@sema-agent/core 7.49.5 → 7.50.1

package/dist/core/runner/tool-output-projection.d.ts

@@ -1,14 +1,15 @@
 /**
  * The `tool_end` output/structured projection, verbatim from
  * `runtask.ts`'s runLocked R4 phase. Pure functions over the harness `AgentToolResult`: zero closure
- * state, zero runtask coupling — the ONLY module-level input is the size cap below. Event-sequence
- * snapshot pin (recorded before/after the move, byte-equal) guards the projection semantics.
+ * state, zero runtask coupling — the module-level inputs are the text cap below and the shared media budget default
+ * (`mediaBudgetBytes`); the leg hands in its own `mediaByteCapBytes`.
  */
-export declare const toolOutputFrom: (result: unknown) => {
+type ToolOutput = {
     output: unknown;
     truncated: boolean;
     totalChars?: number;
-} | undefined;
+};
+export declare const toolOutputFrom: (result: unknown, mediaByteCapBytes: number | undefined) => ToolOutput | undefined;
 /** The `tool_end.structured` projection over a harness tool result: the CC card when `details.type` names a card
  *  the leg admits, else undefined. Minted per leg by {@link createStructuredProjector}; every body projection takes it
  *  as a parameter — there is no module-level card set to fall back to. */
@@ -23,3 +24,4 @@ export declare function createStructuredProjector(opts?: {
     declaredCards?: Iterable<string>;
     onUndeclared?: (type: string) => void;
 }): StructuredProjector;
+export {};

package/dist/core/runner/tool-output-projection.js

@@ -1,62 +1,81 @@
+import { isTextBlock, renderContentBlock } from "../../internal/llm.js";
+import { imageBytes, mediaBudgetBytes } from "../media-byte-cap.js";
 import { engineCardTypes } from "../tool-registry.js";
 import { readMember } from "../thrown-value.js";
 const MAX_TOOL_END_OUTPUT_CHARS = 16384;
-const safeJsonLength = (v) => {
-    try {
-        return JSON.stringify(v)?.length;
+const marker = (n) => `…[+${n} chars truncated]`;
+const isMediaBlock = (b) => {
+    const block = b;
+    return (block?.type === "image" || block?.type === "document") && typeof block.data === "string";
+};
+const ownChars = (b) => isTextBlock(b) ? b.text.length + (JSON.stringify({ ...b, type: undefined, text: undefined })?.length ?? 2) - 2 : isMediaBlock(b) ? b.data.length : (JSON.stringify(b)?.length ?? 0);
+const boundTextLane = (blocks, lane) => {
+    const sized = lane.map((i) => ({ i, size: ownChars(blocks[i]) }));
+    const stream = sized.reduce((n, { size }, k) => n + size + (k > 0 ? 1 : 0), 0);
+    const forms = new Map();
+    let used = 0;
+    for (const [k, { i, size }] of sized.entries()) {
+        const sep = k > 0 ? 1 : 0;
+        if (used + sep + size <= MAX_TOOL_END_OUTPUT_CHARS) {
+            used += sep + size;
+            forms.set(i, blocks[i]);
+            continue;
+        }
+        const shown = renderContentBlock(blocks[i]).slice(0, Math.max(0, MAX_TOOL_END_OUTPUT_CHARS - used - sep));
+        const notShown = stream - Math.min(MAX_TOOL_END_OUTPUT_CHARS, used + sep) - (isTextBlock(blocks[i]) ? shown.length : 0);
+        forms.set(i, { type: "text", text: shown + marker(notShown) });
+        return { forms, cut: true };
     }
-    catch {
-        return undefined;
+    return { forms, cut: false };
+};
+const wireBytes = (b) => Buffer.byteLength(JSON.stringify(b)) + 1;
+const SUMMARY_RESERVE = wireBytes({ type: "omitted", blocks: Number.MAX_SAFE_INTEGER, bytes: Number.MAX_SAFE_INTEGER, truncated: true }) + 2;
+const fitMedia = (media, budget) => {
+    let used = 0;
+    let degraded = false;
+    const blocks = [];
+    for (const [i, m] of media.entries()) {
+        const cost = used + m.data.length >= budget ? Infinity : wireBytes(m);
+        const kept = used + cost <= budget;
+        const out = kept ? m : { type: m.type, ...(typeof m.mimeType === "string" && m.mimeType.length <= 255 ? { mimeType: m.mimeType } : {}), bytes: imageBytes(m), truncated: true };
+        const outCost = kept ? cost : wireBytes(out);
+        degraded ||= !kept;
+        if (used + outCost > budget) {
+            const rest = media.slice(i);
+            blocks.push({ type: "omitted", blocks: rest.length, bytes: rest.reduce((n, r) => n + imageBytes(r), 0), truncated: true });
+            break;
+        }
+        used += outCost;
+        blocks.push(out);
     }
+    return { blocks, degraded };
 };
-const trunc = (s) => ({
-    text: s.slice(0, MAX_TOOL_END_OUTPUT_CHARS) + `…[+${s.length - MAX_TOOL_END_OUTPUT_CHARS} chars truncated]`,
-    totalChars: s.length,
-});
-export const toolOutputFrom = (result) => {
-    const content = result !== null && typeof result === "object" ? result.content : result;
-    if (content === undefined)
-        return undefined;
-    if (typeof content === "string") {
-        if (content.length <= MAX_TOOL_END_OUTPUT_CHARS)
+const project = (content, mediaByteCapBytes) => {
+    if (!Array.isArray(content)) {
+        const s = typeof content === "string" ? content : (JSON.stringify(content) ?? "");
+        if (s.length <= MAX_TOOL_END_OUTPUT_CHARS)
             return { output: content, truncated: false };
-        const t = trunc(content);
-        return { output: t.text, truncated: true, totalChars: t.totalChars };
+        return { output: s.slice(0, MAX_TOOL_END_OUTPUT_CHARS) + marker(s.length - MAX_TOOL_END_OUTPUT_CHARS), truncated: true, totalChars: s.length };
     }
-    let serialized;
+    const media = content.map(isMediaBlock);
+    const text = boundTextLane(content, content.flatMap((_, i) => (media[i] ? [] : [i])));
+    const limit = mediaBudgetBytes(mediaByteCapBytes);
+    const textBytes = [...text.forms.values()].reduce((n, f) => n + wireBytes(f), 0);
+    const fit = fitMedia(content.filter((_, i) => media[i]), limit === Infinity ? Infinity : Math.ceil((limit * 4) / 3) - SUMMARY_RESERVE - textBytes);
+    if (!text.cut && !fit.degraded)
+        return { output: content, truncated: false };
+    let next = 0;
+    const output = content.flatMap((_, i) => (media[i] ? (fit.blocks[next++] ?? []) : text.forms.has(i) ? [text.forms.get(i)] : []));
+    return { output, truncated: true, totalChars: content.reduce((n, b) => n + ownChars(b), 0) };
+};
+export const toolOutputFrom = (result, mediaByteCapBytes) => {
     try {
-        serialized = JSON.stringify(content) ?? "";
+        const content = result !== null && typeof result === "object" ? result.content : result;
+        return content === undefined ? undefined : project(content, mediaByteCapBytes);
     }
     catch {
-        return { output: "[unserializable tool output]", truncated: false };
-    }
-    if (serialized.length <= MAX_TOOL_END_OUTPUT_CHARS)
-        return { output: content, truncated: false };
-    let anyNonText = false;
-    let trueChars = 0;
-    const raw = Array.isArray(content)
-        ? content
-            .map((b) => {
-            const block = b;
-            if (block?.type === "text" && typeof block.text === "string") {
-                trueChars += block.text.length;
-                return block.text;
-            }
-            anyNonText = true;
-            trueChars += typeof block?.data === "string" ? block.data.length : (safeJsonLength(block) ?? 0);
-            return `[${typeof block?.type === "string" ? block.type : "block"}${typeof block?.mimeType === "string" ? `: ${block.mimeType}` : ""}]`;
-        })
-            .join("\n")
-        : serialized;
-    const totalChars = Array.isArray(content) ? trueChars : serialized.length;
-    if (raw.length > MAX_TOOL_END_OUTPUT_CHARS) {
-        const t = trunc(raw);
-        return { output: t.text, truncated: true, totalChars };
-    }
-    if (!anyNonText) {
-        return { output: raw, truncated: false };
+        return { output: "[unserializable tool output]", truncated: true };
     }
-    return { output: raw, truncated: true, totalChars };
 };
 const CC_DETAIL_TYPES = engineCardTypes();
 export function createStructuredProjector(opts = {}) {

package/dist/core/runner-deps.d.ts

@@ -852,8 +852,9 @@ export interface RunnerDeps {
      * family this seat complements, not replaces — BCE stays the fleet-row lane with registry `a*`
      * handles and ticks; this seat is the leg-identity lane), and workflow-spawned agents. Frames are
      * minted at the child leg's own runner chokepoint and carry the #281 件A identity envelope plus a
-     * terminal status summary — see {@link DelegationLifecycleEvent} for the emission points, the
-     * per-leg semantics and the recorded honest absences. Wire it once at Runner construction; a
+     * terminal status summary; the `spawn` phase is the projection of the child's `task_started` frame
+     * (once per cycle), the `terminal` phase is per leg — see {@link DelegationLifecycleEvent} for the
+     * emission points and the recorded honest absences. Wire it once at Runner construction; a
      * deployment needs NO RunInternals access to observe delegation any more. Observation only — a
      * throwing or rejecting observer is contained ({@link deliverDelegationLifecycle}) and never
      * faults the child run; a PRESENT non-function value here is announced once per process and the
@@ -1446,7 +1447,9 @@ export interface RunnerDeps {
      * CC 2.1.196 `tengu_media_byte_cap` parity). Image reads (`Read` → ImageContent) are per-image-capped but
      * accumulate across turns; this bounds the SUM in the request by stripping the OLDEST images (replaced with a
      * marker) — request-only, non-destructive (the durable session keeps the image; the model can re-Read it).
-     * Default {@link AGGREGATE_MEDIA_BUDGET_BYTES}; set `Infinity`/`0` to disable.
+     * The same budget bounds the media of one `tool_end.output` (spent there as base64 on the wire, x 4/3); both readers
+     * read it through `mediaBudgetBytes`. Default {@link AGGREGATE_MEDIA_BUDGET_BYTES}; set `Infinity`/`0` to disable. A
+     * non-number, `NaN` or a negative is refused at `new Runner` (`config.invalid_argument`), never read as "no budget".
      */
     mediaByteCapBytes?: number;
     /** Optional telemetry fired when {@link mediaByteCapBytes} strips media in a request (CC's

package/dist/core/shared-memory/types.d.ts

@@ -2,8 +2,8 @@
  * design/177 — the SHARED memory-store seam (connected team/deployment memory libraries the model may
  * BROWSE and READ through two tools) and its model-facing constants.
  *
- * Upstream anchor: CC 2.1.223's `memory_list` / `memory_read` pair. The defining property of that face
- * is READ/WRITE ASYMMETRY: the model side has no write channel at all — write governance is an
+ * Upstream anchor: CC 2.1.223's `memory_list` / `memory_read` pair, whose defining property was READ/WRITE
+ * ASYMMETRY (no model-side write channel); CC no longer has that shape — 2.1.296 also mounts `yd` (cli296.js:242348) "memory_write" — and sema keeps the 223 one (KL-878): write governance is an
  * environment concern, and the tool face's entire participation in it is truthfully reporting each
  * store's `writable` bit. sema keeps that structure and pushes the whole credential/consent half onto
  * the HOST (BYOM: core holds no identity face), so this module's seam is a single pull-shaped snapshot

package/dist/core/shell-read-silence.d.ts

@@ -0,0 +1,23 @@
+import type { ShellReadVerdict } from "../tools/fs/shell-read-check.js";
+import type { GatePass } from "./runner/gate-exit.js";
+import type { AskGuard } from "./tool-policy.js";
+/** Whose silence a station's answer carries, each its own class on the question it keeps or mints: unread rows are a rule that could
+ *  not be read (the rule lane's class); the finding `unanswered` is, unless rows are unread, the environment's silence — shell text the
+ *  engine cannot read (a guard) — and the marks only pick whose. Either is a question only a person answers; `probe` follows the finding. */
+export declare function silencedBy(verdict: ShellReadVerdict, d: {
+    readonly guards?: readonly AskGuard[];
+    readonly ruleUnreadable?: unknown;
+}): {
+    ruleUnreadable?: "persisted_rows";
+    guards?: readonly AskGuard[];
+    requiresRealApproval?: true;
+};
+/** The finding `unanswered` IS the silence, applied once, before any disposition arm: a station — a host-mounted one included — may
+ *  spell `vouch` or `mandated` beside it, and neither word vouches for what nobody judged. A deny stands; an ask keeps its words and
+ *  gains the silence's class; an allow becomes the silence's question (`ask.message`), one only a person answers. Nothing is admitted,
+ *  no `probe` is stamped and no grant is offered — the station made no finding. */
+export declare function applyUnansweredSilence(pass: GatePass, verdict: ShellReadVerdict, ask: {
+    readonly message: string;
+    readonly account: string | undefined;
+    readonly tightenedBy: "shell_gate" | "safety";
+}): void;

package/dist/core/shell-read-silence.js

@@ -0,0 +1,18 @@
+export function silencedBy(verdict, d) {
+    const environment = verdict.environmentSilent === true || (verdict.finding === "unanswered" && verdict.rowsUnread !== true);
+    const rows = verdict.rowsUnread === true && d.ruleUnreadable === undefined ? { ruleUnreadable: "persisted_rows" } : {};
+    const guards = environment && d.guards?.includes("unverifiable_shell_text") !== true ? { guards: [...(d.guards ?? []), "unverifiable_shell_text"] } : {};
+    return environment || verdict.rowsUnread === true ? { ...rows, ...guards, requiresRealApproval: true } : {};
+}
+export function applyUnansweredSilence(pass, verdict, ask) {
+    if (verdict.details !== undefined)
+        pass.shellReadDetails = verdict.details;
+    if (pass.decision.action === "ask") {
+        pass.decision = { ...pass.decision, ...silencedBy(verdict, pass.decision) };
+        return;
+    }
+    if (pass.decision.action !== "allow")
+        return;
+    pass.decision = { action: "ask", message: ask.message, decisionReason: "safety", ...silencedBy(verdict, {}), ...(ask.account !== undefined ? { probeReason: ask.account } : {}) };
+    pass.tightenedBy = ask.tightenedBy;
+}

package/dist/core/synthetic-read-verdict.d.ts

@@ -1,24 +1,40 @@
 /**
- * The synthetic-Read DENY judge — "would a `Read` of this file be refused outright?", asked without a call,
- * without an approver and without a hook. One judge, one set of layers, for every consumer that needs the
- * answer for a file the model did not itself ask to read (the changed-file notice today; a user's
- * attachment next). It answers in THREE states and never picks a direction:
+ * The synthetic-call judge — "would this call be refused outright?", asked without a model call, without an
+ * approver and without a hook. One judge, one set of layers, for every consumer that needs the answer for a file the
+ * model did not itself ask to touch. It has TWO FACES over one body (the layer walk below is written once):
+ *
+ *   READ  — a `Read` of a file the model did not ask for (the changed-file notice; a user's attachment). An ordinary
+ *           `ask` — a person's own ask rule — is not a refusal: the person who would answer it is the one asking.
+ *   WRITE — a `Write` of a path the engine itself writes in the background (the memory consolidation run). Every `ask`
+ *           is an objection here: nobody is present to answer it, so a layer that would ask a person refuses the write.
+ *
+ * It never picks a direction. The read face answers in FOUR states:
  *
  *   deny          — some layer refuses it;
- *   no_objection  — every layer it consulted answered and none refused (an `ask` is not a refusal);
- *   unanswerable  — no layer refused, and at least one could not answer (see the table below).
+ *   mandated_ask  — no layer refuses it, and some layer would put the read to a person no rule may answer for
+ *                   (the ask's own mandate reading, {@link ruleClearanceOf}: a real-approval demand, the deployment's
+ *                   own question, an ancestor's, a hook's; or an organization rule's ask) — the person who must
+ *                   answer is not necessarily the one asking;
+ *   no_objection  — every layer it consulted answered and none objected;
+ *   unanswerable  — no layer objected, and at least one could not answer (see the table below).
+ *
+ * The write face answers the same four, with `ask` in place of `mandated_ask`: any layer's ask, mandated or not.
  *
- * The CONSUMER decides where `unanswerable` goes: a notice that merely tells the model a file changed
- * reads it as no objection (the worst case is a notice about a file it then cannot re-read); a face that
- * would put a file's contents in front of the model reads it as a refusal.
+ * ONE PRECEDENCE on both faces: a deny anywhere wins over a held ask, and a held ask over an unanswerable layer; the walk
+ * goes on past an ask (a later layer's deny is the stronger answer). The faces differ only in which asks are held. The
+ * CONSUMER decides where `mandated_ask` and `unanswerable` go: a notice that merely tells the model a file changed reads
+ * both as no objection (the worst case is a notice about a file it then cannot re-read); a face that would put a file's
+ * contents in front of the model reads both as a refusal; a background write reads everything but `no_objection` as a
+ * refusal. Every answer but `unanswerable` names the location the layers judged (`judged`, the canonical view of the
+ * stamped target, when a stamp was taken), so a consumer that resolved the file itself can tell the judged file from the
+ * one it opens.
  *
- * THE LAYERS (every one that can refuse a model's own `Read`): the run's skill deny rows; the
+ * THE LAYERS (every one that can refuse a model's own call): the run's skill deny rows; the
  * deny-narrowing fold (session rules, inherited ancestor rules, frozen constraint projections); the
  * deployment's caller policy; each live inherited parent policy; the person's persisted-rule lane; the org
- * lane. Not consulted, by design: PreToolUse hooks (the deployment's screening of a model's CALL), the
- * permission mode's write gate and the integrity guards (neither refuses a read), and the read-deny table
- * and containment roots (the path's own resolution judges those before this judge is asked). A deny
- * anywhere wins over an unanswerable layer elsewhere.
+ * lane. Not consulted, by design: PreToolUse hooks (the deployment's screening of a model's CALL), the permission mode's write
+ * gate, the integrity guards and the write-protection table (a live `Write` meets them; the read face never needs them and the
+ * write face's background run is not asked), and the read-deny table and containment roots (the path's own resolution judges those first).
  *
  * FAULT → STATE (the live gate's own readings, through the same functions — never a second copy):
  *   | layer                       | fault                                                | state                         |
@@ -28,11 +44,13 @@
  *   | caller / inherited policy   | its deny carries an engine settlement (an approval   | unanswerable `approval_seat`  |
  *   |                             | seat that ended unanswered; in a combinePolicies     |                               |
  *   |                             | composition a rule deny anywhere is returned instead)|                               |
- *   | persisted lane              | store unreadable, throws, times out (readPersistedRuleLane ⇒ `{unreadable}`) | its rows take no part |
+ *   | persisted lane              | a store partition (or all of it) is unreadable, the lane throws, times out (readPersistedRuleLane ⇒ `{unreadable}`) | unanswerable `store_unreadable` (both faces: a row nobody could read may forbid the call) |
  *   | persisted lane              | the call cannot be read against the rows (`reason`) — applyPersistedTightening ⇒ `unreadable` | unanswerable `call_unreadable` |
  *   | org lane                    | unavailable: throws, garbage (readOrgRuleLane)       | unanswerable `org_unavailable` |
+ *   | any policy layer            | answers with a rewrite of the arguments (`updatedInput`) | unanswerable `rewritten`  |
+ *   | inherited parent policy     | answers `ask` (the ancestor's approver's question)    | mandated_ask (write: ask)     |
  *   | any layer                   | the judgment's budget (one dependency timeout, or a  | unanswerable `timed_out`      |
- *   |                             | batch's shared deadline) is spent                    | (persisted: rows take no part)|
+ *   |                             | batch's shared deadline) is spent                    |                               |
  *
  * NEVER AN APPROVER. A deployment policy (the caller's, an inherited parent's) is consulted with an
  * ALREADY-ABORTED signal and no approver seat: the `ToolPolicy.check` contract is that an aborted signal
@@ -45,32 +63,50 @@
  * the notice face stays silent. The engine's own layers (narrowing, skill rows, the two lanes) get the
  * run's real signal: they are pure matchers and store reads.
  *
- * THE PROBE'S IDENTITY. Every layer sees `toolName: "Read"`, the probed arguments, and the stable synthetic
- * call id `<face>-visibility-probe` ({@link syntheticReadProbeId}), so a deployment's audit can tell a
- * visibility probe from a model's call.
+ * THE PROBE'S IDENTITY. Every layer sees the probed tool's name (`Read` / `Write`), the probed arguments, and a stable
+ * synthetic call id (`<face>-visibility-probe` for a read, `<face>-write-probe` for a write; {@link syntheticReadProbeId},
+ * {@link syntheticWriteProbeId}), so a deployment's audit can tell a probe from a model's call. The write face stamps the
+ * facts the live gate stamps on a write (the roster's `Write` face, the tracked cwd and root, the advertised writable
+ * directories, the data root's exemption): a containment fence and a data-root exemption judge the probe as they judge the call.
  */
 import type { ToolCallRequest, ToolCallFace, ToolPolicy } from "./tool-policy.js";
-import type { CallTargetStamp } from "./effective-path-target.js";
+import { type CallTargetStamp } from "./effective-path-target.js";
 import { type SkillGrantLane } from "./skill-grant.js";
 import type { OrgGateVerdict, PersistedRuleAnswer } from "./hooks.js";
 /** The layers the judge consults, as named in its verdicts. */
 export declare const SYNTHETIC_READ_LAYERS: readonly ["skill_rows", "narrowing", "caller_policy", "inherited_constraint", "persisted_rules", "org_rules"];
 export type SyntheticReadLayer = (typeof SYNTHETIC_READ_LAYERS)[number];
 /** Why a layer could not answer — the consumer's disclosure word. */
-export declare const SYNTHETIC_READ_UNANSWERABLE_CAUSES: readonly ["threw", "timed_out", "approval_seat", "call_unreadable", "org_unavailable"];
+export declare const SYNTHETIC_READ_UNANSWERABLE_CAUSES: readonly ["threw", "timed_out", "approval_seat", "call_unreadable", "org_unavailable", "rewritten", "store_unreadable"];
 export type SyntheticReadUnanswerableCause = (typeof SYNTHETIC_READ_UNANSWERABLE_CAUSES)[number];
 export type SyntheticReadVerdict = {
     verdict: "deny";
     layer: SyntheticReadLayer;
     message?: string;
+    judged?: string;
+} | {
+    verdict: "mandated_ask";
+    layer: SyntheticReadLayer;
+    message?: string;
+    judged?: string;
 } | {
     verdict: "no_objection";
+    judged?: string;
 } | {
     verdict: "unanswerable";
     layer: SyntheticReadLayer;
     cause: SyntheticReadUnanswerableCause;
     reason: string;
 };
+/** The write face's answer: the read face's states with `ask` — any layer's ask, mandated or not — in place of `mandated_ask`. */
+export type SyntheticWriteVerdict = Exclude<SyntheticReadVerdict, {
+    verdict: "mandated_ask";
+}> | {
+    verdict: "ask";
+    layer: SyntheticReadLayer;
+    message?: string;
+    judged?: string;
+};
 export interface SyntheticReadLayers {
     skillGrants?: Pick<SkillGrantLane, "denying">;
     denyNarrowingPolicy?: ToolPolicy;
@@ -97,9 +133,27 @@ export interface SyntheticReadCall {
     /** The live roster's face for `Read`, when the consumer has one. */
     face?: ToolCallFace;
 }
+/** The path a synthetic `Write` probes. The request's other facts come from the judge's {@link SyntheticWriteFacts}. */
+export interface SyntheticWriteCall {
+    file_path: string;
+}
+/** The facts the live gate stamps on a write, read at the moment of each judgment (the leg's cells move: the tracked cwd,
+ *  the advertised-directory ledger). Every member is optional — a leg without hands has no roster face, cwd or root. */
+export interface SyntheticWriteFacts {
+    /** The live roster's face for `Write` (a containment fence admits a write only by the tool's own declared path target). */
+    face?: ToolCallFace | undefined;
+    cwd?: string | undefined;
+    root?: string | undefined;
+    advertisedWritableDirs?: {
+        readonly roots: readonly string[];
+    } | undefined;
+    exemptRoots?: readonly string[] | undefined;
+}
 /** The stable synthetic call id a probe carries: `<face>-visibility-probe`, `face` a lowercase word
  *  (letters and hyphens) naming the consumer. */
 export declare function syntheticReadProbeId(face: string): string;
+/** The write face's stable synthetic call id: `<face>-write-probe`, `face` the same lowercase word. */
+export declare function syntheticWriteProbeId(face: string): string;
 /** One judgment's wait budget. `deadlineAt` (epoch ms) bounds the WHOLE judgment — every layer waits at most
  *  what is left of it, and a layer reached after it has passed is not consulted (`timed_out`). Absent ⇒ the
  *  dependency timeout from the start of this judgment. A consumer judging a batch passes one shared deadline,
@@ -108,4 +162,9 @@ export interface SyntheticReadBudget {
     deadlineAt?: number;
 }
 export type SyntheticReadJudge = (call: SyntheticReadCall, face: string, budget?: SyntheticReadBudget) => Promise<SyntheticReadVerdict>;
+export type SyntheticWriteJudge = (call: SyntheticWriteCall, face: string, budget?: SyntheticReadBudget) => Promise<SyntheticWriteVerdict>;
+/** The READ face: only a mandated ask is held (a person's own ask is that person's question). */
 export declare function createSyntheticReadJudge(layers: SyntheticReadLayers): SyntheticReadJudge;
+/** The WRITE face: every ask is held as an objection (no approver is present), and a persisted store that cannot be read is
+ *  unanswerable rather than silent. */
+export declare function createSyntheticWriteJudge(layers: SyntheticReadLayers, facts: () => SyntheticWriteFacts): SyntheticWriteJudge;

package/dist/core/synthetic-read-verdict.js

@@ -1,20 +1,36 @@
-import { attestationOf, describeThrown, refuseOutOfContractDecision } from "./tool-policy.js";
+import { callTargetReadingOf } from "./effective-path-target.js";
+import { advertisedWritableRootsSeat, attestationOf, describeThrown, exemptRootsSeat, refuseOutOfContractDecision } from "./tool-policy.js";
+import { ownedClearanceFacts, ruleClearanceOf } from "./ask-origin.js";
 import { skillRowRefusal } from "./skill-grant.js";
 import { applyPersistedTightening } from "./persisted-rule-arms.js";
 import { readOrgRuleLane, readPersistedRuleLane } from "./rule-lane-reads.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "./permission-rule-org.js";
+import { deepJsonEqual } from "./runner/decide-continuation.js";
 export const SYNTHETIC_READ_LAYERS = Object.freeze(["skill_rows", "narrowing", "caller_policy", "inherited_constraint", "persisted_rules", "org_rules"]);
-export const SYNTHETIC_READ_UNANSWERABLE_CAUSES = Object.freeze(["threw", "timed_out", "approval_seat", "call_unreadable", "org_unavailable"]);
+export const SYNTHETIC_READ_UNANSWERABLE_CAUSES = Object.freeze(["threw", "timed_out", "approval_seat", "call_unreadable", "org_unavailable", "rewritten", "store_unreadable"]);
 export function syntheticReadProbeId(face) {
+    return `${probeFaceWord(face)}-visibility-probe`;
+}
+export function syntheticWriteProbeId(face) {
+    return `${probeFaceWord(face)}-write-probe`;
+}
+function probeFaceWord(face) {
     if (!/^[a-z][a-z-]*$/.test(face))
-        throw new Error(`syntheticReadProbeId: the probe face must be a lowercase word (letters and hyphens), got ${JSON.stringify(face)}`);
-    return `${face}-visibility-probe`;
+        throw new Error(`synthetic probe id: the probe face must be a lowercase word (letters and hyphens), got ${JSON.stringify(face)}`);
+    return face;
 }
 const ABORTED = AbortSignal.abort();
+function sameArguments(value, probed) {
+    try {
+        return deepJsonEqual(value, probed);
+    }
+    catch {
+        return false;
+    }
+}
 export function createSyntheticReadJudge(layers) {
+    const judge = createProbeJudge(layers, "read");
     return async (call, face, budget) => {
-        const deadlineAt = budget?.deadlineAt ?? Date.now() + ORG_ADJUDICATION_TIMEOUT_MS;
-        const left = () => Math.max(0, Math.min(ORG_ADJUDICATION_TIMEOUT_MS, deadlineAt - Date.now()));
         const probe = {
             toolName: "Read",
             args: { file_path: call.file_path, ...(call.offset !== undefined ? { offset: call.offset } : {}), ...(call.limit !== undefined ? { limit: call.limit } : {}) },
@@ -22,32 +38,76 @@ export function createSyntheticReadJudge(layers) {
             ...(call.cwd !== undefined ? { cwd: call.cwd } : {}),
             ...(call.face !== undefined ? { face: call.face } : {}),
         };
+        const v = await judge(probe, budget);
+        return v.verdict === "ask" ? { ...v, verdict: "mandated_ask" } : v;
+    };
+}
+export function createSyntheticWriteJudge(layers, facts) {
+    const judge = createProbeJudge(layers, "write");
+    return async (call, face, budget) => {
+        const f = facts();
+        const probe = {
+            toolName: "Write",
+            args: { file_path: call.file_path, content: "" },
+            toolCallId: syntheticWriteProbeId(face),
+            ...(f.cwd !== undefined ? { cwd: f.cwd } : {}),
+            ...(f.root !== undefined ? { root: f.root } : {}),
+            ...(f.face !== undefined ? { face: f.face } : {}),
+            ...advertisedWritableRootsSeat(f.advertisedWritableDirs),
+            ...(f.exemptRoots !== undefined ? exemptRootsSeat(f.exemptRoots) : {}),
+        };
+        return judge(probe, budget);
+    };
+}
+function createProbeJudge(layers, kind) {
+    const everyAskHeld = kind === "write";
+    return async (probe, budget) => {
+        const deadlineAt = budget?.deadlineAt ?? Date.now() + ORG_ADJUDICATION_TIMEOUT_MS;
+        const left = () => Math.max(0, Math.min(ORG_ADJUDICATION_TIMEOUT_MS, deadlineAt - Date.now()));
+        const probedArgs = structuredClone(probe.args);
         const stamped = layers.stampCallTarget?.(probe, layers.signal);
         const req = stamped !== undefined ? await stamped : probe;
+        const view = callTargetReadingOf(req)?.protective;
+        const judged = view?.kind === "path" && view.canonical !== undefined ? { judged: view.canonical } : {};
         let unanswered;
+        let held;
         const cannot = (layer, cause, reason) => {
             unanswered ??= { verdict: "unanswerable", layer, cause, reason };
         };
+        const ask = (layer, message, mandated) => {
+            if (everyAskHeld || mandated)
+                held ??= { verdict: "ask", layer, ...(message !== undefined ? { message } : {}), ...judged };
+        };
         const spent = (layer) => {
             if (left() > 0)
                 return false;
             cannot(layer, "timed_out", "the judgment's wait budget was spent before this layer was asked");
             return true;
         };
-        const policyLayer = async (layer, policy, signal) => {
+        const policyLayer = async (layer, policy, signal, ancestorOwned = false) => {
             if (spent(layer))
                 return undefined;
             const waitMs = left();
             let timedOut = false;
+            let thrown = undefined;
             const TIMEOUT = Symbol("timeout");
             let d;
             try {
-                d = await settleOrgVerdictWithin(Promise.resolve().then(() => policy.check(req, signal)), TIMEOUT, { ...(layers.signal !== undefined ? { signal: layers.signal } : {}), timeoutMs: waitMs, onFallback: () => void (timedOut = true) });
+                d = await settleOrgVerdictWithin(Promise.resolve()
+                    .then(() => policy.check(req, signal))
+                    .catch((err) => {
+                    thrown = { err };
+                    return TIMEOUT;
+                }), TIMEOUT, { ...(layers.signal !== undefined ? { signal: layers.signal } : {}), timeoutMs: waitMs, onFallback: () => void (timedOut = true) });
             }
             catch (err) {
                 cannot(layer, "threw", describeThrown(err));
                 return undefined;
             }
+            if (thrown !== undefined) {
+                cannot(layer, "threw", describeThrown(thrown.err));
+                return undefined;
+            }
             if (d === TIMEOUT || timedOut) {
                 cannot(layer, "timed_out", `no answer within ${waitMs}ms (or the run ended first)`);
                 return undefined;
@@ -60,18 +120,25 @@ export function createSyntheticReadJudge(layers) {
                 cannot(layer, "threw", describeThrown(err));
                 return undefined;
             }
+            if (read.action !== "deny" && ((read.updatedInput !== undefined && !sameArguments(read.updatedInput, probedArgs)) || !sameArguments(req.args, probedArgs))) {
+                cannot(layer, "rewritten", "the layer would rewrite the call's arguments, so its answer is not about this call");
+            }
+            if (read.action === "ask") {
+                ask(layer, read.message, ancestorOwned || ruleClearanceOf(ownedClearanceFacts(read), {}).mandated);
+                return undefined;
+            }
             if (read.action !== "deny")
                 return undefined;
             if (attestationOf(read, req)?.settlement !== undefined) {
-                cannot(layer, "approval_seat", "the policy would ask an approver, who is never consulted for a visibility probe");
+                cannot(layer, "approval_seat", "the policy would ask an approver, who is never consulted for a synthetic probe");
                 return undefined;
             }
-            return { verdict: "deny", layer, ...(read.message !== undefined ? { message: read.message } : {}) };
+            return { verdict: "deny", layer, ...(read.message !== undefined ? { message: read.message } : {}), ...judged };
         };
         try {
             const refusal = skillRowRefusal(layers.skillGrants, req);
             if (refusal !== undefined)
-                return { verdict: "deny", layer: "skill_rows", ...(refusal.message !== undefined ? { message: refusal.message } : {}) };
+                return { verdict: "deny", layer: "skill_rows", ...(refusal.message !== undefined ? { message: refusal.message } : {}), ...judged };
         }
         catch (err) {
             cannot("skill_rows", "threw", describeThrown(err));
@@ -82,14 +149,14 @@ export function createSyntheticReadJudge(layers) {
                 return v;
         }
         if (layers.callerPolicy !== undefined) {
-            const v = await policyLayer("caller_policy", layers.callerPolicy, ABORTED);
+            const v = await policyLayer("caller_policy", layers.callerPolicy, ABORTED, (layers.inheritedPolicies ?? []).includes(layers.callerPolicy));
             if (v !== undefined)
                 return v;
         }
         for (const parent of layers.inheritedPolicies ?? []) {
             if (parent === layers.callerPolicy)
                 continue;
-            const v = await policyLayer("inherited_constraint", parent, ABORTED);
+            const v = await policyLayer("inherited_constraint", parent, ABORTED, true);
             if (v !== undefined)
                 return v;
         }
@@ -97,17 +164,21 @@ export function createSyntheticReadJudge(layers) {
             const read = await readPersistedRuleLane(layers.persistedRuleLane, req, layers.signal, left());
             const tightened = applyPersistedTightening({ action: "allow" }, read).tightened;
             if (tightened === "deny")
-                return { verdict: "deny", layer: "persisted_rules" };
-            if (tightened === "unreadable")
-                cannot("persisted_rules", "call_unreadable", read.reason ?? "the call could not be read against the rules");
+                return { verdict: "deny", layer: "persisted_rules", ...judged };
+            if (tightened === "ask")
+                ask("persisted_rules", undefined, false);
+            if (read.unreadable === true)
+                cannot("persisted_rules", read.reason !== undefined ? "call_unreadable" : "store_unreadable", read.reason ?? "a partition of the person's rule store could not be read, so whether a standing rule forbids this call is unknown");
         }
         if (layers.orgRuleLane !== undefined && !spent("org_rules")) {
             const org = await readOrgRuleLane(layers.orgRuleLane, req, layers.signal, left());
             if (org.status === "unavailable")
                 cannot("org_rules", left() > 0 ? "org_unavailable" : "timed_out", org.disclosures.join("; ") || "organization governance could not be read");
             else if (org.verdict?.behavior === "deny")
-                return { verdict: "deny", layer: "org_rules", message: `an organization policy rule (${org.verdict.rule}) denies it` };
+                return { verdict: "deny", layer: "org_rules", message: `an organization policy rule (${org.verdict.rule}) denies it`, ...judged };
+            else if (org.verdict?.behavior === "ask")
+                ask("org_rules", `an organization policy rule (${org.verdict.rule}) requires approval for it`, true);
         }
-        return unanswered ?? { verdict: "no_objection" };
+        return held ?? unanswered ?? { verdict: "no_objection", ...judged };
     };
 }