@sema-agent/core 7.48.0 → 7.49.1

package/dist/core/runner/prepare-policy-chain.js

@@ -7,8 +7,9 @@ import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
 import { assertHookSeatsCallable } from "../hook-seats.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, wrapToolPolicy, attestAskUnresolvableCause } from "../tool-policy.js";
+import { askApproverIdentity, attest, attestationOf, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, mergeAttestation, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, withAttestation, wrapToolPolicy } from "../tool-policy.js";
 import { judgeRuleToolName, mountedToolNames } from "../tool-name-aliases.js";
+import { approvalCardMemberOf } from "../tool-roster.js";
 import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
 import { skillGrantBindingMembers } from "../skill-grant.js";
@@ -189,11 +190,11 @@ export async function preparePolicyChain(input) {
         return true;
     };
     const mandatedCallFloats = (toolCallId) => resolveCheckpointStore(spec, deps) !== undefined && durableParkOptInDeclared({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined }) && markInheritedUnavailable(toolCallId);
-    const mandateUnreconstructibleDeny = (creq) => attestAskUnresolvableCause({
+    const mandateUnreconstructibleDeny = (creq) => attest({
         action: "deny",
         message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-    }, "mandate_unreconstructible", creq);
-    const markerChannelFullDeny = (creq) => attestAskUnresolvableCause({ action: "deny", message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed` }, "approver_unavailable", creq);
+    }, creq, { unresolvableCause: "mandate_unreconstructible" });
+    const markerChannelFullDeny = (creq) => attest({ action: "deny", message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed` }, creq, { unresolvableCause: "approver_unavailable" });
     const inheritedAskGrants = new Map();
     const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs, settled, classes) => {
         if (typeof approver !== "function")
@@ -357,12 +358,8 @@ export async function preparePolicyChain(input) {
         const ancestorTracker = ancestorAutoMode?.denialTracking;
         let editArgs = edit;
         let settledBy = approved;
-        const vetoed = (d) => {
-            const out = { ...d };
-            carryEngineAttestations(d, out);
-            carryPrecedingSettlement(settledBy, out);
-            return out;
-        };
+        const onApproval = (d) => withAttestation(d, mergeAttestation(creq, attestationOf(settledBy, creq), attestationOf(d, creq), "answer"));
+        const vetoed = onApproval;
         for (let round = 0;; round++) {
             if (round >= 3) {
                 return vetoed({
@@ -385,19 +382,13 @@ export async function preparePolicyChain(input) {
                 return vetoed(re);
             if (re.action === "allow") {
                 const stated = re.updatedInput === undefined ? "mode" : re.decisionReason;
-                const out = { action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs, ...(stated !== undefined ? { decisionReason: stated } : {}) };
-                carryEngineAttestations(re, out);
-                carryPrecedingSettlement(settledBy, out);
-                return out;
+                return onApproval(withAttestation({ action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs, ...(stated !== undefined ? { decisionReason: stated } : {}) }, re.attestation));
             }
             if (re.updatedInput !== undefined)
                 editArgs = re.updatedInput;
             const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
-                const cleared = { ...judged.result };
-                carryEngineAttestations(judged.result, cleared);
-                carryPrecedingSettlement(settledBy, cleared);
-                return cleared;
+                return onApproval(judged.result);
             }
             if (judged.kind === "deny")
                 return vetoed(judged.result);
@@ -405,9 +396,7 @@ export async function preparePolicyChain(input) {
             re = editAsk;
             const editArbitrated = arbitrateInherited(re, creq.toolCallId, judged);
             if (editArbitrated !== undefined) {
-                const out = editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs, decisionReason: "mode" } : editArbitrated;
-                carryPrecedingSettlement(settledBy, out);
-                return out;
+                return onApproval(editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs, decisionReason: "mode" } : editArbitrated);
             }
             const { resolved: rr, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
                 toolName: creq.toolName,
@@ -417,22 +406,20 @@ export async function preparePolicyChain(input) {
                 ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
                 ...askSourceIdentity(),
                 ...riskAxesOf(creq),
+                ...approvalCardMemberOf(creq),
                 ...grantBindingOf(creq, editArgs),
                 ...(j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 ...askMandateMember(ancestorFacts(j.ask)),
                 ...inheritedAskCarry(j, isLiveApproverSeat(onAskOf), ancestorTracker),
                 ruleEvidence: inheritedAskEvidence,
-            }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), ancestorTracker, creq.toolName, inheritedStationFacts(creq));
+            }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), ancestorTracker, creq, inheritedStationFacts(creq));
             void settleReadRootGrant(rr.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
             settleDenialLimitFallback({ fallback: settled.fallback, mintedHere: settled.mintedHere, tracker: ancestorTracker, resolved: rr, headless: headlessDenyAtRecheck, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
             if (rr.action !== "allow")
                 return rr;
             settledBy = rr;
-            if (rr.updatedInput === undefined) {
-                const out = { action: "allow", updatedInput: editArgs, decisionReason: "mode" };
-                carryPrecedingSettlement(rr, out);
-                return out;
-            }
+            if (rr.updatedInput === undefined)
+                return onApproval({ action: "allow", updatedInput: editArgs, decisionReason: "mode" });
             editArgs = rr.updatedInput;
         }
     };
@@ -497,12 +484,13 @@ export async function preparePolicyChain(input) {
                         ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
                         ...askSourceIdentity(),
                         ...riskAxesOf(creq),
+                        ...approvalCardMemberOf(creq),
                         ...grantBindingOf(creq, presentedArgs),
                         ...(j.ask.action === "ask" && j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                         ...askMandateMember(ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
                         ...inheritedAskCarry(j, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                         ruleEvidence: inheritedAskEvidence,
-                    }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq.toolName, inheritedStationFacts(creq));
+                    }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq, inheritedStationFacts(creq));
                     void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
                     const askWaitMs = Math.max(0, now() - askT0);
                     if (resolved.action === "deny" && resolved.approverUnavailable === true) {
@@ -570,12 +558,13 @@ export async function preparePolicyChain(input) {
                     ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq),
+                    ...approvalCardMemberOf(creq),
                     ...grantBindingOf(creq, presentedArgs),
                     ...(j.ask.action === "ask" && j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     ...askMandateMember(ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
                     ...inheritedAskCarry(j, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                     ruleEvidence: inheritedAskEvidence,
-                }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq.toolName, inheritedStationFacts(creq));
+                }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq, inheritedStationFacts(creq));
                 void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
                 const askWaitMs = Math.max(0, now() - askT0);
                 if (resolved.action === "deny" && resolved.approverUnavailable === true) {
@@ -594,9 +583,7 @@ export async function preparePolicyChain(input) {
                 }
                 if (decision.updatedInput === undefined)
                     return resolved;
-                const approvedWithRewrite = { ...resolved, updatedInput: decision.updatedInput };
-                carryEngineAttestations(resolved, approvedWithRewrite);
-                return approvedWithRewrite;
+                return { ...resolved, updatedInput: decision.updatedInput };
             }));
     const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
     const rewriteEmitterIndex = new Map();
@@ -656,16 +643,13 @@ export async function preparePolicyChain(input) {
             const finalRead = withArgsReading(req, decision.updatedInput, signal);
             const finalReq = finalRead !== undefined ? await finalRead : { ...req, args: decision.updatedInput };
             let asked;
-            const revalidated = {};
+            let revalidated;
             let restated;
             try {
                 for (const layer of recheckLayers) {
                     const d = refuseOutOfContractDecision(await layer.check(finalReq, signal));
                     if (d.action === "deny") {
-                        const carried = { ...d, updatedInput: decision.updatedInput };
-                        carryEngineAttestations(d, carried);
-                        carryPrecedingSettlement(decision, carried);
-                        return carried;
+                        return withAttestation({ ...d, updatedInput: decision.updatedInput }, mergeAttestation(req, attestationOf(decision, req), attestationOf(d, req), "answer"));
                     }
                     if (d.updatedInput !== undefined) {
                         return {
@@ -678,22 +662,18 @@ export async function preparePolicyChain(input) {
                         asked = d;
                     if (d.action === "allow" && restated === undefined && d.decisionReason !== undefined)
                         restated = d.decisionReason;
-                    carryEngineAttestations(d, revalidated);
+                    revalidated = mergeAttestation(req, revalidated, d.attestation);
                 }
             }
             finally {
                 rewriteEmitterIndex.delete(req.toolCallId);
             }
             if (asked !== undefined && decision.action === "allow") {
-                const surfaced = { ...asked, updatedInput: decision.updatedInput };
-                carryEngineAttestations(asked, surfaced);
-                return surfaced;
+                return { ...asked, updatedInput: decision.updatedInput };
             }
             if (decision.action === "allow") {
                 const owned = { ...decision, ...(decision.decisionReason === undefined && restated !== undefined ? { decisionReason: restated } : {}) };
-                carryEngineAttestations(decision, owned);
-                carryEngineAttestations(revalidated, owned);
-                return owned;
+                return withAttestation(owned, mergeAttestation(req, attestationOf(decision, req), revalidated));
             }
             return decision;
         })

package/dist/core/runner/prepare-project-context.d.ts

@@ -62,7 +62,7 @@ export interface PrepareProjectContextInput {
      *  is judged on the ALREADY-MOUNTED read face (names + aliases). */
     roster: RosterBuilder;
     /** borrowed-readonly — the frozen task-start tool face; only `exclude` is read (pair yield ①). */
-    toolFaceSnapshot: Pick<ToolFaceSnapshot, "exclude">;
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector">;
     /** borrowed-readonly — the once-per-session announcement ledger; only its deduplicated `onError`
      *  sink is invoked (a pair's mount shape is a session-level fact, announced once). */
     onceLedger: AnnounceOnceSink;

package/dist/core/runner/prepare-project-context.js

@@ -107,19 +107,18 @@ export async function prepareProjectContext(input) {
     const sharedMemoryProvider = deps.sharedMemoryStores;
     let sharedMemoryPairMounted = false;
     if (sharedMemoryProvider !== undefined) {
-        const excluded = new Set(toolFaceSnapshot.exclude ?? []);
         const mountedNameDomain = new Set();
         for (const t of tools) {
             mountedNameDomain.add(t.name);
             for (const alias of t.aliases ?? [])
                 mountedNameDomain.add(alias);
         }
-        const excludedName = SHARED_MEMORY_TOOL_NAMES.find((n) => excluded.has(n));
+        const excludedName = SHARED_MEMORY_TOOL_NAMES.find((n) => !toolFaceSnapshot.selector.admits({ name: n }));
         const occupiedName = SHARED_MEMORY_TOOL_NAMES.find((n) => mountedNameDomain.has(n));
         if (excludedName !== undefined || occupiedName !== undefined) {
             onceLedger.onError(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: ` +
                 (excludedName !== undefined
-                    ? `excludeTools removes "${excludedName}"`
+                    ? `the run's tool selector (allowTools / excludeTools) does not admit "${excludedName}"`
                     : `this task already declares a tool named "${occupiedName}" (the built-in yields to it)`) +
                 " — the pair mounts together or not at all."), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
         }
@@ -139,7 +138,7 @@ export async function prepareProjectContext(input) {
     else if (memoryEngineSession !== undefined && !memorySearchToolsPlanned) {
         onceLedger.onError(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: ` +
             (memoryPairExcludedName !== undefined
-                ? `excludeTools removes "${memoryPairExcludedName}"`
+                ? `the run's tool selector (allowTools / excludeTools) does not admit "${memoryPairExcludedName}"`
                 : `this task already declares a tool named "${memoryPairOccupiedName}" (the built-in yields to it)`) +
             " — these tools mount together or not at all."), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
     }

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -41,6 +41,12 @@ export interface PrepareProtocolToolsInput {
      *  and `mcpImageResizer` ride into the MCP intake; `onError` takes the A2A warnings (no ledger — a peer is
      *  re-read every prepare); `mcpRevocations` + `onNotice` make the revocation wiring. */
     deps: Pick<RunnerDeps, "onElicit" | "mcpImageResizer" | "onError" | "mcpRevocations" | "onNotice">;
+    /** borrowed-readonly — the run tree's MCP connection pool (the leg leases its connections from it) and whether THIS leg created it
+     *  (then this leg's dispose also closes it). Absent for a leg that declares no server. */
+    mcpPool?: {
+        pool: import("../mcp-connection-pool.js").McpConnectionPool;
+        owned: boolean;
+    };
     /** borrowed-readonly — the leg's reminder mark (the MCP intake's disclosure bounding reads it). */
     reminderMark: string;
     /** borrowed-mutable — the reminder-disclosure counters: the MCP intake's bounding writes them here, and
@@ -66,9 +72,9 @@ export interface PrepareProtocolToolsInput {
     rosterSeat: ToolRosterDeltaSeat;
     /** borrowed-readonly — the large-result wrapper for protocol tools (per-tool `_meta` bar, 50K default). */
     remoteToolOffload: (tool: AgentTool) => AgentTool;
-    /** borrowed-readonly — the frozen tool face; `exclude` is read at REFRESH time so a deployment-excluded
-     *  tool is never re-mounted by a model-triggered refresh. */
-    toolFaceSnapshot: Pick<ToolFaceSnapshot, "exclude">;
+    /** borrowed-readonly — the frozen tool face; its selector is read at REFRESH time so a tool the leg may not use is never
+     *  mounted by a model-triggered refresh. */
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector">;
     /** borrowed-mutable — the effect table the fold writes under a has-guard (`?? "write"` default) and the
      *  refresh closure resets per prefix domain before re-folding; RefreshMcpTools registers itself `read`. */
     toolEffects: Map<string, ToolEffect>;

package/dist/core/runner/prepare-protocol-tools.js

@@ -11,7 +11,7 @@ import { mintNamespacePrefix } from "../protocol-naming.js";
 import { applyMcpToolFaces } from "./tool-face-overlay.js";
 import { thrownText } from "../thrown-value.js";
 export async function prepareProtocolTools(input) {
-    const { lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, toolMarkSources, abortController, rollback } = input;
+    const { lockedPreflight, spec, deps, mcpPool, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, toolMarkSources, abortController, rollback } = input;
     const markedBy = (name, source) => {
         const set = toolMarkSources.get(name);
         if (set !== undefined)
@@ -24,7 +24,7 @@ export async function prepareProtocolTools(input) {
         throw Object.assign(new Error(`MCP server name ${JSON.stringify(overPeer.name.slice(0, 40) + "…")} is ${overPeer.name.length} characters; a peer rides every roster row of its tools and the roster's bound on a name is ${TOOL_WIRE_NAME_MAX_CHARS}.`), { code: "config.tool_name_too_long" });
     }
     const mcp = lockedPreflight.mcp?.length
-        ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId))
+        ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId), mcpPool === undefined ? undefined : { pool: mcpPool.pool, ownsPool: mcpPool.owned })
         :
             { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], reconnect: async (server) => ({ server, prefix: mintNamespacePrefix(MCP_NAMESPACE, server), outcome: "not_declared", reason: "this task declared no MCP servers", toolCount: 0, added: [], removed: [] }), dispose: async () => { } };
     if (lockedPreflight.mcp?.length)
@@ -87,7 +87,6 @@ export async function prepareProtocolTools(input) {
                 const lines = [];
                 let changed = false;
                 let anyActiveFailure = false;
-                const excludedSet = new Set(toolFaceSnapshot.exclude ?? []);
                 for (const r of results) {
                     if (r.tools === undefined) {
                         lines.push(`${r.server}: ${r.status}${r.error !== undefined ? ` (${r.error})` : ""}`);
@@ -103,7 +102,7 @@ export async function prepareProtocolTools(input) {
                     }
                     changed = true;
                     const detail = [];
-                    const shownAdded = r.added.filter((n) => !excludedSet.has(n));
+                    const shownAdded = r.added.filter((n) => !applied.excluded.includes(n));
                     if (shownAdded.length > 0)
                         detail.push(`added: ${shownAdded.join(", ")}`);
                     if (r.removed.length > 0)

package/dist/core/runner/prepare-run-refs.d.ts

@@ -23,6 +23,7 @@ import { SkillGrantTable } from "../skill-grant.js";
 import type { Prepared, RunInternals, ToolProgressLane } from "./contracts.js";
 import type { PermissionModeController } from "../mode-policy.js";
 import { type EditedFilesLedger } from "./edited-files-ledger.js";
+import { type ToolOccurrenceTable } from "./tool-occurrence.js";
 export interface PrepareRunRefsInput {
     /** borrowed-readonly — the REBOUND spec. Read: `forwardSubagentEvents` (widens the forwarding filter),
      *  `retainSubagentSessions` (the ledger opt-in and its config), `handsReadOnly` (a read-only run mints no
@@ -63,6 +64,8 @@ export interface PrepareRunRefsResult {
     toolProgressRef: {
         current?: ToolProgressLane;
     };
+    /** borrowed-mutable — the leg's occurrence table (`Prepared.toolOccurrences`), minted before the band that writes it. */
+    toolOccurrences: ToolOccurrenceTable;
     /** borrowed-mutable — the per-task skill grant table (its rows live for this run). Writers: the project-context phase (the
      *  parent's captured rows, the person's invoked skills) and the `Skill` tool minted over it (a successful activation).
      *  Readers: the tool ctx's `activeSkillGrants()` capture and the gate's skill lane. */

package/dist/core/runner/prepare-run-refs.js

@@ -3,6 +3,7 @@ import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { SkillGrantTable } from "../skill-grant.js";
 import { forwardSafely } from "./forward-sink.js";
 import { createEditedFilesLedger } from "./edited-files-ledger.js";
+import { createToolOccurrenceTable } from "./tool-occurrence.js";
 export function forwardsSubagentEvents(spec) {
     return spec.forwardSubagentEvents === true;
 }
@@ -48,5 +49,5 @@ export function prepareRunRefs(input) {
     };
     const subagentRetain = spec.retainSubagentSessions ? new SubagentRetainLedger(spec.retainSubagentSessions) : undefined;
     const worktreeIsolation = spec.handsReadOnly !== true ? createSubagentWorktreeHelper(executionEnv, taskRootFinal) : undefined;
-    return { noteFileEdited, editedFilesSnapshot, harnessRef, toolProgressRef, skillGrants, forwardEvent, reviewRequestRef, requestReview, stopRequestedRef, requestStopAfterTurn, bindPermissionModeSeat, enterPlanMode, subagentRetain, worktreeIsolation };
+    return { noteFileEdited, editedFilesSnapshot, harnessRef, toolProgressRef, toolOccurrences: createToolOccurrenceTable(), skillGrants, forwardEvent, reviewRequestRef, requestReview, stopRequestedRef, requestStopAfterTurn, bindPermissionModeSeat, enterPlanMode, subagentRetain, worktreeIsolation };
 }

package/dist/core/runner/prepare-safety-scan.d.ts

@@ -1,10 +1,11 @@
-import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
+import type { RunnerDeps, ToolEffect } from "../types.js";
 import type { IrreversibilityTier, ReversibilityProbes } from "./contracts.js";
 import type { ToolMarkSource } from "../ask-origin.js";
+import type { RosterSpec } from "./caller-roster.js";
 export interface PrepareSafetyScanInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`, the config-doors result). The scan reads
-     *  `tools`, `handsReadOnly` and `enablePlanMode`; it never mutates. */
-    spec: TaskSpec;
+     *  `tools`, `handsReadOnly` and `enablePlanMode`; it never mutates. Typed as a spec whose roster is snapshot faces. */
+    spec: RosterSpec;
     /** borrowed-readonly — read only for the hands-enablement fact (`executionEnvFactory`/
      *  `executionEnv` presence gates the hand-band effect preseed). */
     deps: RunnerDeps;
@@ -12,9 +13,6 @@ export interface PrepareSafetyScanInput {
 /**
  * The scan's outputs. Ownership annotations (four-class form):
  *
- * `ownToolNames` is **borrowed-readonly** — a first-await snapshot with no mutation anywhere after
- * the scan (sandbox containment reads the env-hand roster, not this set).
- *
  * The six collections are **borrowed-mutable**: the driver and later phases fold into them IN
  * PLACE (identity is part of the contract — closures alias these exact objects). Mutation owners
  * after this phase, in driver order:
@@ -47,8 +45,6 @@ export interface PrepareSafetyScanResult {
      *  the deployment's own; the protocol fold adds `mcp_annotation` / `a2a_default`). Read by the gate's class
      *  derivation: a mark with no recorded source reads as the deployment's (fail-closed). */
     toolMarkSources: Map<string, Set<ToolMarkSource>>;
-    /** borrowed-readonly — the caller roster's own names, snapshotted before the first await. */
-    ownToolNames: ReadonlySet<string>;
 }
 /** The B-2 phase body — the safety-scan slice, verbatim (see the module header for the contract). */
 export declare function prepareSafetyScan(input: PrepareSafetyScanInput): PrepareSafetyScanResult;

package/dist/core/runner/prepare-safety-scan.js

@@ -51,7 +51,7 @@ export function prepareSafetyScan(input) {
                 ...(t.ruleFace !== undefined ? { ruleFace: t.ruleFace } : {}),
                 ...(t.renderHints !== undefined ? { renderHints: t.renderHints } : {}),
             };
-            const faceProblem = toolFaceProblem(declared, t.parameters);
+            const faceProblem = toolFaceProblem(declared, t.parameters, { toolName: t.name });
             if (faceProblem !== undefined) {
                 const e = new Error(`Tool "${t.name}" declares a face its schema cannot carry: ${faceProblem}.`);
                 e.code = "config.tool_face_invalid";
@@ -145,6 +145,5 @@ export function prepareSafetyScan(input) {
         axisExplicitNegatives,
         reversibilityProbes,
         toolMarkSources,
-        ownToolNames,
     };
 }

package/dist/core/runner/prepare-suspend-saga.d.ts

@@ -19,7 +19,7 @@
 import type { AgentHarness, ExecutionEnv } from "../../internal/harness.js";
 import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
 import type { RemoteExecutionEnv, SnapshotId } from "../remote-env.js";
-import type { CheckpointStore, SerializedCheckpointState } from "../checkpoint-store.js";
+import { type CheckpointStore, type SerializedCheckpointState } from "../checkpoint-store.js";
 import type { RemoteEnvFailureNote, RunnerDeps } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { ReadFileState } from "../../tools/fs/safety.js";
@@ -165,6 +165,12 @@ export interface PrepareSuspendSagaInput {
     hookIdentity: Pick<HookInvocationIdentity, "isDelegatedChild">;
     /** borrowed-readonly — the frozen prepare-time placement resolution (the row's placement stamp). */
     placementRootResolved: string;
+    /** borrowed-readonly — this leg's checkpoint scope (the driver's one `checkpointScopeOf` derivation; the row's `legScope` stamp). */
+    checkpointScope: string;
+    /** borrowed-readonly — the tool-selector layers this leg was spawned under (the live seat, else the resumed row's), the row's `toolCeiling` stamp. */
+    toolCeiling: readonly import("../tool-face.js").ToolSelectorLayer[] | undefined;
+    /** borrowed-readonly — the spawning run's judgment of this leg's own lists, while it is bound to them (`boundToolListsJudgment`), the row's `toolListsJudged` stamp. */
+    toolListsJudged: string | undefined;
     /** borrowed-readonly — the external-content-target fold (the row's monotonic bit). */
     externalContentTargetActive: boolean;
     /** borrowed-mutable — the run-scoped remote-lifecycle failure log (`Prepared.remoteEnvFailures`). Writer here: the

package/dist/core/runner/prepare-suspend-saga.js

@@ -1,5 +1,7 @@
 import { defaultTaskRegistry } from "../task-registry.js";
 import { isRemoteExecutionEnv, isSuspendable, RemoteExecutionError } from "../remote-env.js";
+import { resolveDeclaredFidelity } from "../checkpoint-store.js";
+import { judgeAsStored, stampCheckpointRequirements } from "../checkpoint-requirements.js";
 import { constraintChainDigest, constraintChainEntryOfLayer } from "../tool-policy.js";
 import { raceSettlementAgainstSignal } from "./abort-race.js";
 import { placementValueOrAbsent } from "./checkpoint-scope.js";
@@ -79,7 +81,7 @@ function stampPlacementRootSessionId(placementRootResolved) {
     return placementValueOrAbsent(placementRootResolved);
 }
 export function prepareSuspendSaga(input) {
-    const { gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, reminderMark, handsCwdRef, handsRoot, handsHome, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, inheritedPathRuleAnchors, inheritedPathRuleInstallations, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter } = input;
+    const { gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, reminderMark, handsCwdRef, handsRoot, handsHome, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, inheritedPathRuleAnchors, inheritedPathRuleInstallations, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, checkpointScope, toolCeiling, toolListsJudged, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter } = input;
     if (!gateMachineryActive)
         return { saga: undefined };
     const inFlightSpendMicroUsd = () => {
@@ -175,6 +177,9 @@ export function prepareSuspendSaga(input) {
         isDelegatedChild: hookIdentity.isDelegatedChild ? true : undefined,
         placementRootSessionId: stampPlacementRootSessionId(placementRootResolved),
         externalContentTarget: externalContentTargetActive ? true : undefined,
+        legScope: checkpointScope,
+        toolCeiling: toolCeiling !== undefined ? toolCeiling.map((l) => ({ ...(l.allow !== undefined ? { allow: [...l.allow] } : {}), deny: [...l.deny] })) : undefined,
+        toolListsJudged,
     });
     const compensatePausedVM = (remoteEnv, snapshotId) => compensateUnparkedPause(remoteEnv, snapshotId, {
         boundMs: PARK_COMPENSATION_TIMEOUT_MS,
@@ -237,13 +242,33 @@ export function prepareSuspendSaga(input) {
                 return "unknown";
             }
         };
+        const compensateNotWritten = async (reason) => {
+            if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
+                const back = await compensatePausedVM(remoteEnv, remoteHandle.snapshotId);
+                if (back.ok)
+                    return { tag: "absent", reason };
+                abortController.abort();
+                void harness.abort();
+                return { tag: "compensation_failed", reason };
+            }
+            return { tag: "absent", reason };
+        };
+        let putAttempted = false;
         try {
-            await checkpointStore.put(token, cp);
+            const fidelity = resolveDeclaredFidelity(checkpointStore, "checkpointStore");
+            const stamped = stampCheckpointRequirements(cp, fidelity);
+            const own = judgeAsStored(stamped, fidelity);
+            if (own.kind !== "ok")
+                throw new Error(`the checkpoint row was not written: ${own.kind === "damaged" ? own.why : "it lists words this engine lacks"}`);
+            putAttempted = true;
+            await checkpointStore.put(token, stamped);
             announceCommittedScreeningPark();
             return { tag: "committed" };
         }
         catch (putErr) {
             deps.onError?.(putErr, { phase: "config", sessionId });
+            if (!putAttempted)
+                return compensateNotWritten("the approval checkpoint was not written (the row failed its own requirement judge before the write; the deployment's error face carries why)");
             const confirmed = await confirmPutOutcome(putErr);
             if (confirmed === "committed") {
                 try {
@@ -273,16 +298,7 @@ export function prepareSuspendSaga(input) {
                 void harness.abort();
                 return { tag: "unknown", reason: unknownReason };
             }
-            const reason = "the approval checkpoint could not be persisted (the store rejected the write; the deployment's error face carries the store's own message)";
-            if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
-                const back = await compensatePausedVM(remoteEnv, remoteHandle.snapshotId);
-                if (back.ok)
-                    return { tag: "absent", reason };
-                abortController.abort();
-                void harness.abort();
-                return { tag: "compensation_failed", reason };
-            }
-            return { tag: "absent", reason };
+            return compensateNotWritten("the approval checkpoint could not be persisted (the store rejected the write; the deployment's error face carries the store's own message)");
         }
     };
     const suspendLoopCapHit = (count, cap, detail) => {

package/dist/core/runner/prepare-task.d.ts

@@ -103,7 +103,7 @@ export declare function effectiveDelegationFacts(internals: Pick<RunInternals, "
  * hooks + external-signal cancellation, and sets up the cache-break detector. **No run-loop control
  * flow** lives here — that stays in the Runner loop.
  */
-export declare function prepareTask(spec: TaskSpec, deps: RunnerDeps, sessions: SessionStore, resume?: PrepareResume, internals?: RunInternals, 
+export declare function prepareTask(request: TaskSpec, deps: RunnerDeps, sessions: SessionStore, resume?: PrepareResume, internals?: RunInternals, 
 /** A TRUSTED self-reference to the Runner, passed by the Runner itself (never a
  *  TaskSpec field) so the `run_workflow` tool can execute child tasks via `runner.runTask`. Undefined when
  *  prepareTask is exercised standalone (then run_workflow is simply not mounted). */