@sema-agent/core 7.47.0 → 7.49.0

package/dist/core/runner/gate-exit.js

@@ -2,7 +2,8 @@ import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
 import { askFaceOf, classifyAsk, headlessApprovalRemedy } from "../ask-origin.js";
 import { wireOf } from "../tool-name-readings.js";
 import { isProtectedWrite } from "../tool-registry.js";
-import { askUnresolvableCauseOf, classifierDenyCauseOf, classifierRoundOf, decisionText, engineSettlementOf } from "../tool-policy.js";
+import { attestationOf, decisionText } from "../tool-policy.js";
+import { boundInputHashOf } from "../canonical-json.js";
 import { askUnresolvableRemedySeat } from "../ask-unresolvable-notice.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
@@ -33,8 +34,27 @@ function releaseRecordOf(a) {
 export function directDeny(deniedBy) {
     return mintGateOutcome({ deniedBy });
 }
+const SETTLEMENT_IS_HUMAN = {
+    human_allowed: true,
+    human_refused: true,
+    approval_window_expired: false,
+    denial_limit_window_expired: false,
+    park_sla_expired: false,
+    no_approver: false,
+    approver_unavailable: false,
+    approver_error: false,
+    approver_contract: false,
+    presentation_failed: false,
+    blanket_allow_refused: false,
+    policy_allowed: false,
+    policy_refused: false,
+    task_aborted: false,
+};
+const licensedOf = (r) => (r.inputDigest !== undefined ? { licensed: r.inputDigest } : {});
+const sameClasses = (a, b) => a === undefined || b === undefined ? a === b : a.length === b.length && a.every((c, i) => c === b[i]);
 export function createSettlementLedger(call) {
     let settled;
+    const contractRefusal = (origin) => ({ settlement: { kind: "approver_contract", who: { party: "none" }, when: Date.now() }, origin });
     return {
         get settled() {
             return settled;
@@ -42,36 +62,78 @@ export function createSettlementLedger(call) {
         set(next) {
             settled = next;
         },
-        fromResolved(resolved, asked, toolName) {
+        fromResolved(resolved, asked, req) {
+            const record = attestationOf(resolved, call);
+            const retired = typeof resolved === "object" && resolved !== null && Object.hasOwn(resolved, "settlement");
             if (asked.action !== "ask" || asked.origin === undefined) {
-                if (resolved.settlement === undefined)
-                    return;
-                throw new Error(`an ask for "${toolName}" was resolved without an origin word — the origin stamp precedes every resolution`);
+                if (resolved.action === "allow" && record?.settlement === undefined && !retired)
+                    return resolved;
+                throw new Error(`an ask for "${call.toolName}" was resolved without an origin word — the origin stamp precedes every resolution`);
             }
-            const attested = engineSettlementOf(resolved, call);
-            if (attested !== undefined) {
-                settled = { settlement: attested.settlement, origin: asked.origin };
-                return;
+            const origin = asked.origin;
+            const refused = (message, by) => {
+                settled = by;
+                return { action: "deny", message, decisionReason: "mode" };
+            };
+            if (retired) {
+                return refused(`the resolution for "${call.toolName}" carries the retired "settlement" member — what ended a wait is an engine-minted record ` +
+                    `(\`attestation\`), never a resolver's member; denied fail-closed rather than recording a settlement nobody can attribute`, contractRefusal(origin));
             }
-            if (resolved.settlement === undefined)
-                return;
-            settled = { settlement: resolved.settlement, origin: asked.origin };
+            const edited = resolved.action === "allow" && resolved.updatedInput !== undefined;
+            const licensed = () => {
+                if (edited)
+                    return record.inputDigest === boundInputHashOf(resolved.updatedInput);
+                const askedDigest = boundInputHashOf(req.args);
+                return record.inputDigest === askedDigest && (resolved.presentedInput === undefined || boundInputHashOf(resolved.presentedInput) === askedDigest);
+            };
+            const bound = record?.settlement !== undefined && record.origin === origin && sameClasses(record.classes, asked.classes) ? record.settlement : undefined;
+            const refusal = bound !== undefined && SETTLEMENT_IS_REFUSAL[bound.kind] ? bound : undefined;
+            if (resolved.action === "allow") {
+                if (refusal !== undefined)
+                    return refused(`the resolution for "${call.toolName}" answered allow but its engine record names a refusal ("${refusal.kind}") — denied fail-closed`, { settlement: refusal, origin });
+                const answer = bound !== undefined && licensed() ? bound : undefined;
+                if (answer !== undefined) {
+                    if (asked.requiresRealApproval === true && !SETTLEMENT_IS_HUMAN[answer.kind]) {
+                        return refused(`approval required for "${call.toolName}" — this ask requires real approval; the resolution's engine record names an answer that is not a person's ("${answer.kind}") — denied fail-closed: ${asked.message ?? ""}`, contractRefusal(origin));
+                    }
+                    settled = { settlement: answer, origin, ...licensedOf(record) };
+                    return resolved;
+                }
+                if (asked.requiresRealApproval === true) {
+                    return refused(`approval required for "${call.toolName}" — this ask requires real approval and the resolution's allow carries no engine ` +
+                        `settlement record for it (an answer the engine cannot attribute to anyone); denied fail-closed: ${asked.message ?? ""}`, contractRefusal(origin));
+                }
+                return resolved;
+            }
+            if (resolved.action !== "deny")
+                return resolved;
+            settled = refusal !== undefined ? { settlement: refusal, origin } : contractRefusal(origin);
+            return resolved;
         },
         fromDecision(decision) {
             if (decision.action === "ask")
-                return undefined;
-            const attested = engineSettlementOf(decision, call);
-            if (attested !== undefined)
-                settled = { settlement: attested.settlement, origin: attested.origin };
-            if (decision.action !== "deny")
-                return undefined;
-            return attested !== undefined && SETTLEMENT_IS_REFUSAL[attested.settlement.kind] ? "ask_resolution" : "policy";
+                return { decision };
+            const record = attestationOf(decision, call);
+            const answer = record?.settlement !== undefined && record.origin !== undefined ? { settlement: record.settlement, origin: record.origin, ...licensedOf(record) } : undefined;
+            if (answer !== undefined)
+                settled = answer;
+            const refusal = answer !== undefined && SETTLEMENT_IS_REFUSAL[answer.settlement.kind];
+            if (decision.action === "allow") {
+                if (!refusal)
+                    return { decision };
+                return { decision: { action: "deny", message: `the decision for "${call.toolName}" says allow but its engine record names a refusal ("${answer.settlement.kind}") — denied fail-closed`, decisionReason: "rule" }, deniedBy: "ask_resolution" };
+            }
+            return { decision, deniedBy: refusal ? "ask_resolution" : "policy" };
+        },
+        keepForBytes(runs) {
+            if (settled !== undefined && settled.licensed !== boundInputHashOf(runs))
+                settled = undefined;
         },
         causeOf(decision) {
-            return decision.action === "deny" ? classifierDenyCauseOf(decision, call) : undefined;
+            return decision.action === "deny" ? attestationOf(decision, call)?.classifierCause : undefined;
         },
         classifierRoundOf(decision) {
-            return classifierRoundOf(decision, call);
+            return attestationOf(decision, call)?.classifierRound;
         },
         supersede() {
             settled = undefined;
@@ -90,6 +152,25 @@ export function cloneObserverInput(input) {
         return input;
     }
 }
+export function frozenInputSnapshot(input) {
+    try {
+        return deepFreeze(structuredClone(input));
+    }
+    catch {
+        return Object.freeze(Array.isArray(input) ? [...input] : input !== null && typeof input === "object" ? { ...input } : input);
+    }
+}
+function deepFreeze(value) {
+    if (value === null || typeof value !== "object" || Object.isFrozen(value))
+        return value;
+    Object.freeze(value);
+    for (const key of Reflect.ownKeys(value)) {
+        const d = Object.getOwnPropertyDescriptor(value, key);
+        if (d !== undefined && "value" in d)
+            deepFreeze(d.value);
+    }
+    return value;
+}
 const PARK_FAILURE_CAUSE_MAX = 600;
 function withParkFailureCause(reason, parkFailed) {
     if (parkFailed === undefined)
@@ -104,8 +185,9 @@ export function passAskFace(pass) {
 export async function engineFailClosedExit(pass, reason) {
     const { input, toolName, toolCallId, notifyPermissionDenied } = pass;
     const gate = directDeny("hook");
-    await notifyPermissionDenied({ toolName, input: cloneObserverInput(pass.currentInput), toolCallId, reason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
-    return { block: true, reason: formatHookFeedback(reason, input.reminderMark), gate, preToolContext: pass.preToolContext };
+    const finalInput = frozenInputSnapshot(pass.currentInput);
+    await notifyPermissionDenied({ toolName, input: cloneObserverInput(finalInput), toolCallId, reason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+    return { block: true, reason: formatHookFeedback(reason, input.reminderMark), gate, finalInput, preToolContext: pass.preToolContext };
 }
 export function hookDenyExit(pass, deniedReason) {
     const { input } = pass;
@@ -113,6 +195,7 @@ export function hookDenyExit(pass, deniedReason) {
         block: true,
         reason: formatHookFeedback(deniedReason, input.reminderMark),
         gate: directDeny("hook"),
+        finalInput: frozenInputSnapshot(pass.currentInput),
         preToolContext: pass.preToolContext,
     };
 }
@@ -141,7 +224,7 @@ export async function exitGate(pass) {
             ledger.supersede();
         }
         const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(modeRefusal !== undefined ? { modeRefusal: { mode: modeRefusal.mode, askClass: modeRefusal.askClass, classes: modeRefusal.classes } } : {}) });
-        const foldCause = askUnresolvableCauseOf(pass.decision, { toolCallId, toolName });
+        const foldCause = attestationOf(pass.decision, { toolCallId, toolName })?.unresolvableCause;
         const unresolvable = foldCause ?? unresolvableCauseOfSettlement(gate);
         const tableSeat = unresolvable !== undefined ? askUnresolvableRemedySeat(unresolvable) : undefined;
         const remedySeat = tableSeat === "absent" && input.askSeatForm === "declared_none" && pass.askClassification?.classes.has("content_question") !== true ? "declared_none" : tableSeat;
@@ -151,9 +234,10 @@ export async function exitGate(pass) {
             const cause = unresolvable;
             pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined, ...(remedy !== undefined ? { remedy } : {}) }), "toolGate.onAskUnresolvable");
         }
+        const finalInput = frozenInputSnapshot(pass.currentInput);
         await notifyPermissionDenied({
             toolName,
-            input: cloneObserverInput(pass.currentInput),
+            input: cloneObserverInput(finalInput),
             toolCallId,
             reason: denyReason,
             gate,
@@ -163,6 +247,7 @@ export async function exitGate(pass) {
             block: true,
             reason: formatHookFeedback(denyReason, input.reminderMark),
             gate,
+            finalInput,
             ...(() => {
                 const details = pass.denyDetails ?? (modeRefusal !== undefined ? undefined : pass.shellReadDetails);
                 return details !== undefined ? { details } : {};
@@ -175,11 +260,13 @@ export async function exitGate(pass) {
         if (rw !== undefined)
             pass.currentInput = rw;
     }
+    ledger.keepForBytes(pass.currentInput);
     const release = pass.arbitration?.kind === "released" ? pass.arbitration : (() => { if (ledger.settled !== undefined)
         return undefined; const a = pass.arbitration === undefined ? input.ancestorArbitrationOf?.(toolCallId) : undefined; return a?.kind === "released" ? a : undefined; })();
     return {
         updatedInput: pass.currentInput === event.input ? undefined : pass.currentInput,
         gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(release !== undefined ? { released: releaseRecordOf(release) } : {}) }),
+        finalInput: frozenInputSnapshot(pass.currentInput),
         preToolContext: pass.preToolContext,
     };
 }

package/dist/core/runner/inherited-ask-grants.js

@@ -1,5 +1,6 @@
 import { primaryActivityArg } from "../arg-summary.js";
-import { askApproverIdentity, carryEngineAttestations } from "../tool-policy.js";
+import { askApproverIdentity, attest, attestationOf } from "../tool-policy.js";
+import { boundInputHashOf } from "../canonical-json.js";
 export function askGrantCovers(granted, asked) {
     return asked !== undefined && asked.length > 0 && granted.length > 0 && asked.every((c) => c === "ordinary" || granted.includes(c));
 }
@@ -30,7 +31,8 @@ export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision
         ...(toolArg !== undefined ? { toolArg } : {}),
     });
     const reused = { action: "allow", presentedInput: grant.presented };
-    if (grant.settled !== undefined)
-        carryEngineAttestations(grant.settled, reused);
-    return reused;
+    const settlement = attestationOf(grant.settled, req)?.settlement;
+    if (settlement === undefined || decision.action !== "ask")
+        return reused;
+    return attest(reused, req, { settlement, ...(decision.origin !== undefined ? { origin: decision.origin } : {}), ...(decision.classes !== undefined ? { classes: decision.classes } : {}), inputDigest: boundInputHashOf(grant.presented) });
 }

package/dist/core/runner/mcp-redial.d.ts

@@ -31,9 +31,9 @@ export interface McpRosterDelta {
 /** The seats a roster application writes through. Every one of them is borrowed from the phase that
  *  minted it — this module owns nothing. */
 export interface McpRosterApplyInput {
-    /** borrowed-readonly — the frozen tool face; `exclude` keeps a deployment-excluded tool from ever
-     *  being re-mounted by a face the model or a host can trigger. */
-    toolFaceSnapshot: Pick<ToolFaceSnapshot, "exclude">;
+    /** borrowed-readonly — the frozen tool face; its selector keeps a tool the leg may not use from ever
+     *  being mounted by a face the model or a host can trigger. */
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector">;
     /** borrowed-readonly — the per-server face overlay (the phase's `withFaces`). */
     withFaces: (tools: AgentTool[], server: string) => AgentTool[];
     /** borrowed-readonly — the large-result wrapper every protocol tool is mounted through. */

package/dist/core/runner/mcp-redial.js

@@ -2,9 +2,8 @@ import { deliverEngineNotice } from "../types.js";
 import { thrownText } from "../thrown-value.js";
 export function applyMcpRosterDelta(input, delta) {
     const { toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes, toolEffects, axisExplicitNegatives, roster } = input;
-    const excludedSet = new Set(toolFaceSnapshot.exclude ?? []);
-    const pushable = delta.tools.filter((t) => !excludedSet.has(t.name));
-    const excluded = delta.tools.filter((t) => excludedSet.has(t.name)).map((t) => t.name);
+    const pushable = delta.tools.filter((t) => toolFaceSnapshot.selector.admits(t));
+    const excluded = delta.tools.filter((t) => !toolFaceSnapshot.selector.admits(t)).map((t) => t.name);
     const domainSnapshot = (m) => new Map([...m].filter(([name]) => name.startsWith(delta.prefix)));
     const restoreDomain = (m, snap) => {
         for (const name of [...m.keys()])
@@ -20,7 +19,7 @@ export function applyMcpRosterDelta(input, delta) {
     for (const name of priorDomainNegatives.keys())
         axisExplicitNegatives.delete(name);
     try {
-        foldProtocolAxes(delta.axes.filter((a) => !excludedSet.has(a.name)), "MCP");
+        foldProtocolAxes(delta.axes.filter((a) => !excluded.includes(a.name)), "MCP");
     }
     catch (foldErr) {
         restoreDomain(toolEffects, priorDomainEffects);

package/dist/core/runner/park-commit.d.ts

@@ -33,7 +33,7 @@ export declare const DEFAULT_UNATTENDED_APPROVAL_TTL_MS: number;
  * A caller-supplied TTL is only a TTL if it is a finite, positive number.
  * `TaskSpec.durableApproval.ttlMs` / `resourceSuspend.ttlMs` are typed as a bare `number`, and the mint
  * arithmetic was `Date.now() + ttlMs` with NO validation — so `Number(process.env.APPROVAL_TTL_MS)` on an
- * unset/malformed env var (a config-center miss, an upstream arithmetic slip) silently produced
+ * unset/malformed env var (a web-admin miss, an upstream arithmetic slip) silently produced
  * `deadline = NaN`. Every reaper comparison is `deadline <= cutoff`, and `NaN <= anything` is FALSE, so a
  * checkpoint that LOOKS bounded (it carries a ttlMs and a deadline) became permanently IMMORTAL: no reap
  * cutoff, however far in the future, could ever expire it → a pinned session + a stranded paused VM, and

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -34,8 +34,7 @@ import { type HeadLeads } from "../path-rule-binding.js";
 import type { ToolCallLike } from "../tool-registry.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
 import { type EffectivePermissionRules, type PermissionRuleStoreProvider } from "../permission-rule-provider.js";
-/** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for it and the
- *  name tools). The PATH and NAME grammars' tools are derived (`ruleToolGrammarOf`). */
+/** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for it and the name tools); the other grammars' tools are derived (`ruleToolGrammarOf`). */
 export declare const PERSISTED_RULE_TOOL = "Bash";
 /**
  * The evidence an INHERITED-lane ask carries.

package/dist/core/runner/permission-rule-lanes.js

@@ -1,8 +1,7 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, faceAskSpeaksFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
-import { isAbsolutePathForm } from "../../tools/fs/safety.js";
-import { callTargetViewsOf } from "../effective-path-target.js";
+import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, domainRuleSubjectOf, faceAskSpeaksFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
+import { callTargetViewsOf, validatePath } from "../effective-path-target.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
 import { orgRuleVerdictFor, settleOrgVerdictWithin } from "../permission-rule-org.js";
@@ -81,7 +80,7 @@ export function orgVerdictBeforeClaim(cfg, req) {
 }
 export function createPermissionRuleLanes(cfg) {
     const provider = cfg.provider;
-    if (cfg.home !== undefined && !isAbsolutePathForm(cfg.home)) {
+    if (cfg.home !== undefined && validatePath(cfg.home, { intent: "validate-coordinate" }) === undefined) {
         const e = new Error(`the execution environment declares homeDir ${JSON.stringify(cfg.home)}, which is not an absolute path — a \`~/\` permission rule could not be resolved against it; declare an absolute home directory or none`);
         e.code = "config.execution_env_home_dir_invalid";
         throw e;
@@ -163,6 +162,8 @@ export function createPermissionRuleLanes(cfg) {
             return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, anchorsOf, leads, ...scope });
         if (grammar === "name")
             return persistedRuleAnswerOf(adjudicatePersistedNameRules(table, { tool: req.toolName, name: nameRuleSubjectOf(req.toolName, req.args), cwd: cfg.root, sessionId: cfg.sessionId, ...scope }));
+        if (grammar === "domain")
+            return persistedRuleAnswerOf(adjudicatePersistedDomainRules(table, { tool: req.toolName, host: domainRuleSubjectOf(req.toolName, req.args), cwd: cfg.root, sessionId: cfg.sessionId, ...scope }));
         const command = req.args?.command;
         if (typeof command !== "string")
             return undefined;

package/dist/core/runner/prepare-artifact.d.ts

@@ -22,6 +22,7 @@ import type { ContainmentFace } from "../../tools/fs/index.js";
 import type { PlacedReadDenyMatcher } from "../../tools/fs/read-deny-home.js";
 import { type ArtifactStoreRef } from "./read-root-grant.js";
 import type { Prepared } from "./contracts.js";
+import type { ToolOccurrenceTable } from "./tool-occurrence.js";
 export interface PrepareArtifactInput {
     /** borrowed-readonly — the deployment's hosting seat and the notice sink the refusal arm announces on. */
     deps: Pick<RunnerDeps, "artifactHost" | "onNotice" | "tracer">;
@@ -36,6 +37,9 @@ export interface PrepareArtifactInput {
     /** borrowed-readonly — the run's effective approver (`spec.onAsk ?? deps.onAsk`, the seat the tool gate resolves at):
      *  the tool's shared-read consent gate rides it as a mount dep (a core mount's execute ctx is minimal). */
     onAsk: OnAsk | undefined;
+    /** borrowed-mutable — the leg's occurrence table: a consent the tool asks DURING its execution is a wait on the person
+     *  for that call, counted through the table's one bracket (each confirmation one entry and one exit). */
+    toolOccurrences: ToolOccurrenceTable;
     /** borrowed-readonly — the leg's live permission-mode seat; the tool's shared-read consent gate arbitrates at it before
      *  the approver is consulted (a released read is delivered, undisclosed to nobody: the gate records it). */
     permissionMode: PermissionModeController;

package/dist/core/runner/prepare-artifact.js

@@ -11,7 +11,7 @@ import { emitTrace } from "../trace.js";
 import { createArtifactTool } from "../../tools/artifact/artifact-tool.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareArtifact(input) {
-    const { deps, runId, taskId, sessionId, agentName, onAsk, permissionMode, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames, artifactStoreRef } = input;
+    const { deps, runId, taskId, sessionId, agentName, onAsk: approver, toolOccurrences, permissionMode, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames, artifactStoreRef } = input;
     const host = deps.artifactHost;
     if (host === undefined)
         return { artifactPlane: undefined };
@@ -66,6 +66,7 @@ export function prepareArtifact(input) {
             return { ok: false, reason: "too_large", size: r.value.byteLength, limit: maxBytes, judgedOn: "bytes" };
         return { ok: true, key: rk.key, bytes: r.value };
     };
+    const onAsk = typeof approver === "function" ? (req, signal) => toolOccurrences.whileAwaitingUser(req.toolCallId, () => approver(req, signal)) : approver;
     const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile, ...(onAsk !== undefined ? { onAsk } : {}), permissionMode: () => permissionMode.current, ...(deps.onNotice !== undefined ? { onNotice: deps.onNotice } : {}) });
     roster.mount(firstPartyOffload(defineTool(artifactSpec)), { source: "builtin", mountedBy: "optional" });
     envHandToolNames.add(ARTIFACT_TOOL_NAME);

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -36,6 +36,8 @@ export interface PrepareAskLaneInput {
     stampCallTarget: CallTargetStamp | undefined;
     /** borrowed-readonly — the run's advertised-writable-directory seat, or undefined (hands-less / nothing advertised). `roots` is read at RUN time, never captured: it is the fence's own admitted list and the write gate's exemption domain must be that same list. Not written here. */
     advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
+    /** borrowed-readonly — the leg's ONE exempt root, stamped on every request a policy judges (`ToolCallRequest.exemptRoots`). */
+    exemptRoots: readonly string[];
     /** borrowed-readonly — the shared mount roster; read at RUN time by the approval-preview projection (alias-aware
      *  lookup over whatever the roster holds when the ask is minted). Never mutated here. */
     tools: readonly AgentTool[];

package/dist/core/runner/prepare-ask-lane.js

@@ -1,9 +1,11 @@
 import { cardDisclosureOf } from "../allow-entry.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { hookSeatExpiredError, runHookSeat } from "../hooks.js";
-import { advertisedWritableRootsSeat, isLiveApproverSeat, resolveAsk } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, exemptRootsSeat, attest, attestationOf, isLiveApproverSeat, resolveAsk } from "../tool-policy.js";
+import { boundInputHashOf } from "../canonical-json.js";
 import { composeCallSignal, raceAbort } from "./abort-race.js";
 import { askMandateMember } from "../ask-origin.js";
+import { approvalCardMemberOf } from "../tool-roster.js";
 import { gateAskCarry, lateAskSettlementObserver } from "./denial-limit-arms.js";
 import { consumeInheritedAskGrant } from "./inherited-ask-grants.js";
 import { settleReadRootGrant } from "./read-root-grant.js";
@@ -59,14 +61,14 @@ function resolveApprovalPreview(tools, toolName, args) {
     }
 }
 export function prepareAskLane(input) {
-    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
+    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, advertisedWritableDirs, exemptRoots, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
     if (!gateMachineryActive)
         return { askLane: undefined };
     const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
     const adjudicate = effectivePolicy
         ? (req, callSignal) => {
             const signal = composedCallSignal(callSignal);
-            const stampedReq = () => ({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...(handsRoot !== undefined ? { root: handsRoot } : {}), ...advertisedWritableRootsSeat(advertisedWritableDirs) });
+            const stampedReq = () => ({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...(handsRoot !== undefined ? { root: handsRoot } : {}), ...advertisedWritableRootsSeat(advertisedWritableDirs), ...exemptRootsSeat(exemptRoots) });
             const withReading = stampCallTarget?.(stampedReq(), signal);
             return raceAbort(withReading === undefined ? Promise.resolve(effectivePolicy.check(stampedReq(), signal)) : withReading.then((r) => effectivePolicy.check(r, signal)), signal, () => ({
                 action: "deny",
@@ -77,15 +79,18 @@ export function prepareAskLane(input) {
     const approvalPreviewOf = (toolName, args) => resolveApprovalPreview(tools, toolName, args);
     const resolveAskBound = async (decision, req, callSignal) => {
         if (inheritedUnavailableAsks.delete(req.toolCallId)) {
-            return {
+            const intercepted = {
                 action: "deny",
                 message: `approval for "${req.toolName}" requires an ancestor task's approval that cannot be resolved here ` +
                     `(no live approver reachable, or a durable-park mandate applies), and no durable approval park is ` +
                     `available — denied fail-closed (the inherited constraint stands).`,
                 decisionReason: "mode",
-                settlement: { kind: "approver_unavailable", who: { party: "none" }, when: now() },
                 approverUnavailable: true,
             };
+            const settlement = { kind: "approver_unavailable", who: { party: "none" }, when: now() };
+            return decision.action === "ask"
+                ? attest(intercepted, req, { settlement, ...(decision.origin !== undefined ? { origin: decision.origin } : {}), ...(decision.classes !== undefined ? { classes: decision.classes } : {}), inputDigest: boundInputHashOf(req.args) })
+                : attest(intercepted, req, { settlement, inputDigest: boundInputHashOf(req.args) });
         }
         const grantReuse = consumeInheritedAskGrant(inheritedAskGrants, onAsk, humanReviewRef, decision, req);
         if (grantReuse !== undefined)
@@ -104,6 +109,7 @@ export function prepareAskLane(input) {
             ...cardDisclosureOf(decision, `approval required for "${req.toolName}"`),
             ...askSourceIdentity(),
             ...riskAxesOf(req),
+            ...approvalCardMemberOf(req),
             ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(decision.action === "ask" ? askMandateMember(decision) : {}),
             ...(decision.action === "ask" ? gateAskCarry(decision, isLiveApproverSeat(onAsk), autoModeDenialTracking.current) : {}),
@@ -116,7 +122,7 @@ export function prepareAskLane(input) {
         const granting = settleReadRootGrant(resolved.readRootGrant, grantReadRoot, { toolName: req.toolName, toolCallId: req.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, signal: composedCallSignal(callSignal) });
         if (granting !== undefined)
             await granting;
-        if (resolved.approverUnavailable !== true && resolved.settlement?.kind !== "task_aborted") {
+        if (resolved.approverUnavailable !== true && attestationOf(resolved, req)?.settlement?.kind !== "task_aborted") {
             humanReviewRef.count += 1;
             humanReviewRef.totalWaitMs += waitMs;
             const toolArg = primaryActivityArg(req.args);

package/dist/core/runner/prepare-boundary-parks.d.ts

@@ -26,12 +26,15 @@ export interface PrepareBoundaryParksInput {
      *  absent). Called at park time; never rebuilt here. */
     saga: SuspendSaga | undefined;
     /** borrowed-readonly — the REBOUND spec. Read: `resourceSuspend` (the slice scope/ttl/maxSlices), `retainBackgroundProcesses`
-     *  (the park-only sweep gate), `durableApproval` (the review pause's ttl), `principal` (the rows' identity record and
-     *  the review scope). Never mutated. */
+     *  (the park-only sweep gate), `durableApproval` (the review pause's ttl), `principal` (the rows' identity record).
+     *  Never mutated. */
     spec: Pick<TaskSpec, "resourceSuspend" | "retainBackgroundProcesses" | "durableApproval" | "principal">;
     /** borrowed-readonly — the leg's checkpoint store, or undefined (then the review lane is absent and the resource mint
      *  answers false). */
     checkpointStore: CheckpointStore | undefined;
+    /** borrowed-readonly — this leg's checkpoint scope (the driver's one `checkpointScopeOf` derivation): the `plan_review`
+     *  row's scope, and the resource row's when the caller declared no slice scope of its own. */
+    checkpointScope: string;
     /** borrowed-mutable — prepare's abort seat. `.signal` is read (a cancelling run mints nothing); `abort()` is called on
      *  the review lane's commit (the review pause stops the run the human gate's way). */
     abortController: {
@@ -72,12 +75,6 @@ export interface PrepareBoundaryParksInput {
     liveSpendRef: Prepared["liveSpendRef"];
     /** borrowed-readonly — the injectable wall clock (the review pause's `suspendedAt`). */
     now: () => number;
-    /** borrowed-readonly — the inherited-gate phase's three version-stamp predicates (face / F-012 / org admission). */
-    faceCheckpointState: () => boolean;
-    /** borrowed-readonly — see `faceCheckpointState`. */
-    f012CheckpointState: () => boolean;
-    /** borrowed-readonly — see `faceCheckpointState`. */
-    orgAdmissionCheckpointState: () => boolean;
     /** borrowed-mutable — the run's committed-pause holder (`Prepared.pausedRef`). Writer here: the commit-side publication
      *  of a committed resource / platform / plan-review checkpoint. */
     pausedRef: Prepared["pausedRef"];

package/dist/core/runner/prepare-boundary-parks.js

@@ -1,11 +1,10 @@
 import { hasBackgroundShell, sweepBackgroundShells, sweepRunBoundaryBackgroundShells } from "../background-shell.js";
-import { checkpointVersionFor, debitLedger, mintCheckpointId, mintCheckpointToken, } from "../checkpoint-store.js";
+import { debitLedger, mintCheckpointId, mintCheckpointToken, } from "../checkpoint-store.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { checkpointScopeOf } from "./checkpoint-scope.js";
 import { DEFAULT_RESOURCE_TTL_MS, publishCommittedSuspend, sanitizedTtlMs, USAGE_WINDOW_REAP_MARGIN_MS } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
 export function prepareBoundaryParks(input) {
-    const { saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter } = input;
+    const { saga, spec, checkpointStore, checkpointScope, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter } = input;
     if (saga === undefined)
         return { suspendForResource: undefined, suspendForPlatformLimit: undefined, suspendForReview: undefined };
     const { inFlightSpendMicroUsd, serializeCheckpointState, commitSuspendSaga, suspendLoopCapHit, suspendableEnv, parkOnlyRemoteEnv, parkOnlyHandle } = saga;
@@ -13,7 +12,7 @@ export function prepareBoundaryParks(input) {
         const rs = spec.resourceSuspend;
         if (!checkpointStore)
             return false;
-        const scope = rs?.scope ?? checkpointScopeOf(spec);
+        const scope = rs?.scope ?? checkpointScope;
         if (abortController.signal.aborted)
             return false;
         if (suspendLoopCapHit(priorLedger?.sliceCount ?? 0, maxSlices, " (resource slice limit)"))
@@ -47,7 +46,6 @@ export function prepareBoundaryParks(input) {
         const cp = {
             token,
             checkpointId: mintCheckpointId(),
-            version: checkpointVersionFor({ resource: true, binding: false, token: resourceLedgerOut.totalTokens !== undefined, orgAdmission: orgAdmissionCheckpointState(), f012: f012CheckpointState(), realApproval: false, face: faceCheckpointState() }),
             scope,
             sessionId,
             leafId,
@@ -124,14 +122,13 @@ export function prepareBoundaryParks(input) {
                 remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
             }
             const token = mintCheckpointToken();
-            const scope = checkpointScopeOf(spec);
+            const scope = checkpointScope;
             const gate = { kind: "plan_review", reason: reason ?? `plan review requested` };
             const reviewLedger = debitLedger(priorLedger, liveSpendRef.get?.() ?? { costMicroUsd: 0, tokens: 0, turns: 0, walltimeMs: 0 }, resourceTotal, { countSlice: false });
             const mintedAt = Date.now();
             const cp = {
                 token,
                 checkpointId: mintCheckpointId(),
-                version: checkpointVersionFor({ resource: false, binding: true, token: reviewLedger.totalTokens !== undefined, orgAdmission: orgAdmissionCheckpointState(), f012: f012CheckpointState(), realApproval: false, face: faceCheckpointState() }),
                 scope,
                 sessionId,
                 leafId,

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -30,23 +30,24 @@ import { type CheckpointSeat } from "../checkpoint-seat.js";
 import { type ComplianceCapability } from "../compliance.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { StoredSession } from "../session.js";
-import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
+import type { RunnerDeps, RuntimeCaps, TaskEvent, ToolExecuteContext } from "../types.js";
 import type { AutoModeArmFact } from "../wiring-manifest.js";
 import type { AssertAllKeysHandled } from "../ask-origin.js";
-import type { ContainmentFace } from "../../tools/fs/index.js";
+import { type ChildClampSource } from "../child-clamp-seats.js";
 import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
 import { RosterBuilder } from "../tool-roster.js";
 import type { ParentSpecSeat } from "../parent-spec-seat.js";
+import { type RosterSpec } from "./caller-roster.js";
 export interface PrepareCapsAndWorkflowInput {
     /** borrowed-readonly — the REBOUND spec, whole: the roster map reads `tools`; the mounts read `enableBlockedReport`,
      *  `enablePlanMode`, `interactiveTools`; the caps/compliance stations read `principal`, `selfOrchestration`,
      *  `enableFork`, `getApiKeyAndHeaders`; the Workflow mount forwards `handsReadOnly`, `interactiveTools`. The
-     *  self-orchestration predicate takes the whole spec. Never mutated. */
-    spec: TaskSpec;
+     *  self-orchestration predicate takes the whole spec. Never mutated. Typed as a spec whose roster is snapshot faces. */
+    spec: RosterSpec;
     /** borrowed-readonly — the deployment seats, whole: `runtimeCapsResolver`, `compliancePostureResolver`, `onError`, `onNotice`,
      *  `autoMode`, `brain`, `models`, and the Workflow mount's dozen deps (`workflowScriptRunner`,
-     *  `workflowGovernanceBaseline`, `workflowRunStore`, `workflowJournalStore`, `workflowScriptStore`, `builtinWorkflows`,
+     *  `workflowGovernanceBaseline`, `workflowRunStore`, `workflowJournalStore`, `workflowScriptStore`,
      *  `onWorkflowAgentSpawn`, `workflowCompletionNotifier`, `workflowLimits`, `agents`, `builtinAgents`, `onBackgroundChildEvent`).
      *  The self-orchestration predicate takes the whole record. */
     deps: RunnerDeps;
@@ -87,13 +88,11 @@ export interface PrepareCapsAndWorkflowInput {
     harnessRef: {
         current?: AgentHarness;
     };
-    /** borrowed-readonly — the run's approval seat as the config doors froze it (the Workflow mount's parentOnAsk / parentApprovalReach). */
+    /** borrowed-readonly — the run's approval seat as the config doors froze it (the Workflow mount's parentOnAsk). */
     askSeat: import("../wiring-manifest.js").AskSeat;
     /** borrowed-readonly — the parent SPEC seat the children inherit (minted once by the inherited-gate phase; the Workflow mount's dep, the same value the delegation ctx carries). */ parentSpecSeat: ParentSpecSeat;
-    /** borrowed-readonly — the ONE read-face carrier expression (the Workflow mount's parentReadFace getter calls it). */
-    carrierReadFace: () => ContainmentFace | undefined;
-    /** borrowed-readonly — the same carrier expression on the WRITE seat. */
-    carrierWriteFace: () => ContainmentFace | undefined;
+    /** borrowed-readonly — the run's clamp source (minted once by the inherited-gate phase; the Workflow mount's `parentClamps`, the same source the delegation ctx carries). */
+    runClampSource: () => ChildClampSource;
     /** borrowed-readonly — the filtered display-forwarding wrapper (the Workflow mount's forwardEvent; absent ⇒ no key). */
     forwardEvent: ((e: TaskEvent) => void) | undefined;
     /** borrowed-readonly — the child-chain assembly (the Workflow mount's inheritedGateForChildren). */
@@ -128,6 +127,8 @@ export interface PrepareCapsAndWorkflowInput {
     };
     /** borrowed-readonly — the peer lane's mount verdict (the classifier's cross-session rule fills only while mounted). */
     peerLaneActive: boolean;
+    /** borrowed-readonly — the leg's effective delegation fact (`effectiveDelegationFacts`): the classifier window shows its user lane as the launching agent's. */
+    delegated: boolean;
     /** borrowed-readonly — whether the BUILT-IN SendMessage is on this face (the lane rule's second term). */
     peerSendMessageBuiltIn: boolean;
     /** borrowed-readonly — the trusted Runner self-reference the Workflow mount executes children through; undefined when
@@ -140,11 +141,6 @@ export interface PrepareCapsAndWorkflowInput {
         artifact: PromptEpochArtifact;
         sourceRevision?: string;
     } | undefined;
-    /** borrowed-readonly — LATE-BOUND: the normalized deny additions; the Workflow mount's parentReadDenyPatterns getter reads it at call time. */
-    readDenyAdditionsNormalized: () => ReadonlyArray<{
-        pattern: string;
-        caseSensitive: boolean;
-    }>;
 }
 export interface PrepareCapsAndWorkflowResult {
     /** owned — THE run's roster BUILDER (the mount array is private to it; `Prepared.tools` is its read face,