@sema-agent/core 7.5.2 → 7.6.0

package/dist/core/hooks.d.ts

@@ -1,6 +1,7 @@
 import type { ActorAssertion, DocumentContent, ImageContent, TextContent } from "../internal/llm.js";
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
+import type { GateOutcome } from "./gate-outcome.js";
 import { type AskClass } from "./ask-class.js";
 import { type AutoModeDenialTracker } from "./auto-mode.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
@@ -385,30 +386,7 @@ export declare function runHookSeat<T>(seat: HookSeatName, bound: HookSeatBound,
  * expiry, including the ones where the bound was never reached.)
  */
 export declare function hookSeatExpiredError(seat: HookSeatName, timeoutMs: number, cause: "timeout" | "aborted", consequence: string): Error;
-/**
- * Where a {@link Hooks.permissionDenied} deny came from — our gate-source enum standing in for CC's
- * `decision_reason_type` ('classifier'|'asyncAgent'|'mode'|'rule'), named after OUR adjudicate-chain
- * sources (design/134 R5):
- *  - `"policy"` — the ToolPolicy denied directly, or a policy-raised `ask` resolved to deny
- *    (headless auto-deny / approver said no / approval aborted).
- *  - `"hook"` — a PreToolUse hook `ask` (folded allow→ask) resolved to deny, OR the engine's fail-closed
- *    interception of a hook that THREW (RB-442). (A hook's own `deny` short-circuit is EXCLUDED from the
- *    event — a decision the hook made; the crash interception is a decision the ENGINE made. The
- *    exclusion is ours on that merit; see {@link Hooks.permissionDenied} for why it must NOT be read
- *    as a parity claim about this seat's trigger surface.)
- *  - `"safety"` — the gate's deterministic egress/irreversibility tighten (design/70 / design/77 §4)
- *    raised the `ask` that resolved to deny, from an explicit per-tool mark.
- *  - `"shellGate"` — same tighten-deny, but the tool's irreversibility tier was installed by the COARSE
- *    `TaskSpec.shellGate` doctrine (design/80 D-E), not an explicit per-tool mark.
- *  - `"planMode"` — the design/108 plan-mode write-deny short-circuit (a read-only fidelity gate).
- *  - `"org"` (design/182 §7) — the ORG layer: an organization deny rule, or the fail-closed tighten an
- *    org-governed deployment applies while it cannot adjudicate against a snapshot (that tighten's ask
- *    then resolving to deny). Its own word rather than `"policy"` because the authority is the ORG's
- *    published snapshot, not this deployment's `ToolPolicy` — an operator reading "policy" on a call
- *    their own policy allowed would be looking in the wrong place.
- */
-export type PermissionDeniedSource = "policy" | "hook" | "safety" | "shellGate" | "planMode" | "classifier" | "org";
-/** The payload a {@link Hooks.permissionDenied} callback observes (CC-exact fields + `source`). */
+/** The payload a {@link Hooks.permissionDenied} callback observes (CC-exact fields + the gate outcome). */
 export interface PermissionDeniedPayload {
     /** #281 件A — the run/leg identity envelope. Present on every ENGINE emission (the gate's single
      *  deny exit, the hook-crash intercept, the plan-mode and compliance denies); absent only when a
@@ -421,19 +399,15 @@ export interface PermissionDeniedPayload {
     toolCallId: string;
     /** Human/model-readable deny reason (CC `reason`) — the RAW decision text, NOT `<system-reminder>`-wrapped. */
     reason: string;
-    /** Which gate source produced the deny (our `decision_reason_type` analog). */
-    source: PermissionDeniedSource;
-    /** The ask resolver's own deny-arm classification, carried BESIDE `source` (two different
-     *  questions: `source` names which LAYER raised the gate; this names HOW the ask resolution
-     *  refused — a person's no vs a timeout vs headless vs an approver contract violation …). Present
-     *  only on a deny that came through an ask resolution AND whose word passed the closed-vocabulary
-     *  screen; a policy's direct deny, a hook deny, and the crash/plan-mode/compliance emissions carry
-     *  none. See {@link import("./tool-policy.js").AskDenyResolution}. */
-    resolution?: import("./tool-policy.js").AskDenyResolution;
-    /** #548 — the deny is the classifier denial-limit fallback's AUTO-DENY (core's own window elapsed;
-     *  see {@link import("./tool-policy.js").ResolvedAsk.autoDenied}). Carried verbatim from the resolver;
-     *  absent on every other deny. */
-    autoDenied?: true;
+    /**
+     * The gate outcome this deny is — the SAME object the call's `tool_end` frame carries as `gate` and
+     * the engine's per-call sideband records (one mint, three faces). `disposition.deniedBy` says which
+     * LAYER refused (our `decision_reason_type` analog for the refusing half); when the refusal came through
+     * an ask resolution, `settlement` says how the wait ended and `origin` who asked. Nothing is read out of
+     * an absence: a direct policy / hook / plan-mode / compliance deny carries no settlement because it
+     * settled none.
+     */
+    gate: GateOutcome;
     /** {@link HookSeatSignal} — this invocation's own abort signal. On an OBSERVATION seat the deny has
      *  already happened and nothing this callback does can change it, so the signal says exactly one
      *  thing: stop reading, nobody is waiting for your answer any more. */
@@ -943,46 +917,14 @@ export interface ToolGateResult {
     /** Model-readable block reason (already `<system-reminder>`-wrapped). */
     reason?: string;
     /**
-     * What ended the approval this call was waiting on, when this gate pass settled one (the ask
-     * resolution's own {@link import("./tool-policy.js").ApprovalSettledBy}, carried out verbatim — this
-     * layer classifies nothing). Present on BOTH terminal exits, the block and the allow: an approved
-     * call is a settled approval too, and a caller that saw the source only on refusals would read its
-     * absence on an execution as "nobody approved this". Absent on everything that settled no approval —
-     * a straight policy deny, a hook deny, a posture verdict where nobody was asked, every ordinary
-     * allow. The caller records it on its own per-call sideband so it reaches that call's `tool_end`
-     * frame: the machine-readable half of the disclosure `reason` makes in words, on a channel no tool
-     * and no post-tool hook can write.
-     */
-    settledBy?: import("./tool-policy.js").ApprovalSettledBy;
-    /**
-     * The ask resolver's deny-arm classification (see {@link import("./tool-policy.js").AskDenyResolution}),
-     * present only on a BLOCK whose deny came through an ask resolution and passed the closed-vocabulary
-     * screen at the deny exit (a self-declared word on a policy's own deny is dropped there, never
-     * forwarded). Rides beside {@link settledBy} to the caller's per-call sideband and the call's
-     * `tool_end` frame — the machine-readable "why was this refused" a consumer classifies on.
-     */
-    resolution?: import("./tool-policy.js").AskDenyResolution;
-    /**
-     * `true` ⇔ this BLOCK is the classifier denial-limit fallback's own auto-deny: the ask's window
-     * (`AskRequest.denialLimitFallback.autoDenyAfterMs`) elapsed with nobody answering and the resolver
-     * refused it itself — the same fact the `permissionDenied` observer payload's `autoDenied` carries,
-     * read from the same two places (this gate's own resolution, or the module-private attestation an
-     * inherited arm bound to THIS call). Rides to the call's `tool_end` frame so a consumer can tell
-     * "the classifier fallback's own 120 s window auto-denied" from "the approval factory's own window
-     * (`approvalTimeoutMs`) elapsed" — both settle as `settledBy:"timeout"` / `resolution:"window_expired"`,
-     * and the factory's deadline NEVER carries this. A durable park's expiry settles on the decide lane
-     * with no `resolution` word, so it is told apart by that absence, not by this bit.
-     * Absent everywhere else (a person's no, a policy deny, an executing call).
-     */
-    autoDenied?: true;
-    /**
-     * design/252 G-7 — WHOSE settlement that was: the identifier the approval channel reported, carried
-     * out verbatim beside {@link settledBy}. This layer authenticates nothing and compares nothing; the
-     * value was screened for shape at the seam that received it (`screenApproverAttribution`) and is a
-     * transcription from there on. Present only where the caller settled something AND reported an
-     * identity — absent everywhere else, and absence never means "nobody": it means nobody said.
+     * The record of this pass ({@link GateOutcome}): its final disposition, the ask it settled (if any) and
+     * that ask's origin. Present on BOTH terminal exits, the block and the allow — an approved call is a
+     * settled approval too, and a caller that saw the record only on refusals would read its absence on an
+     * execution as "nobody approved this". Absent only on the durable-suspend exit, where the pass decided
+     * nothing yet. The caller records it on its own per-call sideband so it reaches that call's `tool_end`
+     * frame, and the deny observer receives the same object: one mint, three faces.
      */
-    approver?: string;
+    gate?: GateOutcome;
     /** Rewritten args to execute with (re-validated by the loop); omitted when nothing rewrote. */
     updatedInput?: unknown;
     /**
@@ -1767,20 +1709,4 @@ export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
     origin?: import("./ask-origin.js").AskOrigin;
 };
-/**
- * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant
- * structural ("a hook's `allow` cannot bypass the policy's `deny`/`ask`"):
- *
- *  1. **collect** — run the PreToolUse hook, threading any `updatedInput` rewrite into `currentInput`
- *     and collecting `additionalContext`. A hook `deny` short-circuits to a block immediately; a hook
- *     `ask` is remembered (it does not short-circuit — a later policy `deny` outranks it).
- *  2. **adjudicate** — run the tool policy on the FINAL `currentInput` (never the model's stale args),
- *     fold it with any remembered hook-ask via `deny > ask > allow`, and resolve a surviving `ask`
- *     through `onAsk`. The policy ALWAYS runs regardless of the hook's verdict. A policy `allow` may
- *     itself carry an `updatedInput` rewrite (redact/clamp), applied last over any hook rewrite.
- *
- * Because both phases run in this one linear function, the ordering — and the "policy is final"
- * invariant — is enforced by the call stack, not by registration convention. Returns the gate result
- * for the harness `tool_call` hook plus the PreToolUse context to attach to the tool result.
- */
 export declare function runToolGate(input: ToolGateInput): Promise<ToolGateResult>;

package/dist/core/hooks.js

@@ -1,4 +1,5 @@
-import { coreMintedAutoDeniedOf, coreMintedResolutionOf, decisionText, describeThrown, isAskDenyResolution, refuseOutOfContractDecision } from "./tool-policy.js";
+import { decisionText, describeThrown, refuseOutOfContractDecision } from "./tool-policy.js";
+import { createSettlementLedger, directDeny, mintGateOutcome } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { askOriginOf, classifierMayAnswer, isAskOrigin } from "./ask-origin.js";
 import { denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
@@ -455,8 +456,8 @@ export async function runToolGate(input) {
     const preToolContext = [];
     let hookAsk;
     let parkFailed;
-    let askDenyResolution;
-    let askAutoDenied = false;
+    let deniedBy;
+    const ledger = createSettlementLedger({ toolCallId, toolName });
     const notifier = createSafeNotifier(input.onNotifyError !== undefined ? { onError: input.onNotifyError } : undefined);
     const hookSeatMs = resolveHookTimeoutMs(input.hookTimeoutMs, (err) => traceHookCrash(input, err, notifier));
     const seatBound = (abortEnds) => ({
@@ -493,13 +494,15 @@ export async function runToolGate(input) {
         catch (err) {
             const reason = preToolUseCrashReason(`this call to "${toolName}"`, err);
             traceHookCrash(input, err, notifier);
-            await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, source: "hook", ...(input.identity !== undefined ? { identity: input.identity } : {}) });
-            return { block: true, reason: formatHookFeedback(reason, input.reminderMark), preToolContext };
+            const gate = directDeny("hook");
+            await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+            return { block: true, reason: formatHookFeedback(reason, input.reminderMark), gate, preToolContext };
         }
         if (unanswered !== undefined) {
             const reason = await preToolUseUnansweredBlock(`this call to "${toolName}"`, unanswered);
-            await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, source: "hook", ...(input.identity !== undefined ? { identity: input.identity } : {}) });
-            return { block: true, reason: formatHookFeedback(reason, input.reminderMark), preToolContext };
+            const gate = directDeny("hook");
+            await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+            return { block: true, reason: formatHookFeedback(reason, input.reminderMark), gate, preToolContext };
         }
         if (r) {
             if (r.additionalContext) {
@@ -509,6 +512,7 @@ export async function runToolGate(input) {
                 return {
                     block: true,
                     reason: formatHookFeedback(decisionText(r) ?? `tool "${toolName}" blocked by a PreToolUse hook`, input.reminderMark),
+                    gate: directDeny("hook"),
                     preToolContext,
                 };
             }
@@ -522,7 +526,12 @@ export async function runToolGate(input) {
     }
     const req = { toolName, args: currentInput, toolCallId };
     let decision = adjudicate ? await (callSignal !== undefined ? adjudicate(req, callSignal) : adjudicate(req)) : { action: "allow" };
-    let denySource = "policy";
+    {
+        const refusedBy = ledger.fromDecision(decision);
+        if (refusedBy !== undefined)
+            deniedBy = refusedBy;
+    }
+    let tightenedBy;
     let policyRewrite;
     if ((decision.action === "allow" || decision.action === "ask") && decision.updatedInput !== undefined) {
         policyRewrite = decision.updatedInput;
@@ -538,7 +547,6 @@ export async function runToolGate(input) {
             ...(hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(hookAsk.updatedInput !== undefined ? { updatedInput: hookAsk.updatedInput } : {}),
         };
-        denySource = "hook";
     }
     else if (decision.action === "ask" && hookAsk) {
         const hookMessage = hookAsk.message;
@@ -558,7 +566,7 @@ export async function runToolGate(input) {
             message: `tool "${toolName}" performs an external write (egress) — explicit approval required`,
             decisionReason: "safety",
         };
-        denySource = "safety";
+        tightenedBy = "safety";
     }
     const alreadyAsking = decision.action === "ask";
     if ((decision.action === "allow" || alreadyAsking) && (input.irreversibility === "always" || input.irreversibility === "maybe")) {
@@ -609,7 +617,7 @@ export async function runToolGate(input) {
                 ...(probeCause !== undefined ? { probeCause } : {}),
                 ...(probeMandated === true ? { probeMandated: true } : {}),
             };
-            denySource = input.shellGated === true ? "shellGate" : "safety";
+            tightenedBy = input.shellGated === true ? "shell_gate" : "safety";
         }
         else if (alreadyAsking && probeMandated === true && decision.action === "ask") {
             decision = { ...decision, probeMandated: true };
@@ -629,7 +637,7 @@ export async function runToolGate(input) {
             message: `tool "${toolName}" sends a message to another agent — routed for classifier review in auto mode`,
             decisionReason: "safety",
         };
-        denySource = "safety";
+        tightenedBy = "safety";
     }
     if (decision.action === "allow" && input.writeProtectionCheck !== undefined) {
         const writeProtectedHit = input.writeProtectionCheck(toolName, policyRewrite !== undefined ? policyRewrite : currentInput);
@@ -639,18 +647,17 @@ export async function runToolGate(input) {
                 message: `tool "${toolName}" writes to a write-protected path (table entry "${writeProtectedHit.name}") — explicit approval required`,
                 decisionReason: "safety",
             };
-            denySource = "safety";
+            tightenedBy = "safety";
         }
     }
     let orgRealApprovalRequired = false;
-    let orgAskOrigin;
-    const askOriginFacts = () => ({
+    const askOriginFacts = (org) => ({
         contentQuestion: toolName === ASK_USER_QUESTION_TOOL_NAME,
         markedUnresolvable: input.isMarkedUnresolvable?.(input.event.toolCallId) === true,
-        org: orgAskOrigin,
+        org,
+        tightened: tightenedBy,
     });
     let orgTightenCount = 0;
-    let resolvedApprover;
     let orgEvidence = (() => {
         const w = input.orgRules === undefined ? "not_wired" : "not_adjudicated";
         return { revisionAbsent: w, ruleAbsent: w };
@@ -662,9 +669,9 @@ export async function runToolGate(input) {
     });
     const applyOrgLayer = async (current, args) => {
         if (input.orgRules === undefined)
-            return current;
+            return { decision: current, org: undefined };
         if (toolName === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
-            return current;
+            return { decision: current, org: undefined };
         let decided = current;
         let pending;
         try {
@@ -684,7 +691,6 @@ export async function runToolGate(input) {
         if (answer.status === "unavailable") {
             orgEvidence = { revisionAbsent: "unavailable", ruleAbsent: "unavailable" };
             orgRealApprovalRequired = true;
-            orgAskOrigin = "unavailable";
             await notifier.notifyAsync(() => input.orgRules?.onUnavailable?.({ toolName, toolCallId, message: answer.disclosures.join("; ") }), "toolGate.orgSnapshotUnavailable");
             if (decided.action === "allow") {
                 decided = {
@@ -695,42 +701,43 @@ export async function runToolGate(input) {
                     requiresRealApproval: true,
                 };
                 orgTightenCount += 1;
-                denySource = "org";
             }
             else if (decided.action === "ask" && decided.requiresRealApproval !== true) {
                 decided = { ...decided, requiresRealApproval: true };
                 orgTightenCount += 1;
             }
-            return decided;
+            return { decision: decided, org: "unavailable" };
         }
         const revisionCell = answer.revision !== undefined ? { revision: answer.revision } : { revisionAbsent: "not_reported" };
         if (answer.verdict === undefined) {
             orgEvidence = { ...revisionCell, ruleAbsent: "no_match" };
-            return decided;
+            return { decision: decided, org: undefined };
         }
         const { behavior, rule } = answer.verdict;
         orgEvidence = { ...revisionCell, rule };
         if (behavior === "deny") {
             orgTightenCount += 1;
-            denySource = "org";
-            return { action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON };
+            deniedBy = "org";
+            return { decision: { action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON }, org: undefined };
         }
         if (decided.action === "deny")
-            return decided;
+            return { decision: decided, org: undefined };
         orgTightenCount += 1;
-        denySource = "org";
         orgRealApprovalRequired = true;
-        orgAskOrigin = "rule";
-        return decided.action === "ask"
-            ? { ...decided, requiresRealApproval: true }
-            : {
-                action: "ask",
-                message: `an organization policy rule (${rule}) requires approval for this call`,
-                decisionReason: ORG_RULE_DECISION_REASON,
-                requiresRealApproval: true,
-            };
+        return {
+            decision: decided.action === "ask"
+                ? { ...decided, requiresRealApproval: true }
+                : {
+                    action: "ask",
+                    message: `an organization policy rule (${rule}) requires approval for this call`,
+                    decisionReason: ORG_RULE_DECISION_REASON,
+                    requiresRealApproval: true,
+                },
+            org: "rule",
+        };
     };
-    decision = await applyOrgLayer(decision, policyRewrite !== undefined ? policyRewrite : currentInput);
+    const orgAnswer = await applyOrgLayer(decision, policyRewrite !== undefined ? policyRewrite : currentInput);
+    decision = orgAnswer.decision;
     if (decision.action === "ask") {
         if (policyRewrite !== undefined) {
             currentInput = policyRewrite;
@@ -815,11 +822,13 @@ export async function runToolGate(input) {
                 };
             }
         }
-        const originFacts = askOriginFacts();
+        const originFacts = askOriginFacts(orgAnswer.org);
         if (decision.action === "ask") {
             const stamped = { ...decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
             decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
         }
+        if (decision.action === "ask")
+            ledger.supersede();
         if (input.autoMode && decision.action === "ask" && decision.origin !== undefined && classifierMayAnswer(decision.origin)) {
             const verdict = await input.autoMode.decider
                 .decide({ req, askMessage: decisionText(decision) }, input.abortSignal)
@@ -846,7 +855,6 @@ export async function runToolGate(input) {
                         denialLimitFallback: tracked.fallback,
                     };
                     decision = { ...fallbackAsk, origin: askOriginOf(fallbackAsk, originFacts) };
-                    denySource = "classifier";
                 }
                 else {
                     decision = {
@@ -854,7 +862,7 @@ export async function runToolGate(input) {
                         message: `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
                         decisionReason: "classifier",
                     };
-                    denySource = "classifier";
+                    deniedBy = "classifier";
                 }
             }
         }
@@ -885,9 +893,13 @@ export async function runToolGate(input) {
         const egressTool = input.egress === true;
         const irreversibleTool = input.irreversibility === "always" || input.irreversibility === "maybe";
         const safety = egressTool || irreversibleTool ? { egress: egressTool, irreversible: irreversibleTool } : undefined;
-        const realApprovalOf = (d) => d.action === "ask" && d.requiresRealApproval === true
-            ? { origin: orgAskOrigin !== undefined ? `org_${orgAskOrigin}` : "policy" }
-            : undefined;
+        const realApprovalOf = (d) => {
+            if (d.action !== "ask" || d.requiresRealApproval !== true)
+                return undefined;
+            if (d.origin === undefined)
+                throw new Error(`a real-approval ask for "${toolName}" reached a park site with no origin word — the origin stamp precedes every park`);
+            return { origin: d.origin, ...(originFacts.org !== undefined ? { org: originFacts.org } : {}) };
+        };
         const carryOf = (d) => ({
             ...(callSignal !== undefined ? { signal: callSignal } : {}),
             ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
@@ -923,6 +935,10 @@ export async function runToolGate(input) {
                             return { suspend: suspended, preToolContext };
                     }
                 }
+                if (decision.origin === undefined)
+                    throw new Error(`the content ask for "${toolName}" reached its refusal without an origin word`);
+                ledger.set({ settlement: { kind: input.resolveContentAsk !== undefined ? "approver_unavailable" : "no_approver", who: { party: "none" }, when: Date.now() }, origin: decision.origin });
+                deniedBy = "ask_resolution";
                 decision = {
                     action: "deny",
                     message: "AskUserQuestion could not be parked for a durable human answer on this path (no checkpoint " +
@@ -941,12 +957,9 @@ export async function runToolGate(input) {
         if (decision.action === "ask") {
             const askBeforeResolve = decision;
             const resolved = await (callSignal !== undefined ? resolveAsk(decision, req, callSignal) : resolveAsk(decision, req));
-            if (resolved.action !== "ask" && resolved.approver !== undefined)
-                resolvedApprover = resolved.approver;
-            if (resolved.action === "deny" && isAskDenyResolution(resolved.resolution))
-                askDenyResolution = resolved.resolution;
-            if (resolved.action === "deny" && resolved.autoDenied === true)
-                askAutoDenied = true;
+            ledger.fromResolved(resolved, askBeforeResolve, toolName);
+            if (resolved.action === "deny")
+                deniedBy = "ask_resolution";
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
                 const parkArgs = [req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined];
@@ -962,9 +975,8 @@ export async function runToolGate(input) {
                 if (decision.action === "allow") {
                     input.autoMode?.denialTracking?.recordAllow();
                 }
-                else if (askDenyResolution === "no_approver" ||
-                    askDenyResolution === "blanket_allow_refused" ||
-                    askDenyResolution === "approver_unavailable" ||
+                else if ((resolved.action === "deny" &&
+                    (resolved.settlement.kind === "no_approver" || resolved.settlement.kind === "blanket_allow_refused" || resolved.settlement.kind === "approver_unavailable")) ||
                     resolved.approverUnavailable === true) {
                     try {
                         input.onHeadlessDenialLimit?.({ toolName, toolCallId, fallback: unarmedWindow(askBeforeResolve.denialLimitFallback) });
@@ -983,7 +995,7 @@ export async function runToolGate(input) {
                             action: "deny",
                             message: `the approval-edit chain for "${toolName}" exceeded the re-approval cap — denied fail-closed; re-submit the edited action directly`,
                         };
-                        denySource = "policy";
+                        deniedBy = "policy";
                         break;
                     }
                     if (preToolUse) {
@@ -999,12 +1011,12 @@ export async function runToolGate(input) {
                         catch (err) {
                             traceHookCrash(input, err, notifier);
                             editDenied = { action: "deny", message: preToolUseCrashReason(`the approved edit for "${toolName}"`, err) };
-                            denySource = "hook";
+                            deniedBy = "hook";
                             break;
                         }
                         if (hrUnanswered !== undefined) {
                             editDenied = { action: "deny", message: await preToolUseUnansweredBlock(`the approved edit for "${toolName}"`, hrUnanswered) };
-                            denySource = "hook";
+                            deniedBy = "hook";
                             break;
                         }
                         if (hr) {
@@ -1012,7 +1024,7 @@ export async function runToolGate(input) {
                                 preToolContext.push(hr.additionalContext);
                             if (hr.action === "deny") {
                                 editDenied = { action: "deny", message: decisionText(hr) ?? `the approved edit for "${toolName}" was blocked by a PreToolUse hook` };
-                                denySource = "hook";
+                                deniedBy = "hook";
                                 break;
                             }
                             if (hr.action === "ask") {
@@ -1020,7 +1032,7 @@ export async function runToolGate(input) {
                                     action: "deny",
                                     message: `the approved edit for "${toolName}" raises a new PreToolUse approval requirement the original approval does not cover — denied fail-closed; re-submit the edited action directly`,
                                 };
-                                denySource = "hook";
+                                deniedBy = "hook";
                                 break;
                             }
                             if (hr.updatedInput !== undefined) {
@@ -1043,19 +1055,20 @@ export async function runToolGate(input) {
                             };
                         }
                     }
-                    if (recheck.action === "deny") {
-                        editDenied = recheck;
-                        denySource = "policy";
-                        break;
+                    {
+                        const refusedBy = ledger.fromDecision(recheck);
+                        if (recheck.action === "deny" && refusedBy !== undefined) {
+                            editDenied = recheck;
+                            deniedBy = refusedBy;
+                            break;
+                        }
                     }
                     if (recheck.updatedInput !== undefined) {
                         editArgs = recheck.updatedInput;
                         editRewrittenSinceHuman = true;
                     }
-                    const orgTightensBefore = orgTightenCount;
-                    orgAskOrigin = undefined;
-                    recheck = await applyOrgLayer(recheck, editArgs);
-                    const orgRaisedThisRound = orgTightenCount > orgTightensBefore;
+                    const editOrg = await applyOrgLayer(recheck, editArgs);
+                    recheck = editOrg.decision;
                     if (recheck.action === "deny") {
                         editDenied = recheck;
                         break;
@@ -1072,16 +1085,13 @@ export async function runToolGate(input) {
                         editRewrittenSinceHuman = true;
                     }
                     const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
-                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts()) };
+                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org)) };
                     const editAskReq = { toolName, args: editArgs, toolCallId };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
-                    resolvedApprover = rr.action !== "ask" ? rr.approver : undefined;
+                    ledger.fromResolved(rr, editAskDecision, toolName);
                     if (rr.action !== "allow") {
-                        if (rr.action === "deny" && isAskDenyResolution(rr.resolution))
-                            askDenyResolution = rr.resolution;
                         editDenied = rr;
-                        if (!orgRaisedThisRound)
-                            denySource = "policy";
+                        deniedBy = "ask_resolution";
                         break;
                     }
                     if (rr.updatedInput === undefined) {
@@ -1100,7 +1110,7 @@ export async function runToolGate(input) {
                             action: "deny",
                             message: `the approved edit for "${toolName}" was rewritten by the restriction chain onto a write-protected path (table entry "${editHit.name}") that no approval covers — denied fail-closed; re-submit the edited action directly`,
                         };
-                        denySource = "safety";
+                        deniedBy = "write_protection";
                     }
                 }
                 decision = editDenied ?? { ...decision, updatedInput: editArgs };
@@ -1115,18 +1125,14 @@ export async function runToolGate(input) {
         if (decision.updatedInput !== undefined) {
             currentInput = decision.updatedInput;
         }
-        const denyResolution = askDenyResolution ?? coreMintedResolutionOf(decision, { toolCallId, toolName });
-        const denyAutoDenied = askAutoDenied || coreMintedAutoDeniedOf(decision, { toolCallId, toolName });
-        await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(denyResolution !== undefined ? { resolution: denyResolution } : {}), ...(denyAutoDenied ? { autoDenied: true } : {}), ...(input.identity !== undefined ? { identity: input.identity } : {}) });
-        const denySettledBy = decision.settledBy;
-        const denyApprover = denySettledBy !== undefined ? resolvedApprover : undefined;
+        if (deniedBy === undefined)
+            throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
+        const gate = mintGateOutcome({ deniedBy, ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
+        await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
         return {
             block: true,
             reason: formatHookFeedback(denyReason, input.reminderMark),
-            ...(denySettledBy !== undefined ? { settledBy: denySettledBy } : {}),
-            ...(denyResolution !== undefined ? { resolution: denyResolution } : {}),
-            ...(denyAutoDenied ? { autoDenied: true } : {}),
-            ...(denyApprover !== undefined ? { approver: denyApprover } : {}),
+            gate,
             preToolContext,
         };
     }
@@ -1135,12 +1141,9 @@ export async function runToolGate(input) {
         if (rw !== undefined)
             currentInput = rw;
     }
-    const allowSettledBy = decision.action === "allow" ? decision.settledBy : undefined;
-    const allowApprover = decision.action === "allow" && allowSettledBy !== undefined ? resolvedApprover : undefined;
     return {
         updatedInput: currentInput === event.input ? undefined : currentInput,
-        ...(allowSettledBy !== undefined ? { settledBy: allowSettledBy } : {}),
-        ...(allowApprover !== undefined ? { approver: allowApprover } : {}),
+        gate: mintGateOutcome(ledger.settled !== undefined ? { settled: ledger.settled } : {}),
         preToolContext,
     };
 }