@sema-agent/core 7.5.1 → 7.6.0

package/dist/agents/suspend-guard.d.ts

@@ -1,13 +1,13 @@
-import type { TaskResult } from "../core/types.js";
+import type { PausedCause, TaskResult, TerminalCause } from "../core/types.js";
 /**
- * design/45 §11 Q6 — the **durable-suspend hard boundary** (v1). A `status:"suspended"` result is only
- * safe to handle at the **top-level `runTask`** boundary: the orchestrators (cascade / verify / teacher /
- * team) run their work as *nested* `runTask`s, and none of them can drive a resume from the inside. If a
- * nested task suspends on a durable approval gate, the orchestrator must **fail fast** — not silently
- * treat it as an ordinary failure (which would escalate/re-run side effects) and not release its pinned
- * session (which would orphan the checkpoint). It maps `suspended → failed` + `errorCode:
- * "unexpected.suspended"` and **passes the `checkpointToken`/`checkpointGate` straight through** (via the
- * spread) so the top-level caller can still resume.
+ * design/45 §11 Q6 — the **durable-suspend hard boundary** (v1). A `paused` terminal is only safe to
+ * handle at the **top-level `runTask`** boundary: the orchestrators (cascade / verify / teacher / team)
+ * run their work as *nested* `runTask`s, and none of them can drive a resume from the inside. If a nested
+ * task pauses on a durable gate, the orchestrator must **fail fast** — not silently treat it as an
+ * ordinary failure (which would escalate/re-run side effects) and not release its pinned session (which
+ * would orphan the checkpoint). It maps `paused → failed` with the code `"unexpected.suspended"` (an
+ * approval / resource pause) or `"unexpected.needs_review"` (a review pause) and **carries the pause's own
+ * cause on the failed terminal's `nestedPause` seat** so the top-level caller can still resume.
  *
  * The structural prevention is upstream — an orchestrator should run nested tasks under a **non-durable**
  * approval policy (e.g. the verifier already forces `handsReadOnly` + headless auto-deny, DESIGN#5) so a
@@ -15,20 +15,32 @@ import type { TaskResult } from "../core/types.js";
  * a hard boundary, or a deployment wires durable-suspend into verify and produces silent errors."
  */
 export declare const UNEXPECTED_SUSPENDED = "unexpected.suspended";
-/** design/80 D-B: the `needs_review` durable-pause family (dry-run `needs_review` AND `plan_review`) hits the
- *  SAME nested hard boundary as `suspended` — a distinct code so a caller can tell a review pause from an approval. */
+/** design/80 D-B: the review durable-pause family (dry-run `needs_review` AND `plan_review`) hits the SAME
+ *  nested hard boundary as an approval pause — a distinct code so a caller can tell a review pause from an
+ *  approval. */
 export declare const UNEXPECTED_NEEDS_REVIEW = "unexpected.needs_review";
 /**
- * design/80 D-B: the durable-pause hard boundary covers BOTH `suspended` (an approval gate) AND `needs_review`
- * (a dry-run review OR a `plan_review` plan-gate). Both persist a checkpoint + PIN their session
- * (prepare-task.ts), and a nested orchestrator can't drive their resume — so it must surface the
- * `checkpointToken` and NOT release the pinned session (releasing it orphans the checkpoint). The `types.ts`
- * TaskStatus doc mandates orchestrators map an unexpected `needs_review` the same hard-boundary way as `suspended`.
+ * design/80 D-B: the durable-pause hard boundary covers EVERY `paused` cause — an approval gate, a resource
+ * slice, a dry-run review, a `plan_review` plan-gate. All of them persist a checkpoint + PIN their session,
+ * and a nested orchestrator can't drive their resume — so it must surface the pause and NOT release the
+ * pinned session (releasing it orphans the checkpoint). A type guard, so the caller reads the token/gate
+ * off the narrowed cause.
  */
-export declare function isDurablePause(status: TaskResult["status"]): boolean;
+export declare function isDurablePause(terminal: TerminalCause): terminal is PausedCause;
+/** A result whose terminal is known to be a pause — what {@link isDurablePause} narrows a result's
+ *  `terminal` to, spelled as a type so an orchestrator can HOLD a paused result without re-checking. */
+export type PausedResult = TaskResult & {
+    terminal: PausedCause;
+};
 /**
- * If `result` durably paused (suspended OR needs_review), return it mapped to a `failed` result carrying the
- * checkpoint token; otherwise return it unchanged. The orchestrator should also **stop** (not escalate/re-run)
+ * Which family a pause belongs to — its gate kind's registry row: `"suspended"` (an approval gate, a
+ * resource slice, a platform park) or `"needs_review"` (a dry-run or plan review). The same row the
+ * status word is projected from; read here by the orchestrators that name the family in their own faces.
+ */
+export declare function pauseFamily(t: PausedCause): "suspended" | "needs_review";
+/**
+ * If `result` durably paused, return it mapped to a `failed` result whose terminal carries the pause on
+ * `nestedPause`; otherwise return it unchanged. The orchestrator should also **stop** (not escalate/re-run)
  * and **not release** the session when this maps a pause — the checkpoint still references that session.
  */
 export declare function mapNestedSuspend(result: TaskResult): TaskResult;

package/dist/agents/suspend-guard.js

@@ -1,18 +1,24 @@
+import { PAUSE_REGISTRY } from "../core/pause-registry.js";
 export const UNEXPECTED_SUSPENDED = "unexpected.suspended";
 export const UNEXPECTED_NEEDS_REVIEW = "unexpected.needs_review";
-export function isDurablePause(status) {
-    return status === "suspended" || status === "needs_review";
+export function isDurablePause(terminal) {
+    return terminal.kind === "paused";
+}
+export function pauseFamily(t) {
+    return PAUSE_REGISTRY[t.gate.kind].taskStatus;
 }
 export function mapNestedSuspend(result) {
-    if (!isDurablePause(result.status)) {
+    const t = result.terminal;
+    if (!isDurablePause(t)) {
         return result;
     }
+    const word = pauseFamily(t);
+    const code = word === "needs_review" ? UNEXPECTED_NEEDS_REVIEW : UNEXPECTED_SUSPENDED;
+    const message = `a nested task durably paused ("${word}") on a HITL gate; durable suspend/resume and plan/` +
+        "dry-run review are only supported at the top-level runTask (design/45 v1 / design/80). Resume it via " +
+        "the pause's token, or run the orchestrated task under a non-durable policy so it auto-adjudicates instead of pausing.";
     return {
         ...result,
-        status: "failed",
-        errorCode: result.status === "needs_review" ? UNEXPECTED_NEEDS_REVIEW : UNEXPECTED_SUSPENDED,
-        errorMessage: `a nested task durably paused ("${result.status}") on a HITL gate; durable suspend/resume and plan/` +
-            "dry-run review are only supported at the top-level runTask (design/45 v1 / design/80). Resume it via " +
-            "checkpointToken, or run the orchestrated task under a non-durable policy so it auto-adjudicates instead of pausing.",
+        terminal: { kind: "failed", code, message, nestedPause: t },
     };
 }

package/dist/agents/teacher.js

@@ -119,7 +119,7 @@ export async function runWithTeacher(runner, studentSpec, teacher = {}) {
         }
     }
     const result = await runTeacherCore(runner, spec, teacher);
-    if (store && scope && result.status === "completed" && result.escalations.length > 0) {
+    if (store && scope && result.terminal.kind === "completed" && result.escalations.length > 0) {
         const advice = result.escalations[result.escalations.length - 1].teacher;
         if (advice.strategy && advice.confidence >= (teacher.minConfidenceToStore ?? 2)) {
             try {
@@ -271,7 +271,7 @@ async function runTeacherCore(runner, studentSpec, teacher) {
         ...(studentSpec.restoreGatedTools !== undefined
             ? { restoreGatedTools: Array.isArray(studentSpec.restoreGatedTools) ? [...studentSpec.restoreGatedTools] : studentSpec.restoreGatedTools }
             : {}),
-        ...(studentSpec.checkpointStore === null ? { checkpointStore: null } : {}),
+        ...(studentSpec.checkpointStore === "disabled" ? { checkpointStore: "disabled" } : {}),
     };
     const helperBase = () => teacher.helperModel
         ? { ...inheritedDeploymentConfig, model: teacher.helperModel }
@@ -407,9 +407,8 @@ async function runTeacherCore(runner, studentSpec, teacher) {
     const syntheticAborted = (sid) => ({
         taskId: sid ?? "aborted",
         sessionId: sid ?? "aborted",
-        status: "failed",
+        terminal: { kind: "failed", message: "student run did not settle promptly after stuck-abort" },
         result: "",
-        errorMessage: "student run did not settle promptly after stuck-abort",
         stats: { turns: 0, tokens: 0 },
     });
     const abortFallback = (sid) => {
@@ -451,7 +450,7 @@ async function runTeacherCore(runner, studentSpec, teacher) {
         toolLog.length = 0;
         const { result, stuck, recent } = await runStudent();
         sessionId = result.sessionId;
-        if (isDurablePause(result.status)) {
+        if (isDurablePause(result.terminal)) {
             return finalize(mapNestedSuspend(result));
         }
         let trigger;
@@ -459,10 +458,10 @@ async function runTeacherCore(runner, studentSpec, teacher) {
         if (stuck) {
             trigger = "stuck";
         }
-        else if (result.status === "blocked") {
+        else if (result.terminal.kind === "blocked") {
             trigger = "blocked";
         }
-        else if (result.status === "failed") {
+        else if (result.terminal.kind === "failed") {
             trigger = "failed";
         }
         else if (!verifyOutput) {
@@ -482,7 +481,8 @@ async function runTeacherCore(runner, studentSpec, teacher) {
             return finalize(result);
         }
         if (trigger === "failed" &&
-            /truncat|max[ _-]?tokens?|maximum tokens?|token (limit|budget)|context (length|window)|no answer text|(consumed|exceeded).{0,12}budget/i.test(result.errorMessage ?? "")) {
+            result.terminal.kind === "failed" &&
+            /truncat|max[ _-]?tokens?|maximum tokens?|token (limit|budget)|context (length|window)|no answer text|(consumed|exceeded).{0,12}budget/i.test(result.terminal.message ?? "")) {
             return finalize(result);
         }
         if (escalations.length >= maxEscalations) {
@@ -528,7 +528,7 @@ async function runTeacherCore(runner, studentSpec, teacher) {
                 signal: extSignal,
             });
             addTeacher(r);
-            if (isDurablePause(r.status)) {
+            if (isDurablePause(r.terminal)) {
                 return finalize(mapNestedSuspend(r));
             }
             return finalize(r);

package/dist/agents/team.d.ts

@@ -1,5 +1,6 @@
 import type { Runner } from "../core/runner/runtask.js";
-import type { McpServerSpec, ModelRef, ModelRole, TaskResult, TaskSpec, ToolSpec } from "../core/types.js";
+import type { McpServerSpec, ModelRef, ModelRole, TaskSpec, ToolSpec } from "../core/types.js";
+import type { CheckpointGate, CheckpointToken } from "../core/checkpoint-store.js";
 export interface TeamMember {
     /** The member's role / specialty, e.g. "安全评审" or "performance". */
     role: string;
@@ -206,8 +207,8 @@ export interface TeamResult {
      *  the discussion STOPS (no synthesis on a half-done team) and surfaces the resume capability so the caller
      *  can resume the paused member via the token, then re-run. `conclusionValid` is false in this case. */
     durablePause?: boolean;
-    checkpointToken?: TaskResult["checkpointToken"];
-    checkpointGate?: TaskResult["checkpointGate"];
+    checkpointToken?: CheckpointToken;
+    checkpointGate?: CheckpointGate;
 }
 /**
  * Run a multi-round discussion across several role-specialized agents, then synthesize a conclusion.

package/dist/agents/team.js

@@ -1,5 +1,6 @@
 import { resolveToolSubset } from "./tool-filter.js";
 import { mapNestedSuspend, isDurablePause } from "./suspend-guard.js";
+import { terminalProjection } from "../core/runner/terminal-projection.js";
 import { sanitizeUntrustedText } from "../core/untrusted-text.js";
 const DISCUSSION_WRAPPER_TAGS = ["statement", "discussion", "discussion-final", "earlier-discussion-summary", "previous-summary", "topic"];
 const RETIRED_WRAPPER_TAGS = ["team-discussion", "team-discussion-final"];
@@ -87,7 +88,7 @@ export async function runTeamDiscussion(opts) {
         return {
             status: "failed",
             result: conclusion,
-            errorCode: p.errorCode,
+            errorCode: terminalProjection(mapNestedSuspend(p).terminal).errorCode,
             conclusion,
             conclusionValid: false,
             transcript,
@@ -96,8 +97,8 @@ export async function runTeamDiscussion(opts) {
             failures,
             transcriptCompactions,
             durablePause: true,
-            checkpointToken: p.checkpointToken,
-            checkpointGate: p.checkpointGate,
+            checkpointToken: p.terminal.token,
+            checkpointGate: p.terminal.gate,
         };
     };
     const runTurn = async (objective, systemPrompt, modelRef, role, tools, mcp) => {
@@ -122,16 +123,17 @@ export async function runTeamDiscussion(opts) {
             tokens += res.stats.tokens + (res.stats.nested?.tokens ?? 0);
             turns += res.stats.turns + (res.stats.nested?.turns ?? 0);
             costMicroUsd += (res.stats.costMicroUsd ?? 0) + (res.stats.nested?.costMicroUsd ?? 0);
-            if (isDurablePause(res.status)) {
-                const m = mapNestedSuspend(res);
-                pendingPause = m;
+            if (isDurablePause(res.terminal)) {
+                pendingPause = { ...res, terminal: res.terminal };
+                const m = terminalProjection(mapNestedSuspend(res).terminal);
                 return { text: `[unavailable: ${m.status}/${m.errorCode}]`, ok: false };
             }
             await opts.runner.sessions.release(res.sessionId).catch(() => undefined);
-            if (res.status === "completed" && res.result.trim()) {
+            if (res.terminal.kind === "completed" && res.result.trim()) {
                 return { text: res.result, ok: true };
             }
-            last = `[unavailable: ${res.status}${res.errorCode ? `/${res.errorCode}` : ""}${res.errorMessage ? ` — ${res.errorMessage}` : ""}]`;
+            const face = terminalProjection(res.terminal);
+            last = `[unavailable: ${face.status}${face.errorCode ? `/${face.errorCode}` : ""}${face.errorMessage ? ` — ${face.errorMessage}` : ""}]`;
         }
         return { text: last || "[unavailable]", ok: false };
     };

package/dist/agents/verify.d.ts

@@ -2,7 +2,7 @@ import { Type, type Static } from "typebox";
 import type { Runner, ResumeTaskConfig } from "../core/runner/runtask.js";
 import type { RunInternals } from "../core/runner/prepare-task.js";
 import type { CheckpointGate, CheckpointToken, ResumeOutcome } from "../core/checkpoint-store.js";
-import type { ModelRef, TaskResult, TaskSpec, ToolSpec } from "../core/types.js";
+import type { ModelRef, TaskResult, TaskSpec, TaskStatus, ToolSpec } from "../core/types.js";
 /**
  * Verification gate (developer mode, design/28 §4). An **independent falsification-style verifier** runs after
  * an implementation task and tries to BREAK it — read-only, evidence-required, returning a structured
@@ -131,7 +131,7 @@ export interface VerifyConfig {
      */
     onVerifierPause?: (info: {
         round: number;
-        status: TaskResult["status"];
+        status: TaskStatus;
         sessionId: string;
         checkpointToken?: CheckpointToken;
         checkpointGate?: CheckpointGate;
@@ -200,7 +200,7 @@ export interface VerificationOutcome {
      */
     verifierPause?: {
         /** The verifier run's terminal pause status (`"suspended"` or `"needs_review"`). */
-        status: TaskResult["status"];
+        status: TaskStatus;
         /** The paused verifier's own session id (independent of the implementation's). */
         sessionId: string;
         /** The resume capability for the verifier's checkpoint. Undefined only if the pause carried none. */

package/dist/agents/verify.js

@@ -1,7 +1,7 @@
 import { Type } from "typebox";
 import { CODE_AGENT_PROMPT } from "../prompts/default.js";
 import { releaseSession } from "./session-util.js";
-import { mapNestedSuspend, isDurablePause } from "./suspend-guard.js";
+import { mapNestedSuspend, isDurablePause, pauseFamily } from "./suspend-guard.js";
 import { delimitUntrusted, sanitizeUntrustedText } from "../core/untrusted-text.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
 import { createCumulativeStatsTracker } from "./cumulative-stats.js";
@@ -102,7 +102,7 @@ function verifierObjective(originalObjective, impl, evidence) {
 }
 export async function verifyCompleted(runner, result, specBase, objective, config, internals) {
     refuseUnhonorableInternals(internals, "door");
-    if (result.status !== "completed") {
+    if (result.terminal.kind !== "completed") {
         return { ...result, verification: { verdict: "unverified", unverifiedReason: "impl_incomplete", rounds: 0, findings: [] } };
     }
     const maxRounds = Number.isFinite(config.maxRounds) ? Math.max(1, Math.floor(config.maxRounds)) : 2;
@@ -168,10 +168,10 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
         }, legInternals());
         try {
             const cost = (v.stats.costMicroUsd ?? 0) + (v.stats.nested?.costMicroUsd ?? 0);
-            return { verdict: v.structuredOutput, cost, ...(isDurablePause(v.status) ? { paused: v } : {}) };
+            return { verdict: v.structuredOutput, cost, ...(isDurablePause(v.terminal) ? { paused: { ...v, terminal: v.terminal } } : {}) };
         }
         finally {
-            if (!isDurablePause(v.status))
+            if (!isDurablePause(v.terminal))
                 await releaseSession(runner, v.sessionId);
         }
     };
@@ -202,18 +202,18 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
                 findings: [],
                 verifierCost: verifierSpend,
                 verifierPause: {
-                    status: v.paused.status,
-                    sessionId: v.paused.sessionId,
-                    ...(v.paused.checkpointToken ? { checkpointToken: v.paused.checkpointToken } : {}),
-                    ...(v.paused.checkpointGate ? { checkpointGate: v.paused.checkpointGate } : {}),
+                    status: pauseFamily(paused.terminal),
+                    sessionId: paused.sessionId,
+                    checkpointToken: paused.terminal.token,
+                    checkpointGate: paused.terminal.gate,
                 },
             };
             notifier.notify(() => config.onVerifierPause?.({
                 round,
-                status: paused.status,
+                status: pauseFamily(paused.terminal),
                 sessionId: paused.sessionId,
-                ...(paused.checkpointToken ? { checkpointToken: paused.checkpointToken } : {}),
-                ...(paused.checkpointGate ? { checkpointGate: paused.checkpointGate } : {}),
+                checkpointToken: paused.terminal.token,
+                checkpointGate: paused.terminal.gate,
             }), VERIFY_ON_VERIFIER_PAUSE_SITE);
             notifier.notify(() => config.onRound?.({ round, verdict: outcome.verdict, findings: outcome.findings }), VERIFY_ON_ROUND_SITE);
             break;
@@ -248,10 +248,10 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
         }, legInternals());
         spend += (current.stats.costMicroUsd ?? 0) + (current.stats.nested?.costMicroUsd ?? 0);
         implAccount.add(current.stats);
-        if (isDurablePause(current.status)) {
+        if (isDurablePause(current.terminal)) {
             return { ...mapNestedSuspend(carryFrozenPosture(withImplAccount(current))), verification: outcome };
         }
-        if (current.status !== "completed")
+        if (current.terminal.kind !== "completed")
             break;
     }
     return { ...carryFrozenPosture(withImplAccount(current)), verification: outcome };
@@ -259,8 +259,8 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
 export async function runWithVerification(runner, implSpec, config = {}, internals) {
     refuseUnhonorableInternals(internals, "door");
     const result = await runner.runTask(implSpec, internals);
-    if (isDurablePause(result.status)) {
-        return { ...mapNestedSuspend(result), verification: { verdict: "unverified", unverifiedReason: result.status === "needs_review" ? "needs_review" : "suspended", rounds: 0, findings: [] } };
+    if (isDurablePause(result.terminal)) {
+        return { ...mapNestedSuspend(result), verification: { verdict: "unverified", unverifiedReason: pauseFamily(result.terminal), rounds: 0, findings: [] } };
     }
     refuseUnhonorableInternals(internals, "before_leg");
     return verifyCompleted(runner, result, implSpec, implSpec.objective, config, internals);
@@ -268,8 +268,8 @@ export async function runWithVerification(runner, implSpec, config = {}, interna
 export async function resumeWithVerification(runner, token, outcome, taskConfig, objective, config = {}, internals) {
     refuseUnhonorableInternals(internals, "door");
     const result = await runner.resume(token, outcome, taskConfig, internals);
-    if (isDurablePause(result.status)) {
-        return { ...mapNestedSuspend(result), verification: { verdict: "unverified", unverifiedReason: result.status === "needs_review" ? "needs_review" : "suspended", rounds: 0, findings: [] } };
+    if (isDurablePause(result.terminal)) {
+        return { ...mapNestedSuspend(result), verification: { verdict: "unverified", unverifiedReason: pauseFamily(result.terminal), rounds: 0, findings: [] } };
     }
     refuseUnhonorableInternals(internals, "before_leg");
     return verifyCompleted(runner, result, taskConfig, objective, config, internals);

package/dist/core/a2a.js

@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { Type } from "typebox";
 import { A2A_TASK_STATES } from "./a2a-task-state.js";
-import { describeHttpTransportFailure, resolveProtocolHttpHeaders } from "./mcp.js";
+import { resolveProtocolHttpHeaders } from "./mcp.js";
+import { describeHttpTransportFailure } from "./mcp-failure.js";
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName } from "./protocol-naming.js";
 import { A2A_NAMESPACE } from "./protocol-table.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";

package/dist/core/ask-origin.d.ts

@@ -47,11 +47,21 @@ import type { PermissionResult } from "./tool-policy.js";
  *    an instruction rather than hesitation.
  *  - `denial_limit_fallback` — the auto-mode classifier reached its denial bound and handed the call
  *    to a person; the classifier stands BEFORE this ask, never after it.
- *  - `policy` — everything else: a deployment `ToolPolicy` ask, a mode-default ask, or one of the
- *    engine's own post-fold tightens (egress / irreversibility / peer referral / write protection).
- *    This is the hesitation family — the one an armed classifier exists to resolve.
+ *  - `shell_gate_tighten` — the gate's own irreversibility tighten raised the ask over a tier the COARSE
+ *    `shellGate` doctrine installed (a shell command under `shellGate: "classify"`/`"always"`), not an
+ *    explicit per-tool mark. The gate records that its own tighten spoke; a policy stamping
+ *    `decisionReason: "safety"` on its own ask does not become one.
+ *  - `safety_tighten` — the gate's own post-fold tightens over an EXPLICIT fact of the call: the tool's
+ *    egress mark, its irreversibility mark, a peer-message referral in auto mode, a write onto the
+ *    write-protected table. Same recording rule as above.
+ *  - `policy` — everything else: a deployment `ToolPolicy` ask or a mode-default ask. This is the
+ *    hesitation family — the one an armed classifier exists to resolve. The two tighten words are
+ *    classifier-eligible too (arming auto mode is the deployment's explicit choice to let the
+ *    classifier be the explicit ask-resolution for those classes); they are separate words so a deny
+ *    observer or an approval card can say WHICH engine layer raised the question, which one word
+ *    could not.
  */
-export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "policy"];
+export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 export type AskOrigin = (typeof ASK_ORIGINS)[number];
 /** Whether a value is a member of the closed origin set. Exported because the word crosses process
  *  boundaries: a host validating one it received must not hand-roll the set. */
@@ -77,6 +87,10 @@ export interface AskOriginFacts {
      *  read-back off the decision (a policy can put `decisionReason: "org_rule"` on its own ask; the
      *  gate's cell cannot be written by a policy). */
     readonly org: "rule" | "unavailable" | undefined;
+    /** Which of the gate's OWN post-fold tightens minted the standing ask, if one did — again the gate's
+     *  record of its own layer (a tighten replaces an `allow` wholesale, so at most one fires per pass),
+     *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. */
+    readonly tightened: "shell_gate" | "safety" | undefined;
 }
 /**
  * The ONE derivation of an ask's origin, from the surviving decision plus the gate's own facts. The
@@ -89,6 +103,39 @@ export interface AskOriginFacts {
 export declare function askOriginOf(decision: Extract<PermissionResult, {
     action: "ask";
 }>, facts: AskOriginFacts): AskOrigin;
+/**
+ * Which origins IMPLY the `requiresRealApproval` bit, and WHERE that implication is verified — the
+ * consistency table {@link askOriginOf} reads. An ask of a must-carry origin exists so that no automatic
+ * lane clears it (the org's asks: "no configuration clears this, a person nods"; the classifier's
+ * fallback: no automatic lane may re-clear what the classifier already refused), so the bit must ride
+ * it. The bit is NOT derived from this table: the write sites each have their own reason, and a
+ * table-derived bit would have to either strip a safety policy's mandate or make every hook ask
+ * non-budgetable. The table only refuses the one shape that is a defect: a must-carry origin without
+ * the bit — and says where that refusal can honestly happen:
+ *  - `"at_derivation"` — the origin is derived from a GATE fact only the engine writes (`facts.org`),
+ *    so a missing bit is an engine defect and {@link askOriginOf} fails loud;
+ *  - `"at_mint"` — the origin is derived from a decision MEMBER a policy may compose
+ *    (`denialLimitFallback`: a self-declared one opts the policy's own ask out of automatic
+ *    resolution, the safe direction, not a defect), so the invariant is pinned at the engine's two
+ *    mint sites (the gate's fallback re-mint and the inherited station's) rather than thrown at
+ *    derivation, where a policy's own object could trip it;
+ *  - `false` — the origin says nothing about the bit: a `policy` ask may carry it (a safety policy's
+ *    own mandate) or not, and both are legal.
+ */
+export declare const ORIGIN_IMPLIES_REAL_APPROVAL: {
+    readonly content_question: false;
+    readonly unresolvable: false;
+    readonly org_unavailable: "at_derivation";
+    readonly org_rule: "at_derivation";
+    readonly hook: false;
+    readonly ask_rule: false;
+    readonly denial_limit_fallback: "at_mint";
+    readonly shell_gate_tighten: false;
+    readonly safety_tighten: false;
+    readonly policy: false;
+};
+/** The fence over the consistency table: `never` while every origin has a row. */
+export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<AskOrigin, keyof typeof ORIGIN_IMPLIES_REAL_APPROVAL>>;
 /**
  * The auto-mode CLASSIFIER's table: may a live classifier verdict resolve an ask of this origin?
  *
@@ -107,9 +154,13 @@ export declare function askOriginOf(decision: Extract<PermissionResult, {
  *    whether the person is asked at all, which is the rule's whole content.
  *  - `denial_limit_fallback`: the classifier already spoke (its bound is what minted this ask); an
  *    allow here would un-say the fallback, a block would count it twice.
- *  - `policy`: YES — including the engine's own safety tightens and a safety policy's
- *    `requiresRealApproval` ask (a live verdict is judgment, and arming auto mode is the deployment's
- *    explicit choice to let the classifier be the explicit ask-resolution for those classes).
+ *  - `shell_gate_tighten` / `safety_tighten`: YES — the engine's own tightens are hesitation the
+ *    deployment armed the classifier to resolve (the classify doctrine's whole point for the shell
+ *    tier; the safety marks make the ask NON-BUDGETABLE at the durable park, a different axis from who
+ *    may answer it live).
+ *  - `policy`: YES — including a safety policy's `requiresRealApproval` ask (a live verdict is
+ *    judgment, and arming auto mode is the deployment's explicit choice to let the classifier be the
+ *    explicit ask-resolution for those classes).
  * Exclusion is skip-not-deny: the ask flows the original chain (park / approver / headless deny) —
  * narrower autonomy, never a lost ask.
  */
@@ -121,6 +172,8 @@ declare const CLASSIFIER_MAY_ANSWER: {
     readonly hook: false;
     readonly ask_rule: false;
     readonly denial_limit_fallback: false;
+    readonly shell_gate_tighten: true;
+    readonly safety_tighten: true;
     readonly policy: true;
 };
 /** The fence over the classifier table: `never` while every origin has a row (pinned by a type test). */

package/dist/core/ask-origin.js

@@ -1,9 +1,16 @@
-export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "policy"];
+export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
 export function isAskOrigin(v) {
     return ASK_ORIGIN_SET.has(v);
 }
 export function askOriginOf(decision, facts) {
+    const origin = originLadder(decision, facts);
+    if (ORIGIN_IMPLIES_REAL_APPROVAL[origin] === "at_derivation" && decision.requiresRealApproval !== true) {
+        throw new Error(`ask origin "${origin}" requires the requiresRealApproval bit on the decision it was derived from, and the decision carries none — an engine mint site dropped the bit`);
+    }
+    return origin;
+}
+function originLadder(decision, facts) {
     if (facts.contentQuestion)
         return "content_question";
     if (facts.markedUnresolvable)
@@ -18,8 +25,24 @@ export function askOriginOf(decision, facts) {
         return "ask_rule";
     if (decision.denialLimitFallback !== undefined)
         return "denial_limit_fallback";
+    if (facts.tightened === "shell_gate")
+        return "shell_gate_tighten";
+    if (facts.tightened === "safety")
+        return "safety_tighten";
     return "policy";
 }
+export const ORIGIN_IMPLIES_REAL_APPROVAL = {
+    content_question: false,
+    unresolvable: false,
+    org_unavailable: "at_derivation",
+    org_rule: "at_derivation",
+    hook: false,
+    ask_rule: false,
+    denial_limit_fallback: "at_mint",
+    shell_gate_tighten: false,
+    safety_tighten: false,
+    policy: false,
+};
 const CLASSIFIER_MAY_ANSWER = {
     content_question: false,
     unresolvable: false,
@@ -28,6 +51,8 @@ const CLASSIFIER_MAY_ANSWER = {
     hook: false,
     ask_rule: false,
     denial_limit_fallback: false,
+    shell_gate_tighten: true,
+    safety_tighten: true,
     policy: true,
 };
 export function classifierMayAnswer(origin) {