@sema-agent/core 7.48.0 → 7.49.0

package/dist/core/child-clamp-seats.d.ts

@@ -1,84 +1,240 @@
 /**
- * The TIGHTEN-ONLY CLAMP SEATS an engine-built child spec carries from the run that builds it — and the
- * ONE carrier every such constructor passes them through.
+ * The TIGHTEN-ONLY SEATS of a TaskSpec — the ONE table that says which seats only tighten, which value of each is the
+ * restricting one, how two declarations of a seat compose, and which carrier hands it to an engine-built child. Every
+ * reader reads the table: the public merge ({@link import("./tighten-task-spec.js").tightenTaskSpec}), the child-spec
+ * carrier ({@link childClampSeats}), the run's trusted ctx seats and the workflow mount (one {@link ChildClampSource}
+ * minted per prepare), and a revival's fold of the waker's restrictions ({@link clampValuesOf}). A row added here
+ * reaches all of them; a reader that spells a seat by hand is named by `scripts/verify-child-clamp-seats.mjs`.
  *
- * Why a carrier and not a convention. The engine builds child specs in several places (the delegation
- * lane, the observer sidecar, the wake/revival fold, the teacher's internal legs, the verify gate's two
- * legs, the workflow lane), and each re-deriving per seat WHICH value is the tightening one lands a new
- * seat one constructor at a time — the ones it does not reach staying invisible, since a `grep readFace`
- * census cannot see a station that carries the face through a persisted seed or a synthesized fold.
+ * Two mechanical halves keep it whole:
+ *  · the COMPILER — {@link ChildClampSource} requires every clamp-carrier row as a PRESENT key, so a site that builds a
+ *    source by hand cannot drop a row;
+ *  · the SCAN — the gate reads this table literally, requires each registered constructor to go through the carrier,
+ *    requires the published carriers (`ToolExecuteContext`, `ParentSpecSeat`) to declare exactly the rows they carry,
+ *    and names any hand-written restricting projection outside the carriers.
  *
- * Two mechanical halves replace the census:
- *  · the COMPILER — {@link ChildClampSource} requires every seat as a PRESENT key (an `undefined` value
- *    is fine; a missing key is not), so adding a member to {@link CHILD_CLAMP_SEATS} reds `tsc` at every
- *    construction site until each one says what it carries there;
- *  · the SCAN — `scripts/verify-child-clamp-seats.mjs` reads {@link ENGINE_CHILD_SPEC_CONSTRUCTORS} and
- *    requires each registered constructor to go through this carrier, requires the carrier's own source
- *    to cover every seat, and requires every tighten-only seat `tightenTaskSpec` governs to be either
- *    carried here or listed in {@link CHILD_CLAMP_SEATS_NOT_CARRIED} with a reason.
- *
- * What "tighten-only" means for this seat list: the value that travels is the RESTRICTING one and only
- * that one, so a parent that clamped nothing changes nothing about its children, and nothing a child can
- * author lifts a clamp its parent ran under. That is why the carrier omits a key rather than writing a
- * loosening value — a constructor may state its own stricter default and spread this after it.
+ * "Tighten-only" here: the value that travels is the RESTRICTING one and only that one, so a parent that clamped nothing
+ * changes nothing about its children, and nothing a child can author lifts a clamp its parent ran under.
  */
-import type { ReadDenyEntry } from "../tools/fs/read-deny.js";
+import { readDenyEntryProblem, type ReadDenyEntry } from "../tools/fs/read-deny.js";
+import { complianceCapabilityProblem, type ComplianceCapability } from "./compliance.js";
 import type { TaskSpec } from "./types.js";
+import { writeProtectedEntryIdentity, writeProtectedEntryProblem } from "./write-protect.js";
+/** Which carrier hands a row to an engine-built child: the child-spec carrier ({@link childClampSeats}, ctx seats of the
+ *  same names) or the parent spec seat (`ParentSpecSeat`, applied by `applyParentSpecSeat`). */
+export type ClampCarrier = "clamp" | "specSeat";
+/** The identity an add-only list folds by — case-insensitive unless the entry says otherwise (the deny matcher's reading). */
+declare function readDenyIdentity(entry: ReadDenyEntry): string;
+/** A capability is its own identity (a closed word). */
+declare function complianceIdentity(cap: ComplianceCapability): string;
 /**
- * The clamp seats, as string literals (the closed set the scan and the wire-manifest reader both parse —
- * a spread or an identifier here reads as an empty set).
+ * How a governed workflow SCRIPT's untrusted list for an add-only row is read before the row's `entry` law judges it —
+ * the untrusted layer is bounded where the deployment and task layers are not. `atMost` is refused before any element is
+ * read (`why` says what each entry costs); `entry` reads ONE element, each of its properties exactly once, rebuilds it
+ * from the keys it recognizes (an element's extra own keys never ride along) and throws, naming `at`, on a shape it
+ * refuses. `shape` names the list's element grammar for the not-a-list refusal.
  */
-export declare const CHILD_CLAMP_SEATS: readonly ["handsReadOnly", "interactiveTools", "approvalReach", "readFace", "writeFace", "readDenyPatterns"];
-/** One clamp seat's name. */
-export type ChildClampSeat = (typeof CHILD_CLAMP_SEATS)[number];
+export interface ScriptListLaw<E> {
+    readonly atMost: number;
+    readonly shape: string;
+    readonly why: string;
+    readonly entry: (el: unknown, at: string) => E;
+}
 /**
- * The seats `tightenTaskSpec` governs that this carrier deliberately does NOT carry, each with the reason
- * — the "forgot" / "decided" distinction, kept where a new reader will trip over it. The scan requires
- * every seat named in `tightenTaskSpec` to be in this table or in {@link CHILD_CLAMP_SEATS}.
+ * THE CLAMP TABLE. Two laws:
+ *  · `restricting` — the seat has ONE restricting `value`. Either side carrying it wins; a side that carries a different
+ *    value cannot replace it (the public merge refuses that as a loosening); a seat with nothing restricting keeps what was
+ *    authored.
+ *  · `addOnly` — the seat is a list that only grows: every two of its lists meet in {@link unionAddOnly} (in order, folded
+ *    by `identity`; `[]` erases nothing), and the run's effective list is that union taken with the deployment's own list
+ *    (`deploymentLayer`, the `RunnerDeps` member it arrives through) — so the task layer can add entries and never remove
+ *    one. `entry` is the seat's own entry law (its compiler's, never a copy); the task layer's lists meet it at the one
+ *    door ({@link assertAddOnlySeats}), and an entry it refuses never folds into another. `script` bounds a governed
+ *    workflow script's untrusted list for the seat before `entry` judges it.
+ * `script` also says whether a governed workflow SCRIPT may declare the seat for its child, under the row's law: a
+ * restricting row with `script: true` only as its restricting value (`false` = inherited only); an add-only row through its
+ * `script` list law, then `entry`. The script whitelist reads its tighten-only keys off this table ({@link SCRIPT_SEATS}),
+ * never off a list of its own.
+ * Rows are literals (the gate reads them as written).
  */
-export declare const CHILD_CLAMP_SEATS_NOT_CARRIED: Readonly<Record<string, string>>;
+export declare const CLAMP_SET: Readonly<{
+    handsReadOnly: Readonly<{
+        readonly law: "restricting";
+        readonly value: true;
+        readonly script: true;
+        readonly carrier: "clamp";
+    }>;
+    interactiveTools: Readonly<{
+        readonly law: "restricting";
+        readonly value: false;
+        readonly script: true;
+        readonly carrier: "clamp";
+    }>;
+    approvalReach: Readonly<{
+        readonly law: "restricting";
+        readonly value: "none";
+        readonly script: true;
+        readonly carrier: "clamp";
+    }>;
+    readFace: Readonly<{
+        readonly law: "restricting";
+        readonly value: "roots";
+        readonly script: true;
+        readonly carrier: "clamp";
+    }>;
+    writeFace: Readonly<{
+        readonly law: "restricting";
+        readonly value: "roots";
+        readonly script: true;
+        readonly carrier: "clamp";
+    }>;
+    readDenyPatterns: Readonly<{
+        readonly law: "addOnly";
+        readonly identity: typeof readDenyIdentity;
+        readonly entry: typeof readDenyEntryProblem;
+        readonly script: ScriptListLaw<ReadDenyEntry>;
+        readonly deploymentLayer: "readDenyPatterns";
+        readonly carrier: "clamp";
+    }>;
+    writeProtectedAdditions: Readonly<{
+        readonly law: "addOnly";
+        readonly identity: typeof writeProtectedEntryIdentity;
+        readonly entry: typeof writeProtectedEntryProblem;
+        readonly script: ScriptListLaw<import("./write-protect.js").WriteProtectedEntry>;
+        readonly deploymentLayer: "writeProtectedPaths";
+        readonly carrier: "clamp";
+    }>;
+    complianceAdditionalDenies: Readonly<{
+        readonly law: "addOnly";
+        readonly identity: typeof complianceIdentity;
+        readonly entry: typeof complianceCapabilityProblem;
+        readonly script: ScriptListLaw<ComplianceCapability>;
+        readonly deploymentLayer: "compliancePostureResolver";
+        readonly carrier: "clamp";
+    }>;
+    oneShot: Readonly<{
+        readonly law: "restricting";
+        readonly value: true;
+        readonly script: true;
+        readonly carrier: "specSeat";
+    }>;
+    memoryPersistenceCapable: Readonly<{
+        readonly law: "restricting";
+        readonly value: false;
+        readonly script: true;
+        readonly carrier: "specSeat";
+    }>;
+    fileHistory: Readonly<{
+        readonly law: "restricting";
+        readonly value: "disabled";
+        readonly script: false;
+        readonly carrier: "specSeat";
+    }>;
+}>;
+/** One row's seat name. */
+export type ClampSeat = keyof typeof CLAMP_SET;
+/** The add-only rows' seats. */
+export type AddOnlySeat = {
+    [K in ClampSeat]: (typeof CLAMP_SET)[K]["law"] extends "addOnly" ? K : never;
+}[ClampSeat];
+/** One entry of an add-only seat's list. */
+export type AddOnlyEntry<S extends AddOnlySeat> = NonNullable<TaskSpec[S]> extends ReadonlyArray<infer E> ? E : never;
+/** The seats the child-spec carrier hands on. */
+export type ChildClampSeat = {
+    [K in ClampSeat]: (typeof CLAMP_SET)[K]["carrier"] extends "clamp" ? K : never;
+}[ClampSeat];
+/** Every row's value as some record carries it — present keys, `undefined` where the record has none. */
+export type ClampSource = {
+    [K in ClampSeat]: TaskSpec[K] | undefined;
+};
+/** The clamp source a construction site hands the carrier: EVERY clamp-carrier row as a PRESENT key. */
+export type ChildClampSource = Pick<ClampSource, ChildClampSeat>;
+/** Only the restricting values (add-only rows: a non-empty list) — the shape a waker's clamp seat and a projection take. */
+export type ClampValues = {
+    readonly [K in ClampSeat]?: (typeof CLAMP_SET)[K] extends {
+        readonly value: infer V;
+    } ? V : NonNullable<TaskSpec[K]>;
+};
+/** Every row's seat name, in table order. */
+export declare const CLAMP_SEATS: readonly ClampSeat[];
+/** The rows a governed workflow script may declare for its child (every row whose `script` is not `false`). */
+export type ScriptSeat = {
+    [K in ClampSeat]: (typeof CLAMP_SET)[K]["script"] extends false ? never : K;
+}[ClampSeat];
+/** {@link ScriptSeat}, in table order — the script whitelist's tighten-only half. */
+export declare const SCRIPT_SEATS: readonly ScriptSeat[];
+/** Two declarations of one seat under its row's law (`b` is the later one): the restricting value if either carries it,
+ *  else what was authored (`b` over `a`); an add-only list is the union of both, in order, by the row's identity. */
+export declare function composeClampSeat(seat: ClampSeat, a: unknown, b: unknown): unknown;
+/**
+ * THE union of an add-only seat's lists — the ONE merge every add-only row reads, wherever two of its lists meet: two
+ * declarations of the seat (the public merge, a fold of records) and the run's EFFECTIVE list (the deployment's list
+ * first, then every task-layer list). In order; a lawful entry folds into an earlier one with the same `identity`; `[]`
+ * and absent add nothing, and nothing here removes an entry — so a later layer can only add. An entry the row's entry
+ * law refuses is kept as it is, never folded into a lawful one: it reaches the door or the compiler that refuses it
+ * instead of vanishing behind a namesake. A list that is not a list refuses here (it would be read letter by letter).
+ */
+export declare function unionAddOnly<S extends AddOnlySeat>(seat: S, ...lists: ReadonlyArray<ReadonlyArray<AddOnlyEntry<S>> | undefined>): AddOnlyEntry<S>[];
 /**
- * The engine-built child-spec constructors, as `<repo-relative file>#<name>` — the closed registry the
- * scan enumerates. A constructor that builds a spec for a child RUN belongs here; the scan requires each
- * row to resolve to exactly one declaration IN ITS OWN FILE that calls {@link childClampSeats}.
+ * THE task layer's door for the add-only rows: every add-only seat a spec carries is a list of entries its row's entry
+ * law accepts, or the prepare refuses — one code (`config.invalid_argument`, the table's own refusal), one sentence for a
+ * value that is not a list, and the seat's own entry law (labelled `TaskSpec.<seat>`) for a bad entry. Runs before any
+ * list is folded or compiled, so a task-layer value is judged as the caller wrote it. Absent ⇒ nothing to judge.
+ */
+export declare function assertAddOnlySeats(spec: object): void;
+/** Would `override` LOOSEN `base` on this seat? Only a restricting row can be loosened: a base carrying the restricting
+ *  value meeting an override that states a different one. */
+export declare function loosensClampSeat(seat: ClampSeat, base: unknown, override: unknown): boolean;
+/** Read every row (`carrier`: that carrier's rows only) off a record that carries the seats under their own names (a spec, a ctx, a seat). */
+export declare function clampSourceOf(record: object | undefined): ClampSource;
+export declare function clampSourceOf(record: object | undefined, carrier: "clamp"): ChildClampSource;
+/** Fold several records' declarations of every row, in order, under each row's law — "either side restricting wins",
+ *  add-only lists unioned. The fold of a spawn snapshot and its waker, of a workflow child's own spec and its host's
+ *  clamps, of a ctx and its spec seat. */
+export declare function foldClampSources(...records: ReadonlyArray<object | undefined>): ClampSource;
+/** The restricting values of every row (`carrier` narrows it to one carrier's rows): a row with nothing restricting adds
+ *  NO KEY, so the result spreads onto a spec without ever writing a loosening value. */
+export declare function clampSeatsOf(source: Partial<Record<ClampSeat, unknown>>, carrier?: ClampCarrier): ClampValues;
+/** The coded refusal of a clamp record a caller handed in (`config.invalid_argument`). */
+export declare function clampRecordError(message: string): Error & {
+    code: "config.invalid_argument";
+};
+/**
+ * Refuse a caller-supplied clamp record that names a seat the table does not have (or, with `carrier`, a row another
+ * carrier hands on): a name nobody reads would sit on the record as if wired — the silent drop the retired-key door
+ * exists to prevent. `extra` names the record's own members that are not rows. Absent ⇒ nothing to judge; a member
+ * whose value is `undefined` carries nothing and is read as absent (the retired-key door's presence rule).
+ */
+export declare function assertClampRecord(record: unknown, owner: string, carrier?: ClampCarrier, extra?: readonly string[]): void;
+/** The restricting values of every row that ANY of `records` carries — the clamp seat a waker hands a revival. */
+export declare function clampValuesOf(...records: ReadonlyArray<object | undefined>): ClampValues;
+/**
+ * Project a parent's clamps onto a child spec — the clamp-carrier rows of the table, the ONE place a source becomes the
+ * seats a child spec carries. Spread the result onto the child spec; a seat with nothing to clamp contributes NO KEY, so
+ * a constructor may state its own stricter value above the spread and keep it (a `false` from the parent can never lift it).
  *
- * Why the file is half the key, and why a shape the scan cannot read is a RED rather than an absence: a
- * registry keyed on a bare NAME asks a syntactic scan to enumerate every shape that binds a callable, and
- * that list has no end — every shape it misses leaves the real constructor invisible while a namesake
- * answers for it.
+ * @contract child_spec.clamps_travel_whole — every child spec the ENGINE builds carries the whole of its parent's
+ * tighten-only clamp seats (the `CLAMP_SET` rows whose carrier is `"clamp"`) through this one carrier: only the
+ * restricting value of each seat travels, arrays are copied at spawn, and a seat the parent did not clamp adds no key —
+ * so a clamp can never end one level deep, and a new seat cannot reach some constructors and not others.
  */
-export declare const ENGINE_CHILD_SPEC_CONSTRUCTORS: readonly ["src/agents/subagent.ts#buildChildSpec", "src/agents/subagent.ts#observerSpec", "src/agents/subagent.ts#resumeSpec", "src/agents/teacher.ts#inheritedDeploymentConfig", "src/agents/verify.ts#verifierSpec", "src/agents/verify.ts#fixLegSpec", "src/orchestration/workflow-primitives.ts#workflowChildClamps"];
+export declare function childClampSeats(source: ChildClampSource): Pick<ClampValues, ChildClampSeat>;
 /**
- * The clamp source a construction site hands the carrier: EVERY seat as a present key. A site whose lane
- * has no value for a seat writes `undefined` explicitly — which is the point, since that is a sentence
- * a reader (and a diff) can see, unlike an absent key.
+ * The seats `tightenTaskSpec` governs OUTSIDE the table, each with the reason it is not a row — the "forgot" / "decided"
+ * distinction, kept where a new reader will trip over it. The scan requires every seat `tightenTaskSpec` names to be a
+ * row or listed here.
  */
-export interface ChildClampSource {
-    /** The write-hands clamp: only `true` travels. */
-    handsReadOnly: boolean | undefined;
-    /** The hard-headless clamp: only `false` travels. */
-    interactiveTools: boolean | undefined;
-    /** The declaration that nobody on the run can be asked to approve: only `"none"` travels. */
-    approvalReach: TaskSpec["approvalReach"] | undefined;
-    /** The read containment face: only `"roots"` travels. */
-    readFace: TaskSpec["readFace"] | undefined;
-    /** The write containment face: only `"roots"` travels. */
-    writeFace: TaskSpec["writeFace"] | undefined;
-    /** The deny-set additions: an add-only axis, so a non-empty list travels as a spawn-time copy. */
-    readDenyPatterns: readonly ReadDenyEntry[] | undefined;
-}
+export declare const CHILD_CLAMP_SEATS_NOT_CARRIED: Readonly<Record<string, string>>;
 /**
- * Project a parent's clamps onto a child spec — the ONE place that decides, per seat, which value is the
- * tightening one and how it is copied. Spread the result onto the child spec; a seat with nothing to
- * clamp contributes NO KEY, so a constructor may state its own stricter value above the spread and keep
- * it (a `false` from the parent can never lift it).
+ * The engine-built child-spec constructors, as `<repo-relative file>#<name>` — the closed registry the scan enumerates.
+ * A constructor that builds a spec for a child RUN belongs here; the scan requires each row to resolve to exactly one
+ * declaration IN ITS OWN FILE that calls {@link childClampSeats}.
  *
- * @contract child_spec.clamps_travel_whole — every child spec the ENGINE builds carries the whole of its
- * parent's tighten-only clamp seats (`CHILD_CLAMP_SEATS`) through this one carrier: only the restricting
- * value of each seat travels, arrays are copied at spawn, and a seat the parent did not clamp adds no key
- * — so a clamp can never end one level deep, and a new seat cannot reach some constructors and not others.
+ * Why the file is half the key, and why a shape the scan cannot read is a RED rather than an absence: a registry keyed
+ * on a bare NAME asks a syntactic scan to enumerate every shape that binds a callable, and that list has no end — every
+ * shape it misses leaves the real constructor invisible while a namesake answers for it.
  */
-export declare function childClampSeats(source: ChildClampSource): Partial<TaskSpec>;
+export declare const ENGINE_CHILD_SPEC_CONSTRUCTORS: readonly ["src/agents/subagent.ts#buildChildSpec", "src/agents/subagent.ts#observerSpec", "src/agents/subagent.ts#resumeSpec", "src/agents/verify.ts#verifierSpec", "src/agents/verify.ts#fixLegSpec", "src/orchestration/workflow-primitives.ts#workflowChildClamps"];
 /**
  * The interaction posture a leg keeps under the clamps it inherited: `"interactive"` promises a person on the leg, and a
  * leg that inherited the hard-headless clamp (`interactiveTools: false`) or the declaration that nobody can be asked
@@ -92,13 +248,16 @@ export declare function postureUnderClamps(posture: "interactive" | "headless" |
     readonly approvalReach: TaskSpec["approvalReach"] | undefined;
 }): "interactive" | "headless" | undefined;
 /**
- * The OWN posture of an engine-built leg that never asks the person (the observer sidecar, the verifier): no
- * human-facing tool is mounted AND the leg declares itself headless. Both, always together — the spec's posture
- * outranks the one a leg inherits from its parent or its deployment, and the prepare door refuses an
- * "interactive" posture paired with `interactiveTools: false`, so a leg that stated only the clamp was refused
- * under every interactive parent. Spread ABOVE {@link childClampSeats}: a caller clamp can only tighten it.
+ * The OWN seats of an engine-built leg that never asks the person (the observer sidecar, the verifier) — ONE declaration
+ * the leg's own resolutions read: no human-facing tool is mounted, the leg is headless, and nobody on it can be asked to
+ * approve (the approval seat resolves without the deployment's live approver: refused, or parked where the deployment's
+ * park facility is armed). The spec's posture outranks the one a leg inherits, and the prepare door refuses an
+ * "interactive" posture beside either clamp, so the three travel together. Spread ABOVE {@link childClampSeats}: a caller
+ * clamp can only tighten it.
  */
 export declare function engineHeadlessLegSeats(): {
     interactiveTools: false;
+    approvalReach: "none";
     interactionPosture: "headless";
 };
+export {};

package/dist/core/child-clamp-seats.js

@@ -1,37 +1,231 @@
-export const CHILD_CLAMP_SEATS = Object.freeze(["handsReadOnly", "interactiveTools", "approvalReach", "readFace", "writeFace", "readDenyPatterns"]);
+import { readDenyEntryProblem } from "../tools/fs/read-deny.js";
+import { COMPLIANCE_CAPABILITIES, complianceCapabilityProblem } from "./compliance.js";
+import { writeProtectedEntryIdentity, writeProtectedEntryProblem } from "./write-protect.js";
+function readDenyIdentity(entry) {
+    return typeof entry === "string" ? `i:${entry}` : `${entry.caseSensitive === true ? "s" : "i"}:${entry.pattern}`;
+}
+function complianceIdentity(cap) {
+    return cap;
+}
+const MAX_SCRIPT_LIST_ENTRIES = 16;
+const MAX_SCRIPT_ENTRY_CHARS = 256;
+const MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT = 1;
+function assertScriptEntryLength(text, at, what, why) {
+    if (text.length > MAX_SCRIPT_ENTRY_CHARS)
+        throw new Error(`${at} is ${text.length} characters — a workflow script's ${what} is limited to ${MAX_SCRIPT_ENTRY_CHARS} (${why}).`);
+}
+function assertScriptDenyPatternBounded(pattern, at) {
+    assertScriptEntryLength(pattern, at, "deny pattern", "the matcher runs on every read of the child's run");
+    for (const segment of pattern.split("/")) {
+        const wildcards = segment.split("*").length - 1;
+        if (wildcards > MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT) {
+            throw new Error(`${at} has a path segment with ${wildcards} \`*\` wildcards — a workflow script's deny pattern allows at most ` +
+                `${MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT} per path segment (the same expressiveness the engine's built-in deny table ` +
+                `uses). Each \`*\` compiles to a greedy match, and more than one in a single segment makes the judgment cost grow ` +
+                `superlinearly with the path length, on every read the child performs. Write the intent as separate entries ` +
+                `(the set is a union, so more entries deny strictly more) or anchor it with literal segments.`);
+        }
+    }
+}
+function readDenyScriptEntry(el, at) {
+    if (typeof el === "string") {
+        if (el.length === 0)
+            throw new Error(`${at} must be a non-empty pattern string`);
+        assertScriptDenyPatternBounded(el, at);
+        return el;
+    }
+    if (typeof el !== "object" || el === null || Array.isArray(el))
+        throw new Error(`${at} must be a pattern string or an object { pattern, caseSensitive? }`);
+    const o = el;
+    const pattern = o.pattern;
+    const caseSensitive = o.caseSensitive;
+    if (typeof pattern !== "string" || pattern.length === 0)
+        throw new Error(`${at}.pattern must be a non-empty string, e.g. ".ssh" or "secrets/*.json"`);
+    if (caseSensitive !== undefined && typeof caseSensitive !== "boolean")
+        throw new Error(`${at}.caseSensitive must be a boolean`);
+    assertScriptDenyPatternBounded(pattern, at);
+    return caseSensitive === undefined ? { pattern } : { pattern, caseSensitive };
+}
+function writeProtectedScriptEntry(el, at) {
+    const why = "the judge runs on every write the child names";
+    if (typeof el === "string") {
+        if (el.length === 0)
+            throw new Error(`${at} must be a non-empty name string`);
+        assertScriptEntryLength(el, at, "write-protected name", why);
+        return el;
+    }
+    if (typeof el !== "object" || el === null || Array.isArray(el))
+        throw new Error(`${at} must be a name string or an object { name, kind }`);
+    const o = el;
+    const name = o.name;
+    const kind = o.kind;
+    if (typeof name !== "string" || name.length === 0)
+        throw new Error(`${at}.name must be a non-empty string, e.g. ".npmrc" or ".config/app"`);
+    if (typeof kind !== "string")
+        throw new Error(`${at}.kind must be a string ("basename", "segment" or "segment-run")`);
+    assertScriptEntryLength(name, at, "write-protected name", why);
+    return { name, kind };
+}
+function complianceScriptEntry(el, at) {
+    if (typeof el !== "string")
+        throw new Error(`${at} must be a capability word (${COMPLIANCE_CAPABILITIES.join(", ")})`);
+    return el;
+}
+const READ_DENY_SCRIPT_LAW = Object.freeze({
+    atMost: MAX_SCRIPT_LIST_ENTRIES,
+    shape: 'deny entries (a "/"-separated segment run such as ".ssh", or { pattern, caseSensitive? })',
+    why: "Every entry is judged against every path the child reads, for the child's whole run; the deployment's own entries, and whichever built-in tiers the deployment has on (by default the credentials and home agent-config tiers), are in force on top of these.",
+    entry: readDenyScriptEntry,
+});
+const WRITE_PROTECTED_SCRIPT_LAW = Object.freeze({
+    atMost: MAX_SCRIPT_LIST_ENTRIES,
+    shape: 'write-protected names (a literal name such as ".npmrc", a "/"-separated run such as ".config/app", or { name, kind })',
+    why: "Every row is judged against every write the child names, for the child's whole run; the deployment's own table is in force beside these.",
+    entry: writeProtectedScriptEntry,
+});
+const COMPLIANCE_SCRIPT_LAW = Object.freeze({
+    atMost: MAX_SCRIPT_LIST_ENTRIES,
+    shape: `capability words (${COMPLIANCE_CAPABILITIES.join(", ")})`,
+    why: "The capability set is closed; a longer list can only repeat it.",
+    entry: complianceScriptEntry,
+});
+export const CLAMP_SET = Object.freeze({
+    handsReadOnly: Object.freeze({ law: "restricting", value: true, script: true, carrier: "clamp" }),
+    interactiveTools: Object.freeze({ law: "restricting", value: false, script: true, carrier: "clamp" }),
+    approvalReach: Object.freeze({ law: "restricting", value: "none", script: true, carrier: "clamp" }),
+    readFace: Object.freeze({ law: "restricting", value: "roots", script: true, carrier: "clamp" }),
+    writeFace: Object.freeze({ law: "restricting", value: "roots", script: true, carrier: "clamp" }),
+    readDenyPatterns: Object.freeze({ law: "addOnly", identity: readDenyIdentity, entry: readDenyEntryProblem, script: READ_DENY_SCRIPT_LAW, deploymentLayer: "readDenyPatterns", carrier: "clamp" }),
+    writeProtectedAdditions: Object.freeze({ law: "addOnly", identity: writeProtectedEntryIdentity, entry: writeProtectedEntryProblem, script: WRITE_PROTECTED_SCRIPT_LAW, deploymentLayer: "writeProtectedPaths", carrier: "clamp" }),
+    complianceAdditionalDenies: Object.freeze({ law: "addOnly", identity: complianceIdentity, entry: complianceCapabilityProblem, script: COMPLIANCE_SCRIPT_LAW, deploymentLayer: "compliancePostureResolver", carrier: "clamp" }),
+    oneShot: Object.freeze({ law: "restricting", value: true, script: true, carrier: "specSeat" }),
+    memoryPersistenceCapable: Object.freeze({ law: "restricting", value: false, script: true, carrier: "specSeat" }),
+    fileHistory: Object.freeze({ law: "restricting", value: "disabled", script: false, carrier: "specSeat" }),
+});
+const ROWS = Object.freeze(Object.entries(CLAMP_SET));
+export const CLAMP_SEATS = Object.freeze(ROWS.map(([seat]) => seat));
+export const SCRIPT_SEATS = Object.freeze(ROWS.filter(([, row]) => row.script !== false).map(([seat]) => seat));
+export function composeClampSeat(seat, a, b) {
+    const row = CLAMP_SET[seat];
+    if (row.law === "restricting")
+        return a === row.value || b === row.value ? row.value : (b ?? a);
+    const lists = [a, b];
+    return unionAddOnly(seat, ...lists);
+}
+function notAListSentence(owner, value) {
+    return `${owner} must be an array or absent (got ${value === null ? "null" : typeof value}) — a non-array here would be iterated character by character, so it refuses loudly instead.`;
+}
+export function unionAddOnly(seat, ...lists) {
+    const row = CLAMP_SET[seat];
+    const identity = row.identity;
+    const seen = new Set();
+    const out = [];
+    for (const list of lists) {
+        if (list === undefined)
+            continue;
+        if (!Array.isArray(list))
+            throw clampRecordError(notAListSentence(seat, list));
+        for (const e of list) {
+            if (row.entry(e, seat) !== undefined) {
+                out.push(e);
+                continue;
+            }
+            const key = identity(e);
+            if (!seen.has(key))
+                (seen.add(key), out.push(e));
+        }
+    }
+    return out;
+}
+export function assertAddOnlySeats(spec) {
+    for (const [seat, row] of ROWS) {
+        if (row.law !== "addOnly")
+            continue;
+        const value = spec[seat];
+        if (value === undefined)
+            continue;
+        const owner = `TaskSpec.${seat}`;
+        if (!Array.isArray(value))
+            throw clampRecordError(notAListSentence(owner, value));
+        const entries = value;
+        for (const e of entries) {
+            const problem = row.entry(e, owner);
+            if (problem !== undefined)
+                throw clampRecordError(problem);
+        }
+    }
+}
+export function loosensClampSeat(seat, base, override) {
+    const row = CLAMP_SET[seat];
+    return row.law === "restricting" && base === row.value && override !== undefined && override !== row.value;
+}
+function projected(seat, v) {
+    const row = CLAMP_SET[seat];
+    if (row.law === "restricting")
+        return v === row.value ? row.value : undefined;
+    return Array.isArray(v) && v.length > 0 ? Object.freeze(v.map((e) => (typeof e === "object" && e !== null ? { ...e } : e))) : undefined;
+}
+export function clampSourceOf(record, carrier) {
+    const r = (record ?? {});
+    return Object.fromEntries(ROWS.filter(([, row]) => carrier === undefined || row.carrier === carrier).map(([seat]) => [seat, r[seat]]));
+}
+export function foldClampSources(...records) {
+    return Object.fromEntries(CLAMP_SEATS.map((seat) => [seat, records.reduce((acc, rec) => composeClampSeat(seat, acc, rec?.[seat]), undefined)]));
+}
+export function clampSeatsOf(source, carrier) {
+    const out = {};
+    for (const [seat, row] of ROWS) {
+        if (carrier !== undefined && row.carrier !== carrier)
+            continue;
+        const v = projected(seat, source[seat]);
+        if (v !== undefined)
+            out[seat] = v;
+    }
+    return out;
+}
+export function clampRecordError(message) {
+    const e = new Error(message);
+    e.code = "config.invalid_argument";
+    return e;
+}
+export function assertClampRecord(record, owner, carrier, extra = []) {
+    if (record === undefined)
+        return;
+    if (record === null || typeof record !== "object")
+        throw clampRecordError(`${owner} must be a record of clamp seats, got ${record === null ? "null" : typeof record}`);
+    const legal = [...ROWS.filter(([, row]) => carrier === undefined || row.carrier === carrier).map(([seat]) => seat), ...extra];
+    const unknown = Object.keys(record).filter((k) => record[k] !== undefined && !legal.includes(k));
+    if (unknown.length > 0) {
+        throw clampRecordError(`${owner} names ${unknown.map((k) => JSON.stringify(k)).join(", ")}, which the clamp table does not carry there — the legal seats are ${legal.join(", ")}. Refused rather than ignored: a seat nobody reads would read to the caller as wired.`);
+    }
+}
+export function clampValuesOf(...records) {
+    return clampSeatsOf(foldClampSources(...records));
+}
+export function childClampSeats(source) {
+    return clampSeatsOf(source, "clamp");
+}
 export const CHILD_CLAMP_SEATS_NOT_CARRIED = Object.freeze({
     toolPolicy: "not a clamp a child spec copies: a parent's denies reach its children through the ancestor-constraint chain the child's own prepare folds, not by putting the parent's policy object on the child seat",
     shellGate: "travels on the inherited-gate lane (`InheritedGate.shellGate`, a trusted internals seat), not on the child spec — a spec-level copy would be a second source for the same clamp",
     permissionMode: "travels on the inherited-gate lane (`InheritedGate.permissionMode` / `permissionModeCeiling` — the parent's declared word and its LIVE seat): a child with no word of its own inherits that ceiling on every read, and a word it does declare is clamped under it; a spec-level copy would freeze the parent's word at spawn and be a second source for the same clamp",
     onAsk: "per-lane by construction: the delegation lane wraps the parent's approver with spawn provenance before it becomes the child's seat, and a lane with no approver must hand down none (a parent that declared nobody can be asked hands down no approver — its frozen seat is empty — and the declaration rides `approvalReach`)",
     hooks: "a deployment seat, not an inherited clamp — `tightenTaskSpec` refuses to merge two hook sets rather than composing them, so there is no tightening value to carry",
-    excludeTools: "roster control rather than containment: the lanes that copy a parent's roster do so beside these seats, and the workflow lane authors its child roster from the governance baseline instead of the host's",
-    deferTools: "roster control, same reading as `excludeTools` above",
+    allowTools: "the tool selector's own layer — a parent bounds its children through the selector's ceiling (`RunInternals.toolCeiling`, a trusted internals seat every engine lane fills), not by copying its own list onto the child seat, which would be a second source for the same bound",
+    excludeTools: "the deny half of the same layer as `allowTools` above, same reading: the parent's reaches its children through the ceiling",
+    deferTools: "roster disclosure control rather than containment: the lanes that copy it do so beside these seats, and the workflow lane authors its child roster from the governance baseline instead of the host's",
 });
 export const ENGINE_CHILD_SPEC_CONSTRUCTORS = Object.freeze([
     "src/agents/subagent.ts#buildChildSpec",
     "src/agents/subagent.ts#observerSpec",
     "src/agents/subagent.ts#resumeSpec",
-    "src/agents/teacher.ts#inheritedDeploymentConfig",
     "src/agents/verify.ts#verifierSpec",
     "src/agents/verify.ts#fixLegSpec",
     "src/orchestration/workflow-primitives.ts#workflowChildClamps",
 ]);
-export function childClampSeats(source) {
-    return {
-        ...(source.handsReadOnly === true ? { handsReadOnly: true } : {}),
-        ...(source.interactiveTools === false ? { interactiveTools: false } : {}),
-        ...(source.approvalReach === "none" ? { approvalReach: "none" } : {}),
-        ...(source.readFace === "roots" ? { readFace: "roots" } : {}),
-        ...(source.writeFace === "roots" ? { writeFace: "roots" } : {}),
-        ...(source.readDenyPatterns !== undefined && source.readDenyPatterns.length > 0
-            ? { readDenyPatterns: [...source.readDenyPatterns] }
-            : {}),
-    };
-}
 export function postureUnderClamps(posture, clamps) {
     return posture === "interactive" && (clamps.interactiveTools === false || clamps.approvalReach === "none") ? "headless" : posture;
 }
 export function engineHeadlessLegSeats() {
-    return { interactiveTools: false, interactionPosture: "headless" };
+    return { interactiveTools: false, approvalReach: "none", interactionPosture: "headless" };
 }

package/dist/core/classifier-unavailable-arm.d.ts

@@ -17,6 +17,7 @@
  */
 import { type AutoModeClassifierRound, type AutoModeDenialTracker, type AutoModeFallbackCause, type UnarmedDenialLimitFallback } from "./auto-mode.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "./tool-policy.js";
+import type { Settlement } from "./gate-outcome.js";
 /** Where a classification that did not rule sent the call: `asked` = on to the approval seat, `denied` = refused. */
 export type ClassifierUnavailableDisposition = "asked" | "denied";
 /** What the stations' observer receives — the facts the `classifier.unavailable` notice is composed from. `cause` is why
@@ -71,6 +72,9 @@ export declare function classifierNoRulingArm<A extends Extract<PermissionResult
 export declare function settleNoRulingAsk(opts: {
     ask: PermissionResult;
     mintedHere: boolean;
-    resolved: Pick<ResolvedAsk, "action" | "settlement">;
+    resolved: {
+        action: ResolvedAsk["action"];
+        settlement?: Settlement;
+    };
     tracker: AutoModeDenialTracker | undefined;
 }): UnarmedDenialLimitFallback | undefined;

package/dist/core/classifier-unavailable-arm.js

@@ -1,5 +1,5 @@
 import { classifierNoRulingAskMessage, classifierUnavailableDenyMessage } from "./auto-mode.js";
-import { attestClassifierDenyCause, carryEngineAttestations } from "./tool-policy.js";
+import { attest } from "./tool-policy.js";
 export function classifierNoRulingArm(args) {
     const { ask, req, cause } = args;
     const seated = args.seat?.approvalSeat === true;
@@ -11,11 +11,11 @@ export function classifierNoRulingArm(args) {
         }
     }
     if (seated)
-        return { kind: "asked", ask: carryEngineAttestations(ask, { ...ask, message: classifierNoRulingAskMessage(ask.message ?? `approval required for "${req.toolName}"`, cause), requiresRealApproval: true, classifierNoRuling: cause }) };
+        return { kind: "asked", ask: { ...ask, message: classifierNoRulingAskMessage(ask.message ?? `approval required for "${req.toolName}"`, cause), requiresRealApproval: true, classifierNoRuling: cause } };
     if (cause === "parse_error")
         return { kind: "counted" };
     const deny = { action: "deny", message: classifierUnavailableDenyMessage(req.toolName, cause, args.attribution), decisionReason: "classifier" };
-    return { kind: "denied", deny: attestClassifierDenyCause(deny, "unavailable", req) };
+    return { kind: "denied", deny: attest(deny, req, { classifierCause: "unavailable" }) };
 }
 export function settleNoRulingAsk(opts) {
     const { ask, resolved } = opts;