@sema-agent/core 7.48.0 → 7.49.0

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -15,14 +15,16 @@ import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, resolveComplianceDenies }
 import { createPresentPlanTool, createEnterPlanModeTool } from "../present-plan-tool.js";
 import { brainToRuntime } from "../runtime.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { defineTool, isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
+import { defineTool } from "../tools.js";
 const MOUNT_REMEDY = "author it as a plain-object ToolSpec (own `name` and `execute`), hand the defineTool product itself, or wrap a product through the supported wrapper form (a fresh object re-stamped with `stampDefineToolBrand` whose rebind re-wraps the rebound product)";
 import { isAutoModeDenySource } from "../runtime-caps.js";
+import { unionAddOnly } from "../child-clamp-seats.js";
 import { derivedRouteFallsBack } from "./derived-route-fallback.js";
 import { CLASSIFIER_ATTEMPT_SUFFIX, CLASSIFIER_THINK_SEAT, announceClassifierRoleDefaulted, classifierLadderRungs, classifierReplyAsksAgain, classifierReplyFailure, classifierReplyVerdictText, classifierRoundObserver, classifierRungSeat, classifierSeatModel } from "./classifier-ladder.js";
 import { REPORT_FINDINGS_TOOL_NAME, createReportBlockedTool, createReportFindingsTool } from "./synthetic-tools.js";
 import { RosterBuilder, callerMountSource } from "../tool-roster.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
+import { callerEntryOrigin, rebindProductEntry, specArmCanBuild } from "./caller-roster.js";
 function assembleParentCaptureState(o, i, ctl, ancestors) {
     const build = (optedOut, indeterminate) => ({
         optedOut: optedOut === true,
@@ -114,31 +116,26 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, askSeat, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, askSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, delegated } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
         roster.mount(mounted, { source: callerMountSource(mounted), mountedBy: "scenario" });
     }
-    function specArmCanConstruct(t) {
-        if (typeof t !== "object" || t === null)
-            return false;
-        const name = Object.getOwnPropertyDescriptor(t, "name");
-        const execute = Object.getOwnPropertyDescriptor(t, "execute");
-        return name !== undefined && "value" in name && typeof name.value === "string" && name.enumerable === true && execute !== undefined && "value" in execute && typeof execute.value === "function" && execute.enumerable === true;
-    }
     function mountCallerTool(t) {
-        if (isDefineToolProduct(t))
-            return maybeOffload(rebindDefineToolCtx(t, enrichSpecToolCtx), t);
-        if (!specArmCanConstruct(t)) {
+        const rebound = rebindProductEntry(t, enrichSpecToolCtx);
+        if (rebound !== undefined)
+            return maybeOffload(rebound, t);
+        if (!specArmCanBuild(t)) {
             const shown = Object.getOwnPropertyDescriptor(t, "name")?.value;
             const e = new Error(`spec.tools entry ${typeof shown === "string" ? JSON.stringify(shown) : "(no own name)"}: the ToolSpec arm rebuilds a caller tool from its OWN enumerable members, and this entry does not carry a string \`name\` and a function \`execute\` as own properties (a class instance, a prototype child of a spec or of a defineTool product, a function, or a Proxy over one) — ${MOUNT_REMEDY}`);
             e.code = "config.tool_mount_denied";
             throw e;
         }
+        const execute = t.execute, self = callerEntryOrigin(t);
         return maybeOffload(defineTool({
             ...t,
-            execute: (args, ctx) => t.execute(args, enrichSpecToolCtx(ctx)),
+            execute: (args, ctx) => execute.call(self, args, enrichSpecToolCtx(ctx)),
         }), t);
     }
     const blockedRef = {};
@@ -172,19 +169,22 @@ export async function prepareCapsAndWorkflow(input) {
         runtimeCaps = screened.caps;
         runtimeCapsFaulted ||= screened.faulted;
     }
-    let complianceDenies = new Set();
+    let deploymentDenies = new Set();
     let complianceDegraded = false;
     if (deps.compliancePostureResolver) {
         try {
             const posture = (await deps.compliancePostureResolver(spec.principal)) ?? undefined;
             if (posture !== undefined)
-                complianceDenies = resolveComplianceDenies(posture);
+                deploymentDenies = resolveComplianceDenies(posture);
         }
         catch (err) {
             deps.onError?.(asThrownError(err), { phase: "config", sessionId });
-            complianceDenies = new Set(COMPLIANCE_CAPABILITIES);
+            deploymentDenies = new Set(COMPLIANCE_CAPABILITIES);
             complianceDegraded = true;
         }
+    }
+    const complianceDenies = new Set(unionAddOnly("complianceAdditionalDenies", [...deploymentDenies], spec.complianceAdditionalDenies));
+    if (complianceDenies.size > 0) {
         const complianceRefuse = (capability, requested) => {
             const e = new Error(`${requested} is denied for this principal by the compliance posture (capability "${capability}"` +
                 `${complianceDegraded ? "; the posture resolver is currently failing, so every managed capability is denied fail-closed" : ""}) — ` +
@@ -240,7 +240,7 @@ export async function prepareCapsAndWorkflow(input) {
             assemble: async (input) => {
                 const ctx = await session.buildContext();
                 const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) && (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
-                return renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
+                return renderAutoModeWindow(known, am.window, { delegated }) + renderAutoModeAction(input);
             },
             classify: async (_input, signal, rung, userPrompt) => {
                 const rungModel = rung !== undefined ? classifierRungs[rung.index] : undefined;
@@ -294,7 +294,7 @@ export async function prepareCapsAndWorkflow(input) {
             runner: runnerSelf,
             scriptRunner: deps.workflowScriptRunner,
             governanceBaseline: deps.workflowGovernanceBaseline,
-            parentExcludeTools: toolFaceSnapshot.exclude,
+            parentToolCeiling: toolFaceSnapshot.selector.layers,
             parentDeferTools: toolFaceSnapshot.defer,
             parentAlwaysLoadTools: toolFaceSnapshot.alwaysLoad,
             ...(toolFaceSnapshot.restoreGated !== undefined ? { parentRestoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
@@ -306,7 +306,6 @@ export async function prepareCapsAndWorkflow(input) {
             journalStore: deps.workflowJournalStore,
             ...(deps.onBackgroundChildEvent ? { onBackgroundChildEvent: deps.onBackgroundChildEvent } : {}),
             scriptStore: deps.workflowScriptStore,
-            builtinWorkflows: deps.builtinWorkflows,
             onAgentSpawn: deps.onWorkflowAgentSpawn,
             scope: taskScope,
             notifier: deps.workflowCompletionNotifier,
@@ -327,7 +326,6 @@ export async function prepareCapsAndWorkflow(input) {
             },
             ...(spec.getApiKeyAndHeaders !== undefined ? { parentGetApiKeyAndHeaders: spec.getApiKeyAndHeaders } : {}),
             ...(askSeat.value !== undefined ? { parentOnAsk: askSeat.value } : {}),
-            ...(askSeat.reach !== undefined ? { parentApprovalReach: askSeat.reach } : {}),
             ...(spec.durableApproval !== undefined ? { parentDurableApproval: { ...spec.durableApproval } } : {}),
             ...(internals?.workflowParkedResume !== undefined
                 ? { parkedResume: (resumeFromRunId) => {
@@ -347,13 +345,7 @@ export async function prepareCapsAndWorkflow(input) {
             workflowDepth: internals?.workflowDepth,
             parentCwd: taskRootFinal,
             parentThinking: () => childThinkingSeat(undefined, deploymentSubagentThinking(runnerSelf.agentCatalog?.roles), harnessRef.current?.getThinkingLevel() ?? thinking).thinking,
-            parentReadFace: () => carrierReadFace(),
-            parentWriteFace: () => carrierWriteFace(),
-            parentReadDenyPatterns: () => {
-                const readDenyAdditionsNormalized = input.readDenyAdditionsNormalized();
-                return readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized : undefined;
-            },
-            ...(spec.handsReadOnly === true ? { parentHandsReadOnly: true } : {}), ...(spec.interactiveTools === false ? { parentInteractiveTools: false } : {}),
+            parentClamps: runClampSource,
             onNotice: deps.onNotice,
             ...(checkpointSeat !== undefined ? { parentCheckpointStore: checkpointSeat } : {}),
             parentCenterArtifactDigest: () => input.centerAdoption()?.artifact.artifactDigest,

package/dist/core/runner/prepare-config-doors.d.ts

@@ -30,7 +30,8 @@ import type { SessionStore } from "../session.js";
 import type { RunnerDeps, TaskLimits, TaskSpec } from "../types.js";
 import { type UsageWindow } from "../usage-window-store.js";
 import { type AskSeat } from "../wiring-manifest.js";
-import type { PrepareResume, RunInternals, ToolFaceSnapshot } from "./contracts.js";
+import type { PrepareResume, RunInternals, ToolFaceLists } from "./contracts.js";
+import { type RosterSpec } from "./caller-roster.js";
 export declare function limitConfigError(code: string, message: string): Error & {
     code?: string;
 };
@@ -114,9 +115,9 @@ export declare function resolveModelPromptTraits(model: {
     fableMitigations: boolean;
 };
 export interface PrepareConfigDoorsInput {
-    /** borrowed-readonly — the caller's spec. NEVER mutated here: the per-task agents rebind returns a
-     *  SHALLOW COPY on {@link PrepareConfigDoorsResult.spec} (only `tools` replaced). */
-    spec: TaskSpec;
+    /** borrowed-readonly — the snapshot spec (its roster is faces). NEVER mutated here: the per-task agents rebind returns a
+     *  SHALLOW COPY on {@link PrepareConfigDoorsResult.spec} (only `tools` replaced, each rebuilt entry through the snapshot). */
+    spec: RosterSpec;
     /** borrowed-readonly — deployment seats. Read for: the two containment-face value screens, locked-config preflight,
      *  retention door, interaction-posture door (incl. `deps.onError` disclosure), usage windows,
      *  brain-call guardrail default, model/role maps. */
@@ -136,11 +137,10 @@ export interface PrepareConfigDoorsResult {
      *  `spec.agents` was set, in which case it is a shallow copy whose `tools` is the
      *  withAgents-rebuilt roster. Every later phase (the safety scan above all — T21) must read THIS,
      *  never the original input. */
-    spec: TaskSpec;
-    /** owned — the frozen task-start snapshot of the caller's tool-face control arrays; the ONLY thing
-     *  later face reads consult (own-task filter, defer classify, delegation ctx). Frozen-immutable ⇒
-     *  shared by reference into tool execution ctxs. */
-    toolFaceSnapshot: ToolFaceSnapshot;
+    spec: RosterSpec;
+    /** owned — the frozen task-start copies of the caller's tool-face control arrays; the driver compiles the leg's selector
+     *  from them, and the selector (with the disclosure lists) is the ONLY thing later face reads consult. Frozen-immutable. */
+    toolFaceLists: ToolFaceLists;
     /** owned — the profile half of the single decision point (model-independent by contract). */
     promptProfile: "simple" | "classic";
     /** owned — the administrator lock snapshot; the rest of prepare reads guarded slots through it. */

package/dist/core/runner/prepare-config-doors.js

@@ -1,6 +1,7 @@
 import { resolveBrainCallGuardrailMs } from "../../brain/timeout.js";
 import { assertContainmentFaceValue } from "../../tools/fs/index.js";
 import { MICRO_COMPACT_MACHINES } from "../context-edit.js";
+import { assertAddOnlySeats } from "../child-clamp-seats.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { assertAutoConsolidationWirable } from "./memory-consolidation-driver.js";
@@ -16,6 +17,7 @@ import { deriveAskEffective, resolveAskSeat, resolveQuestionSeam } from "../wiri
 import { assertPeerPresenceValue } from "../../agents/peer-directory.js";
 import { snapshotDefinitionLists } from "../../agents/tool-filter.js";
 import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
+import { rosterFaceOf } from "./caller-roster.js";
 const TASK_LIMIT_KEY_DICT = {
     maxTokens: true,
     maxCostUsd: true,
@@ -166,10 +168,12 @@ export function prepareConfigDoors(input) {
             }
         }
     };
+    assertToolNameListValue(spec.allowTools, "allowTools");
     assertToolNameListValue(spec.excludeTools, "excludeTools");
     assertToolNameListValue(spec.deferTools, "deferTools");
     assertToolNameListValue(spec.alwaysLoadTools, "alwaysLoadTools");
-    const toolFaceSnapshot = {
+    const toolFaceLists = {
+        allow: spec.allowTools ? Object.freeze([...spec.allowTools]) : undefined,
         exclude: spec.excludeTools ? Object.freeze([...spec.excludeTools]) : undefined,
         defer: spec.deferTools ? Object.freeze([...spec.deferTools]) : undefined,
         alwaysLoad: spec.alwaysLoadTools ? Object.freeze([...spec.alwaysLoadTools]) : undefined,
@@ -196,6 +200,7 @@ export function prepareConfigDoors(input) {
     assertContainmentFaceValue(deps.readFace, "read", "deps");
     assertContainmentFaceValue(spec.writeFace, "write", "spec");
     assertContainmentFaceValue(deps.writeFace, "write", "deps");
+    assertAddOnlySeats(spec);
     const memoryDelegationEvidenceRaw = deps.memoryDelegationEvidence;
     if (memoryDelegationEvidenceRaw !== undefined && memoryDelegationEvidenceRaw !== "static-face" && memoryDelegationEvidenceRaw !== "attested-only") {
         const evidence = memoryDelegationEvidenceRaw;
@@ -364,11 +369,11 @@ export function prepareConfigDoors(input) {
         spec = {
             ...spec,
             agents: perTask,
-            tools: pool.map((t) => {
+            tools: pool.map((t, index) => {
                 if (typeof t.withAgents !== "function")
                     return t;
                 const rebuilt = t.withAgents(perTask);
-                return t.modelGate !== undefined && rebuilt.modelGate === undefined ? { ...rebuilt, modelGate: t.modelGate } : rebuilt;
+                return rosterFaceOf(t.modelGate !== undefined && rebuilt.modelGate === undefined ? { ...rebuilt, modelGate: t.modelGate } : rebuilt, index);
             }),
         };
     }
@@ -409,7 +414,7 @@ export function prepareConfigDoors(input) {
         tools: spec.tools,
         modelId: model.id,
         depsSeat: deps.toolModelGate,
-        restoreGated: toolFaceSnapshot.restoreGated,
+        restoreGated: toolFaceLists.restoreGated,
         envRaw: process.env.SEMA_TOOL_MODEL_GATE,
     });
     if (gateDecision.survivors !== undefined) {
@@ -431,7 +436,7 @@ export function prepareConfigDoors(input) {
         : roleModelIfSet("summarize", spec, deps);
     return {
         spec,
-        toolFaceSnapshot,
+        toolFaceLists,
         promptProfile,
         lockedPreflight,
         resolvedInteractionPosture,

package/dist/core/runner/prepare-defer-classify.d.ts

@@ -16,8 +16,8 @@ export interface PrepareDeferClassifyInput {
      *  (element replacement with the wrapped object), the disclosure mount, the MCP refresh re-splice. Since
      *  Every one of those writes is a builder verb (`unmountWhere` / `replaceAt`). */
     roster: RosterBuilder;
-    /** borrowed-readonly — the frozen task-start tool face: `exclude` (the valve), `defer` (operator defers, exact wire names), `alwaysLoad` (the pins). */
-    toolFaceSnapshot: Pick<ToolFaceSnapshot, "exclude" | "defer" | "alwaysLoad">;
+    /** borrowed-readonly — the frozen task-start tool face: the selector (the valve, and whether the search tool deferral needs is admitted), `defer` (operator defers, exact wire names), `alwaysLoad` (the pins). */
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector" | "defer" | "alwaysLoad">;
     /** borrowed-readonly — whether a real execution env is mounted (the full-shell invariant runs only where a shell could be on the roster). */
     handsEnabled: boolean;
     /** borrowed-readonly — the spec-time precomputation the invariant checks the post-exclusion roster against: a mismatch is an engine bug, thrown. */

package/dist/core/runner/prepare-defer-classify.js

@@ -21,9 +21,8 @@ export function prepareDeferClassify(input) {
     if (spec.excludeAllTools === true) {
         roster.unmountWhere(() => true);
     }
-    else if (toolFaceSnapshot.exclude !== undefined && toolFaceSnapshot.exclude.length > 0) {
-        const excluded = new Set(toolFaceSnapshot.exclude);
-        roster.unmountWhere((t) => excluded.has(t.name));
+    else {
+        roster.unmountWhere((t) => !toolFaceSnapshot.selector.admits(t));
     }
     if (handsEnabled) {
         const fullShellOnRoster = tools.some((t) => t.name === "Bash" && getToolContract(t, "core").contractId === FULL_SHELL_CONTRACT_ID);
@@ -48,6 +47,7 @@ export function prepareDeferClassify(input) {
         .map((t) => t.name);
     const resolvedToolSearch = resolveToolSearch(deps.toolSearch);
     const toolSearchSeat = toolSearchSettingOf(resolvedToolSearch);
+    const toolSearchAdmitted = toolFaceSnapshot.selector.admits({ name: TOOL_SEARCH_NAME });
     const classifyDeferredOverFace = (face, builtinDeferNames) => {
         const mounted = new Set(face.map((t) => t.name));
         const classified = classifyDeferredWithGate({
@@ -69,6 +69,8 @@ export function prepareDeferClassify(input) {
         for (const n of [...deferredSet])
             if (!mounted.has(n))
                 deferredSet.delete(n);
+        if (!toolSearchAdmitted)
+            deferredSet.clear();
         return deferredSet;
     };
     const sharedMemoryPair = sharedMemoryPairMounted ? SHARED_MEMORY_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n)) : [];

package/dist/core/runner/prepare-delegation-surface.d.ts

@@ -88,7 +88,7 @@ export interface PrepareDelegationSurfaceInput {
      *  (membership minted at the mount). */
     envHandToolNames: Set<string>;
     /** borrowed-readonly — the frozen tool-face snapshot (`exclude` feeds the ListAgents mount predicate). */
-    toolFaceSnapshot: Pick<ToolFaceSnapshot, "exclude">;
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector">;
     /** borrowed-readonly — the large-result wrapper for first-party mounts. */
     firstPartyOffload: (tool: AgentTool) => AgentTool;
     /** borrowed-readonly — the run's offload store, or undefined when offload is disabled (then no reader mounts and the

package/dist/core/runner/prepare-delegation-surface.js

@@ -54,7 +54,7 @@ export function prepareDelegationSurface(input) {
                 ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
                 ...(deps.mailboxStore !== undefined ? { mailbox: deps.mailboxStore } : {}),
                 ...(reviveSpawn !== undefined ? { reviveSpawn } : {}),
-                ...(peerLaneActive ? peerLaneSendMessageSeats({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, ...(internals?.explicitAgentName !== undefined ? { name: internals.explicitAgentName } : {}), refs: peerLaneRefs, listingMounted: listAgentsMountable({ exclude: toolFaceSnapshot.exclude, specTools: spec.tools ?? [] }) }) : {}),
+                ...(peerLaneActive ? peerLaneSendMessageSeats({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, ...(internals?.explicitAgentName !== undefined ? { name: internals.explicitAgentName } : {}), refs: peerLaneRefs, listingMounted: listAgentsMountable({ selector: toolFaceSnapshot.selector, specTools: spec.tools ?? [] }) }) : {}),
                 onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
                 onTranscriptIntegrityGap: (handle, scope) => deliverEngineNotice(deps.onNotice, {
                     code: "delegation.transcript_integrity",
@@ -80,11 +80,11 @@ export function prepareDelegationSurface(input) {
             }
         }
     }
-    if (sessionBox !== undefined && internals?.onTaskNotification !== undefined && !(toolFaceSnapshot.exclude ?? []).includes(READ_INBOX_TOOL_NAME) && !(spec.tools ?? []).some((t) => t.name === READ_INBOX_TOOL_NAME)) {
+    if (sessionBox !== undefined && internals?.onTaskNotification !== undefined && toolFaceSnapshot.selector.admits({ name: READ_INBOX_TOOL_NAME }) && !(spec.tools ?? []).some((t) => t.name === READ_INBOX_TOOL_NAME)) {
         toolEffects.set(READ_INBOX_TOOL_NAME, "read");
         roster.mount(firstPartyOffload(createReadInboxTool({ pull: () => peerLaneRefs.pull })), { source: "builtin", mountedBy: "peerLane" });
     }
-    const listAgents = (peerLaneActive || delegationSurfaceActive) && peerSendMessageBuiltIn && listAgentsMountable({ exclude: toolFaceSnapshot.exclude, specTools: spec.tools ?? [] }) ? mountListAgents({ ...(peerLaneActive ? { peerDirectory: deps.peerDirectory } : {}), freshWindowMs: resolvePeerLaneConfig(deps.peerLane, deps.onNotice).listingFreshWindowMs, sessionId, scope: taskScope, hostTaskId, ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}), ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}), registry: defaultTaskRegistry, ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}), ...(sendMessageTier !== undefined ? { continuationTier: sendMessageTier } : {}), ...(checkpointSeat !== undefined ? { readSeats: { checkpointSeat } } : {}), specTools: spec.tools ?? [], toolEffects }) : undefined;
+    const listAgents = (peerLaneActive || delegationSurfaceActive) && peerSendMessageBuiltIn && listAgentsMountable({ selector: toolFaceSnapshot.selector, specTools: spec.tools ?? [] }) ? mountListAgents({ ...(peerLaneActive ? { peerDirectory: deps.peerDirectory } : {}), freshWindowMs: resolvePeerLaneConfig(deps.peerLane, deps.onNotice).listingFreshWindowMs, sessionId, scope: taskScope, hostTaskId, ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}), ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}), registry: defaultTaskRegistry, ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}), ...(sendMessageTier !== undefined ? { continuationTier: sendMessageTier } : {}), ...(checkpointSeat !== undefined ? { readSeats: { checkpointSeat } } : {}), specTools: spec.tools ?? [], toolEffects }) : undefined;
     if (listAgents !== undefined)
         roster.mount(firstPartyOffload(listAgents), { source: "builtin", mountedBy: "peerLane" });
     if (backgroundTaskToolsActive) {

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -2,7 +2,7 @@
  * PrepareTask's two GATE STATIONS, verbatim from the driver: the `tool_call` station (the final-roster
  * effect sync, the write-protection judge compiled once per task, the arming predicate, the compliance and plan-mode
  * short-circuits, the `runToolGate` call with every seat it is handed, the lifecycle sweep, the deferred sandbox-admission
- * disclosure, the PreToolUse context stash, the settlement sideband write and the bare-human-rejection boundary) and the
+ * disclosure, the PreToolUse context stash, the gate record's write on the call's occurrence and the bare-human-rejection boundary) and the
  * `tool_result` station's registration (its body, the PostToolUse / PostToolUseFailure seats and the PreToolUse context
  * drain, lives in call-hook-stations.ts). The two module-scope
  * helpers only these stations called moved with them (the settlement screen, the rejection-boundary judgment). The
@@ -131,9 +131,9 @@ export interface PrepareGateStationsInput {
     /** borrowed-mutable — PreToolUse `additionalContext` per call id. Writers here: the `tool_call` station's stash (`set`, only
      *  for calls that will execute) and the `tool_result` station's one-shot drain (`delete`). */
     preToolContexts: Map<string, string[]>;
-    /** borrowed-mutable — the gate-outcome sideband (`Prepared.gateOutcomes`). Writer here: the single screened write per
-     *  gated call (the two short-circuits and the gate's terminal exits); the frame mint reads and deletes. */
-    gateOutcomes: Prepared["gateOutcomes"];
+    /** borrowed-mutable — the leg's occurrence table (`Prepared.toolOccurrences`). Writers here: the one screened gate record per
+     *  gated call, and the wait-on-the-person count around the gate's two asking seats. */
+    toolOccurrences: Prepared["toolOccurrences"];
     /** borrowed-mutable — the turn halt fact (`Prepared.batchHaltRef`). Writer here: the bare-rejection boundary (`current`). */
     batchHaltRef: Prepared["batchHaltRef"];
     /** borrowed-readonly — whether blocked/suspended ids are tracked at all (the post-tool callbacks exist). */

package/dist/core/runner/prepare-gate-stations.js

@@ -3,7 +3,7 @@ import { mountedToolRequiresUserInteraction } from "../mode-policy.js";
 import { complianceCallDenial } from "../compliance.js";
 import { cloneObserverInput, formatHookFeedback, runToolGate } from "../hooks.js";
 import { screenGateOutcome } from "../gate-outcome.js";
-import { directDeny } from "./gate-exit.js";
+import { directDeny, frozenInputSnapshot } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
@@ -46,7 +46,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement, seatInputsFor } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement, seatInputsFor } = input;
     const gatePreToolUse = ownGatePreToolUse !== undefined ? (name, args, ctx) => ownGatePreToolUse(name, args, { ...ctx, permissionMode: permissionMode.observed }) : undefined;
     const releasesAnnounced = new Map();
     const onModeReleased = (info) => {
@@ -92,6 +92,7 @@ export function prepareGateStations(input) {
             harness.on("tool_call", async (called) => {
                 const e = { ...called, toolName: rosterToolName(toolRosterDeltas.current, called.toolName) };
                 const call = { toolName: e.toolName, ...callFaceSeat(toolCallFaceOf(toolRosterDeltas.current, called.toolName)) };
+                toolOccurrences.ensure({ toolCallId: e.toolCallId, spelledName: called.toolName, wireName: e.toolName, args: called.input });
                 const tierSeat = seatOf("gate.shellSeat", irreversibilityTier, call);
                 const markSources = new Set(heldValues("gate.markSources", toolMarkSources, call).flatMap((s) => [...s]));
                 blockedToolCalls.delete(e.toolCallId);
@@ -102,9 +103,10 @@ export function prepareGateStations(input) {
                         if (blockedTracked)
                             blockedToolCalls.add(e.toolCallId);
                         const gate = directDeny("compliance");
-                        gateOutcomes.set(e.toolCallId, gate);
+                        const finalInput = frozenInputSnapshot(e.input);
+                        toolOccurrences.gateRound(e.toolCallId, gate, finalInput);
                         if (notifyPermissionDenied) {
-                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, gate, identity: hookIdentity, permissionMode: permissionMode.observed });
+                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(finalInput), toolCallId: e.toolCallId, reason: complianceDeny, gate, identity: hookIdentity, permissionMode: permissionMode.observed });
                         }
                         return { block: true, reason: formatHookFeedback(complianceDeny, reminderMark), preToolContext: [] };
                     }
@@ -124,9 +126,9 @@ export function prepareGateStations(input) {
                         ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
                         toolFaceOf: (name) => toolCallFaceOf(toolRosterDeltas.current, name === e.toolName ? called.toolName : name),
                         adjudicate,
-                        resolveAsk: resolveAskBound,
+                        resolveAsk: (...args) => toolOccurrences.whileAwaitingUser(args[1].toolCallId, () => resolveAskBound(...args)),
                         suspendAsk,
-                        resolveContentAsk,
+                        resolveContentAsk: (...args) => toolOccurrences.whileAwaitingUser(args[0].toolCallId, () => resolveContentAsk(...args)),
                         egress: heldBy("gate.egress", egressTools, call),
                         peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
@@ -224,7 +226,7 @@ export function prepareGateStations(input) {
                 for (const defect of screened.defects)
                     deps.onError?.(new Error(defect), { phase: "config", sessionId });
                 if (screened.gate !== undefined)
-                    gateOutcomes.set(e.toolCallId, screened.gate);
+                    toolOccurrences.gateRound(e.toolCallId, screened.gate, result.finalInput);
                 if (result.block) {
                     const haltRemaining = maybeHumanRejectionHalt({
                         gate: screened.gate,

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -11,6 +11,7 @@ import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import { type ArtifactStoreRef, type GrantReadRoot } from "./read-root-grant.js";
 import type { StoredSession } from "../session.js";
 import type { IrreversibilityTier, PrepareResume, ReversibilityProbes, RunInternals, ToolFaceSnapshot, ToolProgressLane, WriteFaceSeat } from "./contracts.js";
+import type { ToolOccurrenceTable } from "./tool-occurrence.js";
 import { RosterBuilder } from "../tool-roster.js";
 import type { PermissionMode } from "../ask-origin.js";
 /** Test seam (mirrors `__resetMalformedNoticeSeatAnnouncement`): never called by production code.
@@ -61,13 +62,10 @@ export interface PrepareHandsReadFaceInput {
     denyRuleRows: readonly PathRuleDenyRow[];
     /** borrowed-readonly — the leg's one resolution of where rule heads lead (the rows' twins, the same the gate's lanes read). */
     headLeads: HeadLeads;
-    /** borrowed-readonly — the two judges a shell command's write targets meet for the mode's file-command placement: the
-     *  leg's write-protection judge (read per judgment — it is compiled at the manifest phase, before any gate is mounted)
-     *  and the chain's write-target guard (`toolPolicyWriteTargetGuard`). Absent ⇒ neither (a standalone phase drive). */
-    writeGuards?: {
-        readonly protection: () => ShellReadBoundary["writeProtectionJudge"];
-        readonly target: ShellReadBoundary["writeTargetGuard"];
-    };
+    /** borrowed-readonly — the ONE judgment a shell command's write targets meet for the mode's file-command placement: the
+     *  leg's write judgment over the write-protection table and the chain's guarded write rows (read per judgment — it is
+     *  compiled at the manifest phase, before any gate is mounted). Absent ⇒ none (a standalone phase drive). */
+    writeTargetJudge?: () => ShellReadBoundary["writeTargetJudge"];
     /** borrowed-readonly — the directories of the person's persisted `Read(//dir/**)` allow rows: read directories of this
      *  run, canonicalized and admitted exactly as `additionalReadDirectories` entries are. */
     persistedReadDirectories?: readonly string[];
@@ -112,6 +110,8 @@ export interface PrepareHandsReadFaceInput {
     toolProgressRef: {
         current?: ToolProgressLane;
     };
+    /** borrowed-mutable — the leg's occurrence table; writer here: the shell read station's refused-admission callback. */
+    toolOccurrences: ToolOccurrenceTable;
     /** borrowed-readonly — ABSOLUTE paths this prepare's restore wrote, deleted,
      *  or failed to write. Every read-state seed above describes the PRE-restore tree, so these keys are
      *  dropped from the map: the engine replaced those bytes itself, and a surviving entry makes the

package/dist/core/runner/prepare-hands-readface.js

@@ -16,6 +16,7 @@ import { readRootGrantOver, rootAdmittingArtifactStore } from "./read-root-grant
 import { sessionSeatAnchorHolds } from "./session-read-file-states.js";
 import { rebaseWorkspacePath } from "./workspace-path.js";
 import { RosterBuilder } from "../tool-roster.js";
+import { unionAddOnly } from "../child-clamp-seats.js";
 import { modePolicyOf } from "../mode-policy.js";
 const faceClampAnnouncedSinks = { read: new WeakSet(), write: new WeakSet() };
 const faceClampConsoleAnnounced = { read: false, write: false };
@@ -67,7 +68,6 @@ function writeFaceReader(input, onDeploymentClamp) {
 export function resolveHandsLessReadFace(input) {
     const { resume, fullShellReachable, spec, deps } = input;
     assertStringArraySeat(deps.readDenyPatterns, "RunnerDeps.readDenyPatterns", "compiler-owned");
-    assertStringArraySeat(spec.readDenyPatterns, "TaskSpec.readDenyPatterns", "compiler-owned");
     let handsLessResolvedFace;
     let handsLessResolvedWriteFace;
     let readDenyAdditionsNormalized = [];
@@ -84,7 +84,7 @@ export function resolveHandsLessReadFace(input) {
         const seed = resume?.seed.readFace;
         handsLessResolvedFace = resume !== undefined && (seed === undefined || seed.face === "roots") ? "roots" : liveFace;
         handsLessResolvedWriteFace = writeFaceReader(input);
-        const denyAdditions = [...(deps.readDenyPatterns ?? []), ...(spec.readDenyPatterns ?? []), ...(seed?.denyEntries ?? [])];
+        const denyAdditions = unionAddOnly("readDenyPatterns", deps.readDenyPatterns, spec.readDenyPatterns, seed?.denyEntries);
         readDenyBuiltinTiersActive = activeReadDenyBuiltinTiers(readDenyBuiltinConfigOf({ tiers: deps.readDenyBuiltinTiers, exclude: deps.readDenyBuiltinExclude }));
         if (denyAdditions.length > 0) {
             readDenyAdditionsNormalized = compileReadDeny(denyAdditions, "readDenyPatterns", { tiers: [] }).entries;
@@ -124,7 +124,6 @@ export async function prepareHandsMount(input) {
     assertStringArraySeat(spec.additionalDirectories, "TaskSpec.additionalDirectories", "strings");
     assertStringArraySeat(spec.additionalReadDirectories, "TaskSpec.additionalReadDirectories", "strings");
     assertStringArraySeat(deps.readDenyPatterns, "RunnerDeps.readDenyPatterns", "compiler-owned");
-    assertStringArraySeat(spec.readDenyPatterns, "TaskSpec.readDenyPatterns", "compiler-owned");
     let readFileStateForCheckpoint;
     let sealReadStateSeat;
     let seedContextFiles;
@@ -219,7 +218,7 @@ export async function prepareHandsMount(input) {
             };
         }
         const seedReadFaceSection = resume?.seed.readFace;
-        const readDenyAdditions = [...(deps.readDenyPatterns ?? []), ...(spec.readDenyPatterns ?? []), ...(seedReadFaceSection?.denyEntries ?? [])];
+        const readDenyAdditions = unionAddOnly("readDenyPatterns", deps.readDenyPatterns, spec.readDenyPatterns, seedReadFaceSection?.denyEntries);
         const readDenyBuiltinCfg = readDenyBuiltinConfigOf({ tiers: deps.readDenyBuiltinTiers, exclude: deps.readDenyBuiltinExclude });
         const denyRuleRows = rowsWhereTheyLead(input.denyRuleRows, await input.headLeads.resolve(input.denyRuleRows));
         const readDenyPlacement = await placeReadDenyAtHome(executionEnv, (homes, linked) => compileReadDeny(readDenyAdditions, "readDenyPatterns", readDenyBuiltinCfg, denyRuleRows, homes, linked), undefined, undefined, deps.agentConfigDir);
@@ -301,8 +300,8 @@ export async function prepareHandsMount(input) {
             ...denySeat,
             ...writeDenySeat,
             writeRoots: [rootCanonical, ...additionalRootsCanonical],
-            ...((judge) => (judge !== undefined ? { writeProtectionJudge: judge } : {}))(input.writeGuards?.protection()),
-            ...(input.writeGuards?.target !== undefined ? { writeTargetGuard: input.writeGuards.target } : {}),
+            ...(resolvedWriteFace !== undefined ? { writeFace: resolvedWriteFace.inForce() } : {}),
+            ...((judge) => (judge !== undefined ? { writeTargetJudge: judge } : {}))(input.writeTargetJudge?.()),
             ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}),
         });
         if (handsIncludeShell) {
@@ -315,6 +314,7 @@ export async function prepareHandsMount(input) {
                 seatOf: () => (handsReadOnly ? "readonly" : "full_shell"),
                 boundaryOf: () => readonlyBoundary() ?? shellReadBoundary(), rootsCanonical: true,
                 homeViews: readDenyPlacement.matcher.homeViews,
+                onAdmissionRefused: (toolCallId) => void input.toolOccurrences.refuse(toolCallId, "read_boundary"),
             });
         }
         if (!handsReadOnly) {
@@ -377,7 +377,7 @@ export async function prepareHandsMount(input) {
                 return memoryWriteGate?.(w);
             },
             mountBackgroundTaskTools: false,
-            monitorToolActive: backgroundTaskToolsActive && !(toolFaceSnapshot.exclude?.includes("Monitor") ?? false),
+            monitorToolActive: backgroundTaskToolsActive && toolFaceSnapshot.selector.admits({ name: "Monitor" }),
         });
         {
             const bandNames = new Set(band.flatMap((t) => [t.name, ...(t.aliases ?? [])]));

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -37,6 +37,7 @@ import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type OnQuestion } from "../ask-question.js";
 import { type ParentSpecSeat } from "../parent-spec-seat.js";
+import { type ChildClampSource } from "../child-clamp-seats.js";
 import { type HookEnvCapabilities, type Hooks } from "../hooks.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
@@ -58,6 +59,8 @@ export interface PrepareInheritedGateInput {
     spec: Pick<TaskSpec, "shellGate" | "durableApproval" | "onQuestion" | "handsReadOnly" | "interactiveTools" | "oneShot" | "clientContext" | "principal" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "getApiKeyAndHeaders" | "backgroundScope" | "enablePlanMode" | "excludeAllTools">;
     /** borrowed-readonly — the seat this run hands its children (`checkpointSeatOf`, minted once by the driver after the config doors): the ctx's `checkpointStoreForChildren`, absent when the run has no seat. */
     checkpointSeat: import("../checkpoint-seat.js").CheckpointSeat | undefined;
+    /** borrowed-readonly — this leg's checkpoint scope (the driver's one `checkpointScopeOf` derivation): the ctx's `checkpointScopeForChildren`, which every delegation lane copies into its children's internals. */
+    checkpointScope: string;
     /** borrowed-readonly — the deployment seats: `autoMode.denialLimit` (the rebuilt trackers' bounds), `memoryScopeAdmission` /
      *  `deploymentMemoryScopes` / `compliancePostureResolver` (the governed-provenance bit), `onError` (the screening-face crash
      *  lane), `onNotice` (the stop seat's notice), `executionEnv` (the hook-env identity predicate), `delegationEntryCaps` (resolved
@@ -101,6 +104,8 @@ export interface PrepareInheritedGateInput {
     toolFaceSnapshot: ToolFaceSnapshot;
     /** borrowed-readonly — the ctx's `mountsCallerTool` seat: identity membership in the caller's `spec.tools`, pre-gate. */
     mountsCallerTool: (tool: ToolSpec) => boolean;
+    /** borrowed-readonly — the ctx's `mountedMcp` seat: the MCP surface the run mounts right now (call-time; the roster is minted after this phase). Present iff the run declared a server. */
+    mountedMcp?: () => import("../mounted-mcp.js").MountedMcp;
     /** borrowed-readonly — the resolved prompt profile (ctx seat). */
     promptProfile: ToolExecuteContext["promptProfile"];
     /** borrowed-readonly — the resolved interaction posture (ctx seat; absent ⇒ no key). */
@@ -267,8 +272,6 @@ export interface PrepareInheritedGateResult {
     ownOrgVerdictRef: {
         current: OwnOrgAdmissionVerdict | undefined;
     };
-    /** owned — the org-admission checkpoint stamp predicate (inherited set ∨ own verdict ∨ governed). */
-    orgAdmissionCheckpointState: () => boolean;
     /** owned — the read-face checkpoint section builder (hands-less resume carries the seed; every other leg mints from the live
      *  resolution; undefined for the default posture). */
     faceCheckpointSection: () => {
@@ -278,8 +281,6 @@ export interface PrepareInheritedGateResult {
             caseSensitive: boolean;
         }>;
     } | undefined;
-    /** owned — the face stamp predicate (`faceCheckpointSection() !== undefined`). */
-    faceCheckpointState: () => boolean;
     /** owned — the WRITE-face checkpoint section builder: written ONLY for a non-default (open) write
      *  posture, so an absent section IS "roots" on every reader, including an engine that predates the
      *  seat. No version stamp rides it — dropping the section can only ever make a resume STRICTER
@@ -290,8 +291,6 @@ export interface PrepareInheritedGateResult {
     /** owned — the SKILL-GRANT checkpoint section builder: the rows this run's table grew (the model's activations, a
      *  delegated child's capture), read off the live table at mint time; absent when there are none. */
     skillGrantCheckpointSection: () => import("../skill-grant.js").SkillGrantRecord[] | undefined;
-    /** owned — the F-012 stamp predicate (opaque constraints present ∨ seed frozen chain ∨ provenance-armed). */
-    f012CheckpointState: () => boolean;
     /** owned — the FROZEN approver seat (spec over deps) every station of this leg and its children's chain resolve at. */
     frozenOnAsk: OnAsk | undefined;
     /** owned — the env the screening face sees through `ctx.env` (identity half of a chain entry's `hookEnv`); the policy-chain
@@ -322,6 +321,8 @@ export interface PrepareInheritedGateResult {
     carrierReadFace: () => ContainmentFace | undefined;
     /** owned — the same expression on the WRITE seat. */
     carrierWriteFace: () => ContainmentFace | undefined;
+    /** owned — the run's clamp source (every clamp-carrier row of the clamp table, resolved seats resolved), read at call time by both delegation mounts. */
+    runClampSource: () => ChildClampSource;
     /** owned — the full shell's structural reachability from spec-time facts. */
     fullShellReachable: boolean;
     /** borrowed-mutable — the gate's typed stop seat (`Prepared.gateStopRef`). Writers: `stopForDenialLimit` only. */