@sema-agent/core 7.47.0 → 7.49.0

package/dist/core/runner/caller-roster.js

@@ -0,0 +1,219 @@
+import { TOOL_SPEC_MEMBERS, frozenExtra, frozenMember, newCopyState } from "../tool-spec-members.js";
+import { isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
+function specArmCanConstruct(t) {
+    if (typeof t !== "object" || t === null)
+        return false;
+    const name = Object.getOwnPropertyDescriptor(t, "name");
+    const execute = Object.getOwnPropertyDescriptor(t, "execute");
+    return name !== undefined && "value" in name && typeof name.value === "string" && name.enumerable === true && execute !== undefined && "value" in execute && typeof execute.value === "function" && execute.enumerable === true;
+}
+const ORIGIN = new WeakMap();
+export function callerEntryOrigin(entry) {
+    return ORIGIN.get(entry) ?? entry;
+}
+const PRODUCT_OF = new WeakMap();
+const IS_MEMBER = new Set(TOOL_SPEC_MEMBERS);
+function faceKeys(t) {
+    const keys = new Set(Reflect.ownKeys(t).filter((k) => Object.getOwnPropertyDescriptor(t, k)?.enumerable === true));
+    for (const name of TOOL_SPEC_MEMBERS)
+        keys.add(name);
+    return [...keys];
+}
+const BUILDABLE = new WeakSet();
+export function specArmCanBuild(entry) {
+    return BUILDABLE.has(entry);
+}
+const entryName = (t) => {
+    try {
+        const name = t !== null && (typeof t === "object" || typeof t === "function") ? Object.getOwnPropertyDescriptor(t, "name")?.value : undefined;
+        return typeof name === "string" ? JSON.stringify(name) : "(no own name)";
+    }
+    catch {
+        return "(no readable name)";
+    }
+};
+function refuseUnreadableEntry(index, entry, cause) {
+    let said = "";
+    try {
+        said = cause instanceof Error ? cause.message.slice(0, 120) : "";
+    }
+    catch {
+    }
+    const e = new Error(`spec.tools[${index}] ${entryName(entry)}: its members could not be read${said === "" ? "" : ` (${said})`} — the run fixes its tool roster by reading each entry once, before its first await, and an entry that cannot be read is not a tool. Pass a tool whose declaration reads without throwing.`);
+    e.code = "config.tool_mount_denied";
+    throw e;
+}
+export function rosterFaceOf(t, index) {
+    if ((typeof t !== "object" && typeof t !== "function") || t === null)
+        return t;
+    try {
+        const product = isDefineToolProduct(t) ? t : undefined;
+        const buildable = product === undefined && specArmCanConstruct(t);
+        const source = t;
+        const face = {};
+        const ledger = newCopyState();
+        for (const key of faceKeys(source)) {
+            const own = Object.prototype.hasOwnProperty.call(source, key);
+            const value = source[key];
+            if (value === undefined && !own)
+                continue;
+            let kept;
+            if (typeof key === "string" && IS_MEMBER.has(key))
+                kept = frozenMember(key, value, ledger);
+            else {
+                const extra = frozenExtra(String(key), value, ledger);
+                if (!extra.kept)
+                    continue;
+                kept = extra.value;
+            }
+            Object.defineProperty(face, key, { value: kept, enumerable: true, writable: true, configurable: true });
+        }
+        ORIGIN.set(face, source);
+        if (product !== undefined)
+            PRODUCT_OF.set(face, product);
+        else if (buildable && specArmCanConstruct(face))
+            BUILDABLE.add(face);
+        return Object.freeze(face);
+    }
+    catch (cause) {
+        return refuseEntry(index, t, cause);
+    }
+}
+function refuseEntry(index, entry, cause) {
+    let refusal;
+    try {
+        if (cause instanceof Error && cause.code === "config.tool_mount_denied")
+            refusal = cause.message;
+    }
+    catch {
+    }
+    if (refusal === undefined)
+        return refuseUnreadableEntry(index, entry, cause);
+    const e = new Error(`spec.tools[${index}] ${entryName(entry)}: ${refusal}`);
+    e.code = "config.tool_mount_denied";
+    throw e;
+}
+function sameMember(was, now, ledger, depth = 0) {
+    if (Object.is(was, now))
+        return true;
+    if (depth > 64 || typeof was !== "object" || typeof now !== "object" || was === null || now === null)
+        return false;
+    const met = ledger.pairs.get(was);
+    if (met?.has(now) === true)
+        return true;
+    if (met === undefined)
+        ledger.pairs.set(was, new WeakSet([now]));
+    else
+        met.add(now);
+    try {
+        if (Array.isArray(was) !== Array.isArray(now))
+            return false;
+        const a = Reflect.ownKeys(was), b = Reflect.ownKeys(now);
+        if (a.length !== b.length)
+            return false;
+        ledger.steps += a.length + 1;
+        if (ledger.steps > COMPARE_STEPS) {
+            ledger.over = true;
+            return false;
+        }
+        for (const key of a) {
+            const x = Object.getOwnPropertyDescriptor(was, key), y = Object.getOwnPropertyDescriptor(now, key);
+            if (x === undefined || y === undefined || !("value" in x) || !("value" in y) || !sameMember(x.value, y.value, ledger, depth + 1))
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const COMPARE_STEPS = 20_000;
+function shown(v) {
+    if (v === undefined || typeof v === "boolean" || typeof v === "number")
+        return String(v);
+    if (typeof v === "string")
+        return JSON.stringify(v.length > 60 ? `${v.slice(0, 60)}…` : v);
+    try {
+        if (Array.isArray(v) && v.length <= 8 && v.every((x) => typeof x === "string"))
+            return `[${v.map((x) => shown(x)).join(", ")}]`;
+    }
+    catch {
+    }
+    return undefined;
+}
+function refuseProductDrift(face, rebound) {
+    const was = face;
+    const now = rebound;
+    const keys = new Set([...Reflect.ownKeys(face), ...faceKeys(rebound)]);
+    keys.delete("execute");
+    const driftProblems = [];
+    const ledger = { pairs: new WeakMap(), steps: 0, over: false };
+    for (const key of keys) {
+        let after;
+        try {
+            after = now[key];
+        }
+        catch {
+            driftProblems.push(`${String(key)} (unreadable)`);
+            continue;
+        }
+        if (sameMember(was[key], after, ledger))
+            continue;
+        const before = shown(was[key]), later = shown(after);
+        driftProblems.push(ledger.over ? `${String(key)} (declaration comparison over budget)` : before !== undefined && later !== undefined ? `${String(key)} (${before} → ${later})` : `${String(key)} (differs)`);
+        if (ledger.over)
+            break;
+    }
+    if (driftProblems.length === 0)
+        return;
+    const e = new Error(`defineTool product ${entryName(face)} changed after the run fixed its tool roster (before its first await): ${driftProblems.join(", ")}. The safety scan judged the product as it stood then, so a product that no longer matches is never mounted — not under its new name, not under the old one. Pass the final product before starting the run.`);
+    e.code = "config.tool_mount_denied";
+    throw e;
+}
+function mountedProduct(face, rebound) {
+    const members = {};
+    for (const key of Reflect.ownKeys(face))
+        members[key] = { value: face[key], enumerable: true };
+    members.execute = { value: rebound.execute.bind(rebound), enumerable: true };
+    return Object.freeze(Object.create(Object.prototype, members));
+}
+export function rebindProductEntry(entry, enrich) {
+    const product = PRODUCT_OF.get(entry);
+    if (product === undefined)
+        return undefined;
+    const rebound = rebindDefineToolCtx(product, enrich);
+    refuseProductDrift(entry, rebound);
+    return mountedProduct(entry, rebound);
+}
+export function snapshotCallerRoster(spec) {
+    const tools = spec.tools;
+    const descriptors = Object.getOwnPropertyDescriptors(spec);
+    const handed = Array.isArray(tools) ? Object.freeze([...tools]) : undefined;
+    const slot = handed !== undefined ? Object.freeze(handed.map((t, i) => rosterFaceOf(t, i))) : tools;
+    descriptors.tools = { value: slot, enumerable: slot !== undefined, writable: false, configurable: false };
+    const copy = Object.create(Object.getPrototypeOf(spec), descriptors);
+    return { spec: copy, roster: { caller: spec, handed: tools === undefined ? Object.freeze([]) : handed } };
+}
+export function refuseLateRosterChanges(roster) {
+    const { handed } = roster;
+    if (handed === undefined)
+        return;
+    const current = roster.caller.tools;
+    const now = current === undefined ? [] : Array.isArray(current) ? current : throwChanged([`spec.tools (reassigned to a value that is not an array)`]);
+    const changed = [];
+    for (let i = 0; i < Math.max(now.length, handed.length); i++) {
+        if (now[i] === handed[i])
+            continue;
+        if (i < now.length)
+            changed.push(`${entryName(now[i])} (${i < handed.length ? "replaced" : "added"})`);
+        else
+            changed.push(`${entryName(handed[i])} (removed)`);
+    }
+    if (changed.length > 0)
+        throwChanged(changed);
+}
+function throwChanged(changed) {
+    const e = new Error(`spec.tools changed after the run fixed its tool roster: ${changed.join(", ")}. The roster is the one the request carried when the run started (before its first await) — the scan that judges each tool's effect and marks and the mount read that one copy, so a later entry is never mounted. Pass the complete roster before starting the run.`);
+    e.code = "config.tool_mount_denied";
+    throw e;
+}

package/dist/core/runner/checkpoint-scope.d.ts

@@ -1,9 +1,8 @@
 /**
  * The durable-suspend checkpoint ROW-IDENTITY vocabulary — the default isolation scope, the ONE derivation of a row's
  * scope, and the ONE reading of the placement fields' empty string — moved whole out of the orchestrator so the
- * wiring-manifest phase (the synthesized durableApproval), the park-lane phases (the mint sites and the suspend stamp),
- * the driver (the restore fold) and runtask (the resume rung) reach DOWN for the same names. Pure: a constant and two
- * string functions.
+ * park-lane phases (the suspend stamp), the driver (the leg's scope, derived once and handed to every mint lane; the
+ * restore fold) and runtask (the resume rung) reach DOWN for the same names. Pure: a constant and two string functions.
  */
 /** The multi-tenant scope used when a durable suspend fires for an IRREVERSIBLE tool in an
  *  unattended deployment that did NOT opt into `durableApproval` (so there is no caller-supplied scope). The
@@ -12,26 +11,27 @@
  *  unattended irreversible suspend auditable as such. */
 export declare const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
 /**
- * The SINGLE derivation of a durable-suspend checkpoint's scope (both gate mint
- * sites + the bg-watcher park lane's expire compensation/arbitration consume THIS; a re-derived copy
- * that drifted was the exact bug the park tests caught — expire against the wrong scope silently
- * no-ops). `|| DEFAULT` (not `??`): an EMPTY-string principal must not become a shared scope bucket.
+ * The SINGLE derivation of a durable-suspend checkpoint's scope — the LEG's scope, computed once per prepare and
+ * read by every mint lane of that leg (approval park, resource and `plan_review` parks, the forceDurableGate
+ * synthesis) and by its children; a re-derived copy that drifted was the exact bug the park tests caught (expire
+ * against the wrong scope silently no-ops). `seat` is the scope the leg was already given: on a spawn lane the
+ * PARENT leg's (`RunInternals.checkpointScope`) — a child's rows land where its parent's do, which the child's own
+ * spec cannot say, since the synchronous lane does not carry the parent's `durableApproval` (it would also arm the
+ * child's plain asks to park); on a resume that hands no seat, the leg's own recorded scope
+ * (`CheckpointState.legScope`), so the resume config cannot move it. The seat moves the scope and nothing else. A
+ * root leg's first prepare has no seat.
  *
- * That rule is stated twice in this file and was enforced on ONE of the two
- * inputs — the principal half used `||`, the `durableApproval.scope` half used `??`, so an empty string
- * arriving through the scope field (a config-centre / env lookup that came back blank is the realistic
- * source) sailed through as the literal scope `""`. Two different tenants both landed in that one bucket,
- * where `listByScope("")` reads BOTH their pending approvals — including each summary's `toolInput`
- * preview of the raw arguments — and `reap("")` / `resolve(token, "")` act across both. `durableApproval.
- * scope` is documented as "Multi-tenant isolation key … Required"; a blank string is the absence of an
- * isolation key wearing its clothes, so both halves now fall through to the default isolation scope.
+ * `||` on EVERY rung (not `??`): a blank string — a config-centre / env lookup that came back empty is the
+ * realistic source — is the absence of an isolation key wearing its clothes. Kept as a literal `""` it would be
+ * one bucket for every tenant that hit it: `listByScope("")` reads all their pending approvals (with each
+ * summary's `toolInput` preview) and `reap("")` / `resolve(token, "")` act across all of them.
  */
 export declare function checkpointScopeOf(spec: {
     durableApproval?: {
         scope?: string;
     };
     principal?: string;
-}): string;
+}, seat?: string): string;
 /**
  * The ONE spelling of the placement fields' empty-string discipline: `""` is absence
  * wearing clothes (the resume entry's principal-rung posture), and every placement read that must

package/dist/core/runner/checkpoint-scope.js

@@ -1,6 +1,6 @@
 export const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
-export function checkpointScopeOf(spec) {
-    return spec.durableApproval?.scope || spec.principal || DEFAULT_IRREVERSIBLE_SCOPE;
+export function checkpointScopeOf(spec, seat) {
+    return seat || spec.durableApproval?.scope || spec.principal || DEFAULT_IRREVERSIBLE_SCOPE;
 }
 export function placementValueOrAbsent(value) {
     return value || undefined;

package/dist/core/runner/child-tree.js

@@ -1,5 +1,5 @@
 import { isRemoteExecutionEnv } from "../remote-env.js";
-import { isAbsolutePathForm } from "../../tools/fs/safety.js";
+import { validatePath } from "../effective-path-target.js";
 import { installPolicyAnchors, installationAnchorsOf, installedFrom } from "../path-rule-binding.js";
 import { CheckpointError } from "../checkpoint-store.js";
 export function deploymentCanRerootChild(deps) {
@@ -37,7 +37,7 @@ function recordedAnchors(r, rebase) {
         if (typeof v !== "string")
             return undefined;
         const p = rebase(v);
-        return isAbsolutePathForm(p) ? p : undefined;
+        return validatePath(p, { intent: "validate-coordinate" });
     };
     const [root, home] = [read(r.root), read(r.home)];
     return { ...(root !== undefined ? { root } : {}), ...(home !== undefined ? { home } : {}) };

package/dist/core/runner/contracts.d.ts

@@ -64,15 +64,27 @@ import type { BlockedRef, OutputRef, SkillListingEntry } from "./synthetic-tools
 import type { createAttachmentState, WriteFamily } from "./turn-attachments.js";
 import type { cacheFamilyOf } from "./usage-accounting.js";
 /**
- * The frozen task-start snapshot of the caller's tool-face control arrays: produced by the
- * config-doors phase, read by the hands/read-face phase. Named here rather than reached for as
- * `PrepareConfigDoorsResult["toolFaceSnapshot"]` — an indexed access into a sibling phase's Result
- * is a sideways dependency wearing a type's clothes.
+ * The frozen task-start copies of the caller's tool-face control arrays, as the config-doors phase takes them (synchronously,
+ * before the first await): the selector's own layer (`allow` / `exclude`) and the disclosure lists. The driver compiles the
+ * selector from them once the leg's delegation facts are known ({@link ToolFaceSnapshot}).
  */
-export interface ToolFaceSnapshot {
+export interface ToolFaceLists {
+    allow: readonly string[] | undefined;
     exclude: readonly string[] | undefined;
     defer: readonly string[] | undefined;
     alwaysLoad: readonly string[] | undefined;
+    restoreGated: readonly string[] | true | undefined;
+}
+/**
+ * The leg's tool face: its compiled tool selector (the ONE answer to "may this run use this tool" — the roster valve, every
+ * "is X available" mount decision, the MCP refresh and re-dial, the deferred-search lane, and the ceiling every child inherits)
+ * and the frozen disclosure lists. Named here rather than reached for through a phase's Result — an indexed access into a
+ * sibling phase's Result is a sideways dependency wearing a type's clothes.
+ */
+export interface ToolFaceSnapshot {
+    selector: import("../tool-face.js").ToolSelector;
+    defer: readonly string[] | undefined;
+    alwaysLoad: readonly string[] | undefined;
     /** The model-gate restore selector ({@link TaskSpec.restoreGatedTools}), fourth
      *  seat of the same frozen task-start snapshot: the gate decision and the delegation carrier
      *  read THIS, never the live spec. */
@@ -326,23 +338,17 @@ export interface Prepared {
      *  emits; the tool_result-side delete in prepare-task never fires for immediate results). */
     blockedToolCalls: Set<string>;
     /**
-     * WHAT ended the approval a gated call was waiting on and WHOSE settlement it
-     * was, keyed by tool-call id: written ONLY by the tool gate, at the one exit where an ask resolved,
-     * and read once when that call's `tool_end` frame is minted (the reader deletes on read; a call the
-     * gate never settled has no entry, and an entry never names neither fact).
+     * The leg's tool-call OCCURRENCES (`tool-occurrence.ts`): one record per call attempt, the only holder of what
+     * the engine knows about a call in flight — its start frame, its gate rounds (the gate's exit record and any
+     * refusal after it), its wait on the person, its heartbeat clocks. Every frame of the call, the heartbeat, the
+     * trace row and the resumed leg's execution record read it; a call leaves it when its end frame is minted.
      *
-     * ONE record rather than two parallel maps because they are one observation: an attribution without
-     * the settlement kind beside it is unreadable ("alice" — approved? her window elapsed?), and two maps
-     * keyed alike are two chances to drain one and leak the other.
-     *
-     * It is a sideband and not a field on the tool RESULT because a result is not a trustworthy carrier
-     * for this: `details` is arbitrary tool-authored data that post-tool hooks may also replace, so a
-     * failing tool could stamp a settlement on itself and tell a consumer's audit view that a person
-     * approved something nobody was ever shown. Provenance has to travel on a channel only the
-     * adjudicating layer can write. Same reason the entries are keyed by CALL id: the gate adjudicated
-     * that exact call, and the frame that reads it is that call's own.
+     * An engine-owned seat and not a field on the tool RESULT because a result is not a trustworthy carrier: its
+     * `details` is tool-authored and replaceable by post-tool hooks, so provenance read from it would let a failing
+     * tool claim a person approved it. Writers: the announcing stations, the gate station, the shell read
+     * admission, the resumed leg's belts; the end projection closes the record.
      */
-    gateOutcomes: Map<string, import("../gate-outcome.js").GateOutcome>;
+    toolOccurrences: import("./tool-occurrence.js").ToolOccurrenceTable;
     /**
      * The parent-thread human-rejection halt fact (see `maybeHumanRejectionHalt`): present from the
      * moment a bare human rejection halts the turn's batch until the run ends or the NEXT provider
@@ -404,6 +410,8 @@ export interface Prepared {
     };
     /** The run's advertised-writable-directory seat (present with hands): `roots` is what the prompt advertised as writable and the fence admitted. Read live wherever a policy is adjudicated off a resumed leg, so the write gate's exemption domain is that same list. */
     advertisedWritableDirs?: Pick<import("./advertised-writable-dirs.js").AdvertisedWritableDirs, "roots">;
+    /** The leg's ONE exempt root (its single resolution of `RunnerDeps.memoryEngineDir`), stamped wherever a policy is adjudicated off a resumed leg (`ToolCallRequest.exemptRoots`) — the same list the live gate stamps. */
+    exemptRoots: readonly string[];
     /** The ACTIVE EnterWorktree session ref (mounted with the worktree tools; undefined without
      *  real write hands). runtask's settle write reads `current` for the workspace-state entry. */
     worktreeSessionRef?: {
@@ -1608,6 +1616,30 @@ export interface PromptFeatureFlags {
  * await latch is a separate, pinned guarantee (prepare-task-phase-pins T1).
  */
 export interface RunInternals {
+    /**
+     * The MCP connection pool of this leg's run tree (a delegation tool hands its own down to every child that inherits its MCP
+     * mount; the root run creates it). A leg that declares a server leases the connection from it instead of dialling a copy, and
+     * releases the lease when its materialization is disposed — see `mcp-connection-pool.ts`. Trusted, never a TaskSpec field.
+     */
+    mcpPool?: import("../mcp-connection-pool.js").McpConnectionPool;
+    /**
+     * The tool-selector layers of the run that spawned this leg — its ceiling ({@link ToolFaceSnapshot.selector}`.layers`): this
+     * leg's selector is these layers plus its own `allowTools` / `excludeTools`, so nothing a child names can widen what its
+     * parent could use. Present on every leg an engine lane spawns (an empty list when the parent was unbounded). Trusted, never a
+     * TaskSpec field.
+     */
+    toolCeiling?: readonly import("../tool-face.js").ToolSelectorLayer[];
+    /** Set by the delegation lane when the spawning run's prepare judged this leg's own tool lists (its spec's `allowTools` /
+     *  `excludeTools` — a definition's or the delegation tool's) where they were mounted: their digest (`toolListsDigest`), the evidence
+     *  bound to exactly those lists. A prepare whose own lists digest to it does not judge them again against its own, narrower universe,
+     *  and its rows record it (`CheckpointState.toolListsJudged`) so a resume that hands no internals keeps the judgment. Absent (a
+     *  workflow agent, a team member, a host's direct `runTask`), or lists that digest differently ⇒ the leg judges its own lists. */
+    toolListsJudged?: string;
+    /** Set by the delegation lane: whose lists this leg's own are (`delegationListWhere` — the agent definition it was spawned as, or the
+     *  delegation tool's tool-level list), so a refusal at the leg's prepare names the list to fix. Absent ⇒ the leg's own `TaskSpec` seats. */
+    ownToolListsWhere?: string;
+    /** Set only on an observer sidecar's legs: the leg kind whose protocol is the observer's report tool. */
+    observerLeg?: true;
     /** The live repair bundle from a `runRepairLoop` attempt in flight (attemptCount>0). Serialized onto a
      *  checkpoint minted MID-attempt so a resume re-seeds it; undefined for any non-repair run. */
     repairBundle?: RepairBundle;
@@ -1983,15 +2015,19 @@ export interface RunInternals {
      * to a domain the row is not in — scope is fail-closed on both access predicates, so such a child
      * cannot see its own row, its siblings, or the children it spawns. Carrying the domain as its own
      * trusted axis keeps `principal` the IDENTITY it is: the identity also keys the durable
-     * approval / checkpoint namespace (`checkpointScopeOf`), the runtime-capability lookup and the MCP
-     * principal header, and a mount's registry scope has no business moving any of those (an unattended
-     * safety park must not migrate into the caller's opt-in approval bucket).
+     * approval / checkpoint namespace of a root leg (`checkpointScopeOf`), the runtime-capability lookup and the
+     * MCP principal header, and a mount's registry scope has no business moving any of those (a child's checkpoint
+     * scope is its own fact — {@link checkpointScope} — and a registry domain is never it).
      *
      * TRUSTED channel (never a {@link TaskSpec} field, never a model argument), like the parentage axes
      * above. When a deployment sets both, they agree by construction: with a principal present the
      * delegation tool resolves this axis TO that principal.
      */
     registryScope?: string;
+    /** The spawning leg's checkpoint scope, filled by the delegation tool off the parent's ctx seat on every spawn lane (a
+     *  resume that hands none fills the rung from the row's `CheckpointState.legScope`): the top rung of `checkpointScopeOf`,
+     *  so a child's rows are listed with its parent's. Scope only, never park capability. TRUSTED channel; `""` is absence. */
+    checkpointScope?: string;
     /** The spawning run's ADOPTED center artifact, threaded down the
      *  trusted internals chain so every child in the tree composes the SAME closure (a child must
      *  never spontaneously adopt the live candidate while its parent runs an older pin — that is the
@@ -2697,22 +2733,19 @@ export interface TurnBoundaryDeps {
 export type ToolProgressBody = Omit<Extract<TaskEvent, {
     type: "tool_progress";
 }>, "type" | "elapsedTimeSeconds" | keyof TaskEventIdentity>;
-/** The run's TOOL-PROGRESS lane: the ONE mint of `tool_progress` plus the heartbeat clock over the calls
- *  in flight. Declared on the FLOOR because both registry-side readers sit above its implementation (the
- *  driver builds it, the harness-handler lane drives it) and the Prepared seat that carries it to the tool
- *  band is here too. `createToolProgressLane` (tool-progress-lane.ts, layer 1) is its one implementation. */
+/** The run's TOOL-PROGRESS lane: the ONE mint of `tool_progress` plus the heartbeat over the calls in flight —
+ *  the leg's occurrences (`Prepared.toolOccurrences`), read, never a set of its own. Declared on the FLOOR because
+ *  both registry-side readers sit above its implementation (the driver builds it, the harness-handler lane drives
+ *  it) and the Prepared seat that carries it to the tool band is here too. `createToolProgressLane`
+ *  (tool-progress-lane.ts, layer 1) is its one implementation. */
 export interface ToolProgressLane {
     /** Offer ONE frame — from a tool that observes its own progress (the shell's per-second tick) or from
      *  the lane's own heartbeat. The lane stamps the elapsed time, DROPS the offer when it would land inside
      *  the cadence floor, and resets that call's beat clock when it does not. NEVER THROWS: a tool calls this
      *  from inside an environment output callback, where a throw kills the command it is describing. */
     emit(body: ToolProgressBody): void;
-    /** A tool call entered execution: it joins the heartbeat's in-flight set and its clock starts, stamped
-     *  by the LANE (one clock owns one number — see its module header on why that clock is monotonic). */
-    noteStart(toolCallId: string, toolName: string): void;
-    /** A tool call settled: it leaves the in-flight set. */
-    noteEnd(toolCallId: string): void;
-    /** Drop every in-flight call and disarm the timer (turn end / teardown): no beating into the next turn. */
+    /** The heartbeat stops covering every call in flight and disarms (turn end / teardown): no beating into the next
+     *  turn. The occurrences stay — a later end must still know its start went out. */
     clear(): void;
 }
 export interface HarnessHandlersDeps {
@@ -2750,8 +2783,8 @@ export interface HarnessHandlersDeps {
 }
 /**
  * The Runner as the modules it drives and the compositions over it see it — the delegation tools
- * (Agent / SendMessage / AgentTranscript), the repair, verify, cascade, teacher and team loops, the
- * workflow and goal orchestrations, the scenario registry, the HTTP server, `warmResume`, and the
+ * (Agent / SendMessage / AgentTranscript), the repair, verify and cascade loops, the
+ * workflow and goal orchestrations, the HTTP server, `warmResume`, and the
  * orchestrator's own trusted `runnerSelf` seat. Every one of them used to name the `Runner` CLASS
  * through `import type`, which is a type edge from below the runner back up into it — a cycle the
  * direction gate could only carry as an exemption, and one that reached the orchestrator through the

package/dist/core/runner/decide-continuation.d.ts

@@ -7,14 +7,18 @@
  *  · which call a CONTENT-ASK checkpoint parks on, and the one-shot answering face a decide's answer is
  *    bound to for the redeemed call;
  *  · the capture-time domain checks on a decide's TEXT payloads, and the label a rejected value gets;
+ *  · WHO decided: the host's decision facts, validated once and minted into the settlement record once, for every
+ *    decide that records its decider (a tool approval's and a plan pause's);
  *  · the continuation prompt itself.
  *
  * Pure over its arguments (the answering face is the one closure, and it closes over its own arguments
  * only). Run-loop machinery (layer 1), named without the `resume-` family prefix: that prefix marks a
  * driven rung of the resume decision ladder, which this is not.
  */
+import { type AskOrigin } from "../ask-origin.js";
 import { type OnQuestion, type QuestionAnswer } from "../ask-question.js";
-import { type Checkpoint, type ResolvedOutcome } from "../checkpoint-store.js";
+import { type Checkpoint, type ResolvedOutcome, type ResumeOutcome } from "../checkpoint-store.js";
+import { type GateOutcome, type HostDecisionFacts } from "../gate-outcome.js";
 import type { ResumeRun } from "./contracts.js";
 /**
  * Was this resume driven by a NEGATIVE human decision (plan_review/dry_run_review
@@ -72,6 +76,49 @@ redeemedQuestionsHash: string): OnQuestion;
  * the malformed input escaping the very classification the refusal exists to give.
  */
 export declare function describeSuppliedValue(value: unknown): string;
+/** The decide lane a capture serves — the outcome gate word of an arm that carries the facts (the lane only words the refusals). */
+export type DecideLane = Extract<ResumeOutcome, {
+    hostDecision: HostDecisionFacts;
+}>["gate"];
+/** The member every durable decide refuses when a caller supplies it: the settlement record is core's mint. */
+export declare const SUPPLIED_RECORD_KEY: readonly [string, string];
+/** Refuse a decide that carries a key it may not (each with the sentence that says why). Presence is the whole test —
+ *  no value read here is ever consumed, so a stateful accessor has no seam to open; `Reflect.get` keeps the read
+ *  dynamic without naming a refused key as a property. */
+export declare function refuseSuppliedKeys(decide: object, keys: ReadonlyArray<readonly [string, string]>): void;
+/** What a decide says it decided, in the lane's own words: `word` is the verdict as the caller spelled it (for the
+ *  sentence), `allows` whether it is the ALLOW direction (a tool approval's `allow`; a plan pause's `approve` / `edit`). */
+export interface DecideVerdict {
+    readonly word: string;
+    readonly allows: boolean;
+}
+/**
+ * Read and judge the host's decision facts — the ONE validation for every durable decide. `raw` is the caller's
+ * `hostDecision`, read ONCE by the lane (this function reads `decidedBy` and `approver` once each, off it).
+ *  - the facts are REQUIRED: absence (or a non-object) is refused — absence is not a fact about the wait, and core
+ *    does not guess one;
+ *  - `decidedBy` is a member of the closed set ({@link isHostDecider}); the sweep's word is the host's SLA sweep and
+ *    a sweep resolves only rows whose deadline is an SLA resolve-deny (facet `A`, read through `facetOf`) — on any other row
+ *    the word would file a record of an event that row's contract says cannot happen;
+ *  - WHO MAY ALLOW the row: not the sweep's word (a wait nobody answered), and not the policy on a row that demands a
+ *    person (`policyCannotAnswer`, the synchronous seat's rule);
+ *  - the attribution passes the shared screen (a bounded plain string) — refused rather than dropped.
+ */
+export declare function captureHostDecision(cp: Checkpoint, raw: unknown, lane: DecideLane, verdict: DecideVerdict): HostDecisionFacts;
+/** The origin word of the ask a pending row holds: a tool approval's was stamped on the park by the gate; a plan
+ *  pause's is its kind (nothing persisted — the row's kind is the whole fact). Undefined for a row that holds no ask. */
+export declare function parkedOriginOf(cp: Checkpoint): AskOrigin | undefined;
+/**
+ * THE mint for a durable decide's settlement record — the last pre-CAS station of both decide lanes: the host's
+ * facts joined with the row's origin (invariant I1: a settlement names its origin), one record for the row's
+ * resolved outcome. `allowed` is the allow direction; the refusal's `note` is the decider's own text (filed on a
+ * person's refusal only). A row minted before the origin was persisted carries none, and the record cannot be
+ * minted honestly for it: refused by version floor (the row stays pending), never guessed.
+ */
+export declare function mintDecideRecord(cp: Checkpoint, facts: HostDecisionFacts, verdict: {
+    readonly allowed: boolean;
+    readonly note: string | undefined;
+}): GateOutcome;
 /**
  * Capture-time domain check for a decide outcome's TEXT payloads — the review lanes' `editedPlan` /
  * `reason` and the approval lane's deny `reason`. All are persisted (the recorded winner's payload,
@@ -92,6 +139,7 @@ export declare function assertOutcomeText(value: string | undefined, field: "edi
  * `prompt(text)` (it always appends a user message — there is no "continue from tool results" entry), so
  * resume re-enters via a `<system-reminder>`-wrapped user message that tells the model the gated decision
  * was applied. The "user message wart" is accepted (API-valid, and clearer than a silent continuation).
- * `fullShellReachable` is the resumed leg's own roster fact, read by {@link reorientClause}.
+ * `fullShellReachable` is the resumed leg's own roster fact, read by {@link reorientClause}; `delegatedChild` is
+ * the leg's effective delegation fact, which picks the posture of a person's refusal of a tool use.
  */
-export declare function resumeContinuation(resume: ResumeRun, mark: string | undefined, fullShellReachable: boolean): string;
+export declare function resumeContinuation(resume: ResumeRun, mark: string | undefined, fullShellReachable: boolean, delegatedChild: boolean): string;