@sema-agent/core 7.5.1 → 7.6.0

package/dist/core/runner/contracts.d.ts

@@ -26,9 +26,9 @@ import type { CompactionForkContext } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
-import type { CheckpointGate, CheckpointState, CheckpointToken, PlatformLimitReason, ResourceLedger, ResourceLimitReason } from "../checkpoint-store.js";
+import type { Checkpoint, CheckpointState, CheckpointToken, PlatformLimitReason, ResourceLedger, ResourceLimitReason, SerializedCheckpointState } from "../checkpoint-store.js";
 import type { ClearedProjectionLedger, ContextEditMachine, OccurrenceIndex } from "../context-edit.js";
-import type { HookInvocationIdentity, Hooks, OrgGateVerdict } from "../hooks.js";
+import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, ToolGateInput } from "../hooks.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { MemoryEngine } from "../memory-engine/engine.js";
 import type { HarvestReport, MemorySessionHandle } from "../memory-engine/types.js";
@@ -36,7 +36,8 @@ import type { SessionPermissionRules } from "../session-policy-store.js";
 import type { RecoveredOrphan } from "../session-reconcile.js";
 import type { StoredSession } from "../session.js";
 import type { TaskNotificationPayload } from "../task-notification.js";
-import type { OnAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
+import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
+import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
 import type { NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
 import type { WiringManifest } from "../wiring-manifest.js";
@@ -62,7 +63,7 @@ export interface ToolFaceSnapshot {
 /**
  * The once-per-session announcement ledger's OPERATOR SINK as the phases see it: the
  * `RunnerDeps.onError` signature, deduplicated per (code, text) across the session. The ledger itself
- * (load, digests, settle) lives in prepare-announce-once.ts; a phase that announces once invokes only
+ * (load, digests, settle) lives in announce-once-ledger.ts; a phase that announces once invokes only
  * this member, so the member's shape is declared here — below every phase — rather than reached for
  * sideways as the ledger module's type.
  */
@@ -143,6 +144,18 @@ export interface FileHistoryBoundarySeat {
     begin(entryId: string): void;
     settle(): Promise<void>;
 }
+/**
+ * The commit-side facts of the run's ONE durable pause: the terminal cause the result assembles
+ * ({@link import("../types.js").PausedCause} — gate, token, checkpoint id, restore mode), the COMMITTED scope
+ * (read verbatim by the reap/cancel path — never re-derived from the spec, which the cross-scope re-scope
+ * may no longer match), and the id of the tool call the park is holding (only a `tool_approval` pending
+ * action parks ON a call; absent, never guessed, for the kinds that hold none).
+ */
+export interface CommittedPause {
+    cause: import("../types.js").PausedCause;
+    scope: string;
+    gatedCallId?: string;
+}
 export interface Prepared {
     harness: AgentHarness;
     /** The CONCRETE built-in session (engine-internal: prepare constructs/acquires `StoredSession` itself,
@@ -220,17 +233,12 @@ export interface Prepared {
      *
      * It is a sideband and not a field on the tool RESULT because a result is not a trustworthy carrier
      * for this: `details` is arbitrary tool-authored data that post-tool hooks may also replace, so a
-     * failing tool could stamp `settledBy:"human"` on itself and tell a consumer's audit view that a
-     * person approved something nobody was ever shown. Provenance has to travel on a channel only the
+     * failing tool could stamp a settlement on itself and tell a consumer's audit view that a person
+     * approved something nobody was ever shown. Provenance has to travel on a channel only the
      * adjudicating layer can write. Same reason the entries are keyed by CALL id: the gate adjudicated
      * that exact call, and the frame that reads it is that call's own.
      */
-    approvalSettlement: Map<string, {
-        settledBy?: import("../tool-policy.js").ApprovalSettledBy;
-        approver?: string;
-        resolution?: import("../tool-policy.js").AskDenyResolution;
-        autoDenied?: true;
-    }>;
+    gateOutcomes: Map<string, import("../gate-outcome.js").GateOutcome>;
     /**
      * The parent-thread human-rejection halt fact (see `maybeHumanRejectionHalt`): present from the
      * moment a bare human rejection halts the turn's batch until the run ends or the NEXT provider
@@ -553,24 +561,15 @@ export interface Prepared {
      *  and the Runner must tear down on task end. Undefined when the env came from a (caller-owned) static
      *  `deps.executionEnv` or the stub — those outlive the task and must NOT be destroyed here. */
     ownedEnv?: ExecutionEnv;
-    /** design/45: a mutable holder the durable-suspend gate writes when a policy `ask` was checkpointed
-     *  (capture + abort). The run loop reads it to assemble `status:"suspended"`. Empty unless a suspension
-     *  fired this run.
-     *
-     *  `gatedCallId` is the id of the tool call the committed gate is holding — read straight off the
-     *  committed checkpoint's `tool_approval` pendingAction, so the id a contaminated sibling frame names
-     *  and the id the checkpoint parks on are the SAME value by construction, not by convention. ABSENT
-     *  (never guessed) for a park that binds no tool call at all — a `resource_limit` slice and a
-     *  `plan_review` pause both have pendingActions with no tool call, so there is no causal id to name.
-     *  Written unconditionally by the commit-side publisher precisely so a later park cannot inherit an
-     *  earlier one's id. */
-    suspendRef: {
-        token?: CheckpointToken;
-        checkpointId?: string;
-        gate?: CheckpointGate;
-        scope?: string;
-        restoreMode?: "snapshot" | "park_only";
-        gatedCallId?: string;
+    /** The run's ONE committed durable pause ({@link CommittedPause}): a mutable holder the commit-side
+     *  publisher (`publishCommittedSuspend`) writes exactly once per run when a park commits — an approval
+     *  or content ask, a resource slice, a platform pause, a plan or dry-run review — and the run loop reads
+     *  to assemble the result's `terminal: { kind: "paused", … }`. WHICH pause it is is the cause's own
+     *  `gate.kind` (a registry row), not the holder it landed in: the two same-shaped holders that used to
+     *  split the approval family from the review family, and the commit-side routing between them, are
+     *  gone. `current` is absent until a park commits. */
+    pausedRef: {
+        current?: CommittedPause;
     };
     /** Ruled 2026-08-05 (matrix ruling arm A): set true by the resume engine when this leg EXECUTES the
      *  approved pending call — the restart-loop cap then counts from a fresh base (consecutive
@@ -578,22 +577,6 @@ export interface Prepared {
     suspendProgressRef: {
         executedApproved: boolean;
     };
-    /** design/76 §2.5 (dry-run / shadow) + design/80 D-B (plan-gate): the DUAL of {@link suspendRef} for the
-     *  REVIEW-PAUSE family — a `{kind:"needs_review"}` pause (a profile's dry-run interception committed a
-     *  checkpoint whose predicted state-diff a human/judge must REVIEW) OR a `{kind:"plan_review"}` pause (a
-     *  profile's plan-gate committed a checkpoint whose proposed PLAN a human must approve/edit/reject). The
-     *  commit-side discriminant (`publishCommittedSuspend`) writes HERE for a `needs_review` OR `plan_review`
-     *  gate and into {@link suspendRef} for every other gate kind — **never both** (else assemble-result's slot
-     *  8.6 `needs_review` branch is dead code, v4 MAJOR-A). The run loop reads it to assemble
-     *  `status:"needs_review"`. Empty unless a review pause fired this run. */
-    reviewRef: {
-        token?: CheckpointToken;
-        checkpointId?: string;
-        gate?: CheckpointGate;
-        scope?: string;
-        restoreMode?: "snapshot" | "park_only";
-        gatedCallId?: string;
-    };
     /** RB-439-a: the remote-workspace lifecycle failures this run hit, appended in call order and echoed
      *  verbatim on `TaskResult.remoteEnvFailures`. A shared array (not a per-call return) because a suspend
      *  refusal is reported through the deployment's `onError` side channel and the run then continues or
@@ -613,7 +596,7 @@ export interface Prepared {
      *  results, and a remote — or static caller-owned, never per-task-stub — env). The run loop calls it at a
      *  CLEAN turn boundary when a resource limit (turns/budget/walltime) was hit: it mints a `resource_limit`
      *  checkpoint + pauses the workspace + stops the loop cleanly (NOT abort). Returns true iff it committed a
-     *  resumable checkpoint (sets `suspendRef`); false ⇒ caller falls through to normal limit handling.
+     *  resumable checkpoint (publishes the committed pause); false ⇒ caller falls through to normal limit handling.
      *  `sliceSpend` (Slice 4) is THIS slice's cost/tokens/turns, debited onto the cross-slice ledger. */
     suspendForResource?: (reason: ResourceLimitReason, sliceSpend: {
         costMicroUsd: number;
@@ -684,7 +667,7 @@ export interface Prepared {
     };
     /** design/80 D-B: present (≠ undefined) ONLY when a `checkpointStore` is wired (the deployment can pause). The
      *  run loop calls it at a CLEAN turn boundary when `reviewRequestRef.pending` is set: it mints a `plan_review`
-     *  checkpoint (`status:"needs_review"`, routes to `reviewRef`) + pauses the workspace + aborts the loop, reusing
+     *  checkpoint (`status:"needs_review"` by its registry row) + pauses the workspace + aborts the loop, reusing
      *  the SAME commit saga as the human/resource suspends. Returns true iff it committed a resumable checkpoint;
      *  false ⇒ the request could not be honored (caller drops it and continues). */
     suspendForReview?: (reason?: string) => Promise<boolean>;
@@ -745,7 +728,10 @@ export interface Prepared {
      *   · the driver — pushes CronCreate/CronDelete/CronList (write hands; inert without a daemon);
      *   · lsp — pushes the LSP tool (manager wired);
      *   · project-context — pushes Skill (manifest), the shared-memory pair and the memory-engine tools;
-     *   · defer-classify — SPLICES OUT the excluded names and the retracted pair (the only removals at prepare).
+     *   · defer-classify — SPLICES OUT the excluded names and the retracted pair (the only removals at prepare);
+     *   · memory-engine-session — REPLACES entries in place with the content-origin wrappers when it arms (a mounted
+     *     memory session or a recorder channel); the refresh seam re-runs the same pass through `contentOriginWrapRef`
+     *     after a re-splice (identity-tracked, so a wrapper is never wrapped again).
      *  tool-disclosure and listings only READ it (`harnessTools` is a derived list; placeholders never enter here). */
     tools: AgentTool[];
     /** Name→effect map for every tool this task can call (design/44 §3). Used by the abort-path orphan
@@ -962,7 +948,7 @@ export interface Prepared {
      *  ANNOUNCED model catalog the same way (advanced only when a committed frame carried one), so a
      *  catalog change across a suspend is re-announced as a "Models available…" drift line.
      *  `mcpFailed` / `advisories` are the once-per-SESSION arms of the same snapshot (see
-     *  prepare-announce-once.ts): seeded at prepare from the branch's record, advanced by the run loop
+     *  announce-once-ledger.ts): seeded at prepare from the branch's record, advanced by the run loop
      *  on intact delivery of the tools_delta `failedServers` arm / the mcp_dropped_tools frame. */
     announcedListingsRef: AnnouncedListingSnapshotInput;
     /** env-tail migration (#254 shape) — the git-status frame lane's run-local state: this leg's
@@ -1294,6 +1280,25 @@ export interface InheritedGate {
         hookEnv?: unknown;
     }>;
 }
+/** The runtime feature flags the stable prompt's harness-context block gates its sections on
+ *  (design/64 §6.3: claim only what the task has). Spread into the assembly's StablePromptContext
+ *  by the prompt-assembly phase, which re-derives the two orchestration flags against the post-exclusion roster. */
+export interface PromptFeatureFlags {
+    policyEnabled: boolean;
+    hooksEnabled: boolean;
+    isolationEnabled: boolean;
+    reminderMark: string;
+    readFaceOpen: boolean;
+    orchestrationEnabled: boolean;
+    orchestrationDeferred: boolean;
+    promptProfile: "simple" | "classic";
+    fableMitigations: boolean;
+    goalEnabled: boolean;
+    awarenessEnabled: boolean;
+    worktreeIsolated: boolean;
+    withinTaskCompactionEnabled: boolean;
+    isSubagent: boolean;
+}
 /**
  * design/78 Slice-1 (MAJOR-3 wiring): a TRUSTED, run-scoped internal channel into {@link prepareTask}, set
  * ONLY by a trusted CORE caller (`runRepairLoop` via the Runner's internal `runTaskStream` arg) — NEVER from
@@ -1876,3 +1881,92 @@ export interface ResolvedWorkspace {
      *  which `cwd` is a host path a consumer may diff / merge / remove. */
     remote: boolean;
 }
+/**
+ * #457 ② — the resolver's answer, with the WITHHELD cause beside the value.
+ *
+ * The old signature returned a bare `unknown`, which collapsed three different worlds into one
+ * `undefined`: "this tool declares no preview at all", "the projection threw / could not be
+ * serialized", and "the projection declined to speak for these args". The middle one is the case an
+ * approval surface must be told about — a person is being asked to approve something whose display
+ * projection could NOT be produced — and it was indistinguishable from the other two.
+ *
+ * `withheld` names the cause; it is ORTHOGONAL to `preview` presence, deliberately: the oversize arm
+ * still ships its truncation stub (a surface that renders it tells the person the size, which is more
+ * useful than nothing), and the stub alone never carried the fact that the real projection is missing.
+ */
+export interface ResolvedApprovalPreview {
+    /** The display projection, when one could be produced (or the oversize truncation stub). */
+    preview?: unknown;
+    /** Present ⇔ the tool DECLARED a preview and the gate could not present a usable one:
+     *  `"oversize"` — produced but past the 16KiB display bound (the stub rides `preview`);
+     *  `"unavailable"` — the projection threw, or its value has no JSON serialization.
+     *  ABSENT covers both "no preview declared" and "the projection returned nothing to show" — neither
+     *  is a withholding, and claiming one would make every preview-less tool look suppressed. */
+    withheld?: "oversize" | "unavailable";
+}
+/** The in-stream ask lane: the six closures the park closure and the gate station consume. Built as ONE value so
+ *  "the lane exists" is one fact, not six independently-undefined seats. */
+export interface AskLane {
+    /** The shared run+call signal composition, bound to this task's run signal once. */
+    composedCallSignal: (callSignal: AbortSignal | undefined) => AbortSignal;
+    /** The abort-bound policy check, or undefined when no policy is wired (→ the gate reads allow). */
+    adjudicate: ((req: ToolCallRequest, callSignal?: AbortSignal) => Promise<PermissionResult>) | undefined;
+    /** The approval display projection over the live roster (alias-aware; oversize/unavailable named). */
+    approvalPreviewOf: (toolName: string, args: unknown) => ResolvedApprovalPreview;
+    /** THE synchronous ask mint: resolves a surviving `ask` through the live seat, books the ledger. */
+    resolveAskBound: (decision: PermissionResult, req: ToolCallRequest, callSignal?: AbortSignal) => Promise<ResolvedAsk>;
+    /** The pre-wrapped deny observer, or undefined when the deployment wired no `permissionDenied` hook. */
+    notifyPermissionDenied: ((payload: PermissionDeniedPayload) => Promise<void>) | undefined;
+    /** The deployment-facing half of a crashing PreToolUse hook (swallow-guarded). */
+    notifyHookError: (err: unknown) => void;
+}
+/** How the put-commit + put-failure saga ended (see `commitSuspendSaga` inside the phase for each arm's meaning). */
+export type SuspendSagaOutcome = {
+    tag: "committed";
+} | {
+    tag: "cut";
+} | {
+    tag: "absent";
+    reason?: string;
+} | {
+    tag: "unknown";
+    reason: string;
+} | {
+    tag: "compensation_failed";
+    reason: string;
+};
+/** The durable settlement machinery the boundary parks and the park closure consume. Built as ONE value so "the saga
+ *  exists" is one fact, not eight independently-undefined seats. */
+export interface SuspendSaga {
+    /** THIS leg's spend so far in micro-USD (own + nested delta), read at mint time. */
+    inFlightSpendMicroUsd: () => number;
+    /** The §4.bis correctness-state whitelist, serialized from the live values at suspend. */
+    serializeCheckpointState: (workspaceHandle: WorkspaceHandle | undefined, parkedSpendMicroUsd?: number) => SerializedCheckpointState;
+    /** The shared paused-VM compensation, bound to this task's failure ledger and error face. */
+    compensatePausedVM: (remoteEnv: RemoteExecutionEnv, snapshotId: SnapshotId) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** The put-commit + put-failure split — the point of no return, tagged. */
+    commitSuspendSaga: (token: CheckpointToken, cp: Checkpoint, remoteEnv: RemoteExecutionEnv | undefined, remoteHandle: WorkspaceHandle | undefined, cutSignal?: AbortSignal) => Promise<SuspendSagaOutcome>;
+    /** The shared suspend-loop-cap guard (safety state first, diagnostic second). */
+    suspendLoopCapHit: (count: number, cap: number | undefined, detail: string) => boolean;
+    /** The `suspendVM` target by CAPABILITY, or undefined. */
+    suspendableEnv: RemoteExecutionEnv | undefined;
+    /** The park-only remote target (non-suspendable, externally durable), or undefined. */
+    parkOnlyRemoteEnv: RemoteExecutionEnv | undefined;
+    /** The park-only identity capture (snapshotId stripped, `restoreMode: "park_only"`). */
+    parkOnlyHandle: (env: RemoteExecutionEnv) => WorkspaceHandle;
+}
+/** The park closure and the content-ask routing closure the gate station hands to `runToolGate`. Built as ONE value so
+ *  "the park lane's closures exist" is one fact; `suspendAsk` stays optional INSIDE it because the park predicate (a store,
+ *  and something to park for) is a narrower condition than the gate machinery's activation. */
+export interface ParkAsk {
+    /** design/174 — the gate's content-ask routing closure (total by construction; answers `unavailable` with no live face). */
+    resolveContentAsk: NonNullable<ToolGateInput["resolveContentAsk"]>;
+    /** design/45 — the durable park closure (twelve positional seats then the structural carry), or undefined when the park
+     *  lane is not armed (the gate then keeps the synchronous onAsk path). */
+    suspendAsk: ToolGateInput["suspendAsk"];
+}

package/dist/core/runner/denial-limit-arms.d.ts

@@ -148,7 +148,7 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     subject: "this call" | "the approved edit";
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
-export type FallbackResolution = Pick<ResolvedAsk, "action" | "resolution" | "approverUnavailable">;
+export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;
 /** A deny nobody made, at a wrapper arm: no approver wired, or a blanket `onAsk:"allow"` refused as
  *  no approver. `approver_unavailable` is NOT headless here — it floats to the main gate, which owns
  *  that arm (a park, or the fail-closed refusal). */
@@ -173,3 +173,26 @@ export declare function settleDenialLimitFallback(opts: {
     toolName: string;
     toolCallId: string;
 }): void;
+/**
+ * design/384 slice 1 — the observer `resolveAskBound` hands `resolveAsk` for a DETACHED approver's
+ * settlement (the race arm released the wait; the approver's promise lives on):
+ *  · an approval the released wait never consumed becomes the `task.late_approval` notice a host
+ *    can forward on its own wire (the wire-facing half of "release, not a verdict" — the notice
+ *    asserts non-consumption only, never an arrival order the resolver cannot prove);
+ *  · an unconsumed rejection goes to the deployment's error face (`onError(phase:"hook")`) — a
+ *    callback failure the engine no longer awaits is still a callback failure, never silence.
+ */
+export declare function lateAskSettlementObserver(args: {
+    toolName: string;
+    toolCallId: string;
+    sessionId: string;
+    runId: string;
+    taskId?: string;
+    onNotice: import("../types.js").RunnerDeps["onNotice"];
+    onError: import("../types.js").RunnerDeps["onError"];
+}): (late: {
+    kind: "approve";
+} | {
+    kind: "error";
+    error: unknown;
+}) => void;

package/dist/core/runner/denial-limit-arms.js

@@ -53,7 +53,7 @@ export function createDenialLimitStop(opts) {
     };
     return { gateStopRef, stopForDenialLimit };
 }
-const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined };
+const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined };
 function fallbackCarry(fallback, liveApprover, tracker) {
     if (fallback === undefined)
         return {};
@@ -97,10 +97,10 @@ export async function judgeInheritedClassifier(opts) {
     return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, INHERITED_STATION_FACTS) };
 }
 export function headlessDenyAtFold(r) {
-    return r.resolution === "no_approver" || r.resolution === "blanket_allow_refused";
+    return r.settlement?.kind === "no_approver" || r.settlement?.kind === "blanket_allow_refused";
 }
 export function headlessDenyAtRecheck(r) {
-    return headlessDenyAtFold(r) || r.resolution === "approver_unavailable" || r.approverUnavailable === true;
+    return headlessDenyAtFold(r) || r.settlement?.kind === "approver_unavailable" || r.approverUnavailable === true;
 }
 export function settleDenialLimitFallback(opts) {
     const { fallback, resolved } = opts;
@@ -114,3 +114,24 @@ export function settleDenialLimitFallback(opts) {
         opts.stop({ toolName: opts.toolName, toolCallId: opts.toolCallId, fallback });
     }
 }
+export function lateAskSettlementObserver(args) {
+    return (late) => {
+        if (late.kind === "approve") {
+            deliverEngineNotice(args.onNotice, {
+                code: "task.late_approval",
+                message: `an approval for "${args.toolName}" was not consumed: a run or turn interrupt released the ask wait, ` +
+                    `so the tool did NOT run and the approval was not honored (an unconsumed answer is the approver ` +
+                    `releasing its wait, never a verdict).`,
+                detail: {
+                    toolName: args.toolName,
+                    toolCallId: args.toolCallId,
+                    sessionId: args.sessionId,
+                    runId: args.runId,
+                    ...(args.taskId !== undefined ? { taskId: args.taskId } : {}),
+                },
+            });
+            return;
+        }
+        args.onError?.(late.error, { phase: "hook", sessionId: args.sessionId });
+    };
+}

package/dist/core/runner/gate-exit.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The ONE mint of a {@link GateOutcome} — the record of what a tool-gate pass decided, what ask it settled
+ * and who asked. The gate accumulates two facts on its way to an exit (WHO refused, written once at the
+ * refusing site; WHAT was settled, written at the resolution site) and hands them here; this module
+ * assembles the record, runs the invariant screen, and refuses a record the engine composed wrong. Every
+ * projection of the outcome (the deny observer's payload, the call's `tool_end` frame, the engine's
+ * per-call sideband) is the object minted here, never a re-derivation.
+ *
+ * A machinery module on the prepare path's first stratum: it reaches down for the vocabulary only.
+ */
+import { type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
+import type { AskOrigin } from "../ask-origin.js";
+import { type PermissionResult, type ResolvedAsk } from "../tool-policy.js";
+/** The ask a gate pass settled, as the gate captured it at its resolution site: the settlement the
+ *  resolver composed and the origin word the ask carried. Both or neither (invariant I1). */
+export interface SettledAsk {
+    settlement: Settlement;
+    origin: AskOrigin;
+}
+/** The facts a gate pass hands the mint. `deniedBy` is present exactly when the pass refused; `settled`
+ *  exactly when the pass consumed an ask's settlement (a person's yes that was later vetoed included). */
+export interface GateExitFacts {
+    deniedBy?: DeniedBy;
+    settled?: SettledAsk;
+}
+/**
+ * Mint the outcome. A defect here is an ENGINE defect (a refusing site that did not say who refused, a
+ * settlement without its origin, a person's yes beside a non-veto layer's deny) and throws: the gate's
+ * own composition is not a caller input, so there is no fail-closed "deny" to fall back to that would be
+ * more honest than the fault.
+ */
+export declare function mintGateOutcome(facts: GateExitFacts): GateOutcome;
+/** A direct refusal by one layer, with no ask settled — the five short-circuit exits (a hook that threw or
+ *  never answered, the hook's own deny, the compliance lock, the plan-mode block). */
+export declare function directDeny(deniedBy: Exclude<DeniedBy, "ask_resolution">): GateOutcome;
+/**
+ * The gate's settlement LEDGER for one pass — the one place "which ask did this pass consume" is written,
+ * with ONE rule for every attestation read (the main adjudication, the approval-edit re-check, the gate's
+ * own ask resolutions), so the three sites cannot disagree about what an attested decision means:
+ *  - an engine attestation on a decision object (the approval factory's wait ended inside a policy
+ *    `check()`; an inherited lane resolved an ancestor's ask) is a settled ask of THIS call — read off the
+ *    identity-keyed seat, never off a caller-composable member;
+ *  - a deny carrying a REFUSAL attestation is the ask's own resolution (`ask_resolution`); a deny carrying a
+ *    person's YES is a later layer's VETO (the yes stays on the settlement, the layer is the disposition —
+ *    invariant I3);
+ *  - the LATEST resolution wins (a re-check refusal replaces the first approval; a re-approval renews it);
+ *  - a SURVIVING ask supersedes any settlement read off an earlier decision (a tighten minted a new
+ *    question; whoever resolves it settles it afresh).
+ * For a resolver's object the attestation outranks the exposed member; the member is the fallback for a
+ * resolver seat that composes without attesting (a hand-built resolver; the ask lane's own intercept
+ * deny). TRUST BOUNDARY, stated: `ToolGateInput.resolveAsk` is wired by prepare from the engine's own
+ * resolver — a wrapper that spreads a resolved object (dropping the identity-keyed attestation) and
+ * REPLACES the member is inside the engine's trust line, not a deployment's; making the member
+ * attestation-only is the follow-up that migrates the ask lane's composition and the test resolvers
+ * onto an engine-owned mint.
+ */
+export interface SettlementLedger {
+    /** The ask this pass consumed, or undefined when no ask was settled (a direct deny, a plain allow). */
+    readonly settled: SettledAsk | undefined;
+    /** An engine-composed settlement the gate itself minted (the unshown content ask's refusal). */
+    set(settled: SettledAsk): void;
+    /** Record an ask's resolution: the resolver's settlement beside the ask's own origin word. */
+    fromResolved(resolved: ResolvedAsk, asked: PermissionResult, toolName: string): void;
+    /** Read an adjudication's attestation. For a deny, returns the refusing layer word (`ask_resolution`
+     *  for an attested refusal, `policy` otherwise — a veto when a yes rides the settlement); undefined
+     *  for an allow or an ask. */
+    fromDecision(decision: PermissionResult): DeniedBy | undefined;
+    /** A surviving ask supersedes whatever an earlier decision settled. */
+    supersede(): void;
+}
+export declare function createSettlementLedger(call: {
+    toolCallId: string;
+    toolName: string;
+}): SettlementLedger;

package/dist/core/runner/gate-exit.js

@@ -0,0 +1,55 @@
+import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
+import { engineSettlementOf } from "../tool-policy.js";
+export function mintGateOutcome(facts) {
+    const settlement = facts.settled !== undefined ? Object.freeze({ ...facts.settled.settlement, who: Object.freeze({ ...facts.settled.settlement.who }) }) : undefined;
+    const outcome = Object.freeze({
+        disposition: Object.freeze(facts.deniedBy !== undefined ? { kind: "denied", deniedBy: facts.deniedBy } : { kind: "allowed" }),
+        ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
+    });
+    const defects = screenGateOutcome(outcome);
+    if (defects.length > 0)
+        throw new Error(`the tool gate composed an outcome that violates its own record: ${defects.join("; ")}`);
+    return outcome;
+}
+export function directDeny(deniedBy) {
+    return mintGateOutcome({ deniedBy });
+}
+export function createSettlementLedger(call) {
+    let settled;
+    return {
+        get settled() {
+            return settled;
+        },
+        set(next) {
+            settled = next;
+        },
+        fromResolved(resolved, asked, toolName) {
+            if (asked.action !== "ask" || asked.origin === undefined) {
+                if (resolved.settlement === undefined)
+                    return;
+                throw new Error(`an ask for "${toolName}" was resolved without an origin word — the origin stamp precedes every resolution`);
+            }
+            const attested = engineSettlementOf(resolved, call);
+            if (attested !== undefined) {
+                settled = { settlement: attested.settlement, origin: asked.origin };
+                return;
+            }
+            if (resolved.settlement === undefined)
+                return;
+            settled = { settlement: resolved.settlement, origin: asked.origin };
+        },
+        fromDecision(decision) {
+            if (decision.action === "ask")
+                return undefined;
+            const attested = engineSettlementOf(decision, call);
+            if (attested !== undefined)
+                settled = { settlement: attested.settlement, origin: attested.origin };
+            if (decision.action !== "deny")
+                return undefined;
+            return attested !== undefined && SETTLEMENT_IS_REFUSAL[attested.settlement.kind] ? "ask_resolution" : "policy";
+        },
+        supersede() {
+            settled = undefined;
+        },
+    };
+}

package/dist/core/runner/inherited-ask-grants.d.ts

@@ -0,0 +1,46 @@
+import { type OnAsk, type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
+/** RB-40 byte-shape key, throw-proofed: JSON.stringify throws on a cyclic value (a deployment
+ *  policy's rewrite object carries no acyclicity guarantee) — `undefined` here means "no comparable
+ *  shape", which every consumer treats as a mismatch (skip the record / skip the reuse ⇒ the child
+ *  gate just re-asks — the safe direction, never a gate failure). */
+export declare function askGrantShapeOf(args: unknown): string | undefined;
+/**
+ * RB-40 — duplicate-frame collapse (single-Runner embedded shape), the CONSUME half: an inherited
+ * layer already resolved THIS call as a clean allow at the SAME approver function, on EXACTLY the
+ * byte-shape this caller-slot ask now presents. The human's consent covers this consultation
+ * verbatim — asking again is the 2-frame UX debt, not a second authority. Guards, all mismatches
+ * re-ask (⇒ `undefined`):
+ *  · SOURCE (review F-2): only a caller-slot POLICY ask may reuse — a safety tighten
+ *    (egress/irreversible/shellGate stamp `decisionReason:"safety"`), a hook-promoted ask
+ *    ("hook"), or a classifier ask carries a DIFFERENT authority/context and keeps its frame.
+ *  · IDENTITY: the approver FUNCTION reference (never a name) — compared through
+ *    `askApproverIdentity`, not by raw reference (ruled 2026-08-04): a delegated child's approver
+ *    is the ancestor's own, wrapped with delegation provenance — a DIFFERENT function object, the
+ *    SAME operator. Bare `===` therefore stopped collapsing the frame the moment the ask seam
+ *    started forwarding approvers, and one tool call presented the same person the same card
+ *    twice. The wrapper adds metadata and delegates every decision, so it grants no authority of
+ *    its own; identity here only answers "same consultation".
+ *  · SHAPE: byte-equality against the [1462] r5 presented SNAPSHOT; reuse re-emits that snapshot
+ *    as the executed shape via `presentedInput` (review F-1) — the same schema-revalidated binding
+ *    as a main-gate approval (shown == executed, by construction).
+ *  · LEDGER (review F-3): the ONE real consultation (timed on the wrapper arm) is recorded here —
+ *    one frame happened, one frame is booked.
+ * The grant lives only within one gate evaluation (consumed on reuse, swept at the call site) — a
+ * REOPENED checkpoint's re-adjudication never sees a stale grant.
+ */
+export declare function consumeInheritedAskGrant(grants: Map<string, {
+    approver: unknown;
+    argsJson: string;
+    presented: unknown;
+    waitMs: number;
+}>, onAsk: OnAsk | undefined, humanReviewRef: {
+    count: number;
+    totalWaitMs: number;
+    gates: Array<{
+        kind: string;
+        waitMs: number;
+        decision?: string;
+        toolName?: string;
+        toolArg?: string;
+    }>;
+}, decision: PermissionResult, req: ToolCallRequest): ResolvedAsk | undefined;

package/dist/core/runner/inherited-ask-grants.js

@@ -0,0 +1,29 @@
+import { primaryActivityArg } from "../arg-summary.js";
+import { askApproverIdentity } from "../tool-policy.js";
+export function askGrantShapeOf(args) {
+    try {
+        return JSON.stringify(args ?? null);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision, req) {
+    if (decision.decisionReason !== undefined && decision.decisionReason !== "rule")
+        return undefined;
+    const grant = grants.get(req.toolCallId);
+    if (grant === undefined || askApproverIdentity(grant.approver) !== askApproverIdentity(onAsk) || grant.argsJson !== askGrantShapeOf(req.args))
+        return undefined;
+    grants.delete(req.toolCallId);
+    humanReviewRef.count += 1;
+    humanReviewRef.totalWaitMs += grant.waitMs;
+    const toolArg = primaryActivityArg(req.args);
+    humanReviewRef.gates.push({
+        kind: "human",
+        waitMs: grant.waitMs,
+        decision: "allow",
+        toolName: req.toolName,
+        ...(toolArg !== undefined ? { toolArg } : {}),
+    });
+    return { action: "allow", presentedInput: grant.presented };
+}