@sema-agent/core 7.47.0 → 7.49.0

package/dist/core/runner/decide-continuation.js

@@ -1,9 +1,14 @@
-import { ASK_USER_QUESTION_TOOL_NAME, isLiveQuestionFace, markBoundOnlyQuestionFace } from "../ask-question.js";
+import { isAskOrigin } from "../ask-origin.js";
+import { isLiveQuestionFace, markBoundOnlyQuestionFace } from "../ask-question.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { CheckpointError } from "../checkpoint-store.js";
+import { decidersNote, isHostDecider, settlementOfHostDecision } from "../gate-outcome.js";
 import { formatHookFeedback } from "../hooks.js";
+import { facetOf, isGateKind, isQuestionGate } from "../pause-registry.js";
+import { humanRefusalSentence, policyCannotAnswer, screenApproverAttribution } from "../tool-policy.js";
+import { mintGateOutcome } from "./gate-exit.js";
 import { delimitUntrusted, REVIEWER_NOTE_MAX_BODY } from "../untrusted-text.js";
-import { wireOf } from "../tool-name-readings.js";
+import { engineCardOf } from "../tool-roster.js";
 export function resumeDecisionWasNegative(resume) {
     const o = resume.outcome;
     return o.decision === "reject" || o.decision === "deny";
@@ -50,9 +55,7 @@ export function sameWinner(incoming, persisted) {
         (persisted.reason === undefined || incoming.reason === persisted.reason));
 }
 export function pendingContentAskCallId(cp) {
-    return cp.pendingAction.kind === "tool_approval" && wireOf("resume.contentAskRow", cp.pendingAction) === ASK_USER_QUESTION_TOOL_NAME
-        ? cp.pendingAction.toolCallId
-        : undefined;
+    return cp.pendingAction.kind === "tool_approval" && engineCardOf(cp.pendingAction) === "question" ? cp.pendingAction.toolCallId : undefined;
 }
 export function answerFaceForRedeemedCall(answer, redeemedCallId, base, redeemedQuestionsHash) {
     let consumed = false;
@@ -70,6 +73,54 @@ export function answerFaceForRedeemedCall(answer, redeemedCallId, base, redeemed
 export function describeSuppliedValue(value) {
     return typeof value === "string" ? value : value === null ? "null" : typeof value;
 }
+export const SUPPLIED_RECORD_KEY = ["gateOutcome", "the settlement record is minted by core from the host's decision facts and the row's origin, never supplied"];
+export function refuseSuppliedKeys(decide, keys) {
+    for (const [key, why] of keys) {
+        if (Reflect.get(decide, key) !== undefined) {
+            throw new CheckpointError("checkpoint.invalid_outcome", `resume carries \`${key}\` — ${why}; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
+        }
+    }
+}
+export function captureHostDecision(cp, raw, lane, verdict) {
+    if (typeof raw !== "object" || raw === null) {
+        throw new CheckpointError("checkpoint.invalid_outcome", `resume carries no hostDecision — a ${lane} decide names who decided it ({ decidedBy: "person" | "sla_timeout" | "policy", approver? }); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
+    }
+    const decidedBy = raw.decidedBy;
+    if (!isHostDecider(decidedBy)) {
+        throw new CheckpointError("checkpoint.invalid_outcome", `resume hostDecision.decidedBy "${describeSuppliedValue(decidedBy)}" is outside the closed set — it is exactly "person", "sla_timeout" or "policy"; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
+    }
+    const gateIsQuestion = isGateKind(cp.gate.kind) && isQuestionGate(cp.gate);
+    if (decidedBy === "sla_timeout" && !(isGateKind(cp.gate.kind) && facetOf(cp.gate) === "A")) {
+        throw new CheckpointError("checkpoint.invalid_outcome", `resume hostDecision.decidedBy "sla_timeout" names the host's SLA sweep, which resolves approval rows only — this ${gateIsQuestion ? "question" : `"${String(cp.gate.kind)}"`} row's deadline is an abandonment TTL (expired, never resolved); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
+    }
+    const cannotAllow = !verdict.allows
+        ? undefined
+        : decidedBy === "sla_timeout"
+            ? ` — that word names a wait that ended with nobody answering, and it cannot approve an action that EXECUTES (an allow is decided by "person" or "policy")`
+            : policyCannotAnswer(cp, decidedBy)
+                ? ` on a row that requires real approval — a policy's answer is not a person's, and this row demands a person (decide it as "person", or refuse it as "policy")`
+                : undefined;
+    if (cannotAllow !== undefined)
+        throw new CheckpointError("checkpoint.invalid_outcome", `resume carries decision "${verdict.word}" decided by "${decidedBy}"${cannotAllow}; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
+    const attribution = screenApproverAttribution(raw.approver);
+    if (attribution.defect !== undefined) {
+        throw new CheckpointError("checkpoint.invalid_outcome", `resume carries an approver attribution this engine refuses: ${attribution.defect}; refusing pre-CAS, the checkpoint stays pending`, { field: "approver" });
+    }
+    return { decidedBy, ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}) };
+}
+export function parkedOriginOf(cp) {
+    if (cp.pendingAction.kind === "tool_approval")
+        return isAskOrigin(cp.pendingAction.origin) ? cp.pendingAction.origin : undefined;
+    return cp.pendingAction.kind === "plan_review" ? "plan_review" : undefined;
+}
+export function mintDecideRecord(cp, facts, verdict) {
+    const origin = parkedOriginOf(cp);
+    if (origin === undefined) {
+        throw new CheckpointError("checkpoint.unsupported_version", "this checkpoint's pending approval carries no origin word (a row minted before the ask's origin was persisted on the park) — its settlement cannot be recorded; the checkpoint stays pending", { reason: "origin_missing" });
+    }
+    const settlement = settlementOfHostDecision(facts, verdict.allowed ? "allowed" : "refused", verdict.note);
+    return mintGateOutcome({ ...(verdict.allowed ? {} : { deniedBy: "ask_resolution" }), settled: { settlement, origin } });
+}
 export function assertOutcomeText(value, field) {
     if (value !== undefined && typeof value !== "string") {
         throw new CheckpointError("checkpoint.invalid_outcome", `resume \`${field}\` is not a plain string (got ${typeof value}) — a decide's text payload is an operator's plain data, not a live object; refusing pre-CAS, the checkpoint stays pending`);
@@ -82,7 +133,7 @@ function reorientClause(fullShellReachable) {
     return `Before continuing, ${source} to confirm what is already done, then continue the remaining work. ` +
         "Do NOT restart the task or re-run work that is already committed.";
 }
-export function resumeContinuation(resume, mark, fullShellReachable) {
+export function resumeContinuation(resume, mark, fullShellReachable, delegatedChild) {
     if (resume.outcome.gate === "wake") {
         return formatHookFeedback(`You were WOKEN from a parked pause by an operator. ${reorientClause(fullShellReachable)}`, mark);
     }
@@ -96,36 +147,40 @@ export function resumeContinuation(resume, mark, fullShellReachable) {
         return formatHookFeedback(`You were resumed after a dry-run review. ${verdict}. ${reorientClause(fullShellReachable)}`, mark);
     }
     if (resume.outcome.gate === "plan_review") {
+        const byWhom = resume.outcome.hostDecision.decidedBy === "policy" ? " by this deployment's own policy, not by a person" : "";
         if (resume.outcome.decision === "approve") {
-            return formatHookFeedback("Your proposed PLAN was REVIEWED and APPROVED. Proceed with that plan now — begin executing it. " +
+            return formatHookFeedback(`Your proposed PLAN was REVIEWED and APPROVED${byWhom}. Proceed with that plan now — begin executing it. ` +
                 "This is a RESUMED task; do NOT re-plan or restart from scratch, just carry out the approved plan.", mark);
         }
         if (resume.outcome.decision === "edit") {
             if (!resume.outcome.editedPlan) {
-                return formatHookFeedback("Your proposed PLAN was REVIEWED and EDITED, but no revised plan text was supplied — proceed with your " +
+                return formatHookFeedback(`Your proposed PLAN was REVIEWED and EDITED${byWhom}, but no revised plan text was supplied — proceed with your ` +
                     "ORIGINAL plan as-is, begin executing it now. This is a RESUMED task; do NOT re-plan or restart from scratch.", mark);
             }
-            return formatHookFeedback("Your proposed PLAN was REVIEWED and EDITED by a human reviewer. Proceed with the REVISED plan below " +
+            return formatHookFeedback(`Your proposed PLAN was REVIEWED and EDITED${byWhom || " by a human reviewer"}. Proceed with the REVISED plan below ` +
                 "(it supersedes your earlier plan); begin executing it now. This is a RESUMED task; do NOT re-plan " +
                 "or restart from scratch, just carry out the revised plan.\n\nThe REVISED plan to follow is:\n" +
                 delimitUntrusted("revised plan", resume.outcome.editedPlan), mark);
         }
-        const why = resume.outcome.reason ? ` Reviewer note: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : "";
-        return formatHookFeedback(`Your proposed PLAN was REVIEWED and REJECTED; it was NOT executed.${why} Produce a NEW plan that ` +
-            "addresses the concern, then continue. This is a RESUMED task — re-plan from the current state; do " +
-            "NOT execute the rejected plan.", mark);
+        const { reason } = resume.outcome;
+        const policyNote = decidersNote(reason);
+        return formatHookFeedback(resume.outcome.hostDecision.decidedBy === "person"
+            ? `${humanRefusalSentence("plan", reason, delegatedChild)} This is a RESUMED task; do NOT execute the rejected plan.`
+            : `Your proposed PLAN was REVIEWED and REJECTED${byWhom}; it was NOT executed.${policyNote === undefined ? "" : ` Reviewer note: ${delimitUntrusted("reviewer note", policyNote, REVIEWER_NOTE_MAX_BODY)}`} ` +
+                "This is a RESUMED task — re-plan from the current state; do NOT execute the rejected plan.", mark);
     }
     const { pendingAction } = resume.cp;
     if (pendingAction.kind !== "tool_approval") {
         return formatHookFeedback("This is a RESUMED task — continue from where you left off without restarting or re-running prior work.", mark);
     }
-    const decided = resume.outcome.decision === "allow"
+    const { decision, hostDecision } = resume.outcome;
+    const resumed = "This is a RESUMED task — every step before this point is already done and its results are in the conversation above. Do NOT restart the task or re-run any tool you already ran";
+    const carryOn = "; continue from this exact point, building on the existing results, and finish the remaining work.";
+    if (decision === "deny" && hostDecision.decidedBy === "person") {
+        return formatHookFeedback(`${humanRefusalSentence("tool use", resume.outcome.reason, delegatedChild)} ${resumed}${delegatedChild ? carryOn : "."}`, mark);
+    }
+    const decided = decision === "allow"
         ? "was APPROVED and has now been executed — its result is in the tool results above"
-        : resume.outcome.hostDecision.decidedBy === "policy"
-            ? "was DENIED by this deployment's own policy, not by a person — the refusal and its reason are in the tool results above"
-            : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}`;
-    return formatHookFeedback(`The pending tool call "${pendingAction.toolName}" ${decided}. ` +
-        `This is a RESUMED task — every step before this point is already done and its results are in the ` +
-        `conversation above. Do NOT restart the task or re-run any tool you already ran; continue from this ` +
-        `exact point, building on the existing results, and finish the remaining work.`, mark);
+        : `was DENIED ${hostDecision.decidedBy === "policy" ? "by this deployment's own policy" : "because its approval window elapsed with no answer"}, not by a person — the refusal and its reason are in the tool results above`;
+    return formatHookFeedback(`The pending tool call "${pendingAction.toolName}" ${decided}. ${resumed}${carryOn}`, mark);
 }

package/dist/core/runner/denial-limit-arms.d.ts

@@ -2,6 +2,7 @@ import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDen
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
+import { type Settlement } from "../gate-outcome.js";
 import { type EngineNotice } from "../types.js";
 import { type AskClass, type AskClassFacts, type AskClassification, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import type { Prepared, StopForDenialLimit } from "./contracts.js";
@@ -220,12 +221,23 @@ type ResolveJudgment<A extends InheritedAsk> = Extract<InheritedClassifierJudgme
 export declare function inheritedFallbackJudgment<A extends InheritedAsk>(ask: A, fallback: UnarmedDenialLimitFallback, latestBlockedAction: string, facts: AskClassFacts): ResolveJudgment<A>;
 /** One resolution of an inherited ask at its frozen approver (the three arms): a no-ruling card its POLICY refused counts
  *  ({@link settleNoRulingAsk}); at the bound the call is resolved again there as the fallback. Returns the judgment it answered. */
-export declare function resolveInheritedAsk<A extends InheritedAsk, R extends Pick<ResolvedAsk, "action" | "settlement">>(judged: ResolveJudgment<A>, resolveWith: (j: ResolveJudgment<A>) => Promise<R>, tracker: AutoModeDenialTracker | undefined, toolName: string, facts: AskClassFacts): Promise<{
-    resolved: R;
+export declare function resolveInheritedAsk<A extends InheritedAsk>(judged: ResolveJudgment<A>, resolveWith: (j: ResolveJudgment<A>) => Promise<ResolvedAsk>, tracker: AutoModeDenialTracker | undefined, call: {
+    toolCallId: string;
+    toolName: string;
+}, facts: AskClassFacts): Promise<{
+    resolved: ResolvedAsk;
     judged: ResolveJudgment<A>;
 }>;
-/** The resolver's answer as the settlement reads it. */
-export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;
+/** The resolver's answer as the settlement reads it: its action, the settlement its engine record names for the call, the routing marker. */
+export type FallbackResolution = {
+    action: ResolvedAsk["action"];
+    settlement?: Settlement;
+    approverUnavailable?: true;
+};
+export declare const fallbackResolutionOf: (r: ResolvedAsk, call: {
+    toolCallId: string;
+    toolName: string;
+}) => FallbackResolution;
 /** A deny nobody JUDGED, at a wrapper arm — read off the one table over the settlement words
  *  ({@link SETTLEMENT_NOBODY_JUDGED}) rather than listed here, so a word added to the set answers this
  *  question by getting a row and not by falling out of a disjunction. `approver_unavailable` is NOT
@@ -245,7 +257,7 @@ export declare function settleDenialLimitFallback(opts: {
     fallback: UnarmedDenialLimitFallback | undefined;
     mintedHere: boolean;
     tracker: AutoModeDenialTracker | undefined;
-    resolved: FallbackResolution;
+    resolved: ResolvedAsk;
     headless: (r: FallbackResolution) => boolean;
     stop: StopForDenialLimit;
     toolName: string;

package/dist/core/runner/denial-limit-arms.js

@@ -2,7 +2,7 @@ import { markTightenMessage } from "../safety-axis-vocab.js";
 import { classifierParseFailureDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, isAutoModeFallbackCause, rungDidNotRule, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
 import { classifierNoRulingArm, settleNoRulingAsk } from "../classifier-unavailable-arm.js";
-import { attestClassifierDenyCause, attestClassifierRound, carryEngineAttestations } from "../tool-policy.js";
+import { attest, attestationOf } from "../tool-policy.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -88,7 +88,7 @@ export async function judgeInheritedClassifier(opts) {
     const { autoMode, req } = opts;
     const facts = opts.facts ?? INHERITED_STATION_FACTS, m = facts.mandateMarks;
     const frames = [...(m.egress === true ? [markTightenMessage(req.toolName, "egress")] : []), ...(m.irreversibility === "always" ? [markTightenMessage(req.toolName, "irreversible")] : [])];
-    const ask = (frames.length > 0 ? carryEngineAttestations(opts.ask, { ...opts.ask, message: [opts.ask.message ?? inheritedAskFallbackMessage(req.toolName), ...frames].join(" — ") }) : opts.ask);
+    const ask = (frames.length > 0 ? { ...opts.ask, message: [opts.ask.message ?? inheritedAskFallbackMessage(req.toolName), ...frames].join(" — ") } : opts.ask);
     const origin = askOriginOf(ask, facts);
     const classification = classifyAsk(ask, facts);
     const classifierStandsDown = () => {
@@ -103,7 +103,7 @@ export async function judgeInheritedClassifier(opts) {
         .catch(() => ({ kind: "unavailable", cause: "error" }));
     if (verdict.kind === "allow" && classifierStandsDown())
         return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification };
-    const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
+    const attributed = (d) => (verdict.classifier !== undefined ? attest(d, req, { classifierRound: verdict.classifier }) : d);
     if (verdict.kind === "allow") {
         autoMode.denialTracking?.recordAllow();
         return { kind: "allow", result: attributed({ action: "allow", decisionReason: "classifier", ...(opts.allowRewrite !== undefined ? { updatedInput: opts.allowRewrite } : {}) }) };
@@ -123,23 +123,24 @@ export async function judgeInheritedClassifier(opts) {
             message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
             decisionReason: "classifier",
         };
-        return { kind: "deny", result: attributed(verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied) };
+        return { kind: "deny", result: attributed(verdict.kind === "parse_error" ? attest(denied, req, { classifierCause: "parse_error" }) : denied) };
     }
     return inheritedFallbackJudgment(ask, tracked.fallback, reason || category || req.toolName, facts);
 }
 export function inheritedFallbackJudgment(ask, fallback, latestBlockedAction, facts) {
     const { classifierNoRuling: _why, ...standing } = ask;
-    const minted = carryEngineAttestations(ask, { ...standing, message: denialLimitFallbackMessage(fallback, latestBlockedAction), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback });
+    const minted = { ...standing, message: denialLimitFallbackMessage(fallback, latestBlockedAction), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };
     return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, facts), classification: classifyAsk(minted, facts) };
 }
-export async function resolveInheritedAsk(judged, resolveWith, tracker, toolName, facts) {
+export async function resolveInheritedAsk(judged, resolveWith, tracker, call, facts) {
     const resolved = await resolveWith(judged);
-    const refallback = settleNoRulingAsk({ ask: judged.ask, mintedHere: judged.noRulingHere === true, resolved, tracker });
+    const refallback = settleNoRulingAsk({ ask: judged.ask, mintedHere: judged.noRulingHere === true, resolved: fallbackResolutionOf(resolved, call), tracker });
     if (refallback === undefined)
         return { resolved, judged };
-    const again = inheritedFallbackJudgment(judged.ask, refallback, toolName, facts);
+    const again = inheritedFallbackJudgment(judged.ask, refallback, call.toolName, facts);
     return { resolved: await resolveWith(again), judged: again };
 }
+export const fallbackResolutionOf = (r, call) => ({ action: r.action, settlement: attestationOf(r, call)?.settlement, ...(r.approverUnavailable === true ? { approverUnavailable: true } : {}) });
 export function headlessDenyAtFold(r) {
     return r.settlement !== undefined && SETTLEMENT_NOBODY_JUDGED[r.settlement.kind];
 }
@@ -147,9 +148,10 @@ export function headlessDenyAtRecheck(r) {
     return headlessDenyAtFold(r) || r.settlement?.kind === "approver_unavailable" || r.approverUnavailable === true;
 }
 export function settleDenialLimitFallback(opts) {
-    const { fallback, resolved } = opts;
+    const { fallback } = opts;
     if (fallback === undefined)
         return;
+    const resolved = fallbackResolutionOf(opts.resolved, opts);
     if (resolved.action === "allow") {
         if (opts.mintedHere)
             opts.tracker?.recordAllow();

package/dist/core/runner/extra-body-dropped-seat.d.ts

@@ -0,0 +1,8 @@
+import type { EngineNotice } from "../engine-notice.js";
+/** Where the announcement goes and whom it is attributed to — the same triple as the sibling `route.*` seats. */
+export interface ExtraBodyDroppedSeatInput {
+    onNotice: ((notice: EngineNotice) => void) | undefined;
+    sessionId: string;
+    runId: string;
+}
+export declare function createExtraBodyDroppedScope({ onNotice, sessionId, runId }: ExtraBodyDroppedSeatInput): <T>(fn: () => Promise<T>) => Promise<T>;

package/dist/core/runner/extra-body-dropped-seat.js

@@ -0,0 +1,22 @@
+import { runWithExtraBodyDropped } from "../../brain/status-sink.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+export function createExtraBodyDroppedScope({ onNotice, sessionId, runId }) {
+    const announced = new Set();
+    return (fn) => runWithExtraBodyDropped(({ api, modelId, keys }) => {
+        if (keys.length === 0)
+            return;
+        const set = `${api}\u0000${[...keys].sort().join("\u0000")}`;
+        if (announced.has(set))
+            return;
+        announced.add(set);
+        const many = keys.length > 1;
+        deliverEngineNotice(onNotice, {
+            code: "route.extra_body_reserved_dropped",
+            message: `The extraBody of a ${api} request sent as "${modelId}" carried ${many ? "keys" : "a key"} the engine sets itself — ` +
+                `${keys.map((k) => `"${k}"`).join(", ")} — and ${many ? "they were" : "it was"} dropped: the request went out ` +
+                `with the engine's own value${many ? "s" : ""} (or without ${many ? "them" : "it"}, where the engine sends none). Remove ${many ? "them" : "it"} from extraBody; ` +
+                `the same drop applies to every request that model spec is used on, and this notice is said once per run for this set of keys.`,
+            detail: { keys: [...keys], api, modelId, sessionId, runId },
+        });
+    }, fn);
+}

package/dist/core/runner/finish-reason-seat.d.ts

@@ -0,0 +1,9 @@
+import type { EngineNotice } from "../engine-notice.js";
+export interface FinishReasonSeat {
+    /** Observe one assistant message; announce each stream-end fact this leg has not announced yet. */
+    observe(message: unknown): void;
+}
+export declare function createFinishReasonSeat(onNotice: ((notice: EngineNotice) => void) | undefined, ids: {
+    sessionId: string;
+    runId: string;
+}): FinishReasonSeat;

package/dist/core/runner/finish-reason-seat.js

@@ -0,0 +1,40 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+import { readMember } from "../thrown-value.js";
+export function createFinishReasonSeat(onNotice, ids) {
+    const announced = new Set();
+    const once = (key) => {
+        if (announced.has(key))
+            return false;
+        announced.add(key);
+        return true;
+    };
+    return {
+        observe(message) {
+            const word = readMember(message, "finishReasonUnknown");
+            if (typeof word === "string" && once(`unknown\u0000${word}`)) {
+                deliverEngineNotice(onNotice, {
+                    code: "route.finish_reason_unknown",
+                    message: `The provider ended a response with "${word}", a finish reason this engine does not read. The turn was kept ` +
+                        `as the model left it, but the provider may have cut it short — the text above may be incomplete.`,
+                    detail: { finishReason: word, sessionId: ids.sessionId, runId: ids.runId },
+                });
+            }
+            const late = readMember(message, "streamEndIgnored");
+            const statement = readMember(late, "statement");
+            const lateWord = readMember(late, "word");
+            const frames = readMember(late, "frames");
+            if ((statement === "ending" || statement === "error" || statement === "content") &&
+                typeof lateWord === "string" &&
+                typeof frames === "number" &&
+                once(`late\u0000${statement}\u0000${lateWord}`)) {
+                const what = statement === "error" ? `an error "${lateWord}"` : statement === "ending" ? `the ending "${lateWord}"` : `${lateWord} content`;
+                deliverEngineNotice(onNotice, {
+                    code: "route.stream_end_ignored",
+                    message: `After the provider had already ended a response, its stream sent more (first: ${what}; ${frames} frame${frames === 1 ? "" : "s"} in all). ` +
+                        `The first ending stands; nothing after it was added to the turn.`,
+                    detail: { statement, word: lateWord, frames, sessionId: ids.sessionId, runId: ids.runId },
+                });
+            }
+        },
+    };
+}

package/dist/core/runner/gate-exit.d.ts

@@ -6,7 +6,7 @@
  *    refused, written once at the refusing site; WHAT was settled, written at the resolution site) and hands
  *    them here; the mint assembles the record, runs the invariant screen, and refuses a record the engine
  *    composed wrong. Every projection of the outcome (the deny observer's payload, the call's `tool_end`
- *    frame, the engine's per-call sideband) is the object minted here, never a re-derivation;
+ *    frame, the call's occurrence record) is the object minted here, never a re-derivation;
  *  - the settlement LEDGER of a pass ({@link createSettlementLedger}) — the one rule every attestation read
  *    goes through;
  *  - the PASS RECORD ({@link GatePass}) — the per-call cells the gate's station groups read and write, and
@@ -28,10 +28,12 @@ import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from ".
 import type { SafeNotifier } from "../safe-notify.js";
 import type { HookSeatOutcome, PermissionDeniedPayload, PreToolUseResult, ToolGateInput, ToolGateResult } from "../hooks.js";
 /** The ask a gate pass settled, as the gate captured it at its resolution site: the settlement the
- *  resolver composed and the origin word the ask carried. Both or neither (invariant I1). */
+ *  resolver composed and the origin word the ask carried. Both or neither (invariant I1). `licensed` is the engine record's
+ *  digest of the bytes the settlement licensed: the allow exit keeps a settlement only for the bytes that run. */
 export interface SettledAsk {
     settlement: Settlement;
     origin: AskOrigin;
+    licensed?: string;
 }
 /** The facts a gate pass hands the mint. `deniedBy` is present exactly when the pass refused; `cause` only
  *  beside it, when the refusing round was a classifier round that did not rule (the station's attestation,
@@ -62,43 +64,42 @@ export declare function mintGateOutcome(facts: GateExitFacts): GateOutcome;
 export declare function directDeny(deniedBy: Exclude<DeniedBy, "ask_resolution">): GateOutcome;
 /**
  * The gate's settlement LEDGER for one pass — the one place "which ask did this pass consume" is written,
- * with ONE rule for every attestation read (the main adjudication, the approval-edit re-check, the gate's
- * own ask resolutions), so the three sites cannot disagree about what an attested decision means:
- *  - an engine attestation on a decision object (the approval factory's wait ended inside a policy
- *    `check()`; an inherited lane resolved an ancestor's ask) is a settled ask of THIS call — read off the
- *    identity-keyed seat, never off a caller-composable member;
- *  - a deny carrying a REFUSAL attestation is the ask's own resolution (`ask_resolution`); a deny carrying a
- *    person's YES is a later layer's VETO (the yes stays on the settlement, the layer is the disposition —
- *    invariant I3);
+ * with ONE rule for every read, all through the decision's engine record ({@link attestationOf}):
+ *  - a record on an adjudication (the approval factory's wait ended inside a policy `check()`; an inherited
+ *    lane resolved an ancestor's ask) is a settled ask of THIS call — an approval only for the bytes it licensed (an
+ *    allow that runs other bytes runs unattributed); a deny carrying a REFUSAL record is the
+ *    ask's own resolution (`ask_resolution`), a deny carrying a person's YES is a later layer's VETO (the yes
+ *    stays on the settlement, the layer is the disposition — invariant I3), and an allow carrying a refusal
+ *    record is that refusal (invariant I4: the record says what ended the wait, whatever the decision claims);
+ *  - a resolution's record counts only when it answers THE ask the gate put to the resolver — its origin word,
+ *    its class set, the bytes the answer licenses (the record's `inputDigest`); a resolution
+ *    without such a record settled nothing the engine can attribute: a deny is recorded as the resolver's
+ *    out-of-contract refusal (`approver_contract`), an allow on a real-approval ask is refused, a plain allow
+ *    is a posture allow; a resolution still carrying the retired `settlement` member is refused loudly;
  *  - the LATEST resolution wins (a re-check refusal replaces the first approval; a re-approval renews it);
  *  - a SURVIVING ask supersedes any settlement read off an earlier decision (a tighten minted a new
  *    question; whoever resolves it settles it afresh).
- * For a resolver's object the attestation outranks the exposed member; the member is the fallback for a
- * resolver seat that composes without attesting (a hand-built resolver; the ask lane's own intercept
- * deny). TRUST BOUNDARY, stated: `ToolGateInput.resolveAsk` is wired by prepare from the engine's own
- * resolver — a wrapper that spreads a resolved object (dropping the identity-keyed attestation) and
- * REPLACES the member is inside the engine's trust line, not a deployment's; making the member
- * attestation-only is the follow-up that migrates the ask lane's composition and the test resolvers
- * onto an engine-owned mint.
  */
 export interface SettlementLedger {
     /** The ask this pass consumed, or undefined when no ask was settled (a direct deny, a plain allow). */
     readonly settled: SettledAsk | undefined;
     /** An engine-composed settlement the gate itself minted (the unshown content ask's refusal). */
     set(settled: SettledAsk): void;
-    /** Record an ask's resolution: the resolver's settlement beside the ask's own origin word. */
-    fromResolved(resolved: ResolvedAsk, asked: PermissionResult, toolName: string): void;
-    /** Read an adjudication's attestation. For a deny, returns the refusing layer word (`ask_resolution`
-     *  for an attested refusal, `policy` otherwise — a veto when a yes rides the settlement); undefined
-     *  for an allow or an ask. */
-    fromDecision(decision: PermissionResult): DeniedBy | undefined;
-    /** Read a deny's attested classifier CAUSE for this call (an inherited station's `unavailable` /
-     *  `parse_error` round travelling through an ancestor wrapper into this fold); undefined for a ruling
-     *  block, a non-classifier deny, an allow or an ask. */
+    /** Record an ask's resolution; returns the resolution the gate goes on with (the resolver's, or the engine's refusal). */
+    fromResolved(resolved: ResolvedAsk, asked: PermissionResult, req: ToolCallRequest): ResolvedAsk;
+    /** Read an adjudication's record; returns the decision the gate goes on with and, for a deny, the refusing layer word
+     *  (`ask_resolution` for a refusal record, `policy` otherwise — a veto when a yes rides the settlement). */
+    fromDecision(decision: PermissionResult): {
+        decision: PermissionResult;
+        deniedBy?: DeniedBy;
+    };
+    /** The allow exit: the bytes that RUN are decided — a settlement licensed for other bytes leaves the record (the call runs
+     *  unattributed). */
+    keepForBytes(runs: unknown): void;
+    /** A deny's recorded classifier CAUSE for this call (an inherited station's `unavailable` / `parse_error` outcome). */
     causeOf(decision: PermissionResult): ClassifierDenyCause | undefined;
-    /** Read a decision's attested CLASSIFICATION for this call — which model an ancestor's frozen classifier
-     *  asked and which answered, on the allow arm as much as the deny arm. Undefined when no inherited
-     *  classifier judged the call, or when the ancestor's decider could vouch for no name. */
+    /** A decision's recorded CLASSIFICATION for this call — which model an ancestor's frozen classifier asked and which
+     *  answered, on either arm. */
     classifierRoundOf(decision: PermissionResult): AutoModeClassifierRound | undefined;
     /** A surviving ask supersedes whatever an earlier decision settled. */
     supersede(): void;
@@ -116,6 +117,15 @@ export declare function createSettlementLedger(call: {
  * a non-object primitive passes through as-is (immutable anyway).
  */
 export declare function cloneObserverInput(input: unknown): unknown;
+/**
+ * The input a gate exit decided on, as the call's record keeps it ({@link ToolGateResult.finalInput}): a deep,
+ * FROZEN copy — never the live object the tool receives (a tool or a later layer writing into its own arguments
+ * must not rewrite what the gate decided), and never writable by a reader; the deny observer gets a writable
+ * {@link cloneObserverInput} of it. A graph `structuredClone` refuses (functions, handles) is kept as a shallow
+ * copy frozen at its own top level only — its members are the live arguments' own, and freezing those would
+ * freeze the call's input under the tool.
+ */
+export declare function frozenInputSnapshot(input: unknown): unknown;
 /**
  * The PreToolUse screening face as the gate's stations see it — the hook machinery of `runToolGate` (the seat
  * runner, the per-call seat bound, the fresh per-screening context, the result screen, the two fail-closed
@@ -297,9 +307,11 @@ export interface GatePass {
      *  on BOTH its arms (a write tool's target), and the fold's read station (a shell command's written targets,
      *  `ShellReadVerdict.writeProtected`). Reader: the lanes' mandate. */
     writeProtected?: true;
-    /** borrowed-mutable — the same judge could NOT RESOLVE the target: no automatic lane may answer the
-     *  ask. Writer and reader as above; the pair is mutually exclusive (one verdict per judgment). */
-    writeProtectionUnresolved?: true;
+    /** borrowed-mutable — the READING of a written target could not say where it leads on disk (a target a shell command's
+     *  program writes, placed, whose destination the read station could not resolve): no automatic lane may answer the ask.
+     *  A fact of the reading, not of a judge. Writer: the fold's read station (`ShellReadVerdict.targetUnresolved`). Reader:
+     *  the lanes' mandate. */
+    targetUnresolved?: true;
     /** borrowed-mutable — the rewrite remembered BEFORE a hook-ask promotion / tighten, re-applied on the
      *  approved path (a redaction is not cancelled because a person confirmed). Writer: the fold. Readers: the
      *  fold's probe and write-protection judges, the lanes, the allow exit. */