@sema-agent/core 7.44.0 → 7.45.0

package/dist/core/gate-outcome.d.ts

@@ -125,6 +125,11 @@ export type SettlementParty = (typeof SETTLEMENT_PARTIES)[number];
 export type SettlementPartiesMatchTheRecord = AssertAllKeysHandled<Exclude<Settlement["who"]["party"], SettlementParty> | Exclude<SettlementParty, Settlement["who"]["party"]>>;
 /** Membership test for {@link SettlementParty}. */
 export declare function isSettlementParty(v: unknown): v is SettlementParty;
+/** Who REPORTED a durable decide (`hostDecision.decidedBy`): a person, the host's own SLA sweep at the row's deadline, or the
+ *  deployment's policy — the closed set; a host's decide door mirrors the words it accepts from this one. */
+export declare const HOST_DECIDERS: readonly ["person", "sla_timeout", "policy"];
+export type HostDecider = (typeof HOST_DECIDERS)[number];
+export declare const isHostDecider: (word: unknown) => word is HostDecider;
 /** The DECIDER arms of {@link Settlement} — a person's and the deployment policy's, the two parties that
  *  answer an ask either way. Named so a site that both composes one and quotes its note can read the seat
  *  off the record instead of re-deriving it. */

package/dist/core/gate-outcome.js

@@ -25,6 +25,8 @@ const SETTLEMENT_PARTY_SET = new Set(SETTLEMENT_PARTIES);
 export function isSettlementParty(v) {
     return SETTLEMENT_PARTY_SET.has(v);
 }
+export const HOST_DECIDERS = Object.freeze(["person", "sla_timeout", "policy"]);
+export const isHostDecider = (word) => HOST_DECIDERS.some((w) => w === word);
 export function decidersNote(text) {
     return text === "" ? undefined : text;
 }

package/dist/core/hooks.d.ts

@@ -1466,6 +1466,8 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
     permissionMode?: () => import("./ask-origin.js").PermissionMode;
     /** The leg's approval-seat form (`WiringManifest.ask.form`): the deny exit's way-out clause names a declaration, never a missing approver. */
     askSeatForm?: import("./wiring-manifest.js").AskSeamForm;
+    /** The read face the leg resolved, read per call into the class derivation (`roots` withholds the classifier from a `probe` question); absent ⇒ none resolved. */
+    readFace?: () => import("../tools/fs/containment-face.js").ContainmentFace | undefined;
     /** WHO put the tool's egress / irreversibility marks on the seat ({@link import("./ask-origin.js").ToolMarkSource});
      *  absent or empty with a mark present reads as the deployment's own (fail-closed: an operator's mandate). */
     toolMarkSources?: ReadonlySet<import("./ask-origin.js").ToolMarkSource>;

package/dist/core/memory-engine/content-origin.d.ts

@@ -1,37 +1,3 @@
-/**
- * design/178 §3 — the tool content-origin classification (three tiers by CAPABILITY, fail-closed).
- *
- * The question this face answers per mounted tool: can invoking it bring content from OUTSIDE the
- * deployment's trust boundary into the session — and therefore, via the automatic harvest path,
- * into long-term memory? Three tiers:
- *
- *  - "external"  — network-retrieval families and external protocol channels. Invocation marks the
- *                  session's memory EXTERNALLY EXPOSED (one-way, durable; what the mark does at
- *                  harvest is the provenance mode's question — design/336: tag-admit with an origin
- *                  marker under "carry", full quarantine under "off").
- *  - "execution" — general execution (shell/exec). A NAMED residual channel: it can reach external
- *                  content indirectly, but the two industry anchors this tier is calibrated against
- *                  gate on network/protocol families only, and excluding every shell session would
- *                  disable memory for the main coding scenario. Not polluting by default; the
- *                  `execIsExternalContent` strict knob upgrades it to external.
- *  - "local"     — purely local reads/computation.
- *
- * WHO CLASSIFIES (single-source rule): core built-ins declare `contentOrigin` on their own ToolSpec
- * (the classification lives with the tool definition); protocol tools (MCP/A2A) are structurally
- * external (the channel itself crosses the boundary); a HOST tool declares its own — and when it
- * does not, the default is EXTERNAL (fail-closed: unknown = external), overridable only through the
- * explicit `TaskSpec.memory.trustedTools` allowlist. A core-mounted built-in without a declaration
- * defaults local: core owns those definitions, and the fail-closed default exists for tools core
- * CANNOT vouch for, not for its own. A declaration is honored only when it SPELLS a member of the
- * closed vocabulary — an unreadable one is not a declaration.
- *
- * The three tier names are BOUNDARY-RELATIVE, not statements about topology: `"local"` means "does
- * not bring content from outside the deployment's trust boundary", which a unix socket to another
- * process the deployment itself runs satisfies and a loopback HTTP call to somebody else's service
- * does not. Distance is not the axis; whose content it is, is.
- *
- * There is deliberately no "gate inactive" state: every mounted tool gets a class.
- */
 import type { ToolContentOrigin } from "../types.js";
 export interface ClassifyToolContentOriginInput {
     /** The tool's own `contentOrigin` declaration (ToolSpec/AgentTool carry) — wins when present AND

package/dist/core/memory-engine/content-origin.js

@@ -1,3 +1,4 @@
+import { allowedToolNames, readDeniedEntry, readToolNameList } from "../../agents/tool-filter.js";
 const TOOL_CONTENT_ORIGIN_SET = { external: true, execution: true, local: true };
 export const TOOL_CONTENT_ORIGINS = Object.keys(TOOL_CONTENT_ORIGIN_SET);
 export function isToolContentOrigin(value) {
@@ -27,10 +28,14 @@ export function delegationCallIsExternal(input) {
     if (face === undefined)
         return true;
     const selectedFor = (f) => {
-        const d = f.denyTools ?? [];
-        const a = f.allowTools;
-        const isNarrowed = a !== undefined && !a.includes("*");
-        return input.pool.filter((t) => (!isNarrowed || a.some((x) => selectedBy(x, t))) && !d.some((x) => selectedBy(x, t)));
+        const deniedList = readToolNameList(f.denyTools);
+        const d = deniedList.kind === "entries" ? deniedList.entries : [];
+        const a = allowedToolNames(f.allowTools);
+        const denies = (t) => d.some((x) => {
+            const read = readDeniedEntry(x);
+            return read.kind === "name" && selectedBy(read.name, t);
+        });
+        return input.pool.filter((t) => (a === undefined || [...a].some((x) => selectedBy(x, t))) && !denies(t));
     };
     if (selectedFor(face).some((t) => input.isPolluting(t)))
         return true;

package/dist/core/memory-engine/layout.d.ts

@@ -259,6 +259,10 @@ export declare function adoptRootScopeLayout(rootPath: string, controlDir: strin
 export declare const canonicalize: typeof physicalPathOfExisting;
 /** True iff `child` (canonicalized) is `root` or inside it. */
 export declare function isContainedIn(root: string, child: string): boolean;
+/** The codes the store's physical form refuses an act with — the whole family, one closed set: {@link TARGET_OUTSIDE_STORE} and
+ *  {@link SCOPE_HOME_NOT_DIRECTORY}. Each is a plain `Error` carrying `code` and a `detail` ({@link StoreFormRefusalDetail}). */
+export declare const STORE_FORM_REFUSAL_CODES: readonly ["memory.target_outside_store", "memory.scope_home_not_directory"];
+export type StoreFormRefusalCode = (typeof STORE_FORM_REFUSAL_CODES)[number];
 /** The code an act on a store path is refused with when it would land outside the store ({@link landsOutsideStore}). */
 export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
 /** The code a scope home that is not a real directory is refused with ({@link assertHomePhysicalForm}). */
@@ -283,7 +287,7 @@ export type StoreFormRefusalDetail = {
  *  the engine's own account is intact, the layout it was handed is not the layout it needs) carrying a
  *  `code` and a `detail`. */
 export type StoreFormRefusal = Error & {
-    code: typeof TARGET_OUTSIDE_STORE | typeof SCOPE_HOME_NOT_DIRECTORY;
+    code: StoreFormRefusalCode;
     detail: StoreFormRefusalDetail;
 };
 /** Seat 1 — an act the store's physical form refuses: `act` names what was refused (no path), `path` is the

package/dist/core/memory-engine/layout.js

@@ -731,6 +731,7 @@ export function isContainedIn(root, child) {
     const c = canonicalize(child);
     return c === r || c.startsWith(`${r}${sep}`);
 }
+export const STORE_FORM_REFUSAL_CODES = Object.freeze(["memory.target_outside_store", "memory.scope_home_not_directory"]);
 export const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
 export const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
 export const SCOPE_HOME_FORMS = Object.freeze(["symlink", "file", "other"]);

package/dist/core/permission-rules.d.ts

@@ -149,6 +149,10 @@ export interface PermissionRulePolicyOptions {
      * own; #644). Facts of the DEPLOYMENT and the task, never of the rule — a pattern is stored as spelled.
      * A rule whose base is absent (or not an absolute path) here is refused at compile time
      * (`unsupported.path_base`, naming the base — {@link ruleBasesNeeded} is the same classification).
+     * A call's own target resolves against these bases as given; when they hold neither `root` nor `cwd`,
+     * against the request's (`ToolCallRequest.root` / `.cwd`, stamped by the Runner) — never a mix of the two
+     * sources. A target neither supplies the base for is unreadable: every path rule able to reach the call
+     * answers it with the fail-closed ask (`ruleUnreadable`).
      */
     pathBases?: PathRuleBases;
 }

package/dist/core/permission-rules.js

@@ -366,10 +366,13 @@ export function createPermissionRulePolicy(rules, opts) {
         ...(callFace !== undefined ? faceRules[behavior].filter((r) => r.faces.includes(callFace)) : []),
     ];
     const commandParam = catalogRuleFaceOf("Bash")?.primaryParams[0] ?? "command";
+    const policyNamesTree = pathBases.root !== undefined || pathBases.cwd !== undefined;
+    const callBasesOf = (req) => policyNamesTree ? pathBases : { ...pathBases, ...(typeof req.root === "string" ? { root: req.root } : {}), ...(typeof req.cwd === "string" ? { cwd: req.cwd } : {}) };
     const contentHit = (lane, req) => {
         if (lane.length === 0)
             return undefined;
-        const target = effectivePathTargetOf(req, protectivePathTargetOf(req), pathBases);
+        const bases = callBasesOf(req);
+        const target = effectivePathTargetOf(req, protectivePathTargetOf(req), bases);
         const command = isPlainObjectArgs(req.args) ? req.args[commandParam] : undefined;
         let unreadable;
         for (const r of lane) {
@@ -386,7 +389,7 @@ export function createPermissionRulePolicy(rules, opts) {
                     unreadable ??= { rule: r, unreadable: target.reason };
                     continue;
                 }
-                const outcome = pathRuleReachOf(r.parsed, target.identity, pathBases);
+                const outcome = pathRuleReachOf(r.parsed, target.identity, bases);
                 if (outcome.reach === "reached")
                     return { rule: r };
                 if (outcome.reach === "unreadable")

package/dist/core/real-approval.d.ts

@@ -6,6 +6,7 @@
  * may still refuse it.
  */
 import type { Checkpoint } from "./checkpoint-store.js";
+import type { HostDecider } from "./gate-outcome.js";
 import type { OrgGateVerdict } from "./hooks.js";
 import type { AskRequest, PermissionResult, ResolvedAsk } from "./tool-policy.js";
 /** The synchronous seat's refusal of a configuration's allow: one settlement word for both forms
@@ -16,10 +17,12 @@ export declare function unjudgedAllowRefused(req: AskRequest, by: "blanket" | "p
 /** A durable row demands a person when its gate carries the real-approval bit (the gate's own, which every resume
  *  check reads; the pending action's `requiresRealApproval` is its display twin). */
 export declare function rowDemandsAPerson(cp: Checkpoint): boolean;
-/** A question a durable decide is held against, in each form a station holds one: the parked row, a policy's
- *  re-check of an approver's edit, and the organization's CURRENT verdict about the call. */
-export type HeldQuestion = Checkpoint | PermissionResult | OrgGateVerdict;
-/** Whether a durable decide made by `decidedBy` cannot answer the held question: a question demanding a person is not
+/** A question a decide is held against, in each form a station holds one: the parked row, a policy's re-check of an
+ *  approver's edit, the organization's CURRENT verdict about the call, and the request an approver was handed (the card a
+ *  live door answers). */
+export type HeldQuestion = Checkpoint | PermissionResult | OrgGateVerdict | AskRequest;
+/** Whether a decide made by `decidedBy` cannot answer the held question: a question demanding a person is not
  *  the policy's to answer. One predicate for every station that holds a decide against such a question — the resume
- *  entry (the row, an edit's re-check, the org's current verdict) and the execution belt (the last two, re-read). */
-export declare function policyCannotAnswer(question: HeldQuestion, decidedBy: "person" | "sla_timeout" | "policy"): boolean;
+ *  entry (the row, an edit's re-check, the org's current verdict), the execution belt (the last two, re-read) and a live
+ *  door answering the request an approver was handed. */
+export declare function policyCannotAnswer(question: HeldQuestion, decidedBy: HostDecider): boolean;

package/dist/core/real-approval.js

@@ -16,11 +16,11 @@ export function rowDemandsAPerson(cp) {
     return cp.gate.kind === "irreversible_ask" && cp.gate.realApproval !== undefined;
 }
 function demandsAPerson(question) {
-    if ("gate" in question)
-        return rowDemandsAPerson(question);
-    if ("action" in question)
-        return question.action === "ask" && question.requiresRealApproval === true;
-    return question.status === "available" && question.verdict?.behavior === "ask";
+    const gate = Reflect.get(question, "gate");
+    const verdict = Reflect.get(question, "verdict");
+    const row = typeof gate === "object" && gate !== null && rowDemandsAPerson(question);
+    const org = Reflect.get(question, "status") === "available" && typeof verdict === "object" && verdict !== null && Reflect.get(verdict, "behavior") === "ask";
+    return row || Reflect.get(question, "requiresRealApproval") === true || org;
 }
 export function policyCannotAnswer(question, decidedBy) {
     return decidedBy === "policy" && demandsAPerson(question);

package/dist/core/runner/child-tree.d.ts

@@ -0,0 +1,13 @@
+import type { RunnerDeps } from "../types.js";
+/**
+ * Whether this deployment can place a child agent in a tree OTHER than the caller's — the one fact behind
+ * every request of that shape: an explicit `cwd`, a workflow agent's `isolation: "worktree"`, and the
+ * delegation tool's per-call or per-definition `isolation: "worktree"`.
+ *
+ * Only an `executionEnvFactory` can: it builds one execution env per task, so a child can be rooted
+ * wherever the request says. A static `executionEnv` is ONE shared env with ONE cwd — every child that
+ * runs on it runs in the caller's root, whatever tree it was asked to work in. A request the deployment
+ * cannot honor is refused before the child starts (and, for a worktree, before one is minted); each site
+ * keeps its own code and sentence for the refusal, but none decides the condition itself.
+ */
+export declare function deploymentCanRerootChild(deps: Pick<RunnerDeps, "executionEnvFactory">): boolean;

package/dist/core/runner/child-tree.js

@@ -0,0 +1,3 @@
+export function deploymentCanRerootChild(deps) {
+    return deps.executionEnvFactory !== undefined;
+}

package/dist/core/runner/contracts.d.ts

@@ -31,7 +31,7 @@ import type { MaterializedA2a } from "../a2a.js";
 import type { CompactionForkContext, CompactionPhaseDurations, MaybeCompactOptions, RapidRefillState } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker, DenialLimitFallbackFace } from "../auto-mode.js";
-import type { SettlementKind } from "../gate-outcome.js";
+import type { HostDecider, SettlementKind } from "../gate-outcome.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
 import type { Checkpoint, CheckpointState, CheckpointStore, CheckpointToken, PendingSteerEntry, PlatformLimitReason, ReopenReason, ResourceLedger, ResourceLimitReason, ResumeOutcome, SerializedCheckpointState } from "../checkpoint-store.js";
 import type { ExecutionOutcomeRecordWord } from "../checkpoint-execution-record.js";
@@ -391,6 +391,8 @@ export interface Prepared {
     /** The per-task logical cwd ref when a real shell is mounted (else undefined). The Runner
      *  reads `cwdRef.current` after each tool to detect a `cd` move and emit `workspace_changed`. */
     cwdRef?: CwdRef;
+    /** The root the hand tools resolve root-relative spellings against (present with hands; read-only hands included). */
+    handsRoot?: string;
     /** The run's TOOL-PROGRESS lane seat, late-bound for the same reason `harnessRef` is (the tool band is
      *  built during prepare; the lane needs `pushContent` and `ident`, which exist only after it returns).
      *  The driver binds `current` right after `pushContent` exists. Always present on a completed prepare —
@@ -442,7 +444,7 @@ export interface Prepared {
         toolCallId: string;
         toolName: string;
         args: unknown;
-        decidedBy: "person" | "sla_timeout" | "policy";
+        decidedBy: HostDecider;
     }) => Promise<{
         readonly refused: string;
     } | {
@@ -2748,6 +2750,10 @@ export interface RunnerSelfSeat {
         toolPolicy?: RunnerDeps["toolPolicy"];
         hooks?: RunnerDeps["hooks"];
     };
+    /** Whether a child task THIS runner runs can be placed in a tree other than the caller's (an explicit cwd, a worktree):
+     *  true only when its deps carry an `executionEnvFactory` (live read — `swapDeps` replaces the deps). The delegation tool asks
+     *  the runner that will run the child, not the one that ran the parent leg. Absent on a hand-built seat ⇒ read as "cannot say" ⇒ no; a hand-built seat answers for the runner its `runTask` forwards to. */
+    canRerootChild?(): boolean;
     /** Fire `RunnerDeps.onTaskOutcome` through the swallow-guarded chokepoint (thin compositions emit at their terminal state). */
     emitTaskOutcome(outcome: TaskOutcome): void;
     /** Run a task to completion. `internals` is the TRUSTED run-scoped channel (never a TaskSpec field). */

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -28,6 +28,8 @@ export interface PrepareAskLaneInput {
     /** borrowed-readonly — the hand's live tracked cwd, or undefined (hands-less). Read per call at RUN time (`current`),
      *  never captured: the fs hand tools resolve their relative paths against this very ref. Not written here. */
     handsCwdRef: CwdRef | undefined;
+    /** borrowed-readonly — the root the hand tools resolve root-relative spellings against, or undefined (hands-less). */
+    handsRoot: string | undefined;
     /** borrowed-readonly — the run's advertised-writable-directory seat, or undefined (hands-less / nothing advertised). `roots` is read at RUN time, never captured: it is the fence's own admitted list and the write gate's exemption domain must be that same list. Not written here. */
     advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
     /** borrowed-readonly — the shared mount roster; read at RUN time by the approval-preview projection (alias-aware

package/dist/core/runner/prepare-ask-lane.js

@@ -59,14 +59,14 @@ function resolveApprovalPreview(tools, toolName, args) {
     }
 }
 export function prepareAskLane(input) {
-    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
+    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, handsRoot, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
     if (!gateMachineryActive)
         return { askLane: undefined };
     const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
     const adjudicate = effectivePolicy
         ? (req, callSignal) => {
             const signal = composedCallSignal(callSignal);
-            return raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...advertisedWritableRootsSeat(advertisedWritableDirs) }, signal)), signal, () => ({
+            return raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...(handsRoot !== undefined ? { root: handsRoot } : {}), ...advertisedWritableRootsSeat(advertisedWritableDirs) }, signal)), signal, () => ({
                 action: "deny",
                 message: "policy check aborted (task timed out or cancelled)",
             }));

package/dist/core/runner/prepare-config-doors.js

@@ -14,6 +14,7 @@ import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from ".
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeat, resolveQuestionSeam } from "../wiring-manifest.js";
 import { assertPeerPresenceValue } from "../../agents/peer-directory.js";
+import { snapshotDefinitionLists } from "../../agents/tool-filter.js";
 import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
 const TASK_LIMIT_KEY_DICT = {
     maxTokens: true,
@@ -359,9 +360,10 @@ export function prepareConfigDoors(input) {
             e.code = "config.agents.no_delegation_tool";
             throw e;
         }
-        const perTask = spec.agents;
+        const perTask = spec.agents.map(snapshotDefinitionLists);
         spec = {
             ...spec,
+            agents: perTask,
             tools: pool.map((t) => {
                 if (typeof t.withAgents !== "function")
                     return t;

package/dist/core/runner/prepare-execution-env.js

@@ -1,12 +1,13 @@
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasDestroy } from "../remote-env.js";
 import { announceMalformedCapabilities } from "./env-capability-census.js";
+import { deploymentCanRerootChild } from "./child-tree.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 export async function prepareExecutionEnv(input) {
     const { deps, spec, internals, resume, placementRootResolved, sessionId, forgetOnThrow, rollback } = input;
     let ownedEnv;
     let ownedEnvObservedAt;
-    if (internals?.requestedCwd !== undefined && deps.executionEnvFactory === undefined) {
+    if (internals?.requestedCwd !== undefined && !deploymentCanRerootChild(deps)) {
         await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (cwd-unsupported leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
         const e = new Error(`Agent cwd "${internals.requestedCwd}" cannot take effect: this deployment has no executionEnvFactory (a static execution environment cannot be re-rooted per agent). Drop the cwd parameter or deploy a factory.`);
         e.code = "config.cwd_unsupported";

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -37,6 +37,7 @@ import { type WiringManifest } from "../wiring-manifest.js";
 import type { WriteProtectionCheck } from "../write-protect.js";
 import type { ShellReadCheck } from "../../tools/fs/shell-read-check.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
+import type { ContainmentFace } from "../../tools/fs/containment-face.js";
 import type { AskLane, GateSeatInputsFor, IrreversibilityTier, ParkAsk, Prepared, ReversibilityProbes, StopForDenialLimit } from "./contracts.js";
 import type { PermissionRuleLanes } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
@@ -167,6 +168,8 @@ export interface PrepareGateStationsInput {
     /** borrowed-readonly — the leg's shell READ STATION (`ToolGateInput.shellReadCheck`), mounted by the hands phase, or
      *  undefined with no real shell: no station, nothing judged. */
     shellReadCheck: ShellReadCheck | undefined;
+    /** borrowed-readonly — the leg's resolved read face (`undefined` with no hands), read per call into the class derivation. */
+    readFace: () => ContainmentFace | undefined;
     /** borrowed-readonly — the per-tool irreversibility tier handed to the gate per call. */
     irreversibilityTier: IrreversibilityTier;
     /** borrowed-readonly — the per-tool reversibility probes handed to the gate per call. */

package/dist/core/runner/prepare-gate-stations.js

@@ -46,7 +46,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement, seatInputsFor } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, shellReadCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement, seatInputsFor } = input;
     const gatePreToolUse = ownGatePreToolUse !== undefined ? (name, args, ctx) => ownGatePreToolUse(name, args, { ...ctx, permissionMode: permissionMode.observed }) : undefined;
     const releasesAnnounced = new Map();
     const onModeReleased = (info) => {
@@ -130,6 +130,7 @@ export function prepareGateStations(input) {
                         peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                         ...(shellReadCheck !== undefined ? { shellReadCheck } : {}),
+                        readFace,
                         irreversibility: tierSeat?.value,
                         reversibilityProbe: tierSeat?.read(reversibilityProbes),
                         abortSignal: abortController.signal,

package/dist/core/runner/prepare-listings.d.ts

@@ -1,6 +1,6 @@
 /**
- * PrepareTask's LISTINGS phase: the per-task agent definitions' tool-name audit
- * (deny entries fail loud, allow entries advise), the agent-listing announce face read off the
+ * PrepareTask's LISTINGS phase: the sub-agent tool lists' audit (`sub-agent-deny-lists.ts`),
+ * the agent-listing announce face read off the
  * delegation tool's roster (with its deferred / excluded / removal-to-zero arms), the two listing
  * opt-out advisories, the announced-listings mirror seeded from the once-per-session ledger, the
  * deferred roster's ToolSearch ride, and the date_change seam. The body is the driver's stretch moved
@@ -10,8 +10,8 @@
  * the disclosure mount before it and the context-lane seats after it (a stretch
  * with no await is extracted as a sync function — an `async` wrapper would open a microtask window).
  *
- * Throws pass through unchanged: `config.agent.unknown_tool` (a deny entry naming a tool this
- * deployment does not mount — a typo there would silently guard nothing).
+ * Throws pass through unchanged: `config.agent.unknown_tool` (a denied-tools entry that names no
+ * tool — one judgment for every list a deployment writes, in `sub-agent-deny-lists.ts`).
  */
 import type { AgentTool } from "../../internal/harness.js";
 import type { TaskSpec } from "../types.js";

package/dist/core/runner/prepare-listings.js

@@ -1,30 +1,10 @@
 import { formatLocalDate } from "../../prompts/default.js";
+import { auditSubAgentToolLists } from "./sub-agent-deny-lists.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { renderAgentListingDelta } from "./turn-attachments.js";
 export function prepareListings(input) {
     const { spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingBudget, listingRideRef, renderWithDate, envFacts, tzValid, userTz, dateAnchor } = input;
-    if (spec.agents !== undefined && spec.agents.length > 0) {
-        const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
-        for (const def of spec.agents) {
-            const unknownAllow = (def.allowTools ?? []).filter((n) => n !== "*" && !known.has(n));
-            if (unknownAllow.length > 0) {
-                try {
-                    onceLedger.onError(new Error(`TaskSpec.agents: agent "${def.name}" allows tool(s) ${unknownAllow.join(", ")} not present in this task's assembled roster — likely a typo (the entry would be item-filtered at spawn; the agent stays usable). Advisory only: the delegation pool can differ from this roster, so a tool mounted only on the delegation tool or produced by per-spawn extraTools makes this spurious.`), { phase: "config", sessionId });
-                }
-                catch {
-                }
-            }
-            for (const n of def.denyTools ?? []) {
-                if (n === "*")
-                    continue;
-                if (!known.has(n)) {
-                    const e = new Error(`TaskSpec.agents: agent "${def.name}" declares tool "${n}" in its denied tools, but no such tool exists in this deployment — fix the agent's tools list or mount the tool.`);
-                    e.code = "config.agent.unknown_tool";
-                    throw e;
-                }
-            }
-        }
-    }
+    auditSubAgentToolLists({ spec, tools, onceLedger, sessionId });
     const rosterBearingSpec = (spec.tools ?? []).find((t) => t.agentListing !== undefined && t.agentListing.length > 0);
     const rosterFaceDeferred = rosterBearingSpec !== undefined &&
         !(toolFaceSnapshot.exclude?.includes(rosterBearingSpec.name) ?? false) &&

package/dist/core/runner/prepare-park-ask.d.ts

@@ -94,6 +94,8 @@ export interface PrepareParkAskInput {
     /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read at park time for the re-adjudication.
      *  Not written here. */
     handsCwdRef: CwdRef | undefined;
+    /** borrowed-readonly — the root the live gate stamps beside the cwd ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.handsRoot}). */
+    handsRoot: string | undefined;
     /** borrowed-readonly — the SAME seat the live gate stamps from ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.advertisedWritableDirs}): a parked call's projection re-adjudication asks one question about one call, so it must ask it against the same admitted list. Read at park time, not written here. */
     advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
     /** borrowed-readonly — the run's offload store, or undefined (a volatile store holding results refuses the park). */

package/dist/core/runner/prepare-park-ask.js

@@ -27,7 +27,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -165,7 +165,7 @@ export function prepareParkAsk(input) {
                         toolCallId: req.toolCallId,
                         budget: budgetSnapshot,
                         ...callFaceSeat(req.face),
-                        ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}),
+                        ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...(handsRoot !== undefined ? { root: handsRoot } : {}),
                         ...advertisedWritableRootsSeat(advertisedWritableDirs),
                     }, cutSignal)), cutSignal);
                     if (reprojectedRaced.tag === "aborted")

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -140,6 +140,8 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — LATE-BOUND: this task's own classifier instance (the pass-through test's decider term), read at chain
      *  assembly (the arming runs after this phase, and again on a steer into `auto`). */
     autoModeDecider: () => AutoModeDecider | undefined;
+    /** borrowed-readonly — the leg's resolved read face (`undefined` with no hands), read per call into the inherited stations' class derivation. */
+    readFace: () => import("../../tools/fs/containment-face.js").ContainmentFace | undefined;
     /** borrowed-readonly — the leg's live permission-mode seat: the mode gate policy layer and the inherited stations' arbitration
      *  read `current` per call. */
     permissionMode: PermissionModeController;

package/dist/core/runner/prepare-policy-chain.js

@@ -24,7 +24,7 @@ import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-
 import { thrownText } from "../thrown-value.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -305,11 +305,13 @@ export async function preparePolicyChain(input) {
     const grantBindingOf = (call, args) => skillGrantBindingMembers(call, args, skillSpecs, SKILL_TOOL_NAME);
     const inheritedStationFacts = (call) => {
         const seat = seatMarksOf(call);
+        const face = readFace();
         return {
             ...INHERITED_STATION_FACTS,
             mandateMarks: { egress: seat.egress, shellGated: false, ...(seat.tier === "always" && !seat.shellGated ? { irreversibility: "always" } : {}) },
             ...(seat.sources.size > 0 ? { toolMarkSources: seat.sources } : {}),
             ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}),
+            ...(face !== undefined ? { readFace: face } : {}),
         };
     };
     const inheritedAskEvidence = inheritedAskRuleEvidence(deps.permissionRuleStore);
@@ -616,7 +618,7 @@ export async function preparePolicyChain(input) {
         ...instrumentedChain,
         ...(rewriteCapableLayers ? narrowingLayers : []),
     ];
-    const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy()];
+    const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy({ removalSeat: { env: executionEnv, additionalRoots: () => additionalRootsCanonical } })];
     const guardedPolicyLayers = rewriteCapableLayers
         ? [...integrityGuardLayers, ...policyLayers, modeGateLayer, ...integrityGuardLayers]
         : [...integrityGuardLayers, ...policyLayers, modeGateLayer];