@sema-agent/core 7.44.0 → 7.46.0

package/dist/core/governance-codes.d.ts

@@ -136,7 +136,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.allowed_tool_not_granted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
 /** A catalogued code (see {@link ENGINE_NOTICE_CODES}); {@link NOTICE_MINTER} says who mints it. NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */
@@ -181,6 +181,7 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "permission.ask_released_by_mode": "user";
     readonly "permission.read_deny_unapplied": "user";
     readonly "permission.rule_store_unavailable": "user";
+    readonly "permission.rule_row_dropped": "user";
     readonly "permission.allowed_tool_not_granted": "user";
     readonly "memory.capture_opted_out": "user";
     readonly "memory.capture_optout_unpersisted": "user";
@@ -295,6 +296,7 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "permission.ask_released_by_mode": "engine";
     readonly "permission.read_deny_unapplied": "engine";
     readonly "permission.rule_store_unavailable": "engine";
+    readonly "permission.rule_row_dropped": "engine";
     readonly "permission.allowed_tool_not_granted": "engine";
     readonly "peer.inbound_disposition": "engine";
     readonly "peer.held_settled": "engine";

package/dist/core/governance-codes.js

@@ -144,6 +144,7 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "permission.ask_released_by_mode",
     "permission.read_deny_unapplied",
     "permission.rule_store_unavailable",
+    "permission.rule_row_dropped",
     "permission.allowed_tool_not_granted",
     "peer.inbound_disposition",
     "peer.held_settled",
@@ -229,6 +230,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "permission.ask_released_by_mode": "user",
     "permission.read_deny_unapplied": "user",
     "permission.rule_store_unavailable": "user",
+    "permission.rule_row_dropped": "user",
     "permission.allowed_tool_not_granted": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
@@ -324,6 +326,7 @@ const NOTICE_MINTER_TABLE = {
     "permission.ask_released_by_mode": "engine",
     "permission.read_deny_unapplied": "engine",
     "permission.rule_store_unavailable": "engine",
+    "permission.rule_row_dropped": "engine",
     "permission.allowed_tool_not_granted": "engine",
     "peer.inbound_disposition": "engine",
     "peer.held_settled": "engine",

package/dist/core/hooks.d.ts

@@ -1,6 +1,7 @@
 import type { ActorAssertion, DocumentContent, ImageContent, TextContent } from "../internal/llm.js";
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallFace, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
+import type { CallTargetStamp } from "./effective-path-target.js";
 import type { GateOutcome } from "./gate-outcome.js";
 import { type PreToolUseScreening } from "./runner/gate-exit.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./rule-lane-reads.js";
@@ -1176,6 +1177,8 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
      *  starting directory and answer for a run that has since `cd`ed. Absent ⇒ the contexts carry no
      *  `cwd`, which is the honest answer for a run with no tracked one. */
     trackedCwd?: () => string | undefined;
+    /** The leg's target-reading stamp, applied where the gate's request is minted over the final args (a rewrite re-reads it: `withArgsReading`). */
+    stampCallTarget?: CallTargetStamp;
     /** The read-only env capability face put on every {@link HookToolContext} this gate call
      *  builds ({@link HookEnvCapabilities}). Built ONCE per task by the runner (after the env is minted) and
      *  passed through unchanged; omitted when the deployment wired no execution environment. */
@@ -1466,6 +1469,8 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
     permissionMode?: () => import("./ask-origin.js").PermissionMode;
     /** The leg's approval-seat form (`WiringManifest.ask.form`): the deny exit's way-out clause names a declaration, never a missing approver. */
     askSeatForm?: import("./wiring-manifest.js").AskSeamForm;
+    /** The read face the leg resolved, read per call into the class derivation (`roots` withholds the classifier from a `probe` question); absent ⇒ none resolved. */
+    readFace?: () => import("../tools/fs/containment-face.js").ContainmentFace | undefined;
     /** WHO put the tool's egress / irreversibility marks on the seat ({@link import("./ask-origin.js").ToolMarkSource});
      *  absent or empty with a mark present reads as the deployment's own (fail-closed: an operator's mandate). */
     toolMarkSources?: ReadonlySet<import("./ask-origin.js").ToolMarkSource>;

package/dist/core/memory-engine/content-origin.d.ts

@@ -1,37 +1,3 @@
-/**
- * design/178 §3 — the tool content-origin classification (three tiers by CAPABILITY, fail-closed).
- *
- * The question this face answers per mounted tool: can invoking it bring content from OUTSIDE the
- * deployment's trust boundary into the session — and therefore, via the automatic harvest path,
- * into long-term memory? Three tiers:
- *
- *  - "external"  — network-retrieval families and external protocol channels. Invocation marks the
- *                  session's memory EXTERNALLY EXPOSED (one-way, durable; what the mark does at
- *                  harvest is the provenance mode's question — design/336: tag-admit with an origin
- *                  marker under "carry", full quarantine under "off").
- *  - "execution" — general execution (shell/exec). A NAMED residual channel: it can reach external
- *                  content indirectly, but the two industry anchors this tier is calibrated against
- *                  gate on network/protocol families only, and excluding every shell session would
- *                  disable memory for the main coding scenario. Not polluting by default; the
- *                  `execIsExternalContent` strict knob upgrades it to external.
- *  - "local"     — purely local reads/computation.
- *
- * WHO CLASSIFIES (single-source rule): core built-ins declare `contentOrigin` on their own ToolSpec
- * (the classification lives with the tool definition); protocol tools (MCP/A2A) are structurally
- * external (the channel itself crosses the boundary); a HOST tool declares its own — and when it
- * does not, the default is EXTERNAL (fail-closed: unknown = external), overridable only through the
- * explicit `TaskSpec.memory.trustedTools` allowlist. A core-mounted built-in without a declaration
- * defaults local: core owns those definitions, and the fail-closed default exists for tools core
- * CANNOT vouch for, not for its own. A declaration is honored only when it SPELLS a member of the
- * closed vocabulary — an unreadable one is not a declaration.
- *
- * The three tier names are BOUNDARY-RELATIVE, not statements about topology: `"local"` means "does
- * not bring content from outside the deployment's trust boundary", which a unix socket to another
- * process the deployment itself runs satisfies and a loopback HTTP call to somebody else's service
- * does not. Distance is not the axis; whose content it is, is.
- *
- * There is deliberately no "gate inactive" state: every mounted tool gets a class.
- */
 import type { ToolContentOrigin } from "../types.js";
 export interface ClassifyToolContentOriginInput {
     /** The tool's own `contentOrigin` declaration (ToolSpec/AgentTool carry) — wins when present AND

package/dist/core/memory-engine/content-origin.js

@@ -1,3 +1,4 @@
+import { allowedToolNames, readDeniedEntry, readToolNameList } from "../../agents/tool-filter.js";
 const TOOL_CONTENT_ORIGIN_SET = { external: true, execution: true, local: true };
 export const TOOL_CONTENT_ORIGINS = Object.keys(TOOL_CONTENT_ORIGIN_SET);
 export function isToolContentOrigin(value) {
@@ -27,10 +28,14 @@ export function delegationCallIsExternal(input) {
     if (face === undefined)
         return true;
     const selectedFor = (f) => {
-        const d = f.denyTools ?? [];
-        const a = f.allowTools;
-        const isNarrowed = a !== undefined && !a.includes("*");
-        return input.pool.filter((t) => (!isNarrowed || a.some((x) => selectedBy(x, t))) && !d.some((x) => selectedBy(x, t)));
+        const deniedList = readToolNameList(f.denyTools);
+        const d = deniedList.kind === "entries" ? deniedList.entries : [];
+        const a = allowedToolNames(f.allowTools);
+        const denies = (t) => d.some((x) => {
+            const read = readDeniedEntry(x);
+            return read.kind === "name" && selectedBy(read.name, t);
+        });
+        return input.pool.filter((t) => (a === undefined || [...a].some((x) => selectedBy(x, t))) && !denies(t));
     };
     if (selectedFor(face).some((t) => input.isPolluting(t)))
         return true;

package/dist/core/memory-engine/layout.d.ts

@@ -259,6 +259,10 @@ export declare function adoptRootScopeLayout(rootPath: string, controlDir: strin
 export declare const canonicalize: typeof physicalPathOfExisting;
 /** True iff `child` (canonicalized) is `root` or inside it. */
 export declare function isContainedIn(root: string, child: string): boolean;
+/** The codes the store's physical form refuses an act with — the whole family, one closed set: {@link TARGET_OUTSIDE_STORE} and
+ *  {@link SCOPE_HOME_NOT_DIRECTORY}. Each is a plain `Error` carrying `code` and a `detail` ({@link StoreFormRefusalDetail}). */
+export declare const STORE_FORM_REFUSAL_CODES: readonly ["memory.target_outside_store", "memory.scope_home_not_directory"];
+export type StoreFormRefusalCode = (typeof STORE_FORM_REFUSAL_CODES)[number];
 /** The code an act on a store path is refused with when it would land outside the store ({@link landsOutsideStore}). */
 export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
 /** The code a scope home that is not a real directory is refused with ({@link assertHomePhysicalForm}). */
@@ -283,7 +287,7 @@ export type StoreFormRefusalDetail = {
  *  the engine's own account is intact, the layout it was handed is not the layout it needs) carrying a
  *  `code` and a `detail`. */
 export type StoreFormRefusal = Error & {
-    code: typeof TARGET_OUTSIDE_STORE | typeof SCOPE_HOME_NOT_DIRECTORY;
+    code: StoreFormRefusalCode;
     detail: StoreFormRefusalDetail;
 };
 /** Seat 1 — an act the store's physical form refuses: `act` names what was refused (no path), `path` is the

package/dist/core/memory-engine/layout.js

@@ -731,6 +731,7 @@ export function isContainedIn(root, child) {
     const c = canonicalize(child);
     return c === r || c.startsWith(`${r}${sep}`);
 }
+export const STORE_FORM_REFUSAL_CODES = Object.freeze(["memory.target_outside_store", "memory.scope_home_not_directory"]);
 export const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
 export const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
 export const SCOPE_HOME_FORMS = Object.freeze(["symlink", "file", "other"]);

package/dist/core/path-rule-binding.d.ts

@@ -0,0 +1,65 @@
+import { type PathRuleBase, type PathRuleBases, type PersistedRule, type RuleBehavior, type RuleScope, type ScopeRootIdentity } from "./permission-rule-model.js";
+import { type DenyFace, type JudgedPathRow, type PathRowReach } from "../tools/fs/read-deny.js";
+import { type ToolPolicy } from "./tool-policy.js";
+export { pathRowsReach, rowsWhereTheyLead, type PathRowsHit, type TargetViews } from "../tools/fs/read-deny.js";
+/** One path rule as a binding reads it: the parsed rule, its text, and — for a deny rule that guards a face of the
+ *  engine's deny tables — those faces (absent: the rule is judged on its own tool's calls only). */
+export interface PathRuleSpec {
+    readonly parsed: Pick<PersistedRule, "match" | "command" | "behavior" | "tool">;
+    readonly ruleText: string;
+    readonly faces?: readonly DenyFace[];
+}
+/** A rule bound to its anchors: a deny-table row (`faces` empty for a rule that guards no table face), its three-valued
+ *  reach over an absolute spelling, and the spec it was bound from. `unanchored` names the base words its pattern needs
+ *  that the anchors do not supply (the rule reads `unreadable` everywhere: a gate lane fails closed on it; a deny table
+ *  cannot judge it and leaves it to the gate). */
+export interface BoundPathRule<S extends PathRuleSpec = PathRuleSpec> extends JudgedPathRow {
+    readonly spec: S;
+    /** The rule's behavior (a deny table takes the `deny` rows that guard a face). */
+    readonly behavior: RuleBehavior;
+    readonly reach: (absolutePath: string) => PathRowReach;
+    readonly unanchored?: readonly PathRuleBase[];
+}
+/**
+ * The ONE binding of path rules to their anchors (`anchors`: one set for every spec, or a set per spec). Each row resolves
+ * its pattern once against its anchors and reads an absolute spelling under the anchors' family — a row installed on a win
+ * root reads `C:\proj\x`, `C:/proj/x` and `c:\proj\x` as one path; a row whose anchors name no tree reads the spelling's
+ * own family. The head (where the row's reach starts) is spelled for the environment, so a leg can judge the row where
+ * the head leads.
+ */
+export declare function bindPathRules<S extends PathRuleSpec>(specs: readonly S[], anchors: PathRuleBases | ((spec: S) => PathRuleBases)): BoundPathRule<S>[];
+/** A caller policy's anchors on the leg it is installed on: the declared `pathBases` word by word, else the leg's — `/x`
+ *  at the declared root (else the leg's root), a relative pattern at the declared cwd (else the `/x` anchor), `~/` at the
+ *  declared home (else the leg environment's). `install` absent (a policy called outside a Runner leg): the declaration
+ *  alone. */
+export declare function policyAnchors(declared: PathRuleBases, install: PathRuleBases | undefined): PathRuleBases;
+/** A stored row's anchors: a PROJECT row's `/x` and relative words at the row's own scope root (the project it was written
+ *  for), a global or session row's at the chain's top leg; `~/` at the top leg's home for every row. */
+export declare function persistedRowAnchors(scope: RuleScope, chainTop: PathRuleBases): PathRuleBases;
+/** A leg's root as an identity for project coverage ({@link ScopeRootIdentity}): its canonical root, and each project
+ *  row's scope root resolved through the leg's resolution (`leads`, each location once per leg) — so a row written under
+ *  one spelling of the project's directory applies to a leg rooted at another spelling of it. `undefined` when the leg
+ *  has no canonical root (the spellings alone are compared). */
+export declare function projectScopeIdentity(rules: readonly Pick<PersistedRule, "scope">[], canonicalRoot: string | undefined, leads: HeadLeads): Promise<ScopeRootIdentity | undefined>;
+/** A leg's resolution of the locations rule heads pass through: each location resolved once (twins are not refreshed
+ *  within a leg — a link re-pointed mid-leg is met through the row as spelled, and at its new location from the next
+ *  prepare; a location that does not resolve has no twin). `resolve` settles the parts of the given rows and answers
+ *  every location settled so far. */
+export interface HeadLeads {
+    resolve(rows: readonly Pick<JudgedPathRow, "head">[]): Promise<ReadonlyMap<string, string | undefined>>;
+}
+export declare function createHeadLeads(leadsTo: (part: string) => Promise<string | undefined>): HeadLeads;
+/**
+ * INSTALL a policy on a leg: its path rules are anchored at `anchors` (the leg's root and home; the policy's declared
+ * `pathBases` still win word by word) — once, for every judgment of the policy from then on: its `check` (the copy of each
+ * request it hands its inner check carries `ToolCallRequest.pathRuleAnchors`), the deny-table rows
+ * (`ToolPolicy.pathRules` answers with this installation's rows whatever it is given), and every child the leg hands
+ * the policy to as a parent constraint. A policy with no path rules is returned as it is. Installing an installed policy
+ * installs what it was installed FROM; one policy installed at the same anchors is one object (identity is the
+ * installation). Every member the policy carries rides as it holds it; the decision its `check` answers is untouched.
+ */
+export declare function installPolicyAnchors(policy: ToolPolicy | undefined, anchors: PathRuleBases): ToolPolicy | undefined;
+/** The policy an installation was installed from (`undefined`: not an installation). */
+export declare function installedFrom(policy: ToolPolicy | undefined): ToolPolicy | undefined;
+/** The anchors an installation was installed at (`undefined`: not an installation). */
+export declare function installationAnchorsOf(policy: ToolPolicy | undefined): PathRuleBases | undefined;

package/dist/core/path-rule-binding.js

@@ -0,0 +1,99 @@
+import { parsePermissionRule } from "./permission-rule-syntax.js";
+import { isUsablePathBase, pathRuleHeadOf, pathRuleReachOf, ruleBasesNeeded } from "./permission-rule-model.js";
+import { pathFamilyOf, spellingOfIdentity } from "../tools/fs/safety.js";
+import { absoluteTargetIdentityOf } from "./effective-path-target.js";
+import { locationLeadsTo, ruleHeadParts } from "../tools/fs/read-deny.js";
+import { carriedMembersOf } from "./tool-policy.js";
+export { pathRowsReach, rowsWhereTheyLead } from "../tools/fs/read-deny.js";
+const NOT_REACHED = { reach: "not_reached" };
+export function bindPathRules(specs, anchors) {
+    return specs.map((spec) => {
+        const a = typeof anchors === "function" ? anchors(spec) : anchors;
+        const family = pathFamilyOf(a);
+        const head = pathRuleHeadOf(spec.parsed, a);
+        const unanchored = ruleBasesNeeded(spec.parsed).filter((b) => !isUsablePathBase(b === "cwd" ? (a.cwd ?? a.root) : a[b], family));
+        const reach = (absolutePath) => {
+            const tree = a.root !== undefined || a.cwd !== undefined ? a : { root: absolutePath };
+            const id = absoluteTargetIdentityOf(absolutePath, tree);
+            return id === undefined ? NOT_REACHED : pathRuleReachOf(spec.parsed, id, a, pathFamilyOf(tree));
+        };
+        return {
+            spec,
+            behavior: spec.parsed.behavior,
+            rule: spec.ruleText,
+            tool: spec.parsed.tool,
+            pattern: parsePermissionRule(spec.ruleText).ruleContent ?? "",
+            faces: spec.faces ?? [],
+            reach,
+            reaches: (absolutePath) => reach(absolutePath).reach !== "not_reached",
+            ...(head !== undefined ? { head: spellingOfIdentity(head, family) } : {}),
+            ...(unanchored.length > 0 ? { unanchored } : {}),
+        };
+    });
+}
+export function policyAnchors(declared, install) {
+    const root = declared.root ?? install?.root;
+    const cwd = declared.cwd ?? root;
+    const home = declared.home ?? install?.home;
+    return { ...(root !== undefined ? { root } : {}), ...(cwd !== undefined ? { cwd } : {}), ...(home !== undefined ? { home } : {}) };
+}
+export function persistedRowAnchors(scope, chainTop) {
+    const root = scope.kind === "project" ? scope.root : chainTop.root;
+    return { ...(root !== undefined ? { root, cwd: root } : {}), ...(chainTop.home !== undefined ? { home: chainTop.home } : {}) };
+}
+export async function projectScopeIdentity(rules, canonicalRoot, leads) {
+    if (canonicalRoot === undefined)
+        return undefined;
+    const roots = rules.flatMap((r) => (r.scope.kind === "project" ? [{ head: r.scope.root }] : []));
+    const led = roots.length > 0 ? await leads.resolve(roots) : new Map();
+    return { canonicalRoot, canonicalOf: (root) => locationLeadsTo(root, led) };
+}
+export function createHeadLeads(leadsTo) {
+    const pending = new Map();
+    const settled = new Map();
+    return {
+        async resolve(rows) {
+            const parts = ruleHeadParts(rows).filter((p) => !settled.has(p));
+            await Promise.all(parts.map((part) => {
+                let p = pending.get(part);
+                if (p === undefined) {
+                    p = leadsTo(part).catch(() => undefined);
+                    pending.set(part, p);
+                }
+                return p.then((led) => settled.set(part, led));
+            }));
+            return settled;
+        },
+    };
+}
+const INSTALLED = new WeakMap();
+const INSTALLATIONS = new WeakMap();
+export function installPolicyAnchors(policy, anchors) {
+    if (policy === undefined)
+        return undefined;
+    const from = INSTALLED.get(policy)?.from ?? policy;
+    const rules = from.pathRules;
+    if (rules === undefined)
+        return from;
+    const key = JSON.stringify([anchors.root ?? null, anchors.cwd ?? null, anchors.home ?? null]);
+    const byAnchors = INSTALLATIONS.get(from) ?? new Map();
+    INSTALLATIONS.set(from, byAnchors);
+    const prior = byAnchors.get(key);
+    if (prior !== undefined)
+        return prior;
+    const seated = Object.freeze({ ...anchors });
+    const installed = {
+        ...carriedMembersOf(from),
+        pathRules: () => rules(seated),
+        check: (req, signal) => from.check({ ...req, pathRuleAnchors: seated }, signal),
+    };
+    INSTALLED.set(installed, { from, anchors: seated });
+    byAnchors.set(key, installed);
+    return installed;
+}
+export function installedFrom(policy) {
+    return policy === undefined ? undefined : INSTALLED.get(policy)?.from;
+}
+export function installationAnchorsOf(policy) {
+    return policy === undefined ? undefined : INSTALLED.get(policy)?.anchors;
+}

package/dist/core/permission-rule-model.d.ts

@@ -76,7 +76,7 @@ import { type DenyFace } from "../tools/fs/read-deny.js";
 import type { AssertAllKeysHandled } from "./ask-origin.js";
 import { type ToolCallLike } from "./tool-registry.js";
 import { type PathFamily, type PathIdentity } from "../tools/fs/safety.js";
-import type { PathTargetReading } from "./effective-path-target.js";
+import { type TargetViews } from "./path-rule-binding.js";
 /**
  * The closed set of rule BEHAVIORS — what a matching rule says about the call. The upstream vocabulary
  * verbatim (`allow` / `deny` / `ask`, the three settings lists), in PRECEDENCE order: when rules of more
@@ -144,7 +144,7 @@ export declare const READ_RULE_TOOL = "Read";
  * its tool's name as its reach (`Write(<path>)` is judged on the Write tool, a stricter reading the reference does not make).
  *
  * The two columns are enforced where each behavior can be: a deny row is exported to the engine's deny tables
- * (`ToolPolicy.pathDenyRules`, the person's rows at prepare), which refuse inside the tool, descend into a search's
+ * (`ToolPolicy.pathRules` bound where the policy is installed, the person's rows at prepare), which refuse inside the tool, descend into a search's
  * results and reach the shell's file commands; an ask is a question asked at the gate before the call runs, so it is
  * judged there, on the call's own path target only — it does not descend (a search rooted above the asked path is not
  * asked, and its results are not filtered).
@@ -600,7 +600,7 @@ export declare function isUsablePathBase(base: string | undefined, family: PathF
  * defect (a `~/` deny falling back to the engine host's home guarded the wrong directory; a `/…` deny with
  * no root reached nothing at all).
  */
-export declare function pathRuleReachOf(rule: Pick<PersistedRule, "match" | "command" | "behavior">, target: PathIdentity, bases: PathRuleBases): ProgramRunReachOutcome;
+export declare function pathRuleReachOf(rule: Pick<PersistedRule, "match" | "command" | "behavior">, target: PathIdentity, bases: PathRuleBases, treeFamily?: PathFamily | undefined): ProgramRunReachOutcome;
 /**
  * Where a path rule's reach STARTS under the call's bases — its HEAD: the location the resolved pattern names before
  * its first segment carrying `*` (the whole path when none does), or a directory rule's directory. Everything the rule
@@ -772,7 +772,7 @@ export declare function lexicalNormalAbsolutePathOf(path: string, family: PathFa
  * there is nothing here for it to clear). As a DENY/ASK the same containment refuses or questions every
  * path under the directory, on whichever path tool the rule names.
  */
-export declare function directoryRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, path: PathIdentity, bases: PathRuleBases): boolean;
+export declare function directoryRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, path: PathIdentity, bases: PathRuleBases, treeFamily?: PathFamily | undefined): boolean;
 /** The identity of a directory SPELLING (the cd resolver's `/`-rooted output) under the call's tree, for the
  *  consumers that hand {@link directoryRuleAdmits} a spelling; a rule minted from it stores this form. */
 export declare function directoryIdentityOf(spelling: string, bases: PathRuleBases): PathIdentity | undefined;
@@ -785,7 +785,18 @@ export declare function directoryIdentityOf(spelling: string, bases: PathRuleBas
  *  r3-② cwd posture), never inferred from the process. ONE function on purpose: this is the scope
  *  conjunct of the single eligibility predicate ({@link eligibleContext}), and a sister predicate
  *  would be the second fact source the 375 §5.1 discipline exists to forbid. */
-export declare function scopeCoversCwd(scope: RuleScope, cwd: string | undefined, sessionId?: string): boolean;
+export declare function scopeCoversCwd(scope: RuleScope, cwd: string | undefined, sessionId?: string, identity?: ScopeRootIdentity): boolean;
+/**
+ * A leg's root as an IDENTITY for project coverage: its canonical spelling, and the leg's resolution of a project row's
+ * scope root to the location it leads to. A DENY or ASK project row written under one spelling of a directory (a link the
+ * host spelled, a firmlink) covers a leg rooted at another spelling of the same directory: the row applies by where the two
+ * roots ARE, not only by how they are spelled. An allow row never reads it ({@link spelledScope}). A caller that holds no
+ * resolution (no leg, no environment) compares the spellings alone.
+ */
+export interface ScopeRootIdentity {
+    readonly canonicalRoot: string;
+    readonly canonicalOf: (root: string) => string | undefined;
+}
 /** Is this rule live — i.e. does it still carry at least one add? Deleted adds are removed by the store
  *  when tombstones are applied, so a rule with an empty `adds` is a rule that no longer exists. */
 export declare function isRuleLive(rule: PersistedRule): boolean;
@@ -815,6 +826,7 @@ export declare function eligibleContext(rule: {
     tool: string;
     cwd: string | undefined;
     sessionId?: string;
+    scopeIdentity?: ScopeRootIdentity;
 }): boolean;
 /**
  * design/375 §5.1 — MAY this PERSISTED rule participate in admitting this call at all? The liveness
@@ -834,7 +846,16 @@ export declare function eligiblePersisted(rule: PersistedRule, call: {
     tool: string;
     cwd: string | undefined;
     sessionId?: string;
+    scopeIdentity?: ScopeRootIdentity;
 }, behavior: RuleBehavior): boolean;
+/**
+ * The call context an ALLOW row's scope is judged in: the spellings alone. A deny or ask row applies wherever its project's
+ * directory is (its scope root resolved where it leads — more rows, only ever more protection); an allow row applies only
+ * where its scope root is SPELLED, so a link someone can re-point never carries a standing approval to another directory.
+ */
+export declare function spelledScope<C extends {
+    scopeIdentity?: ScopeRootIdentity;
+}>(call: C): Omit<C, "scopeIdentity">;
 /**
  * Find the rules that admit this command for a task in `cwd`, or `undefined`.
  *
@@ -914,19 +935,23 @@ export declare function adjudicatePersistedRules(rules: readonly PersistedRule[]
     cwd: string | undefined;
     sessionId?: string;
     execCwd?: string;
+    scopeIdentity?: ScopeRootIdentity;
 }): PersistedRuleVerdict | undefined;
 /**
  * The path-family sibling of {@link adjudicatePersistedRules}: the same precedence walk over the rules
- * of one path-targeting tool, judged on the call's resolved target path.
+ * of one path-targeting tool, judged on the call's target views by the one judgment every path rule meets
+ * ({@link pathRowsReach}: rows outer, views inner).
+ *
+ * TWO readings, because the two directions read the call's path slot differently (design/388 B6/B17): the
+ * tightening arms judge the PROTECTIVE reading's views (`views.tighten` — the object face's declaration, the catalog's
+ * for the name as the floor: reading the catalog for an undeclared same-name tool can only tighten a deny), every row
+ * also where its head leads (`leads`, the judging leg's resolution); the allow arm judges the DECLARED reading's views
+ * (`views.allow` — the face's OWN declaration only: a same-name tool that declares no path target is unconfirmable, and
+ * no grant admits it) with the directory rows, for the Read tool ONLY — a directory allow is a standing yes to reads,
+ * never to a write — and admits only when every view lies under the directory. Either reading may be absent (no
+ * resolvable path in that reading); the arm that needs it then speaks for nothing.
  *
- * TWO targets, because the two directions read the call's path slot differently (design/388 B6/B17): the
- * tightening arms judge the PROTECTIVE target (`protectivePathTargetOf` — the object face's declaration,
- * the catalog's for the name as the floor: reading the catalog for an undeclared same-name tool can only
- * tighten a deny) with {@link pathRuleReaches}; the allow arm judges the DECLARED target
- * (`declaredPathTargetOf` — the face's OWN declaration only: a same-name tool that declares no path
- * target is unconfirmable, and no grant admits it) with {@link directoryRuleAdmits}, and for the Read tool
- * ONLY — a directory allow is a standing yes to reads, never to a write. Either target may be absent
- * (no resolvable path in that reading); the arm that needs it then speaks for nothing.
+ * A row is anchored by `anchorsOf` (the person's rows: a project row at its scope root, the rest at the chain's top leg).
  *
  * `call.face` is the face the call's protective target is on (`read` / `write`): an ASK row speaks for the call when it
  * is the call's tool's row, or when {@link PATH_RULE_FACES} puts that face in the row's ask column (a `Read(<path>)` ask
@@ -938,10 +963,11 @@ export declare function adjudicatePersistedPathRules(rules: readonly PersistedRu
     cwd: string | undefined;
     sessionId?: string;
     face?: DenyFace | undefined;
-}, targets: {
-    readonly tighten?: PathTargetReading;
-    readonly allow?: PathTargetReading;
-}, bases: PathRuleBases): PersistedRuleVerdict | undefined;
+    scopeIdentity?: ScopeRootIdentity;
+}, views: {
+    readonly tighten?: TargetViews;
+    readonly allow?: TargetViews;
+}, anchorsOf: (rule: PersistedRule) => PathRuleBases, leads: ReadonlyMap<string, string | undefined>): PersistedRuleVerdict | undefined;
 /**
  * The name-family sibling of {@link adjudicatePersistedRules}: the same precedence walk over the rules of one name tool
  * ({@link NAME_RULE_FACES}), judged on the one string the call names (`nameRuleSubjectOf`). A rule of the tool speaks for the call
@@ -955,6 +981,7 @@ export declare function adjudicatePersistedNameRules(rules: readonly PersistedRu
     name: string | undefined;
     cwd: string | undefined;
     sessionId?: string;
+    scopeIdentity?: ScopeRootIdentity;
 }): PersistedRuleVerdict | undefined;
 /**
  * The ONE offer a name tool's approval card carries: the exact rule for the name the call carries (`Skill(<name>)`, the reference's
@@ -1009,6 +1036,8 @@ export declare function segmentCoverageOf(command: string, rules: {
     /** The relative-cd resolution base (see {@link findAdmittingRule}'s member of the same name) —
      *  defaults to `cwd`; scope/eligibility stays `cwd`. */
     execCwd?: string;
+    /** The leg's root as an identity for project coverage ({@link ScopeRootIdentity}). */
+    scopeIdentity?: ScopeRootIdentity;
 }): readonly SegmentCoverage[] | undefined;
 /** One row of a per-segment coverage table (see {@link segmentCoverageOf}): the FOLDED, trimmed
  *  segment text (a display/correlation seat, never adjudication input) and whether an eligible rule