
@@ -82,15 +82,15 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentChe
         const workflowChildClamps = childClampSeats({
             handsReadOnly: parentHandsReadOnly,
             interactiveTools: parentInteractiveToolsOff === true ? false : undefined,
+            approvalReach: parentApprovalReachNone === true ? "none" : undefined,
             readFace: parentReadFace?.() === "roots" ? "roots" : childSpec.readFace,
             writeFace: parentWriteFace?.() === "roots" ? "roots" : childSpec.writeFace,
             readDenyPatterns: pd !== undefined && pd.length > 0 ? [...(childSpec.readDenyPatterns ?? []), ...pd] : childSpec.readDenyPatterns,
         });
         Object.assign(childSpec, workflowChildClamps);
-        if (parentInteractiveToolsOff === true) {
-            if (childSpec.interactionPosture === "interactive")
-                delete childSpec.interactionPosture;
-        }
+        const posture = postureUnderClamps(childSpec.interactionPosture, { interactiveTools: parentInteractiveToolsOff === true ? false : undefined, approvalReach: parentApprovalReachNone === true ? "none" : undefined });
+        if (posture !== undefined)
+            childSpec.interactionPosture = posture;
         if (onAgentSpawn) {
             return ctx.agentStream(childSpec, agentOpts).then((handle) => {
                 onAgentSpawn(handle);

package/dist/orchestration/workflow-types.d.ts

@@ -421,6 +421,9 @@ export interface WorkflowRun {
      * read or written carrying this token's `parked` entry, so
      * absence is the confirmed state and an entry written before this member reads as confirmed, exactly as it did; the
      * engine's own material read identity-checks what it finds, so an unconfirmed origin degrades rather than mis-binds.
+     * `parkedBy` is the run standing on the park: a record's run holds it iff `entry.parkedBy === record.id` (never
+     * `originRunId`); inheritance keeps it. `generation` is the inherited entry's, else `0`, plus one per admission — the
+     * highest on a session is the chain's tail, a tie is a fork. Both or neither; an older entry has neither (no holder).
      */
     parks?: Array<{
         callKey: string;
@@ -428,6 +431,8 @@ export interface WorkflowRun {
         token: string;
         originRunId: string;
         originUnconfirmed?: true;
+        parkedBy?: string;
+        generation?: number;
     }>;
     /**
      * Set (`true`) on a resume run's record from its creation and REMOVED the moment its admission completes — so a record

package/dist/orchestration/workflow.d.ts

@@ -223,8 +223,9 @@ export interface WorkflowAgentHandle {
      * legs of one steering ingress are equally replay-safe. ⚠️ ONE arm of that contract is NOT reachable through this
      * handle, deliberately: the idempotent-REPLAY arm ("same id, same payload ⇒ injects nothing"). Each call mints a
      * FRESH unguessable correlation marker into the framing it delivers, so a retry under the same id is a
-     * same-id-DIFFERENT-instruction call and refuses typed `steering.duplicate_input_id`. What the key buys on this
-     * lane is therefore AT-MOST-ONCE: a retried ingress is refused LOUDLY instead of injecting a second copy.
+     * same-id-DIFFERENT-instruction call and refuses typed `steering.duplicate_input_id` (`detail.differs` always names
+     * `text` on this lane). What the key buys on this lane is therefore AT-MOST-ONCE: a retried ingress is refused
+     * LOUDLY instead of injecting a second copy.
      */
     steer(content: string, opts?: {
         inputId?: string;