@sema-agent/core 7.5.0 → 7.5.2

package/dist/core/runner/prepare-gate-stations.js

@@ -0,0 +1,290 @@
+import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
+import { complianceCallDenial } from "../compliance.js";
+import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, runHookSeat, runToolGate } from "../hooks.js";
+import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
+import { isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution } from "../tool-policy.js";
+import { emitTrace } from "../trace.js";
+import { createWriteProtectionCheck } from "../write-protect.js";
+import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
+function screenGateSettlement(result, settling) {
+    const defects = [];
+    const reportedBy = result.settledBy;
+    let settledBy;
+    if (reportedBy !== undefined) {
+        if (!isApprovalSettledBy(reportedBy) || (!settling && reportedBy !== "human")) {
+            defects.push(`a tool-gate settlement reported settledBy "${String(reportedBy)}" on ${settling ? "a blocked" : "an executing"} call — ` +
+                `it is one of "human" / "timeout" / "aborted", and only "human" can be the source of a call that runs; the frame carries no source`);
+        }
+        else
+            settledBy = reportedBy;
+    }
+    const attribution = screenApproverAttribution(result.approver);
+    if (attribution.defect !== undefined) {
+        defects.push(`a tool-gate settlement reported an attribution this engine refuses: ${attribution.defect}; the frame carries no approver`);
+    }
+    const reportedResolution = result.resolution;
+    let resolution;
+    if (reportedResolution !== undefined) {
+        if (!isAskDenyResolution(reportedResolution) || !settling) {
+            defects.push(`a tool-gate settlement reported a deny resolution "${String(reportedResolution)}" on ${settling ? "a blocked" : "an executing"} call — ` +
+                `it is one of the closed ask-deny vocabulary and only a BLOCKED call can carry one; the frame carries no resolution`);
+        }
+        else
+            resolution = reportedResolution;
+    }
+    const reportedAutoDenied = result.autoDenied;
+    let autoDenied;
+    if (reportedAutoDenied === true) {
+        if (!settling)
+            defects.push("a tool-gate settlement reported autoDenied on an executing call — only a BLOCKED call can carry the marker; the frame carries none");
+        else
+            autoDenied = true;
+    }
+    const record = {
+        ...(settledBy !== undefined ? { settledBy } : {}),
+        ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}),
+        ...(resolution !== undefined ? { resolution } : {}),
+        ...(autoDenied !== undefined ? { autoDenied } : {}),
+    };
+    return { ...(settledBy !== undefined || attribution.approver !== undefined || resolution !== undefined || autoDenied !== undefined ? { record } : {}), defects };
+}
+function maybeHumanRejectionHalt(input) {
+    if (!input.bare || input.settledBy !== "human" || input.isDelegatedChild)
+        return undefined;
+    return {
+        reason: `This tool call was NOT executed: the user rejected the "${input.toolName}" tool call in the same ` +
+            `assistant message, which stops the rest of the batch. Nothing was run for this call — ` +
+            `re-issue it after the user's direction only if it is still needed.`,
+        details: {
+            error: "gate.batch_halted",
+            code: "gate.batch_halted",
+            rejectedToolCallId: input.toolCallId,
+            rejectedToolName: input.toolName,
+        },
+    };
+}
+export function prepareGateStations(input) {
+    const { askLane, parkAsk, tools, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, humanBareRejections, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, approvalSettlement, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
+    if (askLane !== undefined && parkAsk !== undefined) {
+        const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
+        const { resolveContentAsk, suspendAsk } = parkAsk;
+        for (const t of tools) {
+            const eff = t.effect;
+            if (eff !== undefined && !toolEffects.has(t.name))
+                toolEffects.set(t.name, eff);
+        }
+        const writeProtectionCheck = createWriteProtectionCheck(deps.writeProtectedPaths, deps.memoryEngineDir !== undefined ? { dataRoot: deps.memoryEngineDir } : undefined);
+        const writeProtectionArmed = writeProtectionCheck !== undefined && tools.some((t) => PATH_CONFINABLE_WRITE_TOOLS.has(t.name));
+        toolCallGateArmedRef.armed =
+            effectivePolicy !== undefined ||
+                hooks?.preToolUse !== undefined ||
+                egressTools.size > 0 ||
+                irreversibleTools.size > 0 ||
+                spec.enablePlanMode === true ||
+                complianceDenies.has("web_fetch") ||
+                writeProtectionArmed;
+        if (toolCallGateArmedRef.armed) {
+            harness.on("tool_call", async (e) => {
+                blockedToolCalls.delete(e.toolCallId);
+                inheritedAskGrants.delete(e.toolCallId);
+                humanBareRejections.delete(e.toolCallId);
+                {
+                    const complianceDeny = complianceCallDenial(complianceDenies, e.toolName);
+                    if (complianceDeny !== undefined) {
+                        if (blockedTracked)
+                            blockedToolCalls.add(e.toolCallId);
+                        if (notifyPermissionDenied) {
+                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, source: "safety", identity: hookIdentity });
+                        }
+                        return { block: true, reason: formatHookFeedback(complianceDeny, reminderMark), preToolContext: [] };
+                    }
+                }
+                if (planModeRef.active && (toolEffects.get(e.toolName) ?? "write") !== "read") {
+                    if (blockedTracked)
+                        blockedToolCalls.add(e.toolCallId);
+                    const planDenyReason = `Plan mode is active — "${e.toolName}" is a write/mutating tool and is read-only-blocked. ` +
+                        `Research with read-only tools, then call ${PRESENT_PLAN_TOOL_NAME} with your plan to get it approved before acting.`;
+                    if (notifyPermissionDenied) {
+                        await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: planDenyReason, source: "planMode", identity: hookIdentity });
+                    }
+                    return {
+                        block: true,
+                        reason: formatHookFeedback(planDenyReason, reminderMark),
+                        preToolContext: [],
+                    };
+                }
+                let result;
+                let humanBareRejection = false;
+                try {
+                    result = await runToolGate({
+                        onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
+                        event: e,
+                        ...(e.signal !== undefined ? { callSignal: e.signal } : {}),
+                        identity: hookIdentity,
+                        reminderMark,
+                        preToolUse: ownGatePreToolUse,
+                        hookTimeoutMs,
+                        ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
+                        ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
+                        adjudicate,
+                        resolveAsk: resolveAskBound,
+                        suspendAsk,
+                        resolveContentAsk,
+                        egress: egressTools.has(e.toolName),
+                        peerMessage: e.toolName === SEND_MESSAGE_TOOL_NAME,
+                        ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
+                        irreversibility: irreversibilityTier.get(e.toolName),
+                        reversibilityProbe: reversibilityProbes.get(e.toolName),
+                        abortSignal: abortController.signal,
+                        ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
+                        onHookError: notifyHookError,
+                        shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
+                        ...(autoModeDecider ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}) } } : {}),
+                        onHeadlessDenialLimit: stopForDenialLimit,
+                        ...(permissionRuleLane
+                            ? {
+                                persistedRules: {
+                                    admits: permissionRuleLane.admits,
+                                    onResolved: (info) => emitTrace(deps.tracer, () => ({
+                                        kind: "permission.persisted_rule_allowed",
+                                        version: 2,
+                                        taskId: hostTaskId,
+                                        toolName: info.toolName,
+                                        toolCallId: info.toolCallId,
+                                        rules: [...info.rules],
+                                        ts: Date.now(),
+                                    })),
+                                },
+                            }
+                            : {}),
+                        ...(permissionRuleOrgLane
+                            ? {
+                                orgRules: {
+                                    adjudicate: permissionRuleOrgLane.adjudicate,
+                                    contentAskToolMounted: questionToolMounted,
+                                    onUnavailable: (info) => emitTrace(deps.tracer, () => ({
+                                        kind: "permission.org_snapshot_unavailable",
+                                        version: 1,
+                                        taskId: hostTaskId,
+                                        toolName: info.toolName,
+                                        toolCallId: info.toolCallId,
+                                        message: info.message,
+                                        ts: Date.now(),
+                                    })),
+                                },
+                            }
+                            : {}),
+                        isMarkedUnresolvable: (toolCallId) => inheritedUnavailableAsks.has(toolCallId),
+                        ...(sandboxAdmissionArmed
+                            ? {
+                                sandboxAdmission: {
+                                    askClassesOf: (toolCallId) => foldAskClasses.get(toolCallId),
+                                    boundaryCapable: sandboxBoundaryCapable(e.toolName),
+                                    onAdmitted: emitSandboxAdmitted,
+                                },
+                            }
+                            : {}),
+                    });
+                }
+                finally {
+                    inheritedUnavailableAsks.delete(e.toolCallId);
+                    inheritedAskGrants.delete(e.toolCallId);
+                    foldAskClasses.delete(e.toolCallId);
+                    humanBareRejection = humanBareRejections.delete(e.toolCallId);
+                }
+                const ancestorAdmitted = ancestorSandboxAdmissions.get(e.toolCallId);
+                ancestorSandboxAdmissions.delete(e.toolCallId);
+                if (ancestorAdmitted !== undefined && !result.block && !result.suspend) {
+                    emitSandboxAdmitted({ toolCallId: e.toolCallId, toolName: e.toolName, askClasses: ancestorAdmitted, boundary: "sandbox_internal" });
+                    result.preToolContext.push(`permission.sandbox_admitted: this call's inherited pending approval was auto-admitted because the deployment declares an isolated sandbox execution env and the request stays inside it. Recorded for audit.`);
+                }
+                if (!result.block && !result.suspend && result.preToolContext.length > 0) {
+                    preToolContexts.set(e.toolCallId, result.preToolContext);
+                }
+                if (blockedTracked && (result.block || result.suspend)) {
+                    blockedToolCalls.add(e.toolCallId);
+                }
+                const settlement = screenGateSettlement(result, result.block === true);
+                for (const defect of settlement.defects)
+                    deps.onError?.(new Error(defect), { phase: "config", sessionId });
+                if (settlement.record !== undefined)
+                    approvalSettlement.set(e.toolCallId, settlement.record);
+                if (result.block) {
+                    const haltRemaining = maybeHumanRejectionHalt({
+                        bare: humanBareRejection,
+                        settledBy: result.settledBy,
+                        isDelegatedChild: delegation.isDelegatedChild === true,
+                        toolName: e.toolName,
+                        toolCallId: e.toolCallId,
+                    });
+                    if (haltRemaining !== undefined) {
+                        batchHaltRef.current = { rejectedToolCallId: e.toolCallId };
+                        return { block: true, reason: result.reason, haltRemaining };
+                    }
+                    return { block: true, reason: result.reason };
+                }
+                return result.updatedInput !== undefined ? { updatedInput: result.updatedInput } : undefined;
+            });
+        }
+    }
+    const toolResultStationArmed = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure);
+    if (toolResultStationArmed) {
+        harness.on("tool_result", async (e) => {
+            if (blockedToolCalls.delete(e.toolCallId)) {
+                return undefined;
+            }
+            let content = e.content;
+            let changed = false;
+            if (e.isError) {
+                if (hooks?.postToolUseFailure) {
+                    let clonedDetails = e.details;
+                    try {
+                        clonedDetails = structuredClone(e.details);
+                    }
+                    catch {
+                    }
+                    const failureSeat = await runHookSeat("postToolUseFailure", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUseFailure(e.toolName, e.input, {
+                        error: e.content
+                            .filter((c) => c.type === "text")
+                            .map((c) => c.text)
+                            .join("\n"),
+                        isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
+                        content: e.content.map((c) => ({ ...c })),
+                        details: clonedDetails,
+                    }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                    if (failureSeat.expired) {
+                        notifyOwnHookCrash(hookSeatExpiredError("postToolUseFailure", hookTimeoutMs, failureSeat.cause, "the observation was abandoned and its additionalContext dropped; the failure result itself is unchanged"));
+                    }
+                    const patch = failureSeat.expired ? undefined : failureSeat.value;
+                    if (patch?.additionalContext) {
+                        content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext, reminderMark) }];
+                        changed = true;
+                    }
+                }
+            }
+            else if (hooks?.postToolUse) {
+                const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                if (successSeat.expired) {
+                    notifyOwnHookCrash(hookSeatExpiredError("postToolUse", hookTimeoutMs, successSeat.cause, "the seat was abandoned; the tool result is delivered to the model UNMODIFIED (no updatedOutput, no additionalContext)"));
+                }
+                const patch = successSeat.expired ? undefined : successSeat.value;
+                if (patch?.updatedOutput) {
+                    content = patch.updatedOutput;
+                    changed = true;
+                }
+                if (patch?.additionalContext) {
+                    content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext, reminderMark) }];
+                    changed = true;
+                }
+            }
+            const pre = preToolContexts.get(e.toolCallId);
+            if (pre) {
+                preToolContexts.delete(e.toolCallId);
+                content = [...content, ...pre.map((t) => ({ type: "text", text: formatHookFeedback(t, reminderMark) }))];
+                changed = true;
+            }
+            return changed ? { content } : undefined;
+        });
+    }
+    return { toolCallStationArmed: toolCallGateArmedRef.armed, toolResultStationArmed };
+}

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -4,9 +4,7 @@ import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { Model } from "../../internal/llm.js";
 import type { AgentTool, ExecutionEnv, WorkspaceState } from "../../internal/harness.js";
 import type { StoredSession } from "../session.js";
-import type { PrepareConfigDoorsResult } from "./prepare-config-doors.js";
-import type { PrepareSafetyScanResult } from "./prepare-safety-scan.js";
-import type { PrepareResume, RunInternals } from "./prepare-task.js";
+import type { IrreversibilityTier, PrepareResume, ReversibilityProbes, RunInternals, ToolFaceSnapshot } from "./contracts.js";
 /** Test seam (mirrors `__resetMalformedNoticeSeatAnnouncement`): never called by production code.
  *  Deliberately asymmetric — it resets only the console latch: the WeakSet arm needs no seam
  *  because a test resets it by minting a fresh sink function (identity IS the ledger key), while
@@ -139,7 +137,7 @@ export interface PrepareHandsReadFaceInput {
     effectiveShellGate: "off" | "classify" | "always";
     /** borrowed-readonly — B-1's frozen task-start face snapshot; only `.exclude` is read here (the
      *  Monitor-mount honesty bit for the gh rate-limit hint, #181-F6). */
-    toolFaceSnapshot: PrepareConfigDoorsResult["toolFaceSnapshot"];
+    toolFaceSnapshot: ToolFaceSnapshot;
     /** borrowed-readonly — B-1's resolved main model; read ONLY for its pdf capability profile
      *  (the Read tool's document-degradation fork). */
     model: Model;
@@ -162,9 +160,9 @@ export interface PrepareHandsReadFaceInput {
      *  when no file restore ran. Fail-closed by construction — dropping a read record only ever
      *  produces refusals. */
     restoredFilePaths?: readonly string[];
-    /** borrowed (ref cell; the REF itself is never replaced) — design/138 S2-C late-bound memory
+    /** borrowed-readonly — (ref cell; the REF itself is never replaced) design/138 S2-C late-bound memory
      *  write gate: the band's beforeWrite closure reads `.current` call-time; prepareMemory (driver,
-     *  after this phase) installs the gate. Declared in the driver because the SAME ref feeds
+     *  after this phase) installs the gate — the one writer; this phase only reads. Declared in the driver because the SAME ref feeds
      *  prepareMemory. */
     memoryWriteGateRef: {
         current?: BeforeWriteHook;
@@ -185,13 +183,13 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-mutable — the shellGate fold's tier write-back (`.get` for the provenance bit,
      *  monotonic `.set` — tighten-only). Same object B-2 returned; owner table lives on the B-2
      *  Result. */
-    irreversibilityTier: PrepareSafetyScanResult["irreversibilityTier"];
+    irreversibilityTier: IrreversibilityTier;
     /** borrowed-mutable — the shellGate fold `.add`s Bash/Monitor here. Same-object contract as
      *  above. */
-    irreversibleTools: PrepareSafetyScanResult["irreversibleTools"];
+    irreversibleTools: Set<string>;
     /** borrowed-mutable — the classify doctrine's probe installs (`.set`, only where the doctrine
      *  owns the seat). Same-object contract as above. */
-    reversibilityProbes: PrepareSafetyScanResult["reversibilityProbes"];
+    reversibilityProbes: ReversibilityProbes;
     /** borrowed-readonly — design/319 (A ticket): the run's reminder provenance mark (minted/adopted
      *  by the driver's adoption ladder); threaded into the hands band so the fs-side engine mints
      *  (the Read cyber/dedup/offset/empty reminders, the gh rate-limit hint) stamp the same mark the
@@ -201,10 +199,10 @@ export interface PrepareHandsReadFaceInput {
      *  band's Read/notebook/PDF trailer outlets bump keys on it at tool-execute time (the driver owns
      *  the object and folds it into result stats). */
     reminderDisclosureCounts: import("../reminder-disclosure.js").ReminderDisclosureCounts;
-    /** design/381 — the first-touch history hook prepare built (present iff a fileHistoryStore is
+    /** borrowed-readonly — design/381: the first-touch history hook prepare built (present iff a fileHistoryStore is
      *  wired and the run mounts a real fs env); threaded to the write band's trackFileEdit seat. */
     trackFileEdit?: import("../types.js").TrackFileEditHook;
-    /** borrowed — the mutation lane's LANDED observation seat (the accumulator behind
+    /** borrowed-readonly — the mutation lane's LANDED observation seat (the accumulator behind
      *  `TaskResult.editedFiles`); threaded to the write band's onFileEdited seat. Unlike
      *  `trackFileEdit` it does NOT depend on a wired history store: it observes what this run's hands
      *  did, so it is present on every run that mounts the band. */

package/dist/core/runner/prepare-hands-readface.js

@@ -7,7 +7,7 @@ import { resolveKey, sha256 } from "../../tools/fs/safety.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
 import { deliverEngineNotice } from "../types.js";
-import { rebaseWorkspacePath } from "./prepare-workspace-restore.js";
+import { rebaseWorkspacePath } from "./workspace-path.js";
 const readFaceClampAnnouncedSinks = new WeakSet();
 let readFaceClampConsoleAnnounced = false;
 export function __resetReadFaceClampAnnouncement() {

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -0,0 +1,268 @@
+/**
+ * design/390 §1.2 M3b — prepareTask's INHERITED-GATE phase, verbatim from the driver: the live/seed fold of the
+ * chain this run inherits (ancestor rules rev-monotonic per (session, principal), shellGate by max rank, the
+ * re-supplied parent constraints with their rebuilt denial trackers, the auto-mode intent, the org-admission
+ * freeze with its tighten-only intersection and the monotonic governed bit), the effective shellGate against the
+ * spec, the three cells later phases fill for the children's chain (own session rules, own admitted org scopes,
+ * own org verdict), the checkpoint-section closures the suspend serializer reads (face / org / F-012 stamps), the
+ * FROZEN ask and question seats (spec over deps), the two delegation refs the memory phase binds late, the ONE
+ * child-chain assembly `inheritedGateForChildren`, the caller-tool ctx enrichment `enrichSpecToolCtx` shared by
+ * the roster wrap and the revival spawner, the denial-limit stop seat, and the full-shell reachability predicate.
+ * The interface is the dependency list the segment had implicitly (design/238 R-1).
+ *
+ * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await (the one `await` in it sits inside the
+ * `hostSessionFork` closure a tool calls later), so the phase adds no yield between the run-refs phase before it
+ * and the caps phase after it (design/390 §1.5: a stretch with no await is extracted as a sync function).
+ *
+ * LATE-BOUND SEATS. The closures minted here run long after this phase returns — at spawn time, at tool-call
+ * time, at suspend time — and several of the facts they read are resolved by LATER stations of the same prepare:
+ * the caps phase's `runtimeCaps` / fork verdict / observers grant / armed classifier trio, the hands mount's
+ * resolved face and deny additions, the policy-chain station's hook record and timeout, the wiring station's hook
+ * env face, the prompt-assembly station's center adoption, the memory phase's engine session. In the driver those
+ * were `let`s and later `const`s the closures captured by name; here each enters as a GETTER on the Input, and
+ * every closure reads it exactly where — and only when — the driver's closure read the variable (a head binding
+ * where the driver read a variable inside one synchronous evaluation; an in-place call where the driver's read
+ * sat behind a short-circuit). Read-stability of the host handles for the call: {@link RunInternals}
+ * (`@contract prepare.deps-read-stable`).
+ *
+ * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member (design/238 R-3).
+ */
+import type { AgentHarness, ExecutionEnv } from "../../internal/harness.js";
+import type { SubagentWorktreeIsolation } from "../../agents/subagent.js";
+import { forkGovernanceDenial } from "../../agents/subagent.js";
+import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
+import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
+import type { ReadFace } from "../../tools/fs/index.js";
+import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
+import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
+import { type OnQuestion } from "../ask-question.js";
+import { type HookEnvCapabilities, type Hooks } from "../hooks.js";
+import type { LockedPreflight } from "../locked-config.js";
+import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
+import type { DelegationContentSafety } from "../memory-engine/delegation-provenance.js";
+import type { SessionPermissionRules } from "../session-policy-store.js";
+import type { SessionStore } from "../session.js";
+import { type OnAsk } from "../tool-policy.js";
+import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
+import type { ActiveSkillScope } from "./active-skill-scope.js";
+import type { InheritedGate, Prepared, PrepareResume, RunInternals, ToolFaceSnapshot } from "./contracts.js";
+import { type StopForDenialLimit } from "./denial-limit-arms.js";
+export interface PrepareInheritedGateInput {
+    /** borrowed-readonly — the REBOUND spec. Read: `shellGate` (the own doctrine the chain fold tightens), `durableApproval`
+     *  (the mandate tests + the children's copy), `onAsk`/`onQuestion` (the frozen seats), `handsReadOnly` / `interactiveTools`
+     *  / `oneShot` / `clientContext` / `principal` / `additionalDirectories` / `additionalReadDirectories` / `envFacts` /
+     *  `memoryPersistenceCapable` / `getApiKeyAndHeaders` / `checkpointStore` / `backgroundScope` / `enablePlanMode` (the ctx
+     *  enrichment's trusted seats). Never mutated. */
+    spec: Pick<TaskSpec, "shellGate" | "durableApproval" | "onAsk" | "onQuestion" | "handsReadOnly" | "interactiveTools" | "oneShot" | "clientContext" | "principal" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "getApiKeyAndHeaders" | "checkpointStore" | "backgroundScope" | "enablePlanMode">;
+    /** borrowed-readonly — the deployment seats: `autoMode.denialLimit` (the rebuilt trackers' bounds), `memoryScopeAdmission` /
+     *  `deploymentMemoryScopes` / `compliancePostureResolver` (the governed-provenance bit), `onError` (the screening-face crash
+     *  lane), `onNotice` (the stop seat's notice), `executionEnv` (the hook-env identity predicate), `delegationEntryCaps` (resolved
+     *  and validated once here), `rosterStore` / `onBackgroundChildEvent` (ctx seats), `onAsk` / `onQuestion` (the deps half of the
+     *  frozen seats). */
+    deps: Pick<RunnerDeps, "autoMode" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "compliancePostureResolver" | "onError" | "onNotice" | "executionEnv" | "delegationEntryCaps" | "rosterStore" | "onBackgroundChildEvent" | "onAsk" | "onQuestion">;
+    /** borrowed-readonly — the trusted spawn-side channel: `inheritedGate` (the LIVE half of the chain fold), `ownOrgAdmissionRef`
+     *  (the same-session continuation's freeze), `delegationProvenance` (the F-012 stamp), and the identity / peer / notification
+     *  seats the ctx enrichment forwards. Never mutated. */
+    internals: Pick<RunInternals, "inheritedGate" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork"> | undefined;
+    /** borrowed-readonly — the resume leg, or undefined on a fresh one: `seed.inheritedGate` is the CHECKPOINT half of the chain
+     *  fold (the trust floor the live half may only tighten), `seed.readFace` the hands-less re-park's carried section. */
+    resume: Pick<PrepareResume, "seed"> | undefined;
+    /** borrowed-readonly — the session store's fork face: `fork` / `release` are bound into the ctx's `hostSessionFork` (present
+     *  only when the store can fork). */
+    sessions: Pick<SessionStore, "fork" | "release">;
+    /** borrowed-readonly — the acquired session id (the crash lane's context, the ctx seat, the ancestor chain's own row). */
+    sessionId: string;
+    /** borrowed-readonly — the run's invocation id (the stop seat's notice names it). */
+    runId: string;
+    /** borrowed-readonly — the per-task identity (`ctx.taskId`, the same fallback the runner uses). */
+    hostTaskId: string;
+    /** borrowed-readonly — the SETTLED task root (`ctx.parentCwd`). */
+    taskRootFinal: string;
+    /** borrowed-readonly — the run's resolved env: the full-shell predicate's kind test and the hook-env identity value. */
+    executionEnv: ExecutionEnv;
+    /** borrowed-readonly — the per-task owned env when a factory minted one (the hook-env identity predicate reads presence). */
+    ownedEnv: ExecutionEnv | undefined;
+    /** borrowed-readonly — the frozen preflight; only `toolPolicy` (the RESOLVED caller policy the children's chain carries). */
+    lockedPreflight: Pick<LockedPreflight, "toolPolicy">;
+    /** borrowed-readonly — the frozen tool-face snapshot (the ctx forwards exclude / defer / alwaysLoad / restoreGated; the
+     *  full-shell predicate reads the exclusion of Bash). */
+    toolFaceSnapshot: ToolFaceSnapshot;
+    /** borrowed-readonly — the resolved prompt profile (ctx seat). */
+    promptProfile: ToolExecuteContext["promptProfile"];
+    /** borrowed-readonly — the resolved interaction posture (ctx seat; absent ⇒ no key). */
+    resolvedInteractionPosture: ToolExecuteContext["interactionPosture"];
+    /** borrowed-readonly — the task's own auto-mode intent seat, screened and snapshotted before the first await. */
+    autoModeSeat: boolean;
+    /** borrowed-readonly — whether an execution env is wired at all (the full-shell predicate's first term). */
+    handsEnabled: boolean;
+    /** borrowed-readonly — the nested-usage sink the ctx forwards. */
+    reportUsage: ToolExecuteContext["reportUsage"];
+    /** borrowed-readonly — the harness seat (the ctx's model / thinking snapshots read it call-time). Not written here. */
+    harnessRef: {
+        current?: AgentHarness;
+    };
+    /** borrowed-readonly — the per-task skill scope (the ctx's `activeSkillScope` snapshot reads it call-time). Not written here. */
+    skillScope: ActiveSkillScope;
+    /** borrowed-readonly — the filtered display-forwarding wrapper (ctx seat; absent ⇒ no key). */
+    forwardEvent: ((e: TaskEvent) => void) | undefined;
+    /** borrowed-readonly — the retain ledger (ctx seat; absent ⇒ no key). */
+    subagentRetain: SubagentRetainLedger | undefined;
+    /** borrowed-readonly — the worktree-isolation helper (ctx seat; absent ⇒ no key). */
+    worktreeIsolation: SubagentWorktreeIsolation | undefined;
+    /** borrowed-readonly — the three run-ref primitives the ctx exposes (plan mode only under `enablePlanMode`). */
+    requestReview: (opts?: {
+        reason?: string;
+    }) => void;
+    /** borrowed-readonly — see `requestReview`. */
+    requestStopAfterTurn: () => void;
+    /** borrowed-readonly — see `requestReview`. */
+    enterPlanMode: () => void;
+    /** borrowed-readonly — the leg's reminder mark (ctx seat). */
+    reminderMark: string;
+    /** borrowed-readonly — the leg's disclosure counters (ctx seat; the outlets that bump them are not in this phase). */
+    reminderDisclosureCounts: Prepared["reminderDisclosureCounts"];
+    /** borrowed-readonly — the file-history fixed point the ctx threads to delegation tools (only when enabled). */
+    fileHistoryEnabled: boolean;
+    /** borrowed-readonly — see `fileHistoryEnabled`. */
+    historyScope: string;
+    /** borrowed-readonly — see `fileHistoryEnabled`. */
+    historyRoot: string;
+    /** borrowed-readonly — see `fileHistoryEnabled`. */
+    historyFs: string;
+    /** borrowed-readonly — the driver's composition of the run's abort (controller + harness), the stop seat's headless arm.
+     *  Composed by the driver because the harness is built after this phase; the seat only ever fires at run time. */
+    abortRun: () => void;
+    /** borrowed-readonly — LATE-BOUND: the per-principal entitlements the caps phase resolves after this one; read only inside
+     *  `inheritedGateForChildren` (the two mandate tests), at spawn time. */
+    runtimeCaps: () => RuntimeCaps | undefined;
+    /** borrowed-readonly — LATE-BOUND: the resolved hook record (`spec.hooks ?? deps.hooks`), read inside the chain assembly for
+     *  this task's own screening face. */
+    hooks: () => Hooks | undefined;
+    /** borrowed-readonly — LATE-BOUND: whether the deployment declared its screening face observational (then it rides no entry). */
+    preToolUseObservational: () => boolean;
+    /** borrowed-readonly — LATE-BOUND: the validated per-invocation hook bound the screening-face entry's policy runs under. */
+    hookTimeoutMs: () => number;
+    /** borrowed-readonly — LATE-BOUND: the hook-env capability face the screening-face entry's policy resolves paths in. */
+    hookEnvFace: () => HookEnvCapabilities | undefined;
+    /** borrowed-readonly — LATE-BOUND: the armed classifier (undefined = not armed), read where the chain freezes it onto both
+     *  entries and where the ctx exposes the spawn-review seat. */
+    autoModeDecider: () => AutoModeDecider | undefined;
+    /** borrowed-readonly — LATE-BOUND: the denial tracker built beside the decider; rides wherever the decider rides. */
+    autoModeDenialTracking: () => AutoModeDenialTracker | undefined;
+    /** borrowed-readonly — LATE-BOUND: the serializable arming recipe (persistArming opt-in only). */
+    autoModeArming: () => AutoModeArmingRecipe | undefined;
+    /** borrowed-readonly — LATE-BOUND: the fork-governance verdict (ctx `forkAccess`, present only when denied). */
+    agentForkDenial: () => ReturnType<typeof forkGovernanceDenial>;
+    /** borrowed-readonly — LATE-BOUND: the observers grant (ctx `observersAllowed`, present only when explicitly granted). */
+    observersActive: () => boolean;
+    /** borrowed-readonly — LATE-BOUND: the hands mount's resolved read face (undefined until/unless hands mount). */
+    resolvedReadFace: () => ReadFace | undefined;
+    /** borrowed-readonly — LATE-BOUND: the normalized deny additions in force (empty until the hands mount resolves them). */
+    readDenyAdditionsNormalized: () => ReadonlyArray<{
+        pattern: string;
+        caseSensitive: boolean;
+    }>;
+    /** borrowed-readonly — LATE-BOUND: the hands-less legs' resolved face (the carrier's second source). */
+    handsLessResolvedFace: () => ReadFace | undefined;
+    /** borrowed-readonly — LATE-BOUND: the adopted center artifact (ctx `centerArtifactDigest` / `centerSourceRevision`). */
+    centerAdoption: () => {
+        artifact: PromptEpochArtifact;
+        sourceRevision?: string;
+    } | undefined;
+    /** borrowed-readonly — LATE-BOUND: the memory-engine session (the ctx's capture-floor getters read it at THEIR call time). */
+    memoryEngineSession: () => Prepared["memoryEngineSession"];
+}
+export interface PrepareInheritedGateResult {
+    /** owned — the LIVE half of the inherited chain as supplied (`internals.inheritedGate`); the durable-gate notice reads it. */
+    liveInheritedGate: RunInternals["inheritedGate"];
+    /** owned — the CHECKPOINT half (`resume.seed.inheritedGate`); the suspend serializer re-reads its frozen chain. */
+    seedInheritedGate: PrepareResume["seed"]["inheritedGate"];
+    /** owned — the rev-monotonic fold of the two halves' ancestor rules (live replaces per (session, principal) only at ≥ rev). */
+    inheritedAncestorRules: InheritedGate["ancestorRules"];
+    /** owned — the max-rank fold of the two halves' shellGate doctrines (before the spec's own is applied). */
+    inheritedShellGate: InheritedGate["shellGate"];
+    /** owned — the live parent constraints with a fresh denial tracker attached per rebuilt decider. */
+    inheritedParentConstraints: NonNullable<InheritedGate["parentConstraints"]>[number][] | undefined;
+    /** owned — the auto-mode INTENT (own seat ∨ live chain ∨ checkpoint bit); the arming site judges the other two arms. */
+    autoModeIntent: boolean;
+    /** owned — the seed ∩ live admitted org scopes (one side absent ⇒ the other; both absent ⇒ undefined). */
+    inheritedAdmittedOrgScopes: readonly string[] | undefined;
+    /** owned — the prior own org verdict: checkpoint ∩ same-session ref (either alone stands; neither ⇒ undefined). */
+    priorOwnOrgVerdict: OwnOrgAdmissionVerdict | undefined;
+    /** owned — the monotonic governed-provenance bit for this leg. */
+    orgGovernedProvenance: boolean;
+    /** owned — the spec's own shellGate tightened by the inherited doctrine. */
+    effectiveShellGate: "off" | "classify" | "always";
+    /** borrowed-mutable — THIS task's own session-rule snapshot for its children's chain. Writers (R-3): the policy-chain
+     *  station's session-policy read, once per leg, when a store is wired and the task carries its own sessionId. Read by
+     *  `inheritedGateForChildren` at spawn time. */
+    ownSessionRulesRef: {
+        current?: {
+            sessionId: string;
+            principal?: string;
+            rev: number;
+            rules: SessionPermissionRules;
+        };
+    };
+    /** borrowed-mutable — THIS task's own frozen admitted org scopes for its children's chain. Writers: the memory phase's
+     *  admission door, once per leg. Read by the chain assembly (always emitted, empty = no org plane). */
+    memoryAdmittedOrgScopesRef: {
+        current: readonly string[];
+    };
+    /** borrowed-mutable — the SESSION-freeze record for the suspend writer (present iff this leg adjudicated an org plane).
+     *  Writers: the memory phase's admission door. Readers: the org stamp predicate here and the suspend serializer. */
+    ownOrgVerdictRef: {
+        current: OwnOrgAdmissionVerdict | undefined;
+    };
+    /** owned — the org-admission checkpoint stamp predicate (inherited set ∨ own verdict ∨ governed). */
+    orgAdmissionCheckpointState: () => boolean;
+    /** owned — the read-face checkpoint section builder (hands-less resume carries the seed; every other leg mints from the live
+     *  resolution; undefined for the default posture). */
+    faceCheckpointSection: () => {
+        face: "open" | "roots";
+        denyEntries?: Array<{
+            pattern: string;
+            caseSensitive: boolean;
+        }>;
+    } | undefined;
+    /** owned — the face stamp predicate (`faceCheckpointSection() !== undefined`). */
+    faceCheckpointState: () => boolean;
+    /** owned — the F-012 stamp predicate (opaque constraints present ∨ seed frozen chain ∨ provenance-armed). */
+    f012CheckpointState: () => boolean;
+    /** owned — the FROZEN approver seat (spec over deps) every station of this leg and its children's chain resolve at. */
+    frozenOnAsk: OnAsk | undefined;
+    /** owned — the env the screening face sees through `ctx.env` (identity half of a chain entry's `hookEnv`); the policy-chain
+     *  station's pass-through arm compares against it. */
+    hookEnvSource: unknown;
+    /** owned — the deployment lane for a screening face that crashes while screening a descendant's call (phase "hook"). */
+    notifyOwnHookCrash: (err: unknown) => void;
+    /** owned — the FROZEN question seat (spec over deps), the content-ask twin of `frozenOnAsk`. */
+    frozenOnQuestion: OnQuestion | undefined;
+    /** borrowed-mutable — the delegation runtime-provenance arming face. Writer: the memory-engine-session phase
+     *  (prepareMemoryEngineSession), once per leg when it arms. Read lazily by delegation tools through the ctx. */
+    provenanceForChildrenRef: {
+        current?: DelegationContentSafety;
+    };
+    /** borrowed-mutable — the delegation-settlement coordinates. Writer: the memory-engine-session phase, once per leg when the
+     *  mounted session carries a settlement seat. Read lazily by delegation tools through the ctx. */
+    delegationSettlementRef: {
+        current?: {
+            controlDir: string;
+            sessionId: string;
+        };
+    };
+    /** owned — chain assembly SINGLE SITE: upstream chain + this task's own contribution, called by delegation tools at spawn. */
+    inheritedGateForChildren: () => InheritedGate;
+    /** owned — the ONE carrier expression both delegation mounts consume (resolved face ?? hands-less face). */
+    carrierReadFace: () => ReadFace | undefined;
+    /** owned — the full shell's structural reachability from spec-time facts. */
+    fullShellReachable: boolean;
+    /** borrowed-mutable — the gate's typed stop seat (`Prepared.gateStopRef`). Writers: `stopForDenialLimit` only. */
+    gateStopRef: Prepared["gateStopRef"];
+    /** owned — the ONE closure that fills the stop seat (the denial-limit fallback's headless arm). */
+    stopForDenialLimit: StopForDenialLimit;
+    /** owned — the caller-tool ctx enrichment shared by the roster wrap and the revival spawner. */
+    enrichSpecToolCtx: (ctx: ToolExecuteContext) => ToolExecuteContext;
+}
+/** The M3b phase body — prepareTask's inherited-gate stretch, verbatim (see the module header). */
+export declare function prepareInheritedGate(input: PrepareInheritedGateInput): PrepareInheritedGateResult;