@sema-agent/core 7.44.0 → 7.45.0

package/dist/core/runner/prepare-task.js

@@ -26,6 +26,7 @@ import { AllowEntryTable, screenAllowedToolsValue } from "../allow-entry.js";
 import { compileOutputSchema } from "./strict-output-schema.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { foldAdmissionFreeze } from "../memory-admission.js";
+import { deploymentCanRerootChild } from "./child-tree.js";
 import { prepareMemory } from "./prepare-memory.js";
 import { prepareMemoryEngineSession } from "./prepare-memory-engine-session.js";
 import { prepareDeferClassify } from "./prepare-defer-classify.js";
@@ -363,9 +364,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 e.code = "isolation.unavailable";
                 throw e;
             };
-            if (ownedEnvSeat.current === undefined) {
+            if (!deploymentCanRerootChild(deps)) {
                 failIsolation("no executionEnvFactory is configured (a static/shared execution env cannot mint a per-agent worktree)");
             }
+            else if (ownedEnvSeat.current === undefined) {
+                failIsolation("the executionEnvFactory returned no env instead of a worktree-rooted env");
+            }
             else if (ownedEnvSeat.current === deps.executionEnv) {
                 ownedEnvSeat.current = undefined;
                 failIsolation("the executionEnvFactory returned the shared static env instead of a worktree-rooted env");
@@ -733,7 +737,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, readFace: () => resolvedReadFace, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
         const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, askSeat: doors.askSeat, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox });
         const writeProtectionCheck = writeProtection?.check;
         writeProtectionJudgeRef.current = writeProtection?.judgeTarget;
@@ -743,18 +747,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return undefined;
             });
         }
-        const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
+        const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, handsRoot: attachmentRootCanonical, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
-        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef });
+        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot: attachmentRootCanonical, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef });
         const seatInputsFor = skillGateWiring({ tools, skillToolName: SKILL_TOOL_NAME, seatOf: skillSeatOf, mode: () => permissionMode.current, lane: skillGrantLane, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.skill_allowed", version: 1, taskId: hostTaskId, ...info, entries: [...info.entries], ts: Date.now() })), allowEntries: { deploymentAllows: { ...allowEntryLanes.deployment, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "deployment", ...info, entries: [...info.entries], ts: Date.now() })) }, requestAllows: { ...allowEntryLanes.request, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "request", ...info, entries: [...info.entries], ts: Date.now() })) } } });
-        const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.pathDenyRules.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
+        const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.pathDenyRules.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, readFace: () => resolvedReadFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
         const postureFrameRef = { report: (err) => deps.onError?.(err, { phase: "degraded", sessionId }) };
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas: rosterSeat, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, contextOverlay: legContextOverlay, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants: skillGrantLane, callerPolicy: lockedPreflight.toolPolicy, inheritedPolicies: (inheritedParentConstraints ?? []).map((c) => c.policy), persistedRuleLane: permissionRuleLane, orgRuleLane: permissionRuleOrgLane, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(attachmentRootCanonical !== undefined ? { handsRoot: attachmentRootCanonical } : {}), toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) });
         rollback.commit();
         commitModeSeats(abortController.signal);
         const prepared = buildPrepared();

package/dist/core/runner/resume-policy-outcome.js

@@ -1,4 +1,5 @@
 import { canonicalizeCapturedPlainData, classifyQuestionOutcome, isLiveQuestionFace } from "../ask-question.js";
+import { isHostDecider } from "../gate-outcome.js";
 import { CHECKPOINT_FEATURES, CheckpointError, checkpointVersionOf, winnerFromOutcome } from "../checkpoint-store.js";
 import { policyCannotAnswer, screenApproverAttribution } from "../tool-policy.js";
 import { sanitizeUntrustedText } from "../untrusted-text.js";
@@ -52,7 +53,7 @@ export function resumePolicyOutcome(input) {
             throw new CheckpointError("checkpoint.invalid_outcome", `resume carries no hostDecision — a policy_ask decide names who decided it ({ decidedBy: "person" | "sla_timeout" | "policy", approver? }); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
         }
         const decidedBy = hostDecisionRaw.decidedBy;
-        if (decidedBy !== "person" && decidedBy !== "sla_timeout" && decidedBy !== "policy") {
+        if (!isHostDecider(decidedBy)) {
             throw new CheckpointError("checkpoint.invalid_outcome", `resume hostDecision.decidedBy "${describeSuppliedValue(decidedBy)}" is outside the closed set — it is exactly "person", "sla_timeout" or "policy"; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
         }
         const cannotAllow = decision !== "allow"

package/dist/core/runner/run-leg.js

@@ -614,7 +614,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     const executedArgs = humanRewrite !== undefined ? resolvedArgs : screened !== undefined ? screened.args : resolvedArgs;
     const unseen = !deepJsonEqual(executedArgs, pendingAction.args);
-    const beltReq = () => ({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)), budget: beltBudget, ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}), ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs) });
+    const beltReq = () => ({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)), budget: beltBudget, ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}), ...(prepared.handsRoot !== undefined ? { root: prepared.handsRoot } : {}), ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs) });
     const unjudgeable = unseen ? chainCannotJudge(resume.cp.state.inheritedGate) : undefined;
     if (unjudgeable !== undefined) {
         const chainDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: its input changed after the approval and the inherited ancestor chain cannot judge the changed input (${unjudgeable}). This approval is spent — the call has to be re-issued.`, prepared.reminderMark);

package/dist/core/runner/run-notification-lane.js

@@ -1,6 +1,6 @@
 import { createPeerInboundChainRef, createPeerSelfRef } from "../../agents/peer-admission.js";
 import { boundInputHashOf } from "../canonical-json.js";
-import { createLiveNotificationLane, DurableAppendObligations, isDelegatedAgentTerminal, isTerminalTaskNotification, renderTaskNotificationXml, routeOrParkNotification, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
+import { createLiveNotificationLane, DurableAppendObligations, injectionLaneOf, isDelegatedAgentTerminal, isTerminalTaskNotification, renderTaskNotificationXml, routeOrParkNotification, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
 import { pendingContentAskCallId } from "./decide-continuation.js";
 export function runNotificationLane(input) {
@@ -76,7 +76,7 @@ async function runNotificationLaneAs(input, obligations) {
                 engineNoteKey: taskNotificationDedupKey(item.payload),
                 ...(item.payload.task_type !== "external" && isTerminalTaskNotification(item.payload) ? { capPreferred: true } : {}),
             };
-            const deliver = item.priority === "later"
+            const deliver = injectionLaneOf(item.priority) === "followUp"
                 ? notificationHarness.followUp(xml, noteOptions)
                 : notificationHarness.steer(xml, { ...noteOptions, ...(item.priority === "now" ? { immediate: true } : {}) });
             void deliver.then(() => item.onDisposition?.("queued"), () => {

package/dist/core/runner/runtask.d.ts

@@ -68,6 +68,8 @@ export declare class Runner implements RunnerSelfSeat {
      *  thin compositions OVER the Runner (`runGoal`) can emit at their terminal state without reaching
      *  into private deps. */
     emitTaskOutcome(outcome: TaskOutcome): void;
+    /** Whether a child this Runner runs can be placed in another tree: {@link RunnerSelfSeat.canRerootChild}. */
+    canRerootChild(): boolean;
     /** The deployment agent catalog (RunnerDeps.agents/builtinAgents), exposed READ-ONLY
      *  so the Agent-tool lane (`createSubagentTool`) defaults to the SAME registry the workflow lane
      *  consumes (single source; the types.ts "pass the same array" follow-on made structural). The array

package/dist/core/runner/runtask.js

@@ -62,6 +62,7 @@ import { runCompactionMachinery } from "./run-compaction-machinery.js";
 import { runStopAndFinalVerify } from "./run-stop-and-final-verify.js";
 import { runRecoveryLanes } from "./run-recovery-lanes.js";
 import { runGitLane } from "./run-git-lane.js";
+import { deploymentCanRerootChild } from "./child-tree.js";
 import { thrownText } from "../thrown-value.js";
 export class Runner {
     deps;
@@ -125,6 +126,7 @@ export class Runner {
     emitTaskOutcome(outcome) {
         emitTaskOutcome(this.deps, outcome);
     }
+    canRerootChild() { return deploymentCanRerootChild(this.deps); }
     get agentCatalog() {
         return {
             ...(this.deps.agents ? { agents: [...this.deps.agents] } : {}),

package/dist/core/runner/stream-steer-verb.js

@@ -3,7 +3,7 @@ import { snapshotActorAssertion } from "../../internal/llm.js";
 import { MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
-import { isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
+import { injectionLaneOf, isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
 import { announceAcceptance, armAcceptance, nextHumanInputSeq } from "./steer-admission.js";
@@ -133,7 +133,7 @@ export function streamSteerVerb(input) {
                 const noteOptions = { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) };
                 if (mintsAFrame)
                     armAcceptance(parkRecord, () => publishQueued(h));
-                if (priority === "later") {
+                if (injectionLaneOf(priority) === "followUp") {
                     await h.harness.followUp(payload, noteOptions);
                     noteAccepted();
                     return;

package/dist/core/runner/sub-agent-deny-lists.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The sub-agent tool lists of one prepared task: the allow advisory for `TaskSpec.agents` and THE judgment of every denied-tools
+ * list a deployment writes — the task's own definitions (`TaskSpec.agents`), the definitions a mounted delegation tool carries
+ * (the `authored` faces — the engine's built-ins name tools of other vocabularies and are not judged) and its tool-level list.
+ * Universe = the task's assembled roster plus every mounted delegation tool's pool, names and aliases; a pool the engine cannot
+ * list (an `extraTools` factory) turns the refusals that need a roster into host notices. A tool's own lists are judged where
+ * the tool is mounted: only a tool a deployment mounted (depth 0) publishes them (`authored`, `agentToolLevelAllowTools`, `agentToolLevelDenyTools`), the
+ * engine's nested copy for a delegated child carries neither.
+ *
+ * Throws `config.agent.unknown_tool` (`refused`, the one site) — synchronous, like the phase that calls it.
+ */
+import type { AgentTool } from "../../internal/harness.js";
+import type { TaskSpec } from "../types.js";
+import type { AnnounceOnceSink } from "./contracts.js";
+/**
+ * The names a definition's denied-tools entries stand for, for a lane that has neither a roster nor a notice sink at the point
+ * it builds its own policy (a workflow leg's agentType): each entry is read by the one reading, so `Tool(content)` denies the
+ * whole tool there too, and an entry that names no tool is refused by the same refusal. The stale-name and told dispositions
+ * need the leg's roster and a sink; the leg's own policy-name audit is what reads them.
+ */
+export declare function deniedToolNamesOf(where: string, value: unknown): string[];
+export interface SubAgentToolListsInput {
+    /** borrowed-readonly — the REBOUND spec: `agents` (the task's definitions) and `tools` (the mounted delegation tools). */
+    spec: Pick<TaskSpec, "agents" | "tools">;
+    /** borrowed-readonly — the FULLY ASSEMBLED mount array (names + aliases = the roster half of the universe). */
+    tools: ReadonlyArray<AgentTool>;
+    /** borrowed-readonly — the once-per-session ledger whose operator sink carries the notices. */
+    onceLedger: Pick<AnnounceOnceSink, "onError">;
+    /** borrowed-readonly — the acquired session's id (operator-line context). */
+    sessionId: string;
+}
+export declare function auditSubAgentToolLists(input: SubAgentToolListsInput): void;

package/dist/core/runner/sub-agent-deny-lists.js

@@ -0,0 +1,121 @@
+import { notAListSentence, notAStringSentence, readDeniedEntry, readToolNameList, valueTypeLabel } from "../../agents/tool-filter.js";
+import { compileAllowList, inertEntryPhrase, renderListEntry } from "../allow-entry.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+const DENY_LIST_NAMES_ONLY = "To block by path or command, write a deny rule in the caller's permission policy: a denied-tools list only takes tool names (it narrows which tools the agent is handed).";
+function refused(message) {
+    const e = new Error(message);
+    e.code = "config.agent.unknown_tool";
+    return e;
+}
+function refusal(where, flaw) {
+    return refused(`${where} declares tool ${inertEntryPhrase(flaw)} in its denied tools, but no tool of that spelling exists in this deployment — fix the entry or mount the tool.${flaw.reason === "grammar" ? ` ${DENY_LIST_NAMES_ONLY}` : ""}`);
+}
+function refusalNotAString(where, side, index, type) {
+    return refused(notAStringSentence(where, side, index, type));
+}
+function refusalNotAList(where, side, list) {
+    return refused(notAListSentence(where, side, list));
+}
+export function deniedToolNamesOf(where, value) {
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        throw refusalNotAList(where, "denied", list);
+    return list.entries.map((entry, index) => {
+        if (entry === "*")
+            return entry;
+        const read = readDeniedEntry(entry);
+        if (read.kind === "not_a_string")
+            throw refusalNotAString(where, "denied", index, read.type);
+        const flaw = compileAllowList([read.name], "deny").inert[0];
+        if (flaw !== undefined && flaw.reason === "grammar")
+            throw refusal(where, { ...flaw, entry: read.name });
+        return read.name;
+    });
+}
+function judgeDeniedToolNames(where, value, universe, advise) {
+    if (value === undefined || value === null)
+        return;
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        throw refusalNotAList(where, "denied", list);
+    let index = -1;
+    for (const entry of list.entries) {
+        index += 1;
+        if (entry === "*")
+            continue;
+        const read = readDeniedEntry(entry);
+        if (read.kind === "not_a_string")
+            throw refusalNotAString(where, "denied", index, read.type);
+        const { name, content } = read;
+        const raw = entry;
+        const { rows, inert } = compileAllowList([name], "deny", universe.known);
+        const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry: raw };
+        const stale = flaw !== undefined && (flaw.reason === "tool_name" || flaw.reason === "near_miss");
+        if (flaw !== undefined && (flaw.reason === "grammar" || (stale && universe.complete)))
+            throw refusal(where, flaw);
+        if (flaw === undefined && universe.known.has(name)) {
+            if (content)
+                advise(new Error(`${where} declares ${renderListEntry(raw)} in its denied tools: this list reads tool names, not content, so the whole tool "${inlineUntrusted(name, 80)}" is denied to the agent. ${DENY_LIST_NAMES_ONLY}`));
+            continue;
+        }
+        advise(new Error(`${where} declares tool ${flaw !== undefined ? inertEntryPhrase(flaw) : renderListEntry(raw)} in its denied tools, a name this task's roster and delegation pools do not carry — the entry hides nothing here. Advisory only: a list shared across deployments is not wrong because one lacks a tool, but a misspelling guards nothing.` +
+            (rows[0]?.compiled.kind === "namespace" ? " This list matches tool names exactly: a server-level entry hides none of that server's tools; name them, or write a deny rule in the caller's permission policy." : "") +
+            (universe.complete ? "" : " A delegation tool this task mounts injects tools the engine cannot enumerate (extraTools), so the name cannot be checked here.")));
+    }
+}
+function judgeAllowedToolList(where, value, known, advise) {
+    if (value === undefined || value === null)
+        return;
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        throw refusalNotAList(where, "allowed", list);
+    const unknownNames = [];
+    let index = -1;
+    for (const entry of list.entries) {
+        index += 1;
+        if (typeof entry !== "string")
+            throw refusalNotAString(where, "allowed", index, valueTypeLabel(entry));
+        if (known !== undefined && entry !== "*" && !known.has(entry))
+            unknownNames.push(entry);
+    }
+    if (unknownNames.length === 0)
+        return;
+    advise(new Error(`${where} allows tool(s) ${unknownNames.map(renderListEntry).join(", ")} not present in this task's assembled roster — likely a typo (the entry would be item-filtered at spawn; the agent stays usable). Advisory only: the delegation pool can differ from this roster, so a tool mounted only on the delegation tool or produced by per-spawn extraTools makes this spurious.`));
+}
+export function auditSubAgentToolLists(input) {
+    const { spec, tools, onceLedger, sessionId } = input;
+    const advise = (err) => {
+        try {
+            onceLedger.onError(err, { phase: "config", sessionId });
+        }
+        catch {
+        }
+    };
+    const delegationTools = (spec.tools ?? []).filter((t) => t.agentToolFaces !== undefined);
+    const taskAgents = spec.agents ?? [];
+    if (taskAgents.length === 0 && delegationTools.length === 0)
+        return;
+    const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
+    const denyKnown = new Set(known);
+    for (const t of delegationTools)
+        for (const p of t.agentToolPool ?? [])
+            for (const n of [p.name, ...(p.aliases ?? [])])
+                denyKnown.add(n);
+    const universe = { known: denyKnown, complete: delegationTools.every((t) => t.agentToolPool !== undefined) };
+    for (const def of taskAgents) {
+        judgeAllowedToolList(`TaskSpec.agents: agent "${def.name}"`, def.allowTools, known, advise);
+        judgeDeniedToolNames(`TaskSpec.agents: agent "${def.name}"`, def.denyTools, universe, advise);
+    }
+    const replaced = new Set(taskAgents.map((d) => d.name));
+    for (const t of delegationTools) {
+        for (const face of t.agentToolFaces ?? []) {
+            if (face.authored === true && !replaced.has(face.name)) {
+                const faceWhere = `delegation tool "${t.name}": agent definition "${face.name}"`;
+                judgeAllowedToolList(faceWhere, face.allowTools, undefined, advise);
+                judgeDeniedToolNames(faceWhere, face.denyTools, universe, advise);
+            }
+        }
+        judgeAllowedToolList(`delegation tool "${t.name}": the tool-level list`, t.agentToolLevelAllowTools, undefined, advise);
+        judgeDeniedToolNames(`delegation tool "${t.name}": the tool-level list`, t.agentToolLevelDenyTools, universe, advise);
+    }
+}

package/dist/core/runner/synthetic-tools.d.ts

@@ -110,7 +110,7 @@ export interface SkillListingEntry {
  *  and the tool, so what the prompt promises is exactly what the tool serves. Each field is READ ONCE, BY NAME, and
  *  both consumers see the copy: the gate screens this list while the invoke substitutes from it, so a `get baseDir()`
  *  answering those two reads differently passed a screen that measured a value the model never received — and a rest
- *  copy would silently drop an INHERITED or non-enumerable list, i.e. lose a skill's grant or its refusals. */
+ *  copy would silently drop an INHERITED or non-enumerable list. The two tables are read by {@link readSkillTable}. */
 export declare function normalizeSkills(skills: SkillLike[] | undefined): SkillLike[];
 /** [c209-C] The skills listing's lead line — single-sourced so the run loop's durable-resume
  *  transcript probe (MED-3② skills arm, runtask) matches EXACTLY what the initial frame carries

package/dist/core/runner/synthetic-tools.js

@@ -2,7 +2,7 @@ import { Type } from "typebox";
 import { defineTool } from "../tools.js";
 import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } from "../skill-listing-budget.js";
-import { skillNamedBy } from "../skill-grant.js";
+import { readSkillTable, skillNamedBy } from "../skill-grant.js";
 import { toolFace } from "../tool-catalog-entries.js";
 import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
 import { foldListingWithin } from "./listing-fold.js";
@@ -116,7 +116,8 @@ export function normalizeSkills(skills) {
             seen.add(s.name);
             const { name, description, content, allowedTools, disallowedTools, files, baseDir, ...rest } = s;
             void rest;
-            out.push({ name, description, content, ...(allowedTools !== undefined ? { allowedTools: [...allowedTools] } : {}), ...(disallowedTools !== undefined ? { disallowedTools: [...disallowedTools] } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
+            const [allowed, denied] = [readSkillTable(allowedTools), readSkillTable(disallowedTools)];
+            out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
         }
     }
     return out.toSorted((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));

package/dist/core/session-policy-store.d.ts

@@ -52,12 +52,16 @@ export interface PutRulesOptions {
      *  this from a verified, role-checked principal (mirrors `steer.trusted`). */
     operator?: boolean;
 }
-/** The {@link SessionPolicyError.detail} of a tool-name refusal: which bucket, which entry, the judgment's word, and the
- *  spelling to write instead when the judgment has one (a retired name's 1:1 successor, an unmintable segment's minted name). */
+/** The {@link SessionPolicyError.detail} of a tool-name refusal: which bucket, which entry, the judgment's word, the judgment's
+ *  one-line sentence when it has one, and the spelling to write instead when the judgment has one (a retired name's 1:1
+ *  successor, an unmintable segment's minted name). */
 export interface SessionRuleNameRefusal {
     field: SessionRuleToolNameField;
     name: string;
     verdict: Exclude<RuleToolNameVerdict["kind"], "current">;
+    /** The `guidance` of the judgment ({@link judgeRuleToolName}), byte for byte — the same string the refusal's sentence quotes. Present for
+     *  `retired` and `unmintable_segment`, the two verdicts that carry one; absent for `unprefixed_namespace`, whose judgment has no sentence of its own. */
+    guidance?: string;
     currentName?: string;
 }
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`

package/dist/core/session-policy-store.js

@@ -41,6 +41,7 @@ export function assertSessionRuleNamesCurrent(rules, mountedToolNames = NO_DECLA
                 continue;
             const quoted = JSON.stringify(name);
             const successor = verdict.kind === "unprefixed_namespace" ? undefined : verdict.currentName;
+            const guidance = verdict.kind === "unprefixed_namespace" ? undefined : verdict.guidance;
             let message;
             switch (verdict.kind) {
                 case "retired":
@@ -57,7 +58,7 @@ export function assertSessionRuleNamesCurrent(rules, mountedToolNames = NO_DECLA
                     return exhaustive;
                 }
             }
-            throw new SessionPolicyError("legacy_tool_name", message, { field, name, verdict: verdict.kind, ...(successor !== undefined ? { currentName: successor } : {}) });
+            throw new SessionPolicyError("legacy_tool_name", message, { field, name, verdict: verdict.kind, ...(guidance !== undefined ? { guidance } : {}), ...(successor !== undefined ? { currentName: successor } : {}) });
         }
     }
 }

package/dist/core/skill-grant.d.ts

@@ -76,8 +76,16 @@ export declare function parkedSkillApprovalRefusal(row: {
     readonly args: unknown;
     readonly boundGrantDigest?: string;
 }, args: unknown, skills: readonly SkillGrantSource[], skillToolName: string, site?: "claim" | "execution"): string | undefined;
-/** A resume's skills read ONCE: each definition copied with its two lists, so the parked Skill approval's binding and the
- *  resumed leg's prepare read one value — a later edit to the caller's own objects or arrays reaches neither. */
+/**
+ * A skill's table (`allowed-tools` / `disallowed-tools`) READ ONCE, the one reading every later reader takes instead of the host's
+ * value: absent (`undefined`, or `null` — a frontmatter's empty key) is no table; a list is its dense copy (by index, no iterator
+ * of the host's runs; a member that is not a string stays as it is); a value that is not a list, or a list whose read throws, is
+ * ONE entry that reads as nothing ({@link nonListValueLabel}), so each table applies the law it already has to an entry that reads
+ * as nothing — a deny table keeps its Skill from activating, an allow table is announced and grants nothing. A string is not spread.
+ */
+export declare function readSkillTable(value: unknown): string[] | undefined;
+/** A resume's skills read ONCE: each definition copied with its two tables ({@link readSkillTable}), so the parked Skill approval's
+ *  binding and the resumed leg's prepare read one value — a later edit to the caller's own objects or arrays reaches neither. */
 export declare function detachSkillLists<T extends SkillGrantSource>(skills: readonly T[]): T[];
 /** Does this skill declare a list (either, non-empty)? The one test of "the Skill card is asked for this skill". */
 export declare function declaresSkillLists(skill: Pick<SkillGrantSource, "allowedTools" | "disallowedTools">): boolean;

package/dist/core/skill-grant.js

@@ -3,7 +3,8 @@ import { parsePermissionRule } from "./permission-rules.js";
 import { mountedToolPermissionSeat } from "./mode-policy.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { boundInputHashOf } from "./canonical-json.js";
-import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, inertEntryPhrase, judgeAllowEntries } from "./allow-entry.js";
+import { readToolNameList } from "../agents/tool-filter.js";
+import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, inertEntryPhrase, judgeAllowEntries, nonListValueLabel, nonStringMemberLabel, renderListEntry } from "./allow-entry.js";
 export const SKILL_GRANT_ORIGINS = Object.freeze(["model", "user", "inherited"]);
 const FROZEN_SKILL_GRANT_ORIGINS = new Set(["model", "inherited"]);
 export function skillNamedBy(args, skills) {
@@ -12,6 +13,8 @@ export function skillNamedBy(args, skills) {
 }
 function skillGrantBinding(skill) {
     const canonical = (entries) => [...new Set((entries ?? []).map((e) => {
+            if (typeof e !== "string")
+                return nonStringMemberLabel(e);
             const p = parsePermissionRule(e);
             return p.ruleContent === undefined ? p.toolName : `${p.toolName}(${p.ruleContent})`;
         }))].sort();
@@ -44,8 +47,21 @@ export function parkedSkillApprovalRefusal(row, args, skills, skillToolName, sit
         ? `${why} — refusing pre-CAS (nothing ran; the checkpoint stays pending). Decide this checkpoint as deny and re-activate it: the new card shows the current lists.`
         : `The approved Skill call was not executed: ${why}. This approval is spent — to use "${chosen}", have the model activate it again: the new card shows its lists.`;
 }
+export function readSkillTable(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    const read = readToolNameList(value);
+    return read.kind === "entries" ? read.entries : [nonListValueLabel(read)];
+}
 export function detachSkillLists(skills) {
-    return skills.map((s) => (typeof s === "object" && s !== null ? { ...s, ...(Array.isArray(s.allowedTools) ? { allowedTools: [...s.allowedTools] } : {}), ...(Array.isArray(s.disallowedTools) ? { disallowedTools: [...s.disallowedTools] } : {}) } : s));
+    return skills.map((s) => {
+        if (typeof s !== "object" || s === null)
+            return s;
+        const { allowedTools: rawAllowed, disallowedTools: rawDenied, ...rest } = s;
+        const allowedTools = readSkillTable(rawAllowed);
+        const disallowedTools = readSkillTable(rawDenied);
+        return { ...rest, ...(allowedTools !== undefined ? { allowedTools } : {}), ...(disallowedTools !== undefined ? { disallowedTools } : {}) };
+    });
 }
 export function declaresSkillLists(skill) {
     return (skill.allowedTools?.length ?? 0) > 0 || (skill.disallowedTools?.length ?? 0) > 0;
@@ -74,7 +90,7 @@ export function skillDenyDecision(hit) {
         action: "deny",
         message: hit.readsAsNothing !== undefined
             ? skillDenyUnreadable(hit.skill, hit.readsAsNothing, "activation").message
-            : `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in disallowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")}) — refused for the rest of this run`,
+            : `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in disallowed-tools (${hit.entries.map(renderListEntry).join(", ")}) — refused for the rest of this run`,
         decisionReason: "skill",
     };
 }
@@ -88,7 +104,7 @@ export function skillRowRefusal(lane, req) {
 export function skillAllowDecision(hit, updatedInput) {
     return {
         action: "allow",
-        message: `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in allowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")})`,
+        message: `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in allowed-tools (${hit.entries.map(renderListEntry).join(", ")})`,
         decisionReason: "skill",
         ...(updatedInput !== undefined ? { updatedInput } : {}),
     };

package/dist/core/task-notification.d.ts

@@ -32,10 +32,21 @@ export declare const SYSTEM_INJECTION_PRIORITIES: readonly SystemInjectionPriori
 export declare function isSystemInjectionPriority(value: unknown): value is SystemInjectionPriority;
 /** The ONE reading of a steer's priority: a parked row or an accepted input that carries none means `"next"`
  *  (the default the live admission has always applied) — so a retry that spells the default and a row parked
- *  without it are the same instruction, whichever side normalized. */
+ *  without it are the same instruction, whichever side normalized. A tier outside the closed set throws
+ *  (`steering.invalid_content`, the sentence names the set); `null` is such a tier, not an absent one. */
 export declare function steerPriorityOf(x: {
     readonly priority?: SystemInjectionPriority;
 }): SystemInjectionPriority;
+/** The two queues a person's input rides on a live run: the `steer` lane (the running turn's next boundary) and the
+ *  `followUp` lane (the run's would-otherwise-stop seat). They are also the two families of the stranded-input account — an
+ *  input's account is the one of the lane it was queued on (`USER_INPUT_UNDRAINED_FAMILIES`). */
+export type UserInputLane = "steer" | "followUp";
+/** The ONE reading of "which lane carries this tier": `"later"` rides the follow-up lane (never folded into work in
+ *  progress), `"next"` and `"now"` ride the steer lane (`"now"` additionally cuts the running turn). Both injection
+ *  seats — the steer verb and the notification lane — branch on it. A parked row that carries no tier reads through
+ *  {@link steerPriorityOf} first: `injectionLaneOf(steerPriorityOf(row))`. A tier outside the closed set throws
+ *  (`steering.invalid_content`, the same check and sentence as {@link steerPriorityOf}). */
+export declare function injectionLaneOf(priority: SystemInjectionPriority): UserInputLane;
 export interface TaskNotificationPayload {
     task_id: string;
     /** design/144 §2: `"external"` is CORE-MINTED ONLY — `TaskStream.notify()` casts it onto every

package/dist/core/task-notification.js

@@ -10,8 +10,20 @@ export const SYSTEM_INJECTION_PRIORITIES = ["now", "next", "later"];
 export function isSystemInjectionPriority(value) {
     return typeof value === "string" && SYSTEM_INJECTION_PRIORITIES.includes(value);
 }
+function requireSystemInjectionPriority(value) {
+    if (isSystemInjectionPriority(value))
+        return value;
+    const shown = typeof value === "string" ? JSON.stringify(value.length > 24 ? `${value.slice(0, 24)}…` : value) : value === null ? "null" : typeof value;
+    const refusal = new Error(`a steer priority must be one of ${SYSTEM_INJECTION_PRIORITIES.join("/")}, got ${shown}`);
+    refusal.code = "steering.invalid_content";
+    throw refusal;
+}
 export function steerPriorityOf(x) {
-    return x.priority ?? "next";
+    return x.priority === undefined ? "next" : requireSystemInjectionPriority(x.priority);
+}
+const LANE_OF_PRIORITY = { now: "steer", next: "steer", later: "followUp" };
+export function injectionLaneOf(priority) {
+    return LANE_OF_PRIORITY[requireSystemInjectionPriority(priority)];
 }
 const TASK_NOTIFICATION_TAGS = [
     "task-notification",

package/dist/core/task-spec.d.ts

@@ -551,9 +551,11 @@ export interface TaskSpec {
      * upstream): an `allowTools` entry naming a tool that does not exist is ITEM-FILTERED at spawn (the
      * agent stays listed and delegable; the only host disclosure is a prepare-time HEURISTIC advisory
      * via `RunnerDeps.onError` phase `"config"` for entries unknown to the parent's assembled roster —
-     * zero model-facing warning, the verified upstream shape); a `denyTools` entry naming an
-     * unknown tool is REJECTED at task start (`config.agent.unknown_tool` — a deny-typo silently WIDENS,
-     * the opposite failure direction, sema extension with no upstream deny-list to defer to); and
+     * zero model-facing warning, the verified upstream shape); a `denyTools` entry is read as the
+     * reference reads it (`Tool(content)` hides the whole `Tool`, with a host notice) and judged once, here and for the
+     * delegation tool's own lists alike: a spelling that names no tool, or a stale one (another case of a mounted tool, a
+     * retired name), is REJECTED at task start (`config.agent.unknown_tool`), any other name no tool carries is told to the
+     * host and hides nothing; and
      * providing this field with NO delegation tool mounted is rejected too
      * (`config.agents.no_delegation_tool`) — never a silent no-op. POLICY-NEUTRAL: a
      * roster listing only; the 1.294 tighten-only parent-policy inheritance is applied at spawn time,

package/dist/core/tool-policy.d.ts

@@ -4,6 +4,7 @@ import { type Settlement } from "./gate-outcome.js";
 export { policyCannotAnswer, rowDemandsAPerson } from "./real-approval.js";
 import { type DecisionReason } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
+import { type RemovalGuardSeat } from "../tools/fs/removal-targets.js";
 /** A tool call presented to a policy before it executes. */
 /** design/388 B6 — the per-call face (see {@link ToolCallRequest.face}). */
 export interface ToolCallFace {
@@ -69,6 +70,15 @@ export interface ToolCallRequest {
      * window — at that declaration, not here.
      */
     cwd?: string;
+    /**
+     * The root this leg's tools resolve a ROOT-relative spelling against (a search tool's relative `path`, a
+     * pattern with no `path`), stamped beside {@link cwd} at every Runner adjudication seat — the same
+     * canonical spelling as `cwd` (the hands' own root, the value `cwd` starts at). Present whenever the leg
+     * mounts file hands, read-only hands included; absent on a hands-less leg and on a bare request. A path
+     * guard whose deployment supplied no base of its own resolves the call's target against `root` / `cwd`.
+     * Read-only, like `cwd`.
+     */
+    root?: string;
     /**
      * The CANONICAL directories THIS RUN'S PROMPT ADVERTISES AS WRITABLE — the admitted list of the root
      * fence's advertised-writable-directory seat (the memory engine's write home, the deployment's
@@ -397,12 +407,12 @@ export type PermissionResult = {
     /** The ask's whole class set, in {@link import("./ask-origin.js").ASK_CLASSES} order (see
      *  {@link AskRequest.classes}). Stamped beside {@link askClass}, under the same rule. */
     classes?: readonly import("./ask-origin.js").AskClass[];
-    /** WHICH integrity guard minted this ask — the unverifiable recursive delete or the session-transcript
-     *  write. ENGINE-STAMPED by the two guard policies; a fold-internal fact the class derivation reads
-     *  ({@link import("./ask-origin.js").classifyAsk}) so the two guards, which mint the same
+    /** WHICH integrity guard minted this ask — a removal of a protected location, an unverifiable recursive delete
+     *  or the session-transcript write. ENGINE-STAMPED by the guard policies; a fold-internal fact the class
+     *  derivation reads ({@link import("./ask-origin.js").classifyAsk}) so the guards, which mint the same
      *  `requiresRealApproval` ask, are told apart by a fact and not by their prose. Never copied onto the
      *  approval request or the park row. */
-    guard?: "unverifiable_delete" | "transcript_write" | "artifact_shared_read";
+    guard?: "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "artifact_shared_read";
     /** The call could not be READ against a rule that may reach it — a content-form deny row, a content-form
      *  ask row, or a persisted-rule row (the lexer's word). ENGINE-STAMPED at the three unreadable mint sites;
      *  the class derivation reads it as `rule_unreadable` (a mode may release it, a person may clear it, no
@@ -1082,6 +1092,7 @@ export declare function createUnverifiableDeletePolicy(opts?: {
     safeVars?: readonly string[];
     /** Override the shell tool names this gate parses (default `Bash`). */
     tools?: string[];
+    removalSeat?: RemovalGuardSeat;
 }): ToolPolicy;
 export declare function createTranscriptIntegrityPolicy(opts?: {
     /** Transcript directories to protect. Default: `($AGENT_DATA_DIR ?? ~/.ai-agent)/sessions`. */